I am asked to design the public key crypto system for an IoT-like devices. These devices are going to be talking to each other over TCP/IP as well as communicating with a cloud-based API server. The firmware for these devices are developed in house.
The requirements are:
- The devices should be able to authenticate each other's identity and talk over secure channels.
- The API sever should also authenticate the identity of all devices.
- Digital signature: all firmware updates will carry a digital signature and the devices should only upgrade itself if the signature is valid.
My solution so far for the first two requirements is to:
- Generate a RSA key for the corporate (keep private in the corporate) and use it to generate a self-signed CA
- Use the self-signed CA to generate a X509 cert for the API servers.
- Use the self-signed CA to generate a X509 certificate for each device.
- Add the self signed CA to each device trusted CA store.
I am new to this, so I still have some questions.
- Is the above valid?
- For the digital signing, as far as I can tell I can use the private key from step one to sign the firmware binaries. Then on the devices, can we just extract the public key from the corporate CA cert and use it to verify the signature?