I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they are) but we do want to (1) authenticate the Arduino and (2) make sure the data was not changed in transit.
After all, we don't want just anyone to be able to send sensor readings to the server, and we want to know where those readings actually came from.
I have thought of using JSON Web Tokens (which are pretty compact and can be hard-coded into the Arduino or on an SD-card) to authenticate the Arduino, but Man-in-the-Middle attacks would still be a problem if we're just using HTTP over TCP. The recommendation seems to be to use HTTPS, but I've read somewhere that an Arduino doesn't have the horsepower required for HTTP over TLS. (Is this really true? I've yet to actually try)
I've thought of the following approach and would appreciate any thoughts on whether it would actually address the problem.
The Arduino has a JSON Web Token (which identifies the Arduino and contains a secret value
The Arduino computes an HMAC for the data using the key
k. Call this H.
H = hmac(data, k)
The Arduino sends the JWT, the data and H using an insecure connection (HTTP over TCP).
The server receives the message from the Arduino. It decrypts the JWT, which only it can do because the JWT was symmetrically encrypted on the server. After decrypting the JWT, the server now knows
k& data and can compute H, allowing it to verify the data's integrity, as well as authenticate the Arduino.
Am I wrong? Is there a better solution? Thank you in advance.