I am trying to create a small smartphone activated lock for my house via Wi-Fi. The setup is like this:

  • The solenoid of the lock is connected to an esp8266 that acts as an access point, and has an HTTP (or WebSocket) server on it.

  • The smart phone connects to the access point and sends a GET request, then the lock opens (or the phone sends some string in the case of WebSocket).

The questions are: Since I am always doing the same operation exactly the same, can someone sniff the packets sent and perform a replay attack?

As far as I know, the encryption key changes each session, but what if I am still connected to the network? Can someone then pretend to be me?

Are there any countermeasures done in Wi-Fi networks?

  • What encryption scheme is the WiFi using? – jrtapsell Feb 10 '18 at 20:15
  • It is using WPA2-Personal protocol – Tareq Sulaiman Feb 10 '18 at 20:17
  • As for the encryption itself it is AES-CCMP – Tareq Sulaiman Feb 10 '18 at 20:22
  • Slide 15 of this seems to point to replay detection existing – jrtapsell Feb 10 '18 at 20:24
  • This is pretty easy to handle within your GET/WebSocket framework with a handshake: the first request sent is "ClientHello", including a lock protocol version number for future compatibility; the reply is "LockHello", which includes 8-12 bytes of (ideally cryptographic) random number generated by the Lock, and the response is "ClientOpen", which has an HMAC authentication based on the random number sent in LockHello. Now replays have a fantastically small chance of succeeding. The Lock has to hold on to the random numbers it sent for a reasonable fraction of a second, after that, start over – Anti-weakpasswords Feb 12 '18 at 3:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.