DLMS/COSEM Master Key Renewal via Class 64 (Security Setup) Key Wrap

[alex_turner]

Updating Global Encryption Keys (GUEK / GAK) in the Field

To rotate encryption keys remotely without exposing plaintext material over the air, DLMS utilizes NIST SP 800-38F / RFC 3394 AES Key Wrap.

Key Renewal Procedure

1. Establish an authenticated and encrypted session using the current Master Key (KEK - Key Encrypting Key).
2. Wrap the new 128-bit Global Unicast Encryption Key (GUEK) using AES Key Wrap with the KEK.
3. Invoke Method 1 (key_transfer) on the Security Setup object (0.0.43.0.0.255
   • Data parameter: Structure containing key_id (e.g., 0 for Global Encryption Key) and wrapped key octet-string (24 bytes).
4. The meter decrypts and verifies the wrapped key. Upon success, all subsequent associations must use the newly installed GUEK.

[elena_rostova]

In meter firmware, always perform an atomic commit: If the new key verification passes, save to secure NVM and trigger an audit event log in Class 7 (Security Event Log). If power is lost mid-transfer, fallback safely to the previous key.