I know that TEA has its weaknesses, but is easy to implement. My question is whether it would be suitable for my use case: The main reason for using encryption is not so much secrecy, but authentication and protection against interference.
- I have a number (max 20-30) of GPS trackers, which send their location by radio in intervals to a base station.
- Each message consists of a tracker ID, a timestamp, the location, and a checksum, so max 16 bytes, but in a fixed format.
- Each message will be similar to the previous one, as the time increment will be constant, and the location will not change very much between two subsequent messages.
- The time frame is about three hours, with probably about 800 messages sent per device during that period. So roughly 20k messages in total.
- the code of the system will probably be public (so security through obscurity will definitely not work)
What I want to avoid from happening is anyone sending fake messages that are mistaken for real positions; decoding the message content is not a problem, as anyone can observe the trackers moving around anyway if they wanted to. So if it takes more than three hours to crack the key and enable sending fake messages, that would not be an issue, as that means the window in which a single key is used would be over.
I guess what I really need to know is:
- Is TEA (or XTEA, or XXTEA) at all suitable for this use case? And if so, vanilla or X/XX? Or is there another algorithm that would be better suited? For example, just a hash checksum?
- Are there any other ways I could improve security (eg use a different key for each tracker, randomly vary the format of the message (location first vs timestamp first), compress the message (only store difference to previous location, eg, to remove some redundancy))
My main design goals are reasonable security (it's competitive sports, not secret missile plans), simplicity of use and implementation (I am a developer, not a cryptography expert), and low computational overhead (this will run on an ESP32 micro-controller).
I have some basic thoughts on this, but would appreciate some expert advice!
UPDATE: Since this was asked in one of the answers: the trackers will be initialised in close proximity on power-up, and the base station can transmit a 'secret' key via Bluetooth Low Energy to each tracker. I do realise that Bluetooth is not really secure, but given the proximity this is in my view a negligible risk.