Constrained CIP Security Best Practices
Jakub Korbel, Jack Visoky
Rockwell Automation

Why the CIP Security Constrained Profile?
•More devices are being “connected” via
Ethernet– Even sensors and other constrained devices•

Each of these present an attack surface
that might be attractive to hackers– Example: Mirai Botnet•

Even if a device isn’t directly connected tothe Internet it could still be targeted– Example: Jeep hack, Trisis malware•

Therefore security protections must be
available for resource-constrained CIPdevices

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

2

Resource Constrained CIP Security••

In April of 2021 ODVA published the CIP Security Resource-Constrained
ProfileProvides functionality for protocol protections, but tailored to moreconstrained devices– PSKs instead of certificates (except for initial commissioning)– Only 3 cipher suites– DTLS only••This makes it much easier for a constrained device to implement security
However, there are still some best practices to discuss

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

3

Why the changes – certificates•Certificates bring a lot of complexity– X.509 parsing– File Object– Certificate Management Object••

Using PSKs is a lot simpler, better
suited to these constrained devices
However, an initial, default certificate
can still be used – no need to parse itor support the objects, just serve it aspart of the initial handshake– This helps bootstrap security and toprovide device authenticity assurances– IEEE 802.1AR IDevID
Technical Track© 2023 ODVA, Inc.

Part of a certificate used on an EtherNet/IP device…seems complicated…
X509 Certificate:
Certificate Extensions: 13
Version: 3
1.3.6.1.4.1.95.3.2: Flags = 0, Length = 3
Serial Number: 6e6e5112000000000f24
Signature Algorithm:
0000 02 01 01
Algorithm ObjectId: 1.2.840.10045.4.3.4 sha512ECDSA...
Algorithm Parameters: NULL
0000: 02 01
Issuer:; INTEGER (1 Bytes)
CN=Rockwell Automation - Manufacturing Intermediary CA
0002:
01
5
O=Rockwell Automation, Inc.
1.3.6.1.4.1.95.3.5: Flags = 0, Length = 3
C=USName Hash(sha1): 02a938c1873ccc4c6c926b3a1a3e2080b3678e1f
0000 02 01 0e
Name Hash(md5): 3ebb00acfb516fbc867fe59dfac3fea3...
0000: 02 01
NotBefore: 12/16/2015 12:19 PM; INTEGER (1 Bytes)
NotAfter: 12/6/2055 12:19 PM
0002:
0e
Subject:
1.3.6.1.4.1.95.3.6: Flags = 0, Length = 4
CN=1756-L85E (00b48f94)
O=Rockwell Automation, Inc.
0000 02 02 00 a8
C=US....
Name Hash(sha1): ec91018dbb124274ba596b0f46e7a939a6c5bc360000: 02 02
Name Hash(md5): 31c2a3931fd0c6b7fd230d6dc07ea7d6; INTEGER (2 Bytes)
0002:
00
Public Key Algorithm:
0003:
a8Algorithm ObjectId: 1.2.840.10045.2.1 ECC
Algorithm Parameters:
1.3.6.1.4.1.95.3.7: Flags = 0, Length = 7
06 08 2a 86 48 ce 3d 03 01 07
1.2.840.10045.3.1.7 ECDH_P2560000 03 05 00 02 00 00 00
Public Key Length: 256 bits.......
Public Key: UnusedBits = 00000: 03 05
0000 04 18 ee 09 3c fd 6e cb 31 d3 89 ba 17 32 43 db; BIT_STRING (5 Bytes)
0010 78 b0 3a 55 47 61 f7 a4 2e b1 92 92 88 a5 d2 8e0002:
00
0020 12 3a 73 d9 38 f6 46 ce 37 35 fa 11 aa ea 2f 200003:
02 00 00 00
0030 cc 27 21 38 d6 78 be 44 9f d2 4b 6e 1b 91 96 73
0040 4f

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

4

Why the changes – ciphers
Just 3 ciphers needed for the Resource Constrained Profile
Cipher

Properties

TLS_ECDHE_PSK_WITH_NULL_SHA256

Authenticity only, no confidentiality. Just
uses the SHA-256 HMAC

TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256

AES GCM for authenticity andconfidentiality. Highly optimized for
hardware acceleration

TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256

ChaCha20 and Poly1305. Highly
optimized for devices without hardware
acceleration

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

5

Why ECDHE Ciphers?
••••

Note that each cipher is Elliptic Curve
Diffie Hellman Ephemeral
This means that an ephemeral key pair isgenerated during the handshake
This does add cost/complexity in terms ofcode space and memory usage However, it also provides perfect forwardsecrecy ☺
–••PERFECT
FORWARD
SECRECY!!

It’s worth
thememoryusage(until it’snot…)

Prevents compromise of datatransmitted if static keys are evercompromised

SIG felt this was important enough to pay
the cost, minimum for security
However it is something that could be
discussed in the future if further
constraints are neededTechnical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

6But How?
••

The CIP Security Resource-Constrained
Profile defines the technologies, but does
not provide guidance on implementationdetails
Here are some practices discovered andestablished during Rockwell Automation‘s
implementation of the profile

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

7

Security Implications• Trade-offs come at a cost!
– Pay attention to your threat model• Certificates are complex, but they provide a
unique identity for every device in the system– PSKs don’tTechnical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

8What are some downsides to PSKs?
••••

Non-repudiation – anyone with the PSK
can deny they did something
Spoofing – cannot distinguish one member
with the PSK from another
Reflection – in some cases connections
can be reflected or redirected
Note with sufficiently small groups (like of2) many of these threats disappear, butthat is often not the case when using
PSKs

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

9Tasking••

Cooperative multitasking == tasks are reqlinquishing CPUcontrol themselves, single stack is sufficient– Did someone say “event loop”?
Pre-emptive multitasking == scheduler relinquishes task‘sCPU control usually as a reaction to ISR (context switch
after finished assigned time slice), a stack per task isneeded– Did someone say “POSIX threads”?

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

10Pre-emptive Multitasking

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

11Tasking••

Task architecture has a big impact on the performance and footprint ofsecurity in a resource-constrained environment
Cooperative multitasking can be suitable if developers have full control overrunning firmware– With single core and well-behaving tasks finishing operations in small chunks,
Cooperative multitasking can present significant performance benefit over preemptive multitasking.

•Pre-emptive multitasking is a must when users can launch misbehaving
tasks, so that the system won‘t halt. It also does not require developers tosplit large calculations or allows them to perform blocking operations.

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

12What is a DTLS Handshake?

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

13

Handshake Stack and Heap consumption•

Handshake and also hash/crypto operations can be very stack and heapconsuming, check it out yourself here.
– Handshake consumes more stack/heap memory than keeping a connection alive– DTLS consumes more memory than TLS, but remember TLS leverages
connection and stream properties of TCP– ECC client side is more memory consuming than RSA, but this might changewith certificate chains, where the sum of key sizes offsets ECC‘s stack and heapheavy operations– Even with size tweaking compile-time options, the stack sizes just for handshakegrew often to 10K

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

14

Handshake••

Handshake operations are also performance intensive,
especially for ECDHECIP I/O cannot wait till the Ephemeral key generation (RNG)
of ECDHE finishes– Pre-emption can be the solution, but it can result in multiplying
RAM consumption for task stacks.
– Splitting the calculations can be the solution in Cooperative
scheme, but it requires support in the TLS library.
– Hardware acceleration can help in combination• More and more cryptochips are being made, some can even help
ECC operations.

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

15

Best practices•

To get to smaller memory footprint and better performance in highly
constrained environments, such as <256KiB of RAM and <300MHz CPU
Speed:––––

Use cooperative multitasking.
Use cryptoacceleration, if available.
Prefer PSKs, but understand the impact on security and establishment of trust.
Benchmark (or read the documentation of) cryptographic libraries for memory
footprint and handshake performance.
– Pick cipher-suites that provide enough security and can sustain the trafficneeded by your product function.
• (Or just conform to Volume 8, CIP Security Resource Constrained Profile ☺)Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

16

Conclusions•••

CIP Security Resource Constrained
Profile provides robust security whilefitting into tightly constrainedenvironments
It is important to be aware of security
limitations with PSKs
Task architecture really matters forconstrained environments andsecurity, think about how constrained
your environment is and pick yourtasking model

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

17

Conclusions••Be careful of how the handshakes aredone, this has a big impact on performanceand memory usage
If in practice this profile is still too
burdensome to highly constrained devices
the SIG can consider PSKs which don’t
provide Perfect Forward Secrecy– This is likely a reasonable trade-off, bringing
some security to constrained devices isbetter than “perfect” security that doesn’t
get usedTechnical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

18