Integrating Elliptic Curve Cryptography with the Modbus TCP SCADA Communication Protocol
Round 1
Reviewer 1 Report
In the introduction section please mention, motivation, contribution and the benefits of your research in bullets.
2) In introduction section please draw a diagram and explain the concept of “Elliptic curve cryptography”.
3) In related work, please add more recent studies and make a compassion table. You can compare most recent studies along with advantages and disadvantages.
4) Please improve the quality of figures in your manuscript.
5) Please mention simulation environment and tool that you have used in this paper.
6) In conclusion section please mention future work of your study.
Author Response
The authors would like to express their gratitude to the anonymous reviewer, whose comments contributed towards a significant enhancement of the quality of the paper. In what follows, we have included all the comments provided by the reviewers along with our reactions.
Comments and Suggestions for Authors
1) In the introduction section please mention, motivation, contribution and the benefits of your research in bullets.
We have enhanced the introduction, following the reviewer’s valid point, with the information shown in bullets from page 2 to page 3, including several clarification statements in the text.
2) In introduction section please draw a diagram and explain the concept of “Elliptic curve cryptography”.
It is difficult to describe in an introductory section a complex algebraic structure such as an Elliptic Curve. However, we have devoted a whole section (Section 3) on the definition of Elliptic Curves and an explanation of why they are more efficient, for similar security levels, than the conventional cryptosystems. In the new version of the paper Section 3 is enhanced so as to reflect, better, the concept of an Elliptic Curve and how it differs from conventional cryptosystems.
3) In related work, please add more recent studies and make a compassion table. You can compare most recent studies along with advantages and disadvantages.
To the best of our knowledge, our approach is the first that actually develops cryptographic enhancements for the Modbus library based on Elliptic Curves not only for serves bad IIoT devices (Industrial Internet of Things). After extensive search, we located an implementation of Modbus with the TMP 2.0 that studied the man-in-the-middle problem in SCADA (Tidrea, A., Korodi A., and Silea, I. Cryptographic Considerations for Automation and SCADA Systems Using Trusted Platform Modules. MDPI Sensors 2019, 19, 4191; doi:10.3390/s19194191). However, this is not closely related to our work. We, nevertheless, included this citation with a description of how our approach differs in Section 2 (Related work).
4) Please improve the quality of figures in your manuscript.
The quality of the figures has been improved.
5) Please mention simulation environment and tool that you have used in this paper.
Please see Section 5, especially the Section 5.1 in which we describe the simulation environment in detail
6) In conclusion section please mention future work of your study.
We have included our most immediate future work goals in the final paragraph of (Section 6).
Reviewer 2 Report
The paper is interesting and timely.
It's not clearly described in Section 5 experiment and evaluation of the proposed solution. The evaluation must be enhanced.
Was performance analysis performed? How many transmissions were analyzed? What were the parameters of transmissions?
It would be beneficial to add other test results, e.g. evaluation of the performance of the proposed solution, and analysis of the system load during the transmission.
There are some typos and editing errors in the article.
Author Response
The authors would like to express their gratitude to the anonymous reviewer, whose comments contributed towards a significant enhancement of the quality of the paper. In what follows, we have included all the comments provided by the reviewers along with our reactions.
Comments and Suggestions for Authors
1) The paper is interesting and timely.
We thank the reviewer for her/his positive opinion towards our work.
2) It's not clearly described in Section 5 experiment and evaluation of the proposed solution. The evaluation must be enhanced.
Please see the enhanced version of Section 5.
3) Was performance analysis performed? How many transmissions were analyzed? What were the parameters of transmissions?
Please see the new Section 5.2 for all these details.
4) There are some typos and editing errors in the article.
We edited the paper and corrected the errors.
Reviewer 3 Report
The following are comments on the paper:
1. What is the full text of SCADA? The full text should be displayed when it first appears.
2. In the Related Work section, what are the full names of TLS, RSA, AES, and PKI? Display the full names at the first occurrence in the paper.
3. Elliptic Curve is often used in cryptography. What is the special feature of this paper? Please explain in detail.
4. Please explain why t of Definition 2 is not equal to 0.
5. What is the reason for CCONV(N) = CCE(n)?
6. In Figure 3, the Modbus Client application and Modbus Server application is the application layer. The difference shown in the figure should describe the difference? Where are the similarities?
Author Response
The authors would like to express their gratitude to the anonymous reviewer, whose comments contributed towards a significant enhancement of the quality of the paper. In what follows, we have included all the comments provided by the reviewers along with our reactions.
Comments and Suggestions for Authors
The following are comments on the paper:
- What is the full text of SCADA? The full text should be displayed when it first appears.
We have added the full text for all abbreviations, in their first appearance, except in the abstract because of the imposed word limitations.
- In the Related Work section, what are the full names of TLS, RSA, AES, and PKI? Display the full names at the first occurrence in the paper.
We have added the full text for all abbreviations, in their first appearance, except in the abstract because of the imposed word limitations.
- Elliptic Curve is often used in cryptography. What is the special feature of this paper? Please explain in detail.
In order to address this valid point of the reviewer, we have enhanced the introduction section by including our contributions in more detail in the bulleted items from page 2 to page 3.
- Please explain why t of Definition 2 is not equal to 0.
The reviewer is right in her/his remark. The value of t can be 0. We included the equality sign so as to have the most general definition. We thought of excluding 0 just to avoid degenerate cases and trivial solutions of the discrete logarithm problem when one of the points P or/and Q are the 0 points. However, the reviewer was right, and we have, accordingly, incorporated her/his comment in the definition.
- What is the reason for CCONV(N) = CCE(n)?
We use this equation in order to deduce the key sizes, i.e. values of N, for which a conventional cryptosystem attains the same level of security as an Elliptic Curve based one with key sizes given by the values of n, Please see the improved explanations provided in Section 3 of the new version of the manuscript.
- In Figure 3, the Modbus Client application and Modbus Server application is the application layer. The difference shown in the figure should describe the difference? Where are the similarities?
We have stressed the fact in the test before Figure 3 that the “white” parts of the Modbus architecture were unchanged in order to attain full compatibility with existing Modbus installations. Thus, we have not modified the client/server layers so that our modified libraries can replace, readily, any existing Modbus application.
Round 2
Reviewer 2 Report
I think that the authors addressed all my comments. This has resulted in an improved version of the paper. I think that this version of the paper should be accepted.
