<![CDATA[DLMS/COSEM Master Key Renewal via Class 64 (Security Setup) Key Wrap]]>Updating Global Encryption Keys (GUEK / GAK) in the Field

To rotate encryption keys remotely without exposing plaintext material over the air, DLMS utilizes NIST SP 800-38F / RFC 3394 AES Key Wrap.

Key Renewal Procedure

  1. Establish an authenticated and encrypted session using the current Master Key (KEK - Key Encrypting Key).
  2. Wrap the new 128-bit Global Unicast Encryption Key (GUEK) using AES Key Wrap with the KEK.
  3. Invoke Method 1 (key_transfer) on the Security Setup object (0.0.43.0.0.255😞
    • Data parameter: Structure containing key_id (e.g., 0 for Global Encryption Key) and wrapped key octet-string (24 bytes).
  4. The meter decrypts and verifies the wrapped key. Upon success, all subsequent associations must use the newly installed GUEK.
]]>https://dlms.sharur.org/topic/20/dlms-cosem-master-key-renewal-via-class-64-security-setup-key-wrapRSS for NodeFri, 16 Oct 2026 19:50:08 GMTSat, 22 Aug 2026 12:33:25 GMT60<![CDATA[Reply to DLMS/COSEM Master Key Renewal via Class 64 (Security Setup) Key Wrap on Sat, 22 Aug 2026 12:36:57 GMT]]>In meter firmware, always perform an atomic commit: If the new key verification passes, save to secure NVM and trigger an audit event log in Class 7 (Security Event Log). If power is lost mid-transfer, fallback safely to the previous key.

]]>https://dlms.sharur.org/post/86https://dlms.sharur.org/post/86Sat, 22 Aug 2026 12:36:57 GMT