[Cryptography] Smart electricity meters can be dangerously insecure, warns expert

[Michael Kjörling]

On 2 Jan 2017 23:44 +0000, from pgut001 at cs.auckland.ac.nz (Peter Gutmann):
> And then replacing all the infrastructure in the field.

_I actually think that's the big issue._ We can figure out how to
create a product (electricity meter) that meets some specifications
(implements protocol X as described by standard ABX-1234, resistant to
attacks Y, Z and Z'). Cryptography can play a part there. Frankly,
this is probably the easy part.

But how often are meters replaced? I suspect a ten year timeframe for
widely fielding a new product is actually perfectly realistic, if not
actually optimistic. I wouldn't be the least bit surprised if the
average electricity meter sees 10-20 years of service life in the
field before being replaced.

As a personal anecdote, I had the electricity meter on my house moved
recently, as the above-ground service feed was replaced with a
below-ground cable and I at the same time opted to have the meter
moved to a physically more convenient location. At a guess, based on
rate of electricity use, I would estimate that the meter is on the
order of 10-15 years old. I specifically asked the power utility
company people, mostly out of curiosity, if they were going to replace
the existing meter, or just move the existing one, and the answer was
along the lines of "why would we do anything but move it?". That's
_recently_ as in _a few months ago_.

Heck, it probably took those 10-20 years for utility companies to
replace "dumb" meters with "smart" meters en masse, despite the
obvious savings from the utilities' point of view in not needing to
regularly send someone to physically read each meter, with the risk of
errors that inevitably introduces. (We can argue all day about various
vulnerabilities, but from the utility's point of view, that _is_ a
pretty nice feature to have.)

There's a lot of inertia to overcome in fielding a new standard,
_especially_ when the new product required doesn't offer a "killer
feature" (pun not intended) for the entity making the decision on
which product to procure.

-- 
Michael Kjörling • https://michael.kjorling.se • michael at kjorling.se
                 “People who think they know everything really annoy
                 those of us who know we don’t.” (Bjarne Stroustrup)