Implement DNP3 Secure Authentication (SAv5) challenge-response for critical SCADA control commands
domain: dnp.org · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Enable Object Group 120 (Authentication) support alongside standard DNP3 application-layer messaging
Configure a pre-shared or per-session key between the master and outstation
On a critical control operation (e.g. a binary output command), have the outstation issue an SAv5 Challenge before executing it
Have the master compute and return an HMAC-based Reply using the shared key
Accept or reject the operation based on authentication success per IEEE 1815-2012 Clause 7
Known gotchas
SAv5 only wraps 'critical' function codes such as control operations — routine polling/read requests are not authenticated, so SAv5 alone does not secure the entire session (pair it with transport-layer security for that)
Key management and rotation are out of band and not standardized by the protocol itself, making inconsistent key lifecycle handling a common integration gap between vendors
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?