I am building kinda simple IoT project, but I would like to implement good security (just for educational purposes and fun). My plan is to build simple solution where one arduino board reads some data (lets say temperature), it sends data to mqtt broker on rapsberry pi and second arduino board subscribed to this broker can do something with temperature data recieved.

As I found out, best solution here is to communicate over TLS, but as you may know those devices are realy resource constrained, so I am not able to use that. I was able to implement AES payload encryption with HMAC to check message integrity, but now I am kinda stuck. My solution works only with same key for every device stored in its flash memory.There must be better way to do that, right?

I know about ECDH protocol, but I am able to use it only when two devices communicate directly, not via mqtt broker and not for more than two devices.

Thank you for every idea!

  • $\begingroup$ This sounds like a job for BearSSL, have you investigated it yet? From the web page: ... a minimal server implementation may fit in about 20 kilobytes of compiled code and 25 kilobytes of RAM.. What resource constraints do you have? $\endgroup$ – Ella Rose Jul 15 '18 at 21:48
  • $\begingroup$ Thank you for response! I have arduino uno + ESP8266 for communication, I think I could offload TLS functionality to ESP. $\endgroup$ – user219863 Jul 16 '18 at 6:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.