When security is applied at the application layer, the plaintext COSEM APDU is encapsulated in a General-Ciphering (0xDB) structure.

Wire Format (APDU Tag 0xDB)

DB 08 47 55 52 55 58 31 32 33 21 00 00 00 42 A1 12 ... 89 AB CD EF 01 23 45 67 89 AB CD EF

Field Breakdown

1. Tag: DB (general-ciphering)
2. System Title Length & Value: 08 followed by 8 bytes (47 55 52 55 58 31 32 33 = GURUX123)
3. Security Control Byte: 21
   • Bit 4-5 (10b = 0x20): Authentication + Encryption (AES-GCM)
   • Bit 0-3 (0001b = 0x01): Security Suite 0 / Key Set 1
4. Invocation Counter: 00 00 00 42 (4 bytes, decimal 66)
5. Ciphertext: A1 12 ...
6. Authentication Tag (GMAC Tag): Last 12 bytes (96-bit or 128-bit ICV)

AES-GCM Initialization Vector (IV) Construction (12 bytes)

• Bytes 0-7: System Title (8 bytes)
• Bytes 8-11: Invocation Counter (4 bytes in Big-Endian)