Gurux DLMS Java – Decryption fails when system title is missing

By marco.simone, 22 September, 2025
Forums
Gurux.DLMS

Hi everyone,
I’m working with the Gurux DLMS Java libraries and I’ve run into an issue.
When the meter sends an encrypted frame without including the system title, I can’t decode it — the decryption fails.

Has anyone faced this situation? Is there a way to handle frames where the system title is missing?

Thanks in advance for any suggestions.

Kurumi

2 months 2 weeks ago

Hi,

If the meter does not send the system title, then the client must set it before decrypting the data. Italy Standard UNI/TS 11291-11-2 works like this and all the meters must use the same client system title. You can read it from the security setup object.

https://www.gurux.fi/Gurux.DLMS.Objects.GXDLMSSecuritySetup

It's not possible to decrypt the data without the correct system title.

BR,
Mikko

marco.simone

2 months 2 weeks ago

Hi Kurumi,
thanks for your reply.

I still have the same issue.

SEVERE: Invalid sender system title.
ERROR getData: Service not allowed. Ciphering failed

Here’s my code:

GXDLMSSecureClient client = new GXDLMSSecureClient(
        true,                    // LN referencing
        16,                      // client address (example)
        1,                       // server address (example)
        Authentication.HIGH_GMAC,
        null,
        InterfaceType.WRAPPER
);

GXCiphering cipher = client.getCiphering();
cipher.setSecurity(Security.AUTHENTICATION_ENCRYPTION);

cipher.setBlockCipherKey(hexToBytes(KEY_HEX));
cipher.setAuthenticationKey(hexToBytes(KEY_HEX));

cipher.setSystemTitle(hexToBytes(effectiveSystemTitle));

if (invocationCounter != null) {
    cipher.setInvocationCounter(invocationCounter);
}

What am I doing wrong?

Kurumi

2 months 1 week ago

Hi,

You have set the client system title. The server system title is set when the communication with the meter starts, and the meter sends AARE message.

You must set the meter system title if you are using pre-established connections where AARQ/AARE is not sent. You can do it like this:

client.setServerSystemTitle(METER SYSTEM TITLE);

BR,
Mikko