I have an IoT device that I have set up to communicate with AES-256-GCM encryption. The working version has the encryption key stored in plaintext in a file on the device (this is going to be improved). Every time it is communicated with, a new key is included inside the encrypted message and the device updates its key to match it ready for the next message.

I would like to prevent someone from being able to communicate with a device, even if they have accessed everything on it.


I am thinking of setting up a (what, salt? hash?) which is sent to the device with each encrypted communication, which it adds/multiplies/hashes with something it has stored to create the password it can use to decrypt the communication. What should I look into to do this properly?

Good or bad idea?

I know it's highly discouraged to 'roll your own' when it comes to crypto, so I want to know whether taking this step would be considered well- or ill-advised.

Thank you.

  • $\begingroup$ What attacker can read all the data off your node without also changing the software on the node to plant malware? $\endgroup$ Nov 3, 2017 at 3:34
  • $\begingroup$ @SqueamishOssifrage We're looking into hashing files/folders so we can detect such changes. I agree what I'm asking about here isn't a 'perfect' solution, but it's trying to eliminate the specific vector of physical read-only access + subsequent remote direction. $\endgroup$
    – sscirrus
    Nov 3, 2017 at 4:30
  • $\begingroup$ Maybe you should write down a clearer statement of what your security model is—not just for reference by a crypto.se questions, but as a design document for yourself so that you don't spend time piling crypto into your application like a dump truck when you've left the key in the ignition. $\endgroup$ Nov 3, 2017 at 16:18

2 Answers 2


This sounds like a job for…public-key signature!

Store a public key on the node, and reject any incoming message if it does not have a valid signature under that public key.

If you're concerned about performance, verification under RSA with $e = 3$, or Rabin–Williams, is very fast.


I'd use the PKI signature as answered by Squeamish Ossifrage, however I'd just give you another view and options.

I would like to prevent someone from being able to communicate with a device, even if they have accessed everything on it.

there were a few question like that and .. if the adversary has all access on anything (even write access), you cannot do much about it. So you have to limit your assumptions on adversary's capabilities. Lets assume an attacker has read only access and you want to prevent processing unauthorized messages.

For that I'd suggest to follow the previous answer and sign every message (with a nonce and timestamp to prevent replay attacks). Indeed the public key can be the answer.

password it can use to decrypt the communication

you should answer yourself if you need integrity only (if it is ok for attacker to read messages) or you need confidentiality (encryption).

If you want to encrypt/decrypt messages, you need to consider if you have power to do so. For reasonable single board computers (RaspberryPi, Beaglebone, ..) all will work nicely, but for small microcontrollers (such as Arduino) PKI operations may take some time.

What should I look into to do this properly?

As a full solution - you could use TLS (SSL) to ensure integrity and confidentiality if you have power for it.

If you're using microcontrollers (or you're unable to do full SSL) and verifying PKI signature for each message would take long time, you could use a key exchange protocol (e.g. Diffie-Hellman key agreement) to derive a new session key. The derived session key can be used for symmetric (AES-256-GCM) encryption.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.