These processes (encryption/decryption) are controlled by a ‘key.’ The key is a secret that is shared between the two communicating parties. The second process of cryptography is called decryption which takes the ciphertext and recreates the plaintext.

This conversion process is called encryption. To understand the ramifications of insufficient key length in an encryption scheme, a little background is needed in basic cryptography.Ĭryptography is the process of converting ordinary information (i.e., plaintext) into a scrambled unintelligible mess (i.e., ciphertext). Weak ciphers are generally known as encryption/ decryption algorithms that use key sizes that are less than 128 bits (i.e., 16 bytes … 8 bits in a byte) in length. The larger the key size the stronger the cipher. Using an insufficient length for a key in an encryption/decryption algorithm opens up the possibility (or probability) that the encryption scheme could be broken (i.e.

How does one go about discovering if weak ciphers are being employed?Ī weak cipher is defined as an encryption/decryption algorithm that uses a key of insufficient length.

Given this scenario, if one is to address the issue of ‘weak ciphers’ some very basic questions need to be answered. Secure communications is typically employed in EMS/DMS/OMS systems where data is transmitted across LANs that are outside of the defined electronic security perimeter (i.e. To do this, a cipher or algorithm for encrypting and decrypting communications is used. In contrast the sender and receiver see the same secure communications and are able to exchange information. On seeing secure communications, third-party adversaries could not interpret the communications. Some examples of this would be telemetry data transferred over a routable protocol such as DNP data exchanged between utilities using ICCP or control system information presented to corporate users using HTTP/HTTPS. Control system data communications are often transmitted over externally controlled third-party mediums. Cryptography as applied to the control system is the practice and technique for securing data communications between a sender and a receiver.

To be concise, a cipher described in the above context refers to the field of cryptography. More specifically, if the utility organization has any exposure to independent cyber security vulnerability assessments done by third parties, then it is also probable and perhaps most likely that personnel responsible for cyber security compliance may be even asked to remove ‘weak ciphers’ references from the assessed EMS/ DMS/OMS system. If utility personnel responsible for cyber security compliance have had any exposure to the Critical Infrastructure Protection (CIP) program sponsored by the North American Electric Reliability Corporation (NERC), then there is a good chance that the term ‘weak ciphers’ has been mentioned in some sort of fashion.

List of ciphers and codes