Im very new to security and trying to learn how to establish a secure connection between a android application and a Bluetooth Low Energy device with limited hardware performance.
- Generate private/public keys with ECDH Key Pair Generator and elliptic curve spec "sect163k1" using
- Send public key to BLE Device
- Generate secret master key from apps private key and the public key from the BLE Device using ECDH (https://docs.oracle.com/javase/7/docs/api/javax/crypto/KeyAgreement.html#generateSecret())
- Store secret master key in database. (never shared)
- Encrypt data with secret key using AES/CBC with integrity (using https://github.com/tozny/java-aes-crypto)
- Send data to BLE Device to be decrypted with the device secret master key
- Generate private/public keys with ECDH Key Pair Generator and elliptic curve spec "sect163k1" (or another curve)
- Send public key to App
- Generate secret master key from apps public key and BLE Device private key using ECDH
- Store secret master key in device (never shared)
- Encrypt data with something like EAS/CBC with integrity
- Send data over to app to be decrypted with apps secret master key
Would this keep the communication between both parts safe? Second time the connection is established the same shared secret could be used to encrypt the data, in order to improve performance. Its a 1:1 relationship between the device and the logged in account in the app so I could also use the shared secret to verify the right user is connecting to the BLE device.