2
$\begingroup$

I have a bunch of IoT devices which can do ECDH/ECDSA and AES. They all are connected to some server and know its public key. In turn, server knows each public key of the corresponding device. Devices do not know about each other, only their master-server and its public key.

What I want is to get rid of ECDH for most of the time and to let all the devices to securely know about some common key that can be used to broadcast messages using AES and which (optionally) could be switched to a new one after some time.

So, the naive idea is for devices to securely "ask" server for a new AES key and its expiration date every time they get online. Or re-ask if they get decryption error.

Does it sound sane? Or should I consider some other group key establishment protocol?

By securely "ask" I mean some proper way of communicating like noiseprotocol/TLS

|improve this question
$\endgroup$
  • $\begingroup$ If you are using TLS or similar to connect to the server, you'll use DH/ECDH in that anyway. So what is the advantage, or conversely, why don't you use TLS for all communications? $\endgroup$ – otus Aug 22 '16 at 15:21
  • $\begingroup$ If I need to broadcast a single message to 1000 devices, I'll need to either send 1000 messages or one huge encrypted message with all recipients included either of which is not god for IoT $\endgroup$ – John dow Aug 22 '16 at 15:35
  • $\begingroup$ So how is your idea better? I'm trying to understand why you would want to do what you are planning. $\endgroup$ – otus Aug 22 '16 at 16:45
  • $\begingroup$ I want to do tls/whatever only once when device starts and then disconnect from server and wait for commands. It will allow me to receive broadcast messages securely without need to establish a secure connection\handshake again $\endgroup$ – John dow Aug 22 '16 at 17:22
  • $\begingroup$ Can't you keep the TLS connection/session alive? $\endgroup$ – otus Aug 22 '16 at 17:26
1
$\begingroup$

This looks likely a classic server-multiple client scenarios, I had the similar situation: Depend on real application, some of my thought:

  1. For most case, IoT devices does not communicate to server at the same time? so server should be able to setup secure key for each of IoT devices through ECDH.
  2. To have a common key for all devices looks too dangerous, that means as soon as one IoT device is compromised, hacker will be able to hijack all IoT devices..
  3. It is only safe for each IoT device to use a common AES key--when you have physical access to them--for exp, in factory, in Lab, before shipment .. after it is been deployed to field, you must consider the different key for each device. Someone also burn a HW AES key into IoT device ROM, but still that have to be different for each of the IoT device, so one compromise does not jeopardize all devices.
  4. Given ECDH could be too heavy for a IoT devices (usually take few back-forth communication), my suggestion would be to consider once time ECDH when IoT device is been activated, and using Ephemeral ECDH (ECDHE) which does not request regenerated ECC keys.
|improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.