I have researched this topic exhaustively and am stuck -- was hoping to get some clarification from helpful folks.
Background: I have Bluetooth transponders attached to locks that are opened by payment in my app. A user pays a fixed fee, the lock opens, they grab their item, and the door closes and locks. I am trying to prevent spoofing attacks where non paying users are able to open these locks.
My current solution theoretically goes as follows: Each transponder is given a random 32 bit salt. Once the app Connects, an authentication request is sent to the transponder. The transponder then creates a random challenge string + its unique salt. The transponder then hash iterates the string 10,000 times (to protect against brute force) using SHA256.
While this is happening, the original challenge string+salt are also transmitted to the app which then sends it to a secure server via SSL where the shared secret hash key and transponder salt are also located. The string is hash iterated 10,000 times using Sha256 , sent back to the app, and back to the transponder which validates the server hash against its own calculated hash. If equal, the lock opens.
My questions are: is this secure? Am I overlooking some glaring security flaw whether it be brute force or other? Am I just completely wrong? Any help or recommendations would be much appreciated