I am trying to come up with a way to authenticate an IoT device to a server. Since the device is "un-monitored", I cannot expect a user to enter a password on the device whenever the device starts or reboots.

I am not overly worried about device theft, but I am worried about the device being cloned and the copy then impersonating the original.

The device will be running Android, and as I understand it, the Android keystore is difficult to copy (correct me if I am wrong). The keystore can be asked to HMAC-sign a value, without exposing the signing key.

  • If I use a regular secret key as the authentication password, that key can be extracted from the keystore and copied to the clone.
  • If instead, I use TOTP, I can present the current time value to the keystore and have it HMAC that value, then proceed with the rest of the TOTP protocol, as defined in RFC 6238.
  • I can use public-key encryption and have the keystore sign some value (like "yes, it's me"), and then have the server check that the signature is valid, but that would be vulnerable to a man-in-middle attack followed by a replay attack. I could have the device sign a challenge provided by the server, but that requires an extra network round trip for each authentication.

I plan on using TLS for all connections.

I saw the answers given in "What are the security implications of using TOTP for single factor authentication?", but I want to confirm that I am selecting a reasonable scheme for IoT.

Are my assumptions correct? Is there a better, more secure way to authenticate a device?

  • If I understand this correctly, it is not easy to reach into the keystore and extract keys: source.android.com/security/keystore. If in fact it is easy, then what is the advantage of the hardware backing?
    – Ralph
    Commented May 5, 2016 at 16:32
  • Yeah sorry, I didn't realize you used an HSM. In that case yes, it is more secure than using a plain password/token that can be stolen. Commented May 5, 2016 at 17:38

1 Answer 1


If we assume that the keystore is safe and keys can not be copied or extracted but it can perform HMAC-SHA(1) then you might think of using TOTP.

But I would also recommend taking a look at OCRA. Here you can do real challenge signing. You either realy do only a challenge signing or you can add time or a counter. This way you would have no problems with a clock drift.

But why not use public key crypto? If the keystore can also store an RSA private key - I would probably go with signing the challenge with a private key.

If you are still going with TOTP or OCRA, you might also want to take a look at privacyIDEA, which can help you to manage all the secret keys of your devices.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .