1
$\begingroup$

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles data but does not send anything back.

The plaintext data part of the QR code needs to be encrypted and should not be changed, nor intercepted, so I made the following protocol:

  • The IoT device generates a new EC keypair at every boot;
  • The server has a permanent EC keypair. The server public key is stored in the firmware of the IoT device;
  • When creating a QR-code, the IoT device calculates a DH agreement with the server's public key and the private key of the IoT device;
  • The IoT device creates an IV from an incremented nonce (8 bytes array);
  • The data gets encrypted using chacha20 with the calculated agreement;

The QR code is then generated using the following format: (IoT public key) + (iv) + (ciphertext).

The server is then able to decrypt the ciphertext by using the IoT public key, which can be used for calculating the agreement and the IV for decrypting the ciphertext.

Now I have several concerns since I am new to crypto and I am almost sure that my protocol is not safe enough.

  • Is it safe to embed and send the IV in plain text in every QR-code?
  • When using the same nonce, decryption will still work, what is the purpose or misuse of the nonce here?
  • Should I use chacha20 at all? Or is there a much better encryption/decryption method to use here?
  • I need to keep my server's public key secret and only in the firmware of the IoT device, to prevent 'fake devices' generating valid but fake QR codes, which sounds bad.
| improve this question | |
$\endgroup$
  • $\begingroup$ Your protocol is not clear. You say that this is an off-line device.. and then it starts to communicate. $\endgroup$ – kelalaka Feb 5 '19 at 14:48
  • $\begingroup$ "This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server.", a mobile phone passes the public key, IV and encrypted data from the IoT device to the server. $\endgroup$ – Giovanni Feb 5 '19 at 14:51
3
$\begingroup$
  • Is it safe to send the IV in plain text in every QR code request?

IV is not secret and never meant to be, it can be sent as it is. See the CBC mode from the Wikipedia.

  • When using the same nonce, decryption will still work, what is the purpose or misuse of the nonce here?

Nonce (in Cryptography) means number used once. The IV in the CBC mode cannot be nonce. The aim of IV is randomizing the encryptions. Using the same IV again turns the CBC mode into the ECB mode. This has catastrophic results, see the penguin from Wikipedia in or look at frequency attack.

For the difference of IV and Nonce please see Difference between a nonce and IV

  • Should I use chacha20 at all? Or is there a much more better encryption/decryption method to use here?

You need authenticated encryption which simultaneously give authenticity and integrity. You may choose ChaCha20Poly1305 or AES-GCM.

  • I need to keep my server's public key secret and only in the firmware of the IoT device, to prevent 'fake devices' generating valid but fake QR codes, which sounds bad.

Public keys are not created to be kept secret. The more important is the ID of the IoT that should be sent during the data transmission so that the server can accept the result. Therefore the server must store the ID's beforehand. In the current design, the server is going to accept any message.

Note: You will also need to authenticate the mobile device, otherwise any mobile device can be used to attack.

Note 2: IV should not be predictable.

Note 3: You don't need to generate if from a nonce. A good random source should be enough. See Best way to generate a IV for AES-CBC when encrypting files?

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ Thanks a lot for you good answer. It's more clear for me now! $\endgroup$ – Giovanni Feb 5 '19 at 15:31
  • $\begingroup$ One more question, if I forget about the IV, is it safe to send the nonce in plaintext instead? $\endgroup$ – Giovanni Feb 5 '19 at 15:35
  • $\begingroup$ Okay thank you. Then I just misunderstood names. Instead of an IV, I will send the plaintext nonce instead. $\endgroup$ – Giovanni Feb 5 '19 at 15:45
  • 1
    $\begingroup$ You generate the IV and prepend it to the ciphertext and send it. The server extracts the IV form ciphertext and uses it. There is no problem sending the IV as it is. $\endgroup$ – kelalaka Feb 5 '19 at 15:58
  • 2
    $\begingroup$ IV for CBC needs to be unpredictable. nonce/IV for GCM or ChaCha (with or without Poly added) only needs to be unique, and a counter is fine -- as long as there is no attack to reset the counter while keeping the key. $\endgroup$ – dave_thompson_085 Feb 6 '19 at 3:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.