← Home
IEC 62443-3-1 Clause 7.1 – Symmetric (Secret) Key Encryption
Teaching note: Paraphrased from IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007) for
learning. The technical report is informational, not a requirements standard. Confirm wording
in the published TR. Later normative parts (2-1, 3-3, 4-2) state the shalls.
Reference: IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007), Clause 7.1
Related:
Clause 7
|
7.2 Public key
|
FR 4
Technology categories:
Overview
|
Cl. 5
|
Cl. 6
|
Cl. 7
|
Cl. 8
|
Cl. 9
|
Cl. 10
Clause 7 pages:
Cl. 7
|
7.1 Symmetric key
|
7.2 Public key
|
7.3 VPN
What it is
Symmetric (secret-key) algorithms use the same key to encrypt
and decrypt (AES- and 3DES-class). They are relatively fast, which matters on control links,
but every party that needs to read the data must hold the secret.
Vulnerabilities addressed
Interception (sniffing) of confidentiality-sensitive traffic, and some integrity attacks when
combined with a MAC or authenticated-encryption mode.
Typical deployment
Link or session encryption between two devices that can share a key; bulk data protection
inside a VPN; disk or historian archive encryption. Key distribution is the operational
problem.
Known issues and weaknesses
- Key distribution and storage: theft of the key equals theft of the data.
- Latency and CPU cost on constrained devices.
- Encrypting a channel can hide traffic from legitimate monitoring and from some IDS.
Use in IACS
Deploy only as part of an enforced crypto policy, sized to the asset. Teaching note: AES is
now the default symmetric algorithm; the TR’s key-length-versus-value rule still applies.
Recommendations
- Deploy cryptography only as part of a comprehensive, enforced security
policy.
- Select protection matched to the value of the information and control assets, and to
IACS operating constraints.
- The key should be long enough that guessing it costs more than the
protected asset is worth.
- Protect encryption hardware from physical tampering and from uncontrolled electronic
connections.
- Use remote key management when units are numerous or geographically dispersed.
- Do not encrypt so as to hide traffic from safety or monitoring that must
see it.