Hello I'm working in a school project and I'm trying to resolve an issue. I have a server, a BLE device and a computer. The BLE device is constantly advertising data, I'm using 7bytes of the data leaving 17 bytes left and I want to use the rest of the bytes to check the authenticity of the BLE device.
So, when a computer is capturing the packages, I need to confirm that that package is really from an authentic device. My idea is:
- The BLE device will sign the data (7bytes) with his private key (RSA method).
- As the signature is much more than the 18bytes, it will generate a Hash of the signature.
- The payload broadcast will result in the data (7bytes) + the hash (16/18bytes)
- The computer will catch the broadcast message
- The computer will send to the server the entire payload.
- The server will have the BLE device private key and will sign the data (7bytes)
- The server will generate the hash and will compare it
- If it matches the server will send a successful code otherwise an error code.
My concern is it is possible to get the private key by getting the hash of a signed message? I think it is, but I'm not sure, maybe the hash can help in the guess of the private key, I don’t know.
And, this is a good and secure solution? If not do you guys know one better? Thank you.