Using TOTP instead of passwords for IoT device authentication

Question

I am trying to come up with a way to authenticate an IoT device to a server. Since the device is "un-monitored", I cannot expect a user to enter a password on the device whenever the device starts or reboots.

I am not overly worried about device theft, but I am worried about the device being cloned and the copy then impersonating the original.

The device will be running Android, and as I understand it, the Android keystore is difficult to copy (correct me if I am wrong). The keystore can be asked to HMAC-sign a value, without exposing the signing key.

• If I use a regular secret key as the authentication password, that key can be extracted from the keystore and copied to the clone.
• If instead, I use TOTP, I can present the current time value to the keystore and have it HMAC that value, then proceed with the rest of the TOTP protocol, as defined in RFC 6238.
• I can use public-key encryption and have the keystore sign some value (like "yes, it's me"), and then have the server check that the signature is valid, but that would be vulnerable to a man-in-middle attack followed by a replay attack. I could have the device sign a challenge provided by the server, but that requires an extra network round trip for each authentication.

I plan on using TLS for all connections.

I saw the answers given in "What are the security implications of using TOTP for single factor authentication?", but I want to confirm that I am selecting a reasonable scheme for IoT.

Are my assumptions correct? Is there a better, more secure way to authenticate a device?

Answer 1

If we assume that the keystore is safe and keys can not be copied or extracted but it can perform HMAC-SHA(1) then you might think of using TOTP.

But I would also recommend taking a look at OCRA. Here you can do real challenge signing. You either realy do only a challenge signing or you can add time or a counter. This way you would have no problems with a clock drift.

But why not use public key crypto? If the keystore can also store an RSA private key - I would probably go with signing the challenge with a private key.

If you are still going with TOTP or OCRA, you might also want to take a look at privacyIDEA, which can help you to manage all the secret keys of your devices.