Let's say we have:
client_id_ran: 256 bit random text (chosen only once for whole system) used to generate
client_idby incrementing 1 for each client.
challenge_ran: 256 bit random text (chosen only once for whole system) used to generate
challenge_plain_textby incrementing 1 for subsequent authentication requests.
challenge_plain_text: generated from
challenge_ranas specified above.
client_id: generated from
client_id_ranas specified above.
server_secrect_key: random 256 bit text
client_secrect_key: pre-shared / configured at industry to
client request for
Server response with the
client decrypts the massage by
client encrypts the
client_secrect_keyand send back to the server. i.e,
AES256(ENCRYPT, client_secrect_key, challenge_plain_text_increamented_by_one);
server decrypts the
if(decrypted_challenge_plain_text_increamented_by_one == challenge_plain_text_increamented_by_one && response_time<=4000ms), client authenticated else connection closed.
AES_ECB mode is used for encryption & decryption of 256bit texts. Hence
challenge_plain_text_increamented_by_one should be achieved by incrementing each 128bit part of 256bit text by one.
The proposed plan is for authenticating IoT devices where we can save the
client_secrect_key to the device before delivering to the customer.