Edit: I have found a scheme that fits my limits (little memory, only AES is available): AES-CMAC described in RFC 4493 (just remember to use different key for encryption and MAC ;) .
I am working on a limited, embedded system that has to be field-upgradable. I want to protect the firmware against copying/reverse-engineering and modification (it will be transferred over plain HTTP).
First parts is easy - I use AES-128-CBC. Keys are burned in the bootloader. Microcontroller memory is locked.
The second part is my problem. My system is too limited to do a "heavyweight" (eg. RSA) signature verification.
I have an idea to distribute the firmware as AES(firmware+hash(firmware)). My device will first decrypt the whole image, calculate hash of the decrypted part and compare it with the original hash appended at the end).
I know that encryption alone is not authentication, but I can't imagine a successful attach against something "inside" AES that will give the right (encrypted) hash at the end.
- Is my scheme secure?
- Can the hash be "weak" and still make the whole scheme secure? (eg. MD5? I know it is "broken", but I think it is still hard to meddle with it inside an encrypted image).