Introduction - KNX

Data Encryption
Authentication / Device Signatures
Signatures, or authentication in any way, are not included in the Dutch smart meter
specifications. This is referred to in the OMS documents (OMS-Spec-
Vol1_General_v100.pdf section 3.6.2) as work in progress.
Encryption
The Dutch smart meter specifications require two-way data encryption. The MUC to
Meter data may contain control data (time synch, valve control, etc) so should be
encrypted. The Meter to MUC data should be encrypted for privacy reasons (to mask
zero or low consumption of temporarily uninhabited quarters).
The MUC documents require only encryption for MUC to Meter data
(MUC_080128_inkl_Anlagen.pdf SRR section 5.3.9).
Note that the EN13757 only specifies encryption for Meter to MUC data.
Encryption Algorithm
The encryption algorithm is in both the Dutch smart meter specification and the OMS
documents AES-128.
The block chaining mode is in both specification documents CBC (Cipher Block
Chaining).
In the Dutch specification, the initialisation vector is binary zero, in the OMS
specification the initialisation vector (IV) is built from data that is sent (in the same
transaction as are the encrypted data) as unencrypted byte stream.
Encryption key exchange
In the Dutch smart meter specifications, a new encryption key is encrypted with a
meter-specific default encryption key to prevent exchange of an unencrypted plaintext
encryption key. This allows a relatively secure modification of encryption keys.
In the OMS documents there is no exchange of encryption keys; hence changing
encryption keys in an operational meter is not possible. The encryption keys in the
OMS specification are configured in the production facility. The encryption key is
then sent unencrypted from the meter to the MUC, and from there to the Head End,
during installation. (MUC_080128_inkl_Anlagen.pdf SRR section 5.3.9).
Comments:
Review M-bus.doc 2 04/12/2008