I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service).
The devices only supports HTTP, some Symmetric-Key Algorithm and some Hashes Function via a development framework on the devices. Unfortunately SSL/TLS is not supported and thus is not an option here.
At boot time the devices contact the HTTP server in order to retrieve their specific configuration. I do have complete control over the devices before they are sent in the wild.
Some of the threats identified are:
- Download of a malicious configuration file.
- Download of the wrong configuration file (from another device).
- Multiple Download of the same configuration file.
- Eavesdropping of the configuration file by an unauthorized third party.
- Fraudulent access to the HTTP server (not necessarily relevant here).
The process of retrieving the configuration file should ideally happen only one time. Once the configuration file is downloaded access to the HTTP server will be discarded for that particular device.
Since I can load a temporary shared secret on the devices before dropping them in the wild, I was thinking of using keyed-HMAC (Hash Message Authentication Code) to authenticate the device without having to send the secret key on the wire. Something similar to the AWS API authentication design and use the unique serial number of the device as Key ID.
Once authenticated the device is granted access to a resource, in this case the configuration file. In order to mitigate some of the threats identified the configuration file must be encrypted and signed(?) during transfer.
For this purpose I was thinking of using an authenticated encryption mode.
I can only use AES256 in CBC mode and HMAC-SHA256. Other "proper" authenticated encryption algorithm are not available within the framework.
Does it make sense?
In order to avoid adding complexity on something complex enough is it an option to use the pre-loaded shared secret as a key for the HMAC function and the shared secret Hash as Encryption Key for the AES encryption?
Does it allow the mitigation of the identified threats under that particular scenario?
Can the process be simplified and keep its security properties?