Encrypting OTA software updates files for embedded devices

Question

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile to device communications are slow (BLE) and can carry 16 bytes of data per message. The device has limited additional memory beyond the 100K so the decryption would need to be in place. Code space is also fairly limited on the device.

The server and the devices can have common secrets and the device can create a sequence of nonces that does not repeat after a power cycle. The files already include CRC32s for data integrity validation.

Is the following a valid approach?

Each device has its own key the server has a table of device keys The device sends its id and nonce to the server. The file is encrypted with authentication as a whole at the server. The encrypted file is sent to the mobile app, broken into 16 byte chunks, sent to the device. The device reassembles the encrypted file, decrypts and checks authenticity.

Would salsa20 + umac be a good choice for encryption/authentication?

Answer 1

Each device has its own key the server has a table of device keys The device sends its id and nonce to the server. The file is encrypted with authentication as a whole at the server. The encrypted file is sent to the mobile app, broken into 16 byte chunks, sent to the device. The device reassembles the encrypted file, decrypts and checks authenticity.

This is fine. Depending on the size of the deployment it can get a bit expensive to store a distinct key for every device. If the device can manage asymmetric (P256/ed25519/etc) the serial can be sent with the public key, update encrypted with a random key and key encrypted using public key. But that's an optimization on cost, it is still reasonable to store a distinct random key per device.

Would salsa20 + umac be a good choice for encryption/authentication?

This question dates itself and in 6 years my specific recommendations will date themselves.

Salsa20 + umac was likely fine at the time. Chacha-Poly is the authenticated encryption recommended pair from that family at the time of this writing. Depending on processor accelerator support, AES-GCM is the recommended authenticated stream cipher from the AES family right now.