I have a microcontroller based device that is controlled by a smartphone app. To make the communication between the two secure, I'm encrypting the communication between the two using AES. However, this means that both devices need to know the private key to decrypt the exchanged messages. A single instance of the app (on a single smartphone) can communicate with multiple devices.

If I were to have the same key for all devices and hardcode that key in the app it would work, however, if for some reason if the key is compromised then all the devices are open to misuse and MITM attacks as well. I'm hoping someone experienced here can help me figure out how each device can have its own unique key and how the app should handle this. Any help would be appreciated. Thanks!


It seems you are mistaking the block cipher AES to be a secure transport protocol.

To provide transport security a secure transport protocol is required. In those protocols the session keys are usually distributed using either encryption with the help of a (trusted) asymmetric key pair or by a key agreement primitives. Together with symmetric message encryption this makes up a hybrid cryptosystem.

For embedded devices usually ECDSA and ephemeral ECDH are used as underlying primtives. Note that in general transport security also requires message authentication.

If you are just looking for a method of securely sharing symmetric keys then you can secure one master key at the server and distribute derived keys to the clients. The master can always perform KDF(master_key, client_id) to derive the keys again. HKDF is probably the best known key based KDF right now.

I'd recommend a careful study of TLS and DTLS before proceeding.

  • 2
    $\begingroup$ ... or just using TLS or DTLS outright with your preferred parameters. $\endgroup$ – SEJPM Aug 21 '16 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.