3
$\begingroup$

I want to create a smart house project, and in that I bought some simple RF modules. Those modules don't support crypto out of the box but I want to connect them to a device that I would program to use crypto (for example AES).

Now the question is since I would be sending a lot of same messages (digital I/O Pins) encrypted with the same password the output encrypted message would be the same. So if someone is sniffing the traffic he/she would be able to transmit that encrypted message and my C&C (command and control) device would think that the message is coming from the inside and do certain actions depending on that message. 4 Way handshake doesn't cut it since even without the knowledge what the message is it can be broadcast to achieve certain results.

Question: What is the best practice/crypto to use in this situation? Should I add a random string appended to my original message and on the other side parse that message and just pull out the info that I need?

Keep in mind that devices on all ends all low computing devices with low memory (some kind of Arduino if you will). So, I need a safe cryptographic solution where – even if the user can sniff the data – the user wouldn't be able to use it.

$\endgroup$
  • $\begingroup$ Do you have two-way communication allowing a challenge-response protocol? Or a common variable reference (like a real-time clock assumed about correctly setup on both sides)? If not, do you have permanent re-writable memory (like EEPROM or battery-backed RAM, or a significant amount of Flash) on both sides? If not (or want to keep things simple), are you OK with being vulnerable to replay of former commands following a power-cycle of the controlled device? $\endgroup$ – fgrieu Jun 19 '15 at 5:16
  • $\begingroup$ Yes i have a two-way communication protocol (but a device can only be in listening or sending mode) There ARE NO common variables between devices. There is an EEPROM but less than 1k in size. And i want the most out of the situation so the best solution is the one that minimizes the open vulneraibilities. (That said replay attacks are a no-no in a smart house project) $\endgroup$ – daniels_pa Jun 24 '15 at 14:10
3
$\begingroup$

Among several aspects of the question, I'll cover only protection against replay of commands.

A common technique (among several) is to have commands tied to a nonce, that somewhat is accepted only once by the slave device receiving the command. The nonce is included in the input of a MAC or public-key signature algorithm that protects the integrity of the command.

When two-way communication is possible, a nonce can simply be a true random value wide-enough to most likely not repeat (say, 16-byte), generated by the slave device and sent to the master before it sends a command. The slave then receives the command, checks the MAC or signature included in the command (prepared on data including the nonce, as a prefix of the data in the actual command), and executes the command only if the MAC or signature checks. The slave then no longer accepts to execute another command until it has generated another nonce.

This is safe from the standpoint of pure replay. However an adversary may be content to defer execution of a command (rather than execute it a second time). Think of a garage door: an adversary waits for the home owner returning home and sending an open command; the adversary captures that command until the middle of the CRC at the end, and starting from that instant jams the radio channel. The command is ignored by the slave for wrong CRC, and does not get executed. Long after the attacker stops the jamming, then retransmits the command with recomputed CRC; abracadabra the door opens! Amazingly, some complex secure channel protocols put no time limit on how much an active adversary can delay a frame (perhaps inserting dummy requests for repetition to keep some link active), and are vulnerable to that attack. There's a simple countermeasure: we can put a time limit to the validity of a nonce, like seconds, enforced by the slave, counted from the sending of the nonce; and the nonce needs to be unpredictable (rather than only unique) to block some variants of the attack.

This is fine, but the nonce requires two extra frames (to the slave asking for the nonce; from the slave with the nonce). One option to reduce at least the number of overhead frames is to embed a fresh nonce in every frame sent, applicable to the next frame if received within delay; so that in a burst of commands, the overhead is two initial frames, plus the size of the nonces added to other frames. With great care, that later overhead can be eliminated using precise conventions on how the nonce evolves when there is authenticated activity.

Caution: the problem of making the nonce unpredictable, or even not repeating itself, is notoriously difficult if the adversary has access to the power supply of a slave device with no reliable TRNG (that was the situation in early Smart Cards). The solution of enciphering a counter held in EEPROM with a local secret key superficially seems to work (and even allow to use a nonce twice narrower with increased assurance against reuse); but there are the issues of making a counter that does not go backward on power loss during change; limited endurance of EEPROM to repeated writes to the same location; and the basic difficulty of keeping a secret key secret despite side-channels.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.