TLS encryption for CIP security purpose

[ChristopheLaurent]

I'm using pylogix for a couple of years to read/write tags in a ControlLogix 5580 Process Controllers.
Now I have to add secured communications between my acquisition computer and the PLC. my PLC already supports TLS and DTLS according to document "CIP Security with Rockwell Automation Products", Allen-Bradly, December 2023.
Is there any plan to add TLS encryption feature to pylogix and support CIP Security ?

[dmroeder]

Hey @ChristopheLaurent, good question. The short is, no there are no current plans. This is something I plan to investigate though. I need to do some digging, I'll keep you posted.

[ChristopheLaurent]

Hi @dmroeder, did you have any chance to investigate this issue and do you have any plan for TLS ? If encryption is not possible, can pylogix support keyed-Hashed Message Authentication Codes (HMAC) to verify data integrity and authenticity ?
Additionally, could it use digital certificates (X.509v3) or pre-shared keys (PSKs) to authenticate devices ?

[evaldes2015]

What's your use case?

[dmroeder]

Supporting CIP security seems like a pretty tall order. I watched what happens when the model is deployed, more than 500 packets were exchanged. I'm not sure where I'll get the bandwidth to figure out what is going on there.

[TheFern2]

I think if you are needing TLS and enhanced security, your best route is to use OPCUA assuming ignition or other services support connecting to PLCs with secured CIP.