Group Domain of Interpretation (GDOI) Protocol Support for IEC 62351 Security Services
Extracted elements (25)
The ID and SA TEK payloads include explicit OID Length and OID-Specific Payload Length fields even though these lengths are redundant with the DER encoding. This is to allow implementations to construct and sanity-check GDOI messages without needing to parse the DER itself.
The selectors in the SA TEK (OID and OID-Specific payload) may not match what the GM requested in the ID payload; the KS may return multiple TEKs with different traffic selectors, and GROUPKEY-PUSH messages do not include an ID payload, so TEK definitions must include traffic selectors.
A key associated with an IEC 61850 authentication algorithm MUST be distributed as a TEK_INTEGRITY_KEY attribute in the KD payload, with key sizes matching the algorithm (32 octets for HMAC-SHA256-128/HMAC-SHA256; 20 octets for AES-GMAC-128 with 16-octet key and 4-octet salt; 36 octets for AES-GMAC-256 with 32-octet key and 4-octet salt).
A key associated with an IEC 61850 confidentiality algorithm MUST be distributed as a TEK_ALGORITHM_KEY attribute in the KD payload, with key sizes matching the algorithm (16 octets for AES-CBC-128; 32 octets for AES-CBC-256; 20 octets for AES-GCM-128 with 4-octet salt; 36 octets for AES-GCM-256 with 4-octet salt).
AES-CBC-128 and AES-CBC-256 do not provide authentication and MUST NOT be used with the NONE authentication algorithm.
Confidentiality Algorithm IDs SHOULD be included in the IEC 61850 SA TEK payload if IEC 61850 messages are expected to traverse public network links and are not protected by another level of encryption (e.g., an encrypted VPN).
IEC 61850 keying material MUST be distributed as defined in Section 5.6 of RFC 6407, and the KD Type MUST be TEK (1).
When encryption is used, authentication MUST also be provided either by an authenticated encryption algorithm (e.g., AES-GCM-128) or by a specific authentication algorithm (e.g., HMAC-SHA-256). Setting authentication to NONE with a non-authenticating confidentiality algorithm MUST NOT be done.
Authentication algorithms defined for IEC 62351 SA TEK: NONE (value 1), HMAC-SHA256-128 (value 2, truncated to 128 bits), HMAC-SHA256 (value 3, full 256-bit output), AES-GMAC-128 (value 4), and AES-GMAC-256 (value 5). Mandatory-to-implement requirements are defined in IEC-TR-61850-90-5.
Confidentiality algorithms defined for IEC 62351 SA TEK: NONE (value 1), AES-CBC-128 (value 2, no authentication), AES-CBC-256 (value 3, no authentication), AES-GCM-128 (value 4, authenticated), and AES-GCM-256 (value 5, authenticated). AES-GCM modes provide authentication and are used with NONE auth algorithm.
GDOI_PROTO_IEC_61850 (value 3) is defined as a new Protocol-ID for the SA TEK payload, used to distribute IEC 61850 security policy. Its TEK Protocol-Specific Payload includes OID, OID-Specific Payload, SPI (4 octets), Auth Alg (2 octets), Enc Alg (2 octets), Remaining Lifetime Value (4 octets), and SA Data Attributes.
The ID_OID identification type (value 13) is defined for GDOI ID payloads to specify an ASN.1 Object Identifier encoded using DER. It consists of an OID Length (1 octet), OID (variable), OID-Specific Payload Length (2 octets), and OID-Specific Payload (variable).
The Key Delivery Assurance (SA_KDA) attribute (value 2, TV type) carries a percentage (0-100) indicating what fraction of Subscribers have received the SA TEK, allowing a Publisher to decide whether to activate the new SA TEK.
The SA Activation Time Delay (SA_ATD) attribute (value 1, TLV type) delays SA installation by a specified number of seconds. It applies only to a single SA and MAY be used in GROUPKEY-PULL or GROUPKEY-PUSH; when both SA_ATD and GAP ACTIVATION_TIME_DELAY are present in GROUPKEY-PUSH, SA_ATD takes precedence.
The SPI in a GDOI_PROTO_IEC_61850 SA TEK is a 4-octet Key Identifier (KeyID) chosen unilaterally by the GCKS. Implementations must avoid duplicating an SPI value currently in use for a particular group.
A new 'ID Types' registry for GDOI Identification Payload was created, derived from the IPSEC Identification Type registry. Values 1-12 mirror the IPsec DOI registry; value 13 (ID_OID) is newly defined by this memo. Future assignments are by Expert Review.
GDOI_PROTO_IEC_61850 (value 3) was added to the existing 'SA TEK Payload Values - Protocol-ID' registry in the 'Group Domain of Interpretation (GDOI) Payloads' registry.
The 'GDOI SA TEK Attributes' registry was created defining SA TEK attributes: SA_ATD (1, Variable/TLV) and SA_KDA (2, Basic/TV). Future assignments are by Expert Review.
The 'IEC 62351-9 Authentication Values' registry was created to define Auth Alg values: NONE (1), HMAC-SHA256-128 (2), HMAC-SHA256 (3), AES-GMAC-128 (4), AES-GMAC-256 (5). Future assignments are by Expert Review.
The 'IEC 62351-9 Confidentiality Values' registry was created to define Enc Alg values: NONE (1), AES-CBC-128 (2, N), AES-CBC-256 (3, N), AES-GCM-128 (4, Y), AES-GCM-256 (5, Y), where Y/N indicates whether authenticated encryption is provided. Future assignments are by Expert Review.
Because the relevant IEC specifications are not freely available to the IETF community, this RFC cannot fully describe all applicable security considerations; implementers must depend on the security analysis within the IEC specifications, and additional cross-SDO analysis may be advisable.
GDOI inherits security properties from RFC 6407 including authentication of participants, confidentiality of key management messages, source authentication, and defenses against man-in-middle, connection-hijacking, replay, reflection, and DoS attacks. It assumes the network may be under complete attacker control.
Setting both authentication and confidentiality algorithms to NONE is possible but NOT RECOMMENDED; it may be necessary during migration when some traffic has not yet been scheduled for protection, or when network-layer encryption is applied before delivery to a public network.
The GDOI_PROTO_IEC_61850 SA TEK payload contains: OID Length (1 octet), OID (variable), OID-Specific Payload Length (2 octets), OID-Specific Payload (variable), SPI (4 octets), Auth Alg (2 octets), Enc Alg (2 octets), Remaining Lifetime Value (4 octets, zero means no expiry), and SA Data Attributes (variable).
The ID_OID Identification Data format encodes: OID Length (1 octet), OID (variable, DER-encoded ASN.1 ObjectIdentifier), OID-Specific Payload Length (2 octets, zero if absent), and OID-Specific Payload (variable, DER-encoded, omitted if length is zero).