Protocol Design for IoT devices having PSK using AES-GCM

Question

Handshake:

1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv"

2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag

---

Client_key_256bit = Client_random_128bit + Server_random_128bit

Server_key_256bit = Server_random_128bit + Client_random_128bit

---

Communication:

$c_{iv}=1, \space s_{iv}=1$

Client_Encrypted_Message = AES-GCM(Message,$c_{iv} \space$,Client_key_256bit),$c_{iv} \space$,tag;

Server_Encrypted_Message = AES-GCM(Message,$s_{iv} \space$,Server_key_256bit),$s_{iv} \space $,tag;

For every Subsequent Message $c_{iv}$ and $s_{iv}$ is incremented by $1$ by client and server respectively.

Client and Server makes sure every new massage's $c_{iv}$ or $s_{iv}$ is greater than the previous massage's else the session is terminated. (tcp protocol)

This is because I don't know any other way to make sure the massage/command is executed only once or to prevent replay attack.

Is there better way to do this considering the device can't keep track of time?

Would it be OK if the $iv$ used in handshake gets repeated considering the plain text is a random number?

Is this secure enough?

Here client is referred to iot_device and device_id as client_id.

psk is referred to pre_shared_key configured in the device at company and known to server.

Answer 1

Would it be OK if the iv used in handshake gets repeated considering the plain text is a random number?

No, it would definitely not be OK. Reusing the IV will allow the attacker to recover the internal GCM H value - this will allow the attacker to make arbitrary modifications to encrypted messages.

For static keying (or anywhere else where it's difficult to avoid repeating the IV), GCM might not be the correct solution. Perhaps AES-SIV would work better?