I am using ECDH key exchange protocol for establishing shared secret between Arduino Uno and Android device. For this purpose I am using this library and more specifically Curve25519. This is the confidentiality part of the secure communication I want to establish.

Now, before establishing shared secret between Arduino Uno and Android device, I want to have both ways authentication. It would be nice to have some sort of session IDs in order to be able to communicate with multiple Arduino Uno devices from single Android device.

What do you suggest? Please consider the memory size of Arduino Uno.

New contributor
PeMaCN is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Run a (KB)KDF over the output of DH, use one label for the session ID and another as base to generate a short display string to show the user so they can press a button at both ends to confirm the validity if both codes match? – SEJPM Nov 8 at 15:24

I am going to assume we're at the application layer here and you're implementing end-to-end (E2EE) encryption.

A public key infrastructure (PKI) could help solve the mutual authentication issue. Without more detail of the project, here is one way to accomplish this.

  1. Both Arduinos and Android share a trusted certificate authority (CA).
  2. Arduinos or Android create their own keys and send a certificate signing request (CSR) to the CA.
  3. CA signs the CSRs and returns them to their respective devices.
  4. Arduinos and Android can now mutually authenticate with each other during ECDH (or maybe even ECDHE).

Here, you're essentially mimicking how TLS provides authentication and confidentiality, but at the application layer. Session Ids can be created by using a secure hash function with your shared secret and some other data. That data will depend upon what you want your session ids to provide (constant ids, unique ids, etc).

Your Answer

PeMaCN is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.