Reading the specs of a new electricity smart meter (called Linky in France), I was surprised about the chosen encryption method (128 bits symmetric key AES), based on a single secret key (called CCC in the specs), that is shared between the meter and the central system, used to generate session keys to encrypt data.
Some context from the documentation:
5. PLC COMMUNICATION SECURITY - Each meter must have a CCC secret key, a unique CC_LAN key, a unique CC_LOCALE key and two session keys for the LAN interface and a session key for the Local interface, transmitted when the application association with the Client concerned was created
5.1 Encryption method - 128-bit AES symmetrical key algorithm, GCM operation mode. It is used to ensure data confidentiality and authentication.
5.2 "CCC" secret key - The CCC key is used to reprogram the "CC_LAN" key or the "CC_LOCALE" key in a meter. This key is never used to encrypt the communications between the concentrator and the meter. It is known only to the meter and the IS (Central server). When the CC_LAN (and the CC_LOCALE respectively) is generated, the IS encrypts it with the CCC and transfers it to the meter via the concentrator. This transfer is completely transparent for the concentrator which sends the encrypted data to the meter. The meter that knows the CCC is responsible for decryption the data in order to retrieve the CC_LAN (and the CC_LOCALE respectively). The CCC key is not accessible in read mode.
5.3 Unique "CC_LAN" and "CC_LOCALE" keys - The CC_LAN and CC_LOCALE keys are only used during the application association phase between the concentrator and the meter, and the TSP and the meter respectively. They are used to crypt the service allowing this application association. This service transfers the session key that will then be used, in the context defined by t his application association, to crypt the communications between the concentrator/TSP and the meter. The CC_LAN and CC_LOCALE keys cannot be accessed in read mode.
A quick note on the architecture: the meter communicates with the local transformer using PLC on open power lines, the transformer communicates with the central system with GPRS. The local transformer, apart from local network management, only forward data packets "as-is" to the central system.
(More information on the architecture is available here. Security is chapter 5, pages 39-40).
- What is the security implication of having a central repository of secret keys?
- If the central key database is hacked, would the attacker be able to decrypt the communication of any meter? (For example, to tamper with it?)
- Is there any reason why not to choose an asymmetric public key mechanism instead, where the central system does not have to know the secret key of all meters? Does this has to do with the complexity of securely communicating the public key once generated? (since the central system has to ensure the authenticity of the public key maybe a manual intervention would be needed?)
- Is there any potential security risks of the chosen architecture?
Note: This question has been also asked on security.stackexchange.com.