2

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile to device communications are slow (BLE) and can carry 16 bytes of data per message. The device has limited additional memory beyond the 100K so the decryption would need to be in place. Code space is also fairly limited on the device.

The server and the devices can have common secrets and the device can create a sequence of nonces that does not repeat after a power cycle. The files already include CRC32s for data integrity validation.

Is the following a valid approach?

Each device has its own key the server has a table of device keys The device sends its id and nonce to the server. The file is encrypted with authentication as a whole at the server. The encrypted file is sent to the mobile app, broken into 16 byte chunks, sent to the device. The device reassembles the encrypted file, decrypts and checks authenticity.

Would salsa20 + umac be a good choice for encryption/authentication?

3
  • can you use tls (like https) on the transfer? if so, what does E2E add if the server does half of it?
    – dandavis
    Commented Nov 1, 2016 at 19:05
  • Thanks, hadn't thought of that. I presume that would mean I would have to implement tls on the embedded device and set it up for the ble link on the mobile apps. Encrypting the file seemed simple as it required no change to the mobile apps.
    – nduru
    Commented Nov 8, 2016 at 6:21
  • I would still like to know if Salsa20 and umac could be a valid choice..... Tls needs far to much work and I cannot change the mobile protocols.
    – nduru
    Commented Nov 15, 2016 at 6:31

1 Answer 1

0

Each device has its own key the server has a table of device keys The device sends its id and nonce to the server. The file is encrypted with authentication as a whole at the server. The encrypted file is sent to the mobile app, broken into 16 byte chunks, sent to the device. The device reassembles the encrypted file, decrypts and checks authenticity.

This is fine. Depending on the size of the deployment it can get a bit expensive to store a distinct key for every device. If the device can manage asymmetric (P256/ed25519/etc) the serial can be sent with the public key, update encrypted with a random key and key encrypted using public key. But that's an optimization on cost, it is still reasonable to store a distinct random key per device.

Would salsa20 + umac be a good choice for encryption/authentication?

This question dates itself and in 6 years my specific recommendations will date themselves.

Salsa20 + umac was likely fine at the time. Chacha-Poly is the authenticated encryption recommended pair from that family at the time of this writing. Depending on processor accelerator support, AES-GCM is the recommended authenticated stream cipher from the AES family right now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .