securitytechnician.wiki
Reference About 8 min read

Protocol security comparison

Compare transport protection, peer identity, permissions, replay handling and key management separately. Check the supported configuration for the specific product.

Sources and scopeSource record 25 August 2026

Technical source record: 25 August 2026. Check the linked documentation for current product requirements.

Protocol family summary only; exact algorithms, editions, profiles, product implementations, certificates, keys, authorisation, fallback, and end to end boundaries require primary specifications and deployment evidence.

Verification and testing

On this page

Overview#

This table isn't a security certification or product claim. “Can provide” means a named standard/profile defines the property when correctly selected, implemented, provisioned, and validated. It doesn't mean a product supports or enables it.

Comparison dimensions#

Dimension Evidence required
Confidentiality Exact protected bytes/hops, algorithm/profile, key ownership, termination points
Peer authentication Server/client/device/user identities and validation rules
Integrity and freshness Authenticated data, replay window/counter/sequence, restart/rollback handling
Authorisation Which identity may read, subscribe, configure, or actuate which resource
Downgrade resistance Whether cleartext/legacy fallback exists and how it is prohibited/detected
Lifecycle Enrollment, rotation, revocation, replacement, backup, expiry, recovery, audit
Residual boundary Plain downstream bus/media, gateway cache, export, logs, physical completion

Family level summary#

Protocol/family Base or legacy posture Protected option or required security Principal residual risk Canonical page
HTTP/REST HTTP alone is cleartext; application auth varies HTTPS with validated TLS; OAuth/mTLS/message signatures as profiled TLS does not make methods safe, authorise objects, or stop SSRF/parser faults HTTP and REST
SOAP/XML SOAP/XML has no inherent channel protection HTTPS; WS Security/XML Signature only under a tightly specified profile XML parser/entity/signature wrapping risk; intermediaries and signed part ambiguity SOAP and XML
WebSocket ws is cleartext and upgrade inherits HTTP auth context wss with TLS plus origin/session/resource authorisation Long lived revocation, reauthentication, message bounds, and connection hijack WebSocket, SSE, and webhooks
SSE / webhooks Inherits HTTP; callback authenticity is application defined HTTPS plus scoped auth; signed webhooks with replay policy where specified Callback SSRF, secret rotation, retries/duplicates, receiver durability WebSocket, SSE, and webhooks
MQTT Protocol can run without protected transport; broker auth/ACLs are deployment choices TLS/mTLS and per client topic/action authorisation Wildcards, retained/Will state, shared identities, bridges, queue exhaustion MQTT
AMQP 1.0 SASL/TLS and authorisation are selected by the deployment; settlement is not security TLS/mTLS, appropriate SASL mechanism, virtual host/node/link permissions Anonymous/weak SASL, cross tenant link authorisation, settlement mistaken for physical completion AMQP 1.0
CoAP / LwM2M Plain CoAP has no universal application security; bootstrap/profile choices vary DTLS/TLS or OSCORE, including Group OSCORE only under an explicit group security design Proxy termination, replay/context loss, unsafe bootstrap, observation amplification, ACK mistaken for outcome CoAP, OSCORE, and LwM2M
CAP / EDXL XML formats do not authenticate an alert issuer by themselves Authenticated transport and/or an explicitly profiled XML signature plus issuer/feed authorisation Signature wrapping/canonicalization, stale update/cancel chains, wrong geography/audience, delivery mistaken for activation CAP and EDXL
gRPC Security comes from its HTTP/2/transport and application profile TLS/mTLS plus per RPC/resource authorisation and bounded metadata Reflection/admin exposure, retrying mutations, streaming revocation, schema/resource exhaustion gRPC and serialisation
ONVIF Services span HTTP/SOAP, WS Discovery, events, RTSP/RTP; deployments vary TLS/device/user security capabilities, protected service endpoints, SRTP where profiled/supported Discovery is unauthenticated; profile registration does not prove site configuration; media may remain plain ONVIF
GB/T 28181 Base SIP/XML/RTP deployments require an explicit security profile and national requirement mapping Applicable GB 35114 mechanisms plus authenticated signalling/transport and platform authorisation Domain/account impersonation, catalogue leakage, weak media protection, security standard edition mismatch GB/T 28181
RTSP / RTP / RTCP Plain control/media lacks modern confidentiality; RTP sequence is not anti replay security RTSP over TLS where supported; SRTP/SRTCP with authenticated key management SDP/address injection, weak URL credentials, multicast joinability, key management mismatch RTSP, RTP, RTCP, and SDP
SIP Hop by hop signaling commonly appears in legacy/plain forms SIP over TLS/SIPS routing; current Digest/identity profiles; SRTP for media TLS signaling does not protect media; DTMF/door actions need separate authorisation SIP and SRTP
WebRTC Security architecture requires protected media/keying in conforming WebRTC DTLS SRTP/SRTP, ICE credentials, HTTPS/WSS signaling under application control Signaling service can misauthorize; TURN/SFU may observe metadata/media by design WebRTC
SRT / RIST Contribution recovery profiles do not supply application/user authorisation or evidence policy SRT encryption/passphrase handling or RIST security profile as explicitly supported, plus endpoint/network identity Shared/static secrets, unauthenticated endpoint selection, resource exhaustion, confusing contribution protection with content entitlement SRT and RIST
OSDP CRC/checksum mode is not cryptographic protection OSDP Secure Channel with unique managed keys Install mode/default key misuse, cleartext fallback, insecure credential before/after link OSDP
Wiegand / Clock and Data No native confidentiality, mutual authentication, or replay protection Replacement by protected reader controller transport; compensating physical controls during migration Static identifiers, easy observation/injection, no supervision, converters preserve weak hop Legacy reader interfaces
Contactless/smart card UID or public memory is not authentication; security is application/profile specific Challenge response, secure messaging, shared key or public key applications Default/shared keys, relay, downgrade to UID, reader controller loss of assurance Contactless and smart card standards
BACnet/IP classic Does not provide modern per message peer authentication/confidentiality for every exchange BACnet/SC uses WebSocket/TLS and PKI for a secure data link Object/property/priority authorisation; legacy MS/TP remains plain behind a router BACnet/SC
Modbus RTU/TCP classic CRC/MBAP transaction ID are not security; no native authorisation/confidentiality Modbus Security uses mutual TLS, X.509 identities, and certificate role information Product specific authorisation, unsafe register writes, cleartext gateway downstream Modbus Security
OPC UA Security modes/policies are explicitly selectable, including insecure choices SecureChannel, application certificates, Sessions, user tokens, roles/access controls Auto trust, None, obsolete policy, namespace/semantic mistakes, method/write consequence OPC UA
IEC 60870-5-101/-104 Base telecontrol profiles were not designed with modern end to end identity/confidentiality Applicable IEC 62351-5 mechanisms, protected conduits, strict station/ASDU allowlists, and operational authorisation Legacy endpoint support, gateway security termination, replay/time/quality ambiguity, high impact commands IEC 60870-5-101 and -104
IEC 61850 MMS, GOOSE, SV, and engineering workflows have different threat and timing models Applicable IEC 62351 parts, certificates/roles, message security, and protected engineering lifecycle Protection latency/availability trade offs, SCL tampering, multicast trust, control/protection coupling IEC 61850
Matter Commissioning, fabrics, operational certificates, and ACLs provide ecosystem security primitives Device attestation during commissioning, fabric operational credentials, ACLs, secure sessions, lifecycle removal Attestation is not authorisation; stale fabrics/controllers, bridge trust, cloud/ecosystem account compromise Matter
KNX classic Plain telegrams do not provide modern cryptographic protection KNX IP Secure for IP paths; KNX Data Secure for selected group/object data Mixed secure/plain configuration, keyring exposure, gateway termination, sequence recovery KNX Secure
SNMP v1/v2c community model is weak and generally unencrypted SNMPv3 USM authPriv, or applicable secure transport model Shared engine state/keys, overly broad views, SET permission, trap authenticity Monitoring and administration
Syslog UDP/TCP forms may be unauthenticated and cleartext Syslog over TLS with validated identities Hop protection is not durable storage integrity; loss/framing/backpressure remains Monitoring and administration
NTP Plain NTP can be spoofed/manipulated on reachable paths Network Time Security (NTS) for supported NTP deployments Authenticated source may still be wrong; endpoint clock/holdover/step policy matters Time synchronisation
Alarm formats DC03/DC05/DC07 Historical formats do not provide a complete modern cryptographic security model Protected conduit/gateway and strict source/account binding; use a modern supported reporting profile A syntactically valid event is not dispatch authorisation; downstream routes are high impact Alarm monitoring
SIA DC09 Edition/configuration dependent; older deployments may use weak/long lived material Exact edition's encryption/authentication/key management options; 2026 adds key rotation capability Account authorisation, duplicate/replay handling, monitoring policy, product interoperability SIA DC09
SAML / OIDC Assertions/tokens are bearer like security objects whose validation profile is application specific Signed assertions/tokens over HTTPS; strict issuer, audience, recipient/redirect, nonce/state/PKCE, key lifecycle XML signature wrapping, token substitution, confused deputy, broad role mapping, stale sessions Enterprise federation
SCIM HTTPS API protection and OAuth scope are deployment choices TLS plus narrowly scoped client identity, resource/attribute authorisation, reconciliation, and audit Overbroad provisioning, tenant crossing, mutable identifiers, async acceptance mistaken for downstream completion SCIM provisioning
WebAuthn / FIDO Public key authentication is scoped to the relying party origin and credential policy WebAuthn ceremony validation, authenticator policy, secure origin, challenge/freshness, recovery controls Account recovery downgrade, sync/account boundary, attestation overclaim, login mistaken for PACS authorisation WebAuthn, FIDO, and passkeys

Security terminators are architectural components#

A gateway, reverse proxy, recorder, broker, hub, router, or cloud service that decrypts and re emits data creates a new boundary. Record:

  • identity and trust before and after termination;
  • plaintext exposure in memory, disk, queues, logs, backups, and diagnostics;
  • authorisation translation and any loss of source identity;
  • schema/semantic translation and unknown field handling;
  • key and certificate custody;
  • outage, failover, replay, retry, and duplicate behaviour;
  • whether a secure upstream link becomes a legacy cleartext field link.

End to end should name endpoints and bytes. “Encrypted in transit” without that boundary isn't actionable evidence.

Common false equivalences#

Claim Why it is unsafe
“It is on 443, therefore secure.” Port 443 does not prove TLS validation, expected application, or authorisation
“The VLAN is trusted.” Segmentation limits reachability; it does not authenticate endpoints or constrain authorised insiders
“The CRC passed.” CRC detects accidental corruption, not deliberate forgery
“The certificate is valid.” A valid chain may still identify the wrong endpoint, role, site, or compromised key
“The user logged in.” Authentication does not grant every resource/action or prove current session intent
“The command returned success.” Transport/application acceptance is not physical completion
“The profile is certified.” Certification must match exact product/firmware/role and does not verify deployment configuration
“Media is encrypted.” Signaling, metadata, recording, exports, or an SFU/gateway may remain exposed

Selection checklist#

  • Exact protocol edition, security addon/profile, and product role pinned
  • Plain/legacy fallback prohibited or explicitly isolated and monitored
  • Server, client/device, service, user, and credential identities modeled separately
  • Least privilege defined for observe, subscribe, configure, and actuate actions
  • Key/certificate bootstrap, rotation, revocation, replacement, backup, and recovery owned
  • Replay/sequence/counter behaviour across reboot and restore documented
  • Every security termination and cleartext downstream segment diagrammed
  • Parser, connection, rate, queue, and decompression limits included
  • Successful request never substituted for authoritative physical state confirmation
  • Product claims and configuration require exact owner approved evidence rather than inference from this comparison

Sources#

Section overview · Wiki home

View MarkdownSuggest an editBack to top ↑