I am building my own MQTT based network for which I would generate my own ca/server/client certificates for authentication.
The goal here is to keep the message sizes as small as possible so as to reduce the bandwidth traffic, but I already know that the TLS layer adds quite an overhead to the traffic it sends. Namely, with the client certificates, I would actually have to send the client certificate to the server and vice versa on each TCP connection attempt which can add up to 8kb without even sending one byte of real data. (I hope I got that part right so far)
Also, since a lot of my clients are small embedded devices which only have a limited number of ciphersuites they can use the matter is complicated even more.
For example this is the allowed list of ciphersuites a client can use:
Now in this example the only ciphersuites available are PSK and RSA based ones. Of course I would love to use the EC ciphersuites but I don't think this is an option for me given the list.
Now a couple of questions I have are:
Given the ciphersuite list can any of the private keys (CA, Server or Client) be EC based or do they all have to be RSA?
Should I also keep individual MQTT packages that are wrapped with TLS as small as possible or is this something which will be padded with additional bytes? (e.g. will it make a difference if my package is as small as 5 bytes or can I freely write a package that is 25 bytes long)
What are some other things I should keep in mind if I want to reduce the traffic bandwidth?
ECDHE-RSA ciphersuites are giving me a headache. They are using EC for key exchange but RSA for PKI ? Does this mean that a server can have EC private key.