I need to establish some security on a network of 8 bit microcontrollers. very limited RAM, CPU and packet sizes.
I have zeroed in on a shared secret based scheme. Setting up shared secret is out of scope. Encryption is AES128.
To securely create and share an encryption key between two nodes, A and B, I cooked up this:
A creates an encryption key Ks = H(Ns, R0) A sends R0 to B B calculates key K's = H(Ns, R0)
K's and Ks will be same if and only if B has Ns
Where H = Hash(R0|Ns|R0), or Hash(R0|Ns|H(Ns)) or maybe HMAC (still undecided) R0 = random number Ns = Shared network secret. Ns is 16 byte. R0 is 4 byte. Both come directly from a RNG.
Primary Objectives are: Tamper proofing, Forward secrecy.
Not concerned about resistance to Side channel or replay attacks for now.
R0 (and hence Ks) will be updated periodically, perhaps every 100-10K independent packet transfers.
Is the scheme ok? Do the Ns or R0 need to be increased in size? Most importantly, will this scheme be able to keep Ns safe, and for how long?
Reg Forward secrecy:
I wanted to ensure that as long as network secret is safe, if a future session key (Ks) is compromised, past session keys and data should not also be compromised. Also, a renegotiation of session key should re-establish security.
That may not be exact definition of forward secrecy, but that's what I meant. I don't have sessions but I will expire keys periodically and after time or some count of packets is crossed etc, and call that a session.
Based on answers, I have added AES(k=Ns, d=R0) to list of functions for H(). Will decide based on time/clock requirements.
For now, based on the answers, I infer that all current options for H() will create good enough keys that will protect both encrypted data and Network Secret Ns.
If you are reading this text and feel that any of them might not be safe, please leave a comment or answer. Thanks.