I have a microcontroller based device that is controlled by a smartphone app. To make the communication between the two secure, I'm encrypting the communication between the two using AES. However, this means that both devices need to know the private key to decrypt the exchanged messages. A single instance of the app (on a single smartphone) can communicate with multiple devices.
If I were to have the same key for all devices and hardcode that key in the app it would work, however, if for some reason if the key is compromised then all the devices are open to misuse and MITM attacks as well. I'm hoping someone experienced here can help me figure out how each device can have its own unique key and how the app should handle this. Any help would be appreciated. Thanks!