1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv"

2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag

Client_key_256bit = Client_random_128bit + Server_random_128bit

Server_key_256bit = Server_random_128bit + Client_random_128bit


$c_{iv}=1, \space s_{iv}=1$

Client_Encrypted_Message = AES-GCM(Message,$c_{iv} \space$,Client_key_256bit),$c_{iv} \space$,tag;

Server_Encrypted_Message = AES-GCM(Message,$s_{iv} \space$,Server_key_256bit),$s_{iv} \space $,tag;

For every Subsequent Message $c_{iv}$ and $s_{iv}$ is incremented by $1$ by client and server respectively.

Client and Server makes sure every new massage's $c_{iv}$ or $s_{iv}$ is greater than the previous massage's else the session is terminated. (tcp protocol)

This is because I don't know any other way to make sure the massage/command is executed only once or to prevent replay attack.

Is there better way to do this considering the device can't keep track of time?

Would it be OK if the $iv$ used in handshake gets repeated considering the plain text is a random number?

Is this secure enough?

Here client is referred to iot_device and device_id as client_id.

psk is referred to pre_shared_key configured in the device at company and known to server.

  • $\begingroup$ Err, what does "the massage/command is executed only once" mean? You'll never ever ever ever send the same command again? Anything like "self destruct" or just preventing a replay attack? $\endgroup$
    – Paul Uszak
    Apr 18, 2019 at 15:54
  • $\begingroup$ @PaulUszak just preventing a replay attack. $\endgroup$
    – Bapi
    Apr 24, 2019 at 5:54

1 Answer 1


Would it be OK if the iv used in handshake gets repeated considering the plain text is a random number?

No, it would definitely not be OK. Reusing the IV will allow the attacker to recover the internal GCM H value - this will allow the attacker to make arbitrary modifications to encrypted messages.

For static keying (or anywhere else where it's difficult to avoid repeating the IV), GCM might not be the correct solution. Perhaps AES-SIV would work better?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.