Developing a wireless home security system based on STM32M0 µcontroller, I'm currently looking for the best way to manage encryption/authentication.
For information, the STM32M0 has an AES hardware acceleration module with main modes.
So , I looked first for AES-GCM as AEAD, but there's too much overhead: my data is about 16 bytes , maybe 4 of additional data, and there's 12 bytes IV, and 16 bytes Tag.
I want to avoid that IV / Nonce to reduce frame size.
So here's the intended scheme:
- Encrypt plaintext (that contains a UNIQUE 32bits counter for frames) using AES.
- Append additional data without encrypt it
- Use a MAC without IV/nonce (like CHASKEY, optimized for embedded)
This way I have to use 2 keys , one for AES and one for the MAC. I guess the second can be derivated from the first.
Is this scheme is secure enough for the purpose ?