Is there any update on release of suite with Digital Signing APDU?
As per our last discussion you were told me that you planned to release in august.
also can send me the third party root certificate authority which provides the certificates as per DLMS or the third party authority that you are using in gurux director.
Support for General signing is added to GXDLMSDirector and C# server and client examples.
If you run command line parameters like this it will generate new private keys and certificates. Then certificates are moved between the client and server.
-h METER_IP_ADDRESS -p METER_PORT -c 1 -a High -P Gurux -t Verbose -N 0.0.43.0.1.255
In GXDLMSDirector select "Secured Connections" tab. Select Suite1 as Security Suite. Then Select "Digitally Signed" as Security. Select "General Signing" for Scheme. After that update the signing key for the client and the server.
General signing messages are started to use after the connection is established. You have successfully established the connection. Have you tried to read some data? For example, the data object?
You are right. The digital signature is using private key already in AARQ and AARE when Key agreement doesn't. This is easy to fix and test because it will affect only one line. The new version is released latest tomorrow.
Can you share the one data frame in Hex format so I can check that we are sending the data in the same format? If it's possible, it will make everything faster.
DLMS standard says that general-signing is using the Signing key (Asymmetric key) for ciphering the data.
This can be easily read from Table 36 – Ciphered xDLMS APDUs.
Your current meter and the client application are using Block cipher and authentication keys (symmetric key) and this is not correct.
You need to inform the meter manufacturer of this issue.
You should receive public and private key certificates that are used to communicate with the meter.
Because I realize that changing this will take a long time, I think if I can find a way to handle this before this is implemented for the meter.
Yes, you are right on this, but the meters that we are reading at the moment are using public/private keys for ciphering and not authentication and block cipher keys. This is what I mean by Table 36 – Ciphered xDLMS. It says that the signing key is used for ciphering.
But, this is not a problem. I made the design yesterday and we changed a few things. The new version is on the testing and now authentication and block cipher keys are supported as well.
Hi,
If you are using Ephemeral Unified Model then the key must be 64 bytes long. Now the client is sending 16 bytes long authentication key. Check Security setup key_agreement from Blue Book.
You can get an example from Green Book: Table C. 1 – Test vector for key agreement using the
Ephemeral Unified Model C(2e, 0s, ECC CDH) scheme
For suite1 DLMS recommends AES-GCM-128 algorithm so 128/8 = 16 => key size should be 16 bytes
similarly for suite2 DLMS recommends AES-GCM-256 algorithm so 256/8 = 32 => key size should be 32 bytes.
64 bytes is nothing but the signature generated for the message and appended right to the message.
Also go though the snap attached for the table c.1 , if you observe the yellow highlighted you found that encryption key agreed is of 16 bytes.
C.1 table explains the procedure of key agreement method for encryption key.
GUEK is coming from the first 16 bytes from KDF. KDF is count from the shared secret, algorithm ID, and system titles.
I remember when I was solving this for Java several years ago. This took a long time to solve.
Beside key agreement method can help to release gurux for suite1 with Digital Signing APDU's as like frames that i had sent to you if you feel that frames are correct.
I'm just reading the Breen Book and try to find the answer should AARQ/AARE sign or not. Content is not signed with Ephemeral Unified Model scheme, One-Pass Diffie-Hellman, or Static Unified Model before the connection is established for the meter.
AARQ /AARE has many components/information in it. one of the component is named as User Information.
Also AARQ/AARE contains the CtoS/StoC challenge values.so i thought xDLMS APDU-s supporting ciphering/signing shall include in it.
AARQ and AARE are ciphered using authentication key and block cipher key. For example, dedicated messages start to use a dedicated key for ciphering AFTER the connection is made. But, I'm trying to find an answer if GeneralSigning starts to use the signing key before the connection is established.
As AARQ contains the user information field which carry Initiate request APDU which is nothing but the xDLMS APDU.
As per table 22 (which snap already sent) digital signature applies to the xDLMS APDU.
so the signature must be applicable for the AARQ/AARE.
The digital signature is a little bit confusing, but at the moment I think that digital signature is used after the connection is established. We have a meter that is passed DLMC CCT and it doesn't use a digital signature before the connection is established.
Sorry but not understanding the meaning of meter has accepted the connection.
I mean when meter accepted the connection after successful AARQ/AARE or after successful authentication.
Please go through the attached snap which proves that Digital signature is applicable for xDLMS initiate request APDU if digital signing is required by the security policy.
Your findings are interesting and when I read them, I believe that you are right. If I understand correctly, AARQ is encrypted with a block cipher and the authentication key, but it's also digitally signed.
Also which one of the following would be the better and easy for implementation (Embeded c) to import and export the certificate of hug length when frame size negotiated is small say 200 bytes.
1. Action request / response with block
2. Segmentation
Hii,
Just got the update of gurux, is this release has the signing for initiate request?
I found one new setting of checkbox to enable disable general signing for initiate request, but in AARQ not found the signature for both enable/disable.
Also may i know how to check the revision history for new release in gurux?
There is a new version where AARQ is not signed. We have two meters that have passed DLMS CTT and Neither signs the AARQ. DLMS Standard says that it's possible, but doesn't say how to sign it.
I'm still reading the DLMS standard and try to find the answer for this.
Hii,
We confirmed from DLMS support and other some DLMS experts that signining is applicable for AARQ as well.
Following is the reply from DLMS against my query:
It depends what security policy is specified - see Green Book 10, clause 9.2.7.2.2.
If bit 4 is set, then, yes, you need to sign the request, if not, you don't.
Hi Aoudumbar,
Hi Aoudumbar,
Tests are over and this is released next week. You can use any CA that your meter accepts.
BR,
Mikko
Hi Aoudumbar,
Hi Aoudumbar,
Support for General signing is added to GXDLMSDirector and C# server and client examples.
If you run command line parameters like this it will generate new private keys and certificates. Then certificates are moved between the client and server.
-h METER_IP_ADDRESS -p METER_PORT -c 1 -a High -P Gurux -t Verbose -N 0.0.43.0.1.255
In GXDLMSDirector select "Secured Connections" tab. Select Suite1 as Security Suite. Then Select "Digitally Signed" as Security. Select "General Signing" for Scheme. After that update the signing key for the client and the server.
BR,
Mikko
Dear Sir,
Dear Sir,
Tested with updated gurux director.
All settings are done as per your suggestions but not found Digital signing Tag and digital signature appended at the right of the message.
Frames seems as like suite0.
following is the log. also attached the setting snippet.
09:29:24 Send SNRM request.
TX: 7E A0 23 00 02 BA 69 21 93 9C 9B 81 80 14 05 02 01 F5 06 02 01 F2 07 04 00 00 00 01 08 04 00 00 00 01 2C 01 7E
09:29:24
RX: 7E A0 23 21 00 02 BA 69 73 D8 87 81 80 14 05 02 01 F2 06 02 01 F5 07 04 00 00 00 01 08 04 00 00 00 01 42 69 7E
09:29:24 Send AARQ request.
TX: 7E A0 2E 00 02 BA 69 21 10 40 03 E6 E6 00 60 1D A1 09 06 07 60 85 74 05 08 01 01 BE 10 04 0E 01 00 00 00 06 5F 1F 04 00 20 1E 5F FF FF 9A 37 7E
09:29:24
RX: 7E A0 46 21 00 02 BA 69 30 61 A3 E6 E7 00 61 35 A1 09 06 07 60 85 74 05 08 01 01 A2 03 02 01 00 A3 05 A1 03 02 01 00 A4 0A 04 08 50 52 4F 7C 23 45 6E F0 BE 10 04 0E 08 00 06 5F 1F 04 00 00 10 10 02 00 00 07 73 0C 7E
09:29:24
RX: 7E A0 18 21 00 02 BA 69 52 9B 17 E6 E7 00 C4 01 C1 00 06 00 00 01 A8 E7 28 7E
09:29:24 Disconnect request
TX: 7E A0 0A 00 02 BA 69 21 53 2A 7F 7E
09:29:24
RX: 7E A0 0A 21 00 02 BA 69 73 62 A5 7E
09:29:24 Send SNRM request.
TX: 7E A0 23 00 02 BA 69 61 93 FA DD 81 80 14 05 02 01 F5 06 02 01 E4 07 04 00 00 00 01 08 04 00 00 00 01 12 46 7E
09:29:25
RX: 7E A0 23 61 00 02 BA 69 73 09 85 81 80 14 05 02 01 E4 06 02 01 F5 07 04 00 00 00 01 08 04 00 00 00 01 81 01 7E
09:29:25 Send AARQ request.
TX: 7E A0 6E 00 02 BA 69 61 10 20 82 E6 E6 00 60 5D A1 09 06 07 60 85 74 05 08 01 03 A6 0A 04 08 31 32 33 34 35 36 37 38 8A 02 07 80 8B 07 60 85 74 05 08 02 05 AC 12 80 10 74 04 21 08 73 31 3D 2F 3B 28 1F 46 62 40 20 2E BE 23 04 21 21 1F 31 00 00 01 A9 0C A5 41 26 4B 40 B5 AA C0 24 56 B5 EC 7E C1 EB 46 BE DB 70 9B 9F 2A 42 8D E7 79 EC 7E
09:29:25
RX: 7E A0 7A 61 00 02 BA 69 30 60 C6 E6 E7 00 61 4A A1 09 06 07 60 85 74 05 08 01 03 A2 03 02 01 00 A3 05 A1 03 02 01 0E A4 0A 04 08 50 52 4F 7C 23 45 6E F0 88 02 07 80 89 07 60 85 74 05 08 02 05 AA 12 80 10 61 62 63 64 65 66 67 68 69 6A 6B 6C 00 00 1E 7F BE 23 04 21 28 1F 30 00 00 01 A8 52 30 6E FB 65 F1 57 E2 49 5C D1 77 A9 99 4C 50 A9 E4 A8 0F 1D FB 6E 93 DB 50 1F C7 7E
09:29:25 Authenticating.
TX: 7E A0 42 00 02 BA 69 61 32 29 52 E6 E6 00 CB 31 31 00 00 01 AA 9A 9A FF 41 D3 0E 50 9D A3 C9 D1 97 FD B5 7A 93 4C 71 FD 77 09 D8 57 31 36 7E 6B 23 41 53 7D 41 09 CD 65 7A 60 00 9A 23 D7 56 A4 4B 08 96 7E
09:29:25
RX: 7E A0 3B 61 00 02 BA 69 52 A7 DE E6 E7 00 CF 2A 30 00 00 01 A9 34 F3 D5 04 86 62 E8 D5 35 CC BE CC C2 5D 8B A4 52 25 45 5A F9 F4 48 A2 8D 5E 78 BC FA ED 8C 3D A0 DF E0 51 38 61 BE 7E
Best Regards,
Aoudumbar Pawar.
Hi Aoudumbar,
Hi Aoudumbar,
General signing messages are started to use after the connection is established. You have successfully established the connection. Have you tried to read some data? For example, the data object?
BR,
Mikko
Dear Sir,
Dear Sir,
can share the sample log?
Also in out meter we are applying general signing APDU's to AARQ,AARE and authentication frames.
Best Regards,
AP
Dear Sir,
Dear Sir,
You are right. The digital signature is using private key already in AARQ and AARE when Key agreement doesn't. This is easy to fix and test because it will affect only one line. The new version is released latest tomorrow.
BR,
Mikko
Dear Sir,
Dear Sir,
Thanks a lot!!!
BR,
AP
Dear Sir,
Dear Sir,
Can you share the one data frame in Hex format so I can check that we are sending the data in the same format? If it's possible, it will make everything faster.
BR,
Mikko
Dear Sir,
Dear Sir,
Please find the below successful log of the Key Agreement method between kalkitech client and out meter with suite1
SENDING HDLC FRAME
21:53:44:710 ====> METER-1 7E A0 23 00 02 BA 69 41 93 C9 FE 81 80 14 05 02 02 00 06 02 02 00 07 04 00 00 00 01 08 04 00 00 00 01 6F EF 7E
RECEIVED HDLC FRAME
21:53:44:875 <==== METER-1 7E A0 23 41 00 02 BA 69 73 69 00 81 80 14 05 02 01 FC 06 02 01 FC 07 04 00 00 00 01 08 04 00 00 00 01 DD A1 7E
COSEM OUT HEADER
21:53:44:902 ====> METER-1 E6 E6 00 60 81 AD
COSEM OUT DATA - PLAIN
21:53:44:902 ====> METER-1 A1 09 06 07 60 85 74 05 08 01 03 A6 0A 04 08 31 32 33 34 35 36 37 38 8A 02 07 80 8B 07 60 85 74 05 08 02 02 AC 12 80 10
75 33 46 20 08 01 44 44 63 19 08 15 33 23 45 2C BE DF 00 08 31 32 33 34 35 36 37 38 00 00 00 0E 01 00 00 00 06 5F 1F 04
00 00 18 1D FF FF 40 69 AD A2 37 DF 91 9F CE 97 93 51 2C 49 4A 3B F6 49 06 26 8A EA 60 AA 28 F9 14 B2 28 3B AA C3 97 A6
3D A1 DA 46 47 46 55 7F 67 80 CE 49 B9 87 88 62 0C C9 95 EE C6 DE EA 5B 85 84 3B DE 3B 69 05 AA 1C FC B6 A6 0C 03 45 FE
4E 2A 73 00 00 00 00 00 00 00 00 00 00
COSEM OUT DATA
21:53:44:902 ====> METER-1 A1 09 06 07 60 85 74 05 08 01 03 A6 0A 04 08 31 32 33 34 35 36 37 38 8A 02 07 80 8B 07 60 85 74 05 08 02 02 AC 12 80 10
75 33 46 20 08 01 44 44 63 19 08 15 33 23 45 2C BE 73 04 71 21 6F 31 00 00 24 9C 87 C4 05 B7 07 7C CB 24 74 26 CF 7D 70
CD CD 8F 2A 47 D3 6B 83 04 F7 03 6B 58 83 D2 D4 27 0F 0F 87 E3 DE 45 7D C3 7B 42 7A 2C 58 49 FF 97 17 19 52 77 8A 79 8B
3B B3 D7 F5 89 01 8D 3F D7 48 88 5A 23 1D 52 CA C1 B8 A3 29 25 6C 37 75 CF FE BD 28 3E A0 73 6E 44 D4 1A 28 7D AE 09 94
5F AA 1C FC B6 A6 0C 03 45 FE 4E 2A 73
SERVICE = AARQ
SENDING HDLC FRAME
21:53:44:902 ====> METER-1 7E A0 BF 00 02 BA 69 41 10 14 CA E6 E6 00 60 81 AD A1 09 06 07 60 85 74 05 08 01 03 A6 0A 04 08 31 32 33 34 35 36 37 38
8A 02 07 80 8B 07 60 85 74 05 08 02 02 AC 12 80 10 75 33 46 20 08 01 44 44 63 19 08 15 33 23 45 2C BE 73 04 71 21 6F 31
00 00 24 9C 87 C4 05 B7 07 7C CB 24 74 26 CF 7D 70 CD CD 8F 2A 47 D3 6B 83 04 F7 03 6B 58 83 D2 D4 27 0F 0F 87 E3 DE 45
7D C3 7B 42 7A 2C 58 49 FF 97 17 19 52 77 8A 79 8B 3B B3 D7 F5 89 01 8D 3F D7 48 88 5A 23 1D 52 CA C1 B8 A3 29 25 6C 37
75 CF FE BD 28 3E A0 73 6E 44 D4 1A 28 7D AE 09 94 5F AA 1C FC B6 A6 0C 03 45 FE 4E 2A 73 B2 B3 7E
RECEIVED HDLC FRAME
21:53:45:732 <==== METER-1 7E A0 D3 41 00 02 BA 69 30 A7 E7 E6 E7 00 61 81 C2 A1 09 06 07 60 85 74 05 08 01 03 A2 03 02 01 00 A3 05 A1 03 02 01 0E
A4 0A 04 08 33 44 4C 07 02 20 00 59 88 02 07 80 89 07 60 85 74 05 08 02 02 AA 12 80 10 61 62 63 64 65 66 67 68 69 6A 6B
6C 00 00 11 DD BE 7B 04 79 28 77 31 00 00 24 9C FE 0B 02 EE 0E 74 18 30 44 7B E2 2A CA E0 3D 5C 7B 87 44 9E A2 E0 F4 EF
FA DF D6 F9 A7 9D B6 26 F0 26 C3 D0 72 39 6C C5 FE 3A F8 10 42 CE 6E 2B D5 F2 4D 95 BC 87 D1 04 36 7A 6A B2 11 4B BA 23
BA F6 04 34 6A F9 2B 6B 91 96 FF 6D F7 9A 9B BD 03 B9 DF 50 14 CB FB 06 BE 8D C0 EE 32 F9 4B E0 61 A5 65 2B 31 F5 46 94
1A F4 A7 E2 D2 66 73 51 25 86 7C 5F 7E
COSEM OUT DATA - PLAIN
21:53:45:757 ====> METER-1 E6 E6 00 CB 60 85 74 05 08 01 DF 00 08 31 32 33 34 35 36 37 38 08 33 44 4C 07 02 20 00 59 00 00 1F C3 01 C1 00 0F 00 00
28 00 00 FF 01 01 09 10 24 20 B2 F3 F8 6A 76 57 D4 F3 A5 BB 9B 17 B2 B2 40 2A 04 95 6C 8B DF 83 51 D9 BC D8 FF D2 3A AE
89 69 4B 83 D4 1E 32 4C 1A D4 F7 44 9F 74 6A A6 6D A5 DF 62 B2 94 22 27 1A EB B2 C2 1D DF A1 B4 CB 67 30 20 DE B9 C7 57
98 00 03 68 B0 10 AB 90 AF 55 DF 91 84 3F 00 3D CD 14 13 6C 81 36
COSEM OUT DATA
21:53:45:758 ====> METER-1 E6 E6 00 CB 81 88 31 00 00 24 9D 6A DC 64 02 9B 8D 16 74 5A 98 04 38 A7 E1 10 F2 DE BE D4 F8 1F FD 41 9E F7 A6 82 B8 6B
86 22 0D 67 99 53 74 BD 10 4B 67 A1 98 AF 6E 2B C9 F0 97 23 FF 26 8A 0A 62 85 11 97 ED 12 C4 3C 3E A7 CC 20 4B 4E C5 1D
71 DF CE C0 9F 8B 10 59 A7 33 3B 4E 71 9A 10 11 DD 85 35 6D 1C FE 19 BF F8 91 FD 2B FF 36 DA 68 CF EF 56 83 C0 84 EE EF
CF 8D A0 B4 42 AD 4F C1 0B 87 55 DF 91 84 3F 00 3D CD 14 13 6C 81
SERVICE = ACTION REQUEST, OBIS = 0-0-40-0-0-255, IC = 15, METH: INDEX = 1
SENDING HDLC FRAME
21:53:45:758 ====> METER-1 7E A0 9A 00 02 BA 69 41 32 24 5B E6 E6 00 CB 81 88 31 00 00 24 9D 6A DC 64 02 9B 8D 16 74 5A 98 04 38 A7 E1 10 F2 DE BE
D4 F8 1F FD 41 9E F7 A6 82 B8 6B 86 22 0D 67 99 53 74 BD 10 4B 67 A1 98 AF 6E 2B C9 F0 97 23 FF 26 8A 0A 62 85 11 97 ED
12 C4 3C 3E A7 CC 20 4B 4E C5 1D 71 DF CE C0 9F 8B 10 59 A7 33 3B 4E 71 9A 10 11 DD 85 35 6D 1C FE 19 BF F8 91 FD 2B FF
36 DA 68 CF EF 56 83 C0 84 EE EF CF 8D A0 B4 42 AD 4F C1 0B 87 55 DF 91 84 3F 00 3D CD 14 13 6C 81 7B 2D 7E
RECEIVED HDLC FRAME
21:53:47:031 <==== METER-1 7E A0 93 41 00 02 BA 69 52 B5 60 E6 E7 00 CF 82 00 80 31 00 00 24 9D 57 CB DD D4 B9 49 63 13 40 7C FD DA 5B 15 27 EB 1A
BF A7 8D 44 87 B7 23 AD DE 42 4D EE F1 24 E6 4D A3 C0 52 87 F2 94 8A 26 8B 75 3C 72 EB FB BF 0E 0B DC FA BF 16 03 56 16
A8 0B 9B 84 04 47 B3 49 19 0F BF AE A1 C0 69 77 AB 1C 64 95 7B 1D 0A E1 30 BF 67 28 60 C0 C8 93 AC 61 D2 B8 6F E9 18 7B
66 A3 9F 14 E0 AD 0E 34 92 DD 48 25 71 F1 7C 7B 38 9D E7 90 ED B7 4A 38 59 CE 70 A5 7E
COSEM OUT HEADER
21:53:47:083 ====> METER-1 E6 E6 00 CB 82 01 00 31 00 00 24 9E
COSEM OUT DATA - PLAIN
21:53:47:083 ====> METER-1 DF 00 08 31 32 33 34 35 36 37 38 08 33 44 4C 07 02 20 00 59 00 00 81 96 C3 01 C1 00 40 00 00 2B 00 01 FF 03 01 01 01 02
02 16 02 09 81 80 5D 5E 77 45 BC D4 4B 71 BA B2 BF 6C 64 D8 EA A5 35 81 76 6F 48 23 C0 A3 FE 19 46 A9 26 03 D4 EA 85 B2
19 F0 1F B3 02 76 E6 42 9B 44 AB 23 AF CD 6E 16 DB 39 D9 98 8A BB 10 E1 29 61 97 04 1C 6F 71 DF 5E B7 14 58 20 D6 BA 02
A0 F0 46 77 38 B8 46 10 92 2E 0D 9C 51 49 8C 91 4B 65 62 BF 05 87 E0 10 2D 4F 2E 2F BC 2C 16 90 8C 13 60 DE 93 D6 64 34
18 B6 1B E6 B7 BC B2 A4 91 E3 54 85 BB 18 40 76 F0 9A FD 0B E1 BE 42 AB B0 CF BA 46 8B D7 C7 93 CD C2 D2 D5 AA F3 B3 19
7C 0E AC 9A 3C DF 6C BA B3 E3 88 1F 86 A2 8A 1F 70 96 27 24 C5 FC 6B 8A 58 10 0A 88 08 EF CD A6 0C 52 1F 96 30 7B AD 49
6C EA AB 79 1D 31 DB FA 10 C4 8A
COSEM OUT DATA
21:53:47:083 ====> METER-1 43 DF FD 2D 20 4A BB B4 05 F4 0B CD FD 46 D2 7A E0 E4 42 BC D7 88 8A EE 10 AA B9 F9 15 88 80 B5 7B 7E 6B 7F 86 AC 1F D4
73 D6 6B 1A 4B 8F 4A 8D DF D1 CE 29 F4 D7 68 01 9C 70 96 3F 18 B8 94 41 78 3F 8C 17 D0 B3 6C 58 D0 4A ED CC 42 14 F8 F2
11 4C 1E FA 68 89 3F B7 E9 6F 5F F4 3D F2 FE 68 BB D3 2F 15 50 60 95 1C 7C 19 AF 04 6F 63 A6 B7 01 9A 9E 56 E5 75 10 5A
F9 7F C5 94 EE 38 0B D5 EC 2C E2 9B A9 29 5D 77 B8 CA C6 7E 6F 8E 50 A6 AE 09 BE 3B DC C4 DB FE DB CF FD 9B 25 C0 11 84
06 FB 97 27 C9 53 8C C4 70 DC 75 6B 26 E5 64 AC 7D 94 0E ED B1 4A 40 4B D0 F2 13 0E A1 88 A9 F9 4B E2 76 FD FC 07 F1 F0
7F EA 96 21 3D 53 94 76 A5 7E 05 5D DB 05 A5 09 80 3D 4D 0A F3 80 71 85 FB 6B 00 8F 02 94 3B 5F 43 B9 09 ED 6D 8A 62 49
6C EA AB 79 1D 31 DB FA 10 C4 8A
SERVICE = ACTION REQUEST, OBIS = 0-0-43-0-1-255, IC = 64, METH: INDEX = 3
SENDING HDLC FRAME
21:53:47:084 ====> METER-1 7E A1 13 00 02 BA 69 41 54 8F 1B E6 E6 00 CB 82 01 00 31 00 00 24 9E 43 DF FD 2D 20 4A BB B4 05 F4 0B CD FD 46 D2 7A E0
E4 42 BC D7 88 8A EE 10 AA B9 F9 15 88 80 B5 7B 7E 6B 7F 86 AC 1F D4 73 D6 6B 1A 4B 8F 4A 8D DF D1 CE 29 F4 D7 68 01 9C
70 96 3F 18 B8 94 41 78 3F 8C 17 D0 B3 6C 58 D0 4A ED CC 42 14 F8 F2 11 4C 1E FA 68 89 3F B7 E9 6F 5F F4 3D F2 FE 68 BB
D3 2F 15 50 60 95 1C 7C 19 AF 04 6F 63 A6 B7 01 9A 9E 56 E5 75 10 5A F9 7F C5 94 EE 38 0B D5 EC 2C E2 9B A9 29 5D 77 B8
CA C6 7E 6F 8E 50 A6 AE 09 BE 3B DC C4 DB FE DB CF FD 9B 25 C0 11 84 06 FB 97 27 C9 53 8C C4 70 DC 75 6B 26 E5 64 AC 7D
94 0E ED B1 4A 40 4B D0 F2 13 0E A1 88 A9 F9 4B E2 76 FD FC 07 F1 F0 7F EA 96 21 3D 53 94 76 A5 7E 05 5D DB 05 A5 09 80
3D 4D 0A F3 80 71 85 FB 6B 00 8F 02 94 3B 5F 43 B9 09 ED 6D 8A 62 49 6C EA AB 79 1D 31 DB FA 10 C4 8A 22 3D 7E
RECEIVED HDLC FRAME
21:53:49:368 <==== METER-1 7E A1 0C 41 00 02 BA 69 74 1E 8F E6 E7 00 CF 82 00 F9 31 00 00 24 9E CC E1 24 03 CF 3C 6F 07 93 DA B6 03 23 B2 9C 46 41
67 8A 98 9A 67 53 DD 12 17 79 5E 5C B6 26 F9 A8 AB 14 BE BF E3 A3 BE 7A AB 7A B2 25 64 EB 7E B1 66 E8 93 77 58 1C C8 F2
B0 FD 9E AD 24 90 D5 3F E5 34 E3 C6 31 C9 5E 77 E4 B1 7E 25 0E 9E 46 FD 1E BB 06 58 85 F9 C0 34 ED 6E F4 B7 93 29 35 90
1E DA B0 F1 C8 AF AD 08 95 01 96 06 E2 C6 70 38 E2 19 8E CD 49 C8 D3 18 53 4A 48 F6 95 DE 87 44 24 A2 4A F6 CA 09 89 4A
8E 89 B2 1A 3F D4 2E C2 21 CA B7 A1 D8 A8 AE 03 EF 86 D1 9C C0 5A C1 5E 59 BE DA 50 86 F3 0B 3D 65 60 FF 17 69 A4 D6 D9
5D 7E 8D EC 07 20 30 91 15 D1 54 2F 05 64 F3 29 62 B4 35 95 DD 57 39 72 F9 B8 DA 62 90 8D BD AC 68 7E 5E F0 83 28 4A 70
F5 42 4A 2C 69 F9 25 57 1A 93 FB B4 50 64 07 24 87 67 BB 95 D7 A2 D6 49 1E 40 F5 15 EC 7E
RECEIVED APPLICATION LAYER FRAME - CIPHERED
21:53:49:405 <==== METER-1 CF 82 00 F9 31 00 00 24 9E CC E1 24 03 CF 3C 6F 07 93 DA B6 03 23 B2 9C 46 41 67 8A 98 9A 67 53 DD 12 17 79 5E 5C B6
RECEIVED APPLICATION LAYER FRAME
21:53:49:406 <==== METER-1 CF 82 00 F9 31 00 00 24 9E DF 00 08 33 44 4C 07 02 20 00 59 08 31 32 33 34 35 36 37 38 00 00 82 00 8E C7 01 C1 00 00
SERVICE = ACTION RESPONSE
SENDING HDLC FRAME
21:53:49:406 ====> METER-1 7E A0 0A 00 02 BA 69 41 53 7F 1A 7E
RECEIVED HDLC FRAME
21:53:50:255 <==== METER-1 7E A1 0C 41 00 02 BA 69 94 10 68 E6 E7 00 CF 82 00 F9 31 00 00 24 9E CC E1 24 03 CF 3C 6F 07 93 DA B6 03 23 B2 9C 46 41
67 8A 98 9A 67 53 DD 12 17 79 5E 5C B6 26 F9 A8 AB 14 BE BF E3 A3 BE 7A AB 7A B2 25 64 EB 7E B1 66 E8 93 77 58 1C C8 F2
B0 FD 9E AD 24 90 D5 3F E5 34 E3 C6 31 C9 5E 77 E4 B1 7E 25 0E 9E 46 FD 1E BB 06 58 85 F9 C0 34 ED 6E F4 B7 93 29 35 90
1E DA B0 F1 C8 AF CD 35 17 35 E8 62 6E 3B 8B 5A CF 86 A5 F4 D2 9C 9A D5 75 B1 D6 3C C2 BF 5E D9 C7 3E EC 35 D7 82 10 9A
EC 45 22 C2 8C 61 6D 9C 7F 82 C5 6D E6 A3 6B D8 AB 11 70 ED 68 F0 F6 98 27 21 04 20 17 8E 0B EC DD F3 5D 27 D9 BE 97 5D
D6 B3 51 82 34 30 7C BE D2 0E 74 FA DD 94 CF CD D1 94 62 2F 91 26 C3 5B 55 81 82 44 0D D1 2B 56 0E C5 25 A5 B0 0E 1B C0
2A 5E 12 0E 96 D1 7D 0E 57 0B 05 00 5E 4A D2 98 10 4C 48 DD EA 48 EB 8F 33 AD 02 15 C5 7E
SENDING HDLC FRAME
21:54:44:288 ====> METER-1 7E A0 23 00 02 BA 69 41 93 C9 FE 81 80 14 05 02 02 00 06 02 02 00 07 04 00 00 00 01 08 04 00 00 00 01 6F EF 7E
RECEIVED HDLC FRAME
21:54:44:455 <==== METER-1 7E A0 23 41 00 02 BA 69 73 69 00 81 80 14 05 02 01 FC 06 02 01 FC 07 04 00 00 00 01 08 04 00 00 00 01 DD A1 7E
COSEM OUT HEADER
21:54:44:483 ====> METER-1 E6 E6 00 60 81 AD
COSEM OUT DATA - PLAIN
21:54:44:483 ====> METER-1 A1 09 06 07 60 85 74 05 08 01 03 A6 0A 04 08 31 32 33 34 35 36 37 38 8A 02 07 80 8B 07 60 85 74 05 08 02 02 AC 12 80 10
57 14 4F 6B 5C 2F 49 37 4B 4D 1F 56 0C 50 5E 05 BE DF 00 08 31 32 33 34 35 36 37 38 00 00 00 0E 01 00 00 00 06 5F 1F 04
00 00 18 1D FF FF 40 51 29 DD 8C 10 32 36 FD 60 2A C3 4C EE 07 F4 D9 9A 3A 18 BB 6F 24 D0 B7 E0 26 42 FA 8D 31 D2 3E 83
A6 A4 D5 28 5D DB EF 7B 53 5B 6E EE 46 FB 55 BF 42 05 40 67 66 8C A8 AC 09 1B 84 11 C1 DC E1 80 FA 5E C0 AD AA 19 0D E9
2C F2 41 00 00 00 00 00 00 00 00 00 00
COSEM OUT DATA
21:54:44:483 ====> METER-1 A1 09 06 07 60 85 74 05 08 01 03 A6 0A 04 08 31 32 33 34 35 36 37 38 8A 02 07 80 8B 07 60 85 74 05 08 02 02 AC 12 80 10
57 14 4F 6B 5C 2F 49 37 4B 4D 1F 56 0C 50 5E 05 BE 73 04 71 21 6F 31 00 00 24 9F 00 52 A8 B5 B7 FD 36 FA 7F 2A 2F F1 62
82 DA D2 B8 86 D3 83 F6 7E FA 0C 49 3F 81 9F 12 84 25 FA 70 DD 13 DE 6F 68 BF 14 11 19 FB B7 48 17 80 19 4E 80 39 E7 B1
9D 72 33 46 FD C0 56 BA 37 BD CE C7 22 3F 97 FA 5C 45 01 CC C3 9E A3 63 5B 94 B5 92 67 4C 04 2E 56 98 88 6A 09 40 C8 B8
10 80 FA 5E C0 AD AA 19 0D E9 2C F2 41
SERVICE = AARQ
SENDING HDLC FRAME
21:54:44:483 ====> METER-1 7E A0 BF 00 02 BA 69 41 10 14 CA E6 E6 00 60 81 AD A1 09 06 07 60 85 74 05 08 01 03 A6 0A 04 08 31 32 33 34 35 36 37 38
8A 02 07 80 8B 07 60 85 74 05 08 02 02 AC 12 80 10 57 14 4F 6B 5C 2F 49 37 4B 4D 1F 56 0C 50 5E 05 BE 73 04 71 21 6F 31
00 00 24 9F 00 52 A8 B5 B7 FD 36 FA 7F 2A 2F F1 62 82 DA D2 B8 86 D3 83 F6 7E FA 0C 49 3F 81 9F 12 84 25 FA 70 DD 13 DE
6F 68 BF 14 11 19 FB B7 48 17 80 19 4E 80 39 E7 B1 9D 72 33 46 FD C0 56 BA 37 BD CE C7 22 3F 97 FA 5C 45 01 CC C3 9E A3
63 5B 94 B5 92 67 4C 04 2E 56 98 88 6A 09 40 C8 B8 10 80 FA 5E C0 AD AA 19 0D E9 2C F2 41 98 5A 7E
RECEIVED HDLC FRAME
21:54:45:315 <==== METER-1 7E A0 D3 41 00 02 BA 69 30 A7 E7 E6 E7 00 61 81 C2 A1 09 06 07 60 85 74 05 08 01 03 A2 03 02 01 00 A3 05 A1 03 02 01 0E
A4 0A 04 08 33 44 4C 07 02 20 00 59 88 02 07 80 89 07 60 85 74 05 08 02 02 AA 12 80 10 61 62 63 64 65 66 67 68 69 6A 6B
6C 00 00 11 DE BE 7B 04 79 28 77 31 00 00 24 9F B7 AD 52 9E C4 D5 AA 6E 3D DA C8 9D 52 27 74 85 2F 3D 57 00 80 D8 54 C6
B5 D4 1F 2B FB CC 75 A5 5F 4B 27 24 9D D4 4D E1 16 70 11 7C B5 97 FA E8 9E EA A2 7D 36 CE 63 4F 3F D6 5C 17 CA 5A 8D 74
B4 A0 A7 E3 D4 91 5C 72 37 E8 D9 C8 FB F4 27 29 44 20 FD 54 16 02 DD 25 E8 0A A4 99 37 C8 C2 0F 27 D5 A4 70 28 36 EC 08
A2 4E 48 33 0C 01 4B 1C 36 29 5F EC 7E
COSEM OUT DATA - PLAIN
21:54:45:366 ====> METER-1 E6 E6 00 CB 60 85 74 05 08 01 DF 00 08 31 32 33 34 35 36 37 38 08 33 44 4C 07 02 20 00 59 00 00 1F C3 01 C1 00 0F 00 00
28 00 00 FF 01 01 09 10 8C 68 2F 8D 84 15 E2 0D E3 1E 7B 42 03 01 97 D2 40 E7 A7 DE 2E FF 98 6F 48 A7 37 D2 11 46 21 D2
AC 40 A9 D1 7D 19 A3 C0 03 01 97 90 E4 E1 EE 90 54 B7 1E 5D E3 6B A8 27 B8 A8 57 D7 11 51 AC 69 A3 68 AB 98 7B 14 FD E0
91 6F E7 31 0A 14 53 A5 9D 1A B6 90 3D C7 68 90 2C BF 57 21 14 3F
COSEM OUT DATA
21:54:45:366 ====> METER-1 E6 E6 00 CB 81 88 31 00 00 24 A0 69 B9 7A 99 B7 1B BA DB 56 D8 8D 30 0F 12 40 56 6E C0 81 A0 E0 A4 78 04 55 46 EA C7 BD
F1 73 56 C3 57 0C 95 83 69 B8 6D 7E 45 88 9F DF DB BE B3 38 D4 50 2B 83 66 11 0E 1B 8F E7 88 6A 98 50 89 91 81 ED 63 03
F8 19 7B BD 38 CF F0 66 F7 70 3A 21 AE 2B 05 C5 96 49 49 D9 F9 43 52 B9 0F D4 18 A8 22 D0 5D 7F 43 16 15 87 24 57 57 C6
56 E6 D5 85 BA 37 F5 2C BB 74 1A B6 90 3D C7 68 90 2C BF 57 21 14
SERVICE = ACTION REQUEST, OBIS = 0-0-40-0-0-255, IC = 15, METH: INDEX = 1
SENDING HDLC FRAME
21:54:45:366 ====> METER-1 7E A0 9A 00 02 BA 69 41 32 24 5B E6 E6 00 CB 81 88 31 00 00 24 A0 69 B9 7A 99 B7 1B BA DB 56 D8 8D 30 0F 12 40 56 6E C0
81 A0 E0 A4 78 04 55 46 EA C7 BD F1 73 56 C3 57 0C 95 83 69 B8 6D 7E 45 88 9F DF DB BE B3 38 D4 50 2B 83 66 11 0E 1B 8F
E7 88 6A 98 50 89 91 81 ED 63 03 F8 19 7B BD 38 CF F0 66 F7 70 3A 21 AE 2B 05 C5 96 49 49 D9 F9 43 52 B9 0F D4 18 A8 22
D0 5D 7F 43 16 15 87 24 57 57 C6 56 E6 D5 85 BA 37 F5 2C BB 74 1A B6 90 3D C7 68 90 2C BF 57 21 14 9B 1E 7E
RECEIVED HDLC FRAME
21:54:46:732 <==== METER-1 7E A0 93 41 00 02 BA 69 52 B5 60 E6 E7 00 CF 82 00 80 31 00 00 24 A0 C7 A4 8C F8 33 68 CD 7B CB 69 76 12 EB 33 A9 11 4E
F9 23 FE 24 04 1C 73 FD A8 A3 7A 9B 7F 47 9A 0C F9 59 A1 48 CD D5 FC E3 0E 50 9C BE 68 62 EA D5 4B AC 04 D0 A8 C2 10 1B
10 11 71 4C 2D F2 37 F3 39 B6 68 2C 81 73 E6 0E CF 6D E6 1D BE 8E 86 BB 16 B9 54 37 77 00 79 8A E6 32 EE B9 96 7D 77 53
F0 AB 98 69 BC E9 27 27 AB F8 72 45 4E E2 50 02 8A F3 67 82 CE 54 D9 07 61 4D 0A A6 7E
COSEM OUT HEADER
21:54:46:782 ====> METER-1 E6 E6 00 CB 82 01 00 31 00 00 24 A1
COSEM OUT DATA - PLAIN
21:54:46:782 ====> METER-1 DF 00 08 31 32 33 34 35 36 37 38 08 33 44 4C 07 02 20 00 59 00 00 81 96 C3 01 C1 00 40 00 00 2B 00 01 FF 03 01 01 01 02
02 16 00 09 81 80 BF EB 1B 17 A6 3D 5A CD DC E9 08 55 B6 BF BC 95 09 A4 46 5B 07 C5 B1 E3 C8 12 AB 9F 8D BD 31 87 E0 70
C3 AB 72 55 13 B3 95 A1 AF 3D B1 69 C2 02 3A F0 2F 9F C9 2F CC F0 65 E1 AF 10 A6 05 C8 4E 21 18 17 0A 6F D1 3B 08 D5 AC
BB 8C C9 FF 7F 1B F1 95 0F FD AA 2B C3 22 65 E1 F8 4E B5 AA 68 6D 66 0A 76 DF 42 D4 26 75 2D 37 97 85 DE 08 55 02 15 E9
10 29 56 E3 9B 37 C7 1B 54 56 B0 B6 B9 27 40 75 43 23 F7 BC DE 9B 64 3D DB 91 16 A9 1D 1F EF 31 E9 9E 81 8E 94 C8 25 02
18 83 9A 22 5B 5F 0E DC F6 E7 4B AF 5A E5 0F 0D 70 22 9A 27 51 37 62 F0 DE E6 ED 5F F4 BE DC 5C 6D 7F C8 2D 29 2A 6E 57
96 6E CD C9 09 F3 91 65 31 2F 65
COSEM OUT DATA
21:54:46:782 ====> METER-1 2F 52 23 8F ED 3D DF D7 B0 4E B7 11 13 A7 77 6E E8 2C CA FC E8 55 CC 4E 45 5D 92 A5 C3 A1 76 12 67 28 FF 3F 7A BC 5A 75
EE 5B 75 AE 9E ED 0C 3E 2F C3 4E B5 CC 7A CC FF 93 51 89 D6 4D 12 DF 7B 34 91 A9 FD 10 27 4F 3C 16 9D 8E 3A 07 77 68 91
85 13 D8 FF 1F 9F 8F 48 EB C9 2C B3 41 CD D2 2F F6 66 43 0C 1E AB AD 57 DD 19 6C 1C 77 FB D7 71 1A DA 23 CF D1 85 2A A8
92 F6 1C 92 16 2C 94 EC 98 B6 08 9C 6A D5 29 9B 62 AE 72 CF 77 B0 54 D4 97 09 61 44 6A 08 BE 6E 22 57 CD DA 1E 34 96 66
34 F3 1D 0E E3 40 CF 2A F9 2D C0 EB 78 AD 76 DE CF 08 FA B9 AE 4F DC 95 32 56 94 5C 42 97 BD 8B F0 69 B2 D4 52 B3 ED 99
61 23 B4 9F 4D 2A 06 85 84 FD 7C FB EB 3A 83 7F 25 F0 E3 E7 64 FE 52 28 EB 87 0D 11 85 79 2B 73 82 DE 2D EC 21 90 AA 57
96 6E CD C9 09 F3 91 65 31 2F 65
SERVICE = ACTION REQUEST, OBIS = 0-0-43-0-1-255, IC = 64, METH: INDEX = 3
SENDING HDLC FRAME
21:54:46:783 ====> METER-1 7E A1 13 00 02 BA 69 41 54 8F 1B E6 E6 00 CB 82 01 00 31 00 00 24 A1 2F 52 23 8F ED 3D DF D7 B0 4E B7 11 13 A7 77 6E E8
2C CA FC E8 55 CC 4E 45 5D 92 A5 C3 A1 76 12 67 28 FF 3F 7A BC 5A 75 EE 5B 75 AE 9E ED 0C 3E 2F C3 4E B5 CC 7A CC FF 93
51 89 D6 4D 12 DF 7B 34 91 A9 FD 10 27 4F 3C 16 9D 8E 3A 07 77 68 91 85 13 D8 FF 1F 9F 8F 48 EB C9 2C B3 41 CD D2 2F F6
66 43 0C 1E AB AD 57 DD 19 6C 1C 77 FB D7 71 1A DA 23 CF D1 85 2A A8 92 F6 1C 92 16 2C 94 EC 98 B6 08 9C 6A D5 29 9B 62
AE 72 CF 77 B0 54 D4 97 09 61 44 6A 08 BE 6E 22 57 CD DA 1E 34 96 66 34 F3 1D 0E E3 40 CF 2A F9 2D C0 EB 78 AD 76 DE CF
08 FA B9 AE 4F DC 95 32 56 94 5C 42 97 BD 8B F0 69 B2 D4 52 B3 ED 99 61 23 B4 9F 4D 2A 06 85 84 FD 7C FB EB 3A 83 7F 25
F0 E3 E7 64 FE 52 28 EB 87 0D 11 85 79 2B 73 82 DE 2D EC 21 90 AA 57 96 6E CD C9 09 F3 91 65 31 2F 65 73 2F 7E
RECEIVED HDLC FRAME
21:54:49:270 <==== METER-1 7E A1 0C 41 00 02 BA 69 74 1E 8F E6 E7 00 CF 82 00 F9 31 00 00 24 A1 0D 2C F6 09 9E 7F 24 D6 5A 75 23 9A 87 E6 BD F9 91
36 C7 D1 00 FB 54 7D AD 39 44 DA 00 DC 9E 6A C9 03 40 7F F3 7E E4 E8 80 5B 21 7A D6 B8 B3 68 8B A5 46 73 31 7B 33 C3 D2
3C 72 C1 5B A3 07 02 6F 38 64 5A B2 A3 E8 B4 33 32 5F EF F9 E5 2F B7 FA F3 2D FD 6A CC 19 09 29 EE F0 80 89 95 88 E7 36
2E AC 6B 9B 95 33 5F AD AD 4D E2 AD 7E FC D3 9A 8B D3 EB CA 7D 25 AE DA 83 34 A3 1B 8E D9 A1 81 2D B7 48 38 4C C6 75 8E
C9 72 83 B3 5C 0C 5E 2E 89 CC A4 B6 DE D6 80 38 28 8A 0C 42 8A 9C F3 F5 01 C4 D7 72 BC FC F7 31 54 7F 23 48 06 19 B1 ED
B9 C9 68 EE F6 6B FA E7 E9 42 31 60 B1 4E E5 B2 98 C7 C3 7B 13 34 2B F1 CD 52 5A F8 F0 7D F3 D8 2F AB E9 5E E4 13 DE 8F
C0 1C 13 D7 61 DD B4 0D 75 60 5C 15 94 63 F3 94 1A 7B 03 8A F3 8B E6 ED 1D 6E 0D D5 1E 7E
RECEIVED APPLICATION LAYER FRAME - CIPHERED
21:54:49:320 <==== METER-1 CF 82 00 F9 31 00 00 24 A1 0D 2C F6 09 9E 7F 24 D6 5A 75 23 9A 87 E6 BD F9 91 36 C7 D1 00 FB 54 7D AD 39 44 DA 00 DC
RECEIVED APPLICATION LAYER FRAME
21:54:49:320 <==== METER-1 CF 82 00 F9 31 00 00 24 A1 DF 00 08 33 44 4C 07 02 20 00 59 08 31 32 33 34 35 36 37 38 00 00 82 00 8E C7 01 C1 00 00
SERVICE = ACTION RESPONSE
SENDING HDLC FRAME
21:54:49:320 ====> METER-1 7E A0 0A 00 02 BA 69 41 53 7F 1A 7E
RECEIVED HDLC FRAME
21:54:50:295 <==== METER-1 7E A1 0C 41 00 02 BA 69 94 10 68 E6 E7 00 CF 82 00 F9 31 00 00 24 A1 0D 2C F6 09 9E 7F 24 D6 5A 75 23 9A 87 E6 BD F9 91
36 C7 D1 00 FB 54 7D AD 39 44 DA 00 DC 9E 6A C9 03 40 7F F3 7E E4 E8 80 5B 21 7A D6 B8 B3 68 8B A5 46 73 31 7B 33 C3 D2
3C 72 C1 5B A3 07 02 6F 38 64 5A B2 A3 E8 B4 33 32 5F EF F9 E5 2F B7 FA F3 2D FD 6A CC 19 09 29 EE F0 80 89 95 88 E7 36
2E AC 6B 9B 95 33 94 8F C0 2E 0C E8 6A 67 A3 02 A1 CE 5D 60 09 C2 C3 60 6C BF 90 11 49 87 23 E5 95 9B 81 82 0B CA 74 4E
CD 20 69 CE 60 FD 66 C4 4F 51 71 33 6C 06 D8 4D F0 3F E8 FB EA BA 7A 49 F8 37 66 99 4D CC F7 9A 11 B4 40 B2 16 E1 71 2D
DB 47 90 8C 7A 88 86 D1 DC 00 40 98 13 AC 9B 71 85 98 0C C3 6C 27 13 A2 31 D5 E1 F3 FE 0D D1 DA 68 32 07 14 C2 EF 53 C9
E6 8E AA 3F 09 CB A0 BE DB 74 A0 3F 2F 66 69 C2 66 CA D2 AA 90 CA A3 F5 64 FA A0 FE 41 7E
BR,
AP
Dear Sir,
Dear Sir,
Thank you for this info. I'll check this and let you know when the new version is released.
BR,
Mikko
Dear Sir,
Dear Sir,
DLMS standard says that general-signing is using the Signing key (Asymmetric key) for ciphering the data.
This can be easily read from Table 36 – Ciphered xDLMS APDUs.
Your current meter and the client application are using Block cipher and authentication keys (symmetric key) and this is not correct.
You need to inform the meter manufacturer of this issue.
You should receive public and private key certificates that are used to communicate with the meter.
Because I realize that changing this will take a long time, I think if I can find a way to handle this before this is implemented for the meter.
BR,
Mikko
Hi,
Hi,
Have you received signing (public/private) keys from the manufacturer or do you have only received authentication and block cipher keys?
BR,
Mikko
Dear Sir,
Dear Sir,
My self created the certificates for the meter and import/export certificates in/from the meter using the gurux director in non suite mode.
After successfully created the certificates and import / export of the certificates i switched the meter from non suite to suite1.
I am the firmware developer so i am developing the DLMS suite1 stack for the meter.
BR,
AP
Dear Sir,
Dear Sir,
Please go through the attached snippet of the green book.
BR,
AP
Hi,
Hi,
Yes, you are right on this, but the meters that we are reading at the moment are using public/private keys for ciphering and not authentication and block cipher keys. This is what I mean by Table 36 – Ciphered xDLMS. It says that the signing key is used for ciphering.
But, this is not a problem. I made the design yesterday and we changed a few things. The new version is on the testing and now authentication and block cipher keys are supported as well.
BR,
Mikko
Hi,
Hi,
Just to make sure. Are you supporting anything other than the Ephemeral Unified Model scheme (One-Pass Diffie-Hellman or Static Unified Model)?
BR,
Mikko
Hii,
Hii,
Right now we are only using the Ephemeral Unified Model scheme by invoking the "key agreement" method of the security setup class.
BR,
AP
Hi,
Hi,
If you are using Ephemeral Unified Model then the key must be 64 bytes long. Now the client is sending 16 bytes long authentication key. Check Security setup key_agreement from Blue Book.
You can get an example from Green Book: Table C. 1 – Test vector for key agreement using the
Ephemeral Unified Model C(2e, 0s, ECC CDH) scheme
BR,
Mikko
Hii Sir,
Hii Sir,
Good Morning!!!
For suite1 DLMS recommends AES-GCM-128 algorithm so 128/8 = 16 => key size should be 16 bytes
similarly for suite2 DLMS recommends AES-GCM-256 algorithm so 256/8 = 32 => key size should be 32 bytes.
64 bytes is nothing but the signature generated for the message and appended right to the message.
Also go though the snap attached for the table c.1 , if you observe the yellow highlighted you found that encryption key agreed is of 16 bytes.
C.1 table explains the procedure of key agreement method for encryption key.
Best Regards,
AP
Hi and Good Morning,
Hi and Good Morning,
GUEK is coming from the first 16 bytes from KDF. KDF is count from the shared secret, algorithm ID, and system titles.
I remember when I was solving this for Java several years ago. This took a long time to solve.
BR,
Mikko
Hii sir,
Hii sir,
Beside key agreement method can help to release gurux for suite1 with Digital Signing APDU's as like frames that i had sent to you if you feel that frames are correct.
BR,
AP
Sear Sir,
Sear Sir,
Still on testing. As I told the basic idea is correct on the frames. You need to count GUEK from KDF or signing will fail.
BR,
Mikko
Hi,
Hi,
The new version was released last week where support for General Signing is added.
Check the Quick Start video from here:
https://youtu.be/h90y4qimLOs
BR,
Mikko
Hii,
Hii,
Thank you!!!
try to testing but not working for me.
For AARQ there is no signature in the log.
Below is the log:
17:54:38 Send SNRM request.
TX: 7E A0 23 00 02 BA 69 61 93 FA DD 81 80 14 05 02 01 F5 06 02 01 F2 07 04 00 00 00 01 08 04 00 00 00 01 2C 01 7E
17:54:38
RX: 7E A0 23 61 00 02 BA 69 73 09 85 81 80 14 05 02 01 F2 06 02 01 F5 07 04 00 00 00 01 08 04 00 00 00 01 42 69 7E
17:54:38 Send AARQ request.
TX: 7E A0 6E 00 02 BA 69 61 10 20 82 E6 E6 00 60 5D A1 09 06 07 60 85 74 05 08 01 03 A6 0A 04 08 31 32 33 34 35 36 37 38 8A 02 07 80 8B 07 60 85 74 05 08 02 05 AC 12 80 10 69 58 4A 1B 4A 4D 0E 41 19 52 45 11 77 07 42 2A BE 23 04 21 21 1F 31 00 07 A1 20 F2 A9 DE C0 82 52 6A 3E 89 70 C2 2D 6E 4B C2 B7 7F 71 37 F6 2D A4 34 30 3A 85 27 8B 7E
17:54:38
RX: 7E A0 D3 61 00 02 BA 69 30 C7 62 E6 E7 00 61 81 C2 A1 09 06 07 60 85 74 05 08 01 03 A2 03 02 01 00 A3 05 A1 03 02 01 0E A4 0A 04 08 50 52 4F 7C 23 45 6E F0 88 02 07 80 89 07 60 85 74 05 08 02 05 AA 12 80 10 61 62 63 64 65 66 67 68 69 6A 6B 6C 00 00 1E E3 BE 7B 04 79 28 77 31 00 00 02 54 73 AC 3B 1E 0D 5D D3 F4 2D 2A A2 E1 48 58 A7 FF 68 29 82 9E D4 00 DC 82 52 D5 C1 AA E1 3E 32 CC 1F C0 A5 B7 E5 9B AA 4A 82 94 BE E4 21 78 3F FF 73 4F 9D D1 3E E8 A4 33 C0 83 B1 2E 0A 25 7E 1A E6 CA 45 B7 2C 19 11 69 8D 3E F2 7B C1 CA D3 F4 15 48 69 F3 D5 B3 EF CE EE C5 D6 89 A4 0B F8 93 0D 65 5B 45 97 2D A9 07 B6 53 E4 C2 3A D0 4D B6 87 12 42 D1 7E
17:54:38
RX: 7E A0 0A 61 00 02 BA 69 73 B3 A7 7E
BR,
AP
Hi,
Hi,
I'm just reading the Breen Book and try to find the answer should AARQ/AARE sign or not. Content is not signed with Ephemeral Unified Model scheme, One-Pass Diffie-Hellman, or Static Unified Model before the connection is established for the meter.
BR,
Mikko
Hii,
Hii,
AARQ /AARE has many components/information in it. one of the component is named as User Information.
Also AARQ/AARE contains the CtoS/StoC challenge values.so i thought xDLMS APDU-s supporting ciphering/signing shall include in it.
BR,
AP
Hi,
Hi,
AARQ and AARE are ciphered using authentication key and block cipher key. For example, dedicated messages start to use a dedicated key for ciphering AFTER the connection is made. But, I'm trying to find an answer if GeneralSigning starts to use the signing key before the connection is established.
BR,
Mikko
Hii,
Hii,
Please go through the attached snap may help you.
BR,
AP
Hii,
Hii,
Please go through the attached snap.
As AARQ contains the user information field which carry Initiate request APDU which is nothing but the xDLMS APDU.
As per table 22 (which snap already sent) digital signature applies to the xDLMS APDU.
so the signature must be applicable for the AARQ/AARE.
BR,
AP
Hii Sir,
Hii Sir,
Good Morning!!!
Any update sir.
BR,
AP
Hi,
Hi,
The digital signature is a little bit confusing, but at the moment I think that digital signature is used after the connection is established. We have a meter that is passed DLMC CCT and it doesn't use a digital signature before the connection is established.
So GXDLMSDirector works correctly at the moment.
BR,
Mikko
Hii,
Hii,
Thank you!!!
is the digital signature applicable for authentication frame ( GMAC authentication frame after AARQ/AARE)?
BR,
AP
Hi,
Hi,
If you are using High authentication level it's added after the meter has accepted the connection.
BR,
Mikko
Hii,
Hii,
Sorry but not understanding the meaning of meter has accepted the connection.
I mean when meter accepted the connection after successful AARQ/AARE or after successful authentication.
BR,
AP
Hi,
Hi,
After successful authentication meter starts to use general ciphering messages.
BR,
Mikko
Hii,
Hii,
Please go through the attached snap which proves that Digital signature is applicable for xDLMS initiate request APDU if digital signing is required by the security policy.
BR,
AP
Hii,
Hii,
Please find the correct highlighted snap.
BR,
AP
Hi,
Hi,
Your findings are interesting and when I read them, I believe that you are right. If I understand correctly, AARQ is encrypted with a block cipher and the authentication key, but it's also digitally signed.
I need to think about this.
BR,
Mikko
Hii,
Hii,
Good Morning!!!
Any updates sir, what would be the final implementation?
BR,
AP
Hello,
Hello,
There are some changes and the new version is released next Monday after the tests are over.
BR,
Mikko
Hii Sir,
Hii Sir,
Thank you very much!!!
Also which one of the following would be the better and easy for implementation (Embeded c) to import and export the certificate of hug length when frame size negotiated is small say 200 bytes.
1. Action request / response with block
2. Segmentation
BR,
Ap
Hii,
Hii,
Also may i know when to release.
BR,
AP
Hi,
Hi,
I'm waiting for the feedback from the new release. I hope that it can be release today or tomorrow.
BR,
Mikko
Hii,
Hii,
Just got the update of gurux, is this release has the signing for initiate request?
I found one new setting of checkbox to enable disable general signing for initiate request, but in AARQ not found the signature for both enable/disable.
Also may i know how to check the revision history for new release in gurux?
Thank you:)
BR,
AP
Hi,
Hi,
There is a new version where AARQ is not signed. We have two meters that have passed DLMS CTT and Neither signs the AARQ. DLMS Standard says that it's possible, but doesn't say how to sign it.
I'm still reading the DLMS standard and try to find the answer for this.
BR,
Mikko
Hii,
Hii,
We confirmed from DLMS support and other some DLMS experts that signining is applicable for AARQ as well.
Following is the reply from DLMS against my query:
It depends what security policy is specified - see Green Book 10, clause 9.2.7.2.2.
If bit 4 is set, then, yes, you need to sign the request, if not, you don't.
Best Regards,
Aoudumbar pawar
Hi,
Hi,
9.2.7.2.2 refers to Security Suite 1. and the access rights of the object. It will describe is the attribute of the COSEM object signed or not.
I'm sorry to say, but it doesn't tell anything from the signing AARQ/AARE.
BR,
Mikko