Advantages of a TLS handshake over pre-shared public keys

Question

Lets assume the following setup:

A vendor manufactures IoT devices where each is able to generate an individual private/public key-pair. Only the public key is exposed, the private key is assumed to be secured inside the device. A database of those public keys is provided by the vendor and is transfered to each client out-of-band.

For each connection to a device the client:

1. gets the ID of the target device
2. looks up the public key
3. encryptes a new symmetric key (e.g. AES) with the public key
4. transfers it, the AES-encrypted data and an AES-encrypted MAC
5. (further bidirectional data transfers)

Only the selected device can decrypt the symmetric key and thus the rest of the data. Data integrity is verifyed by the MAC.

An attack can happen anytime after the devices were deployed in the field, but please focus on the protocol. Physical side channal attacks or other modifications of the devices themselves should not be considered. The vendor is trusted. Client authentication is not needed.

Question

What are the advantages of a TLS handshake compared to pre-shared public keys?
The simple public key database would be replaced with certificates signed by the vendor to authenticate the devices.

Perfect forward secrecy would be an advantage, other extra features of TLS (like cipher suite selection or session resumption) are not needed.

Answer 1

What are the advantages of a TLS handshake compared to pre-shared public keys?

Actually TLS supports raw public keys, so you could actually do what you just described with TLS. Now what it would gain you, for starters, is the fact that you get a protocol which has seen a lot of analysis, which has security reductions, which has some very good implementations and for which you can somewhat easily / more cheaply buy good security review / consultation on the concrete implementation.

transfers it, the AES-encrypted data and an AES-encrypted MAC

For example, TLS doesn't do this (in the handshake), because this is known as MAC-then-Encrypt, which is highly discouraged and has lead to attacks on sloppy implementations in the past. Also TLS has eg measures to prevent replay attacks, ie an attacker just sending your device the same handshake and the same record data again as in a previous session.

Beyond that you don't have to use the full flexibility of TLS. You can just turn off and strip away the code for anything but TLS 1.2 and eg ECDHE with RSA and GCM. This will also have the benefit that you can just use a known-good library and don't have to roll your own protocol and thus save dev-time, nerves and benefit from standardization.