IoT covers a broad range of devices and use cases, like at home the router, smart light bulbs, smart thermostat, maybe smart locks etc. And even more cases can be found in the industry where sensors or data collection systems are everywhere.
Given the broad range of devices they have some things in common: they have some firmware which might have bugs or missing features and thus need to get updates. And they need to communicate with other systems to receive and/or provide collected data.
And this is where certificates (or other trusted containers for a public key) help:
- It is essential in most use cases that the device only runs authorized firmware, i.e. no firmware which can be used to destroy the IoT device or even attack connected machines, sensors or other devices in the network. Digital signatures using certificates are typically used to provide such authorization.
- In order to protect the data in transit encryption is usually required. This requires that the client knows that it transmits the data to the correct server. Certificates are typically used for this server authentication, for example in protocols like TLS. Alternatively the client does not trust the server it is directly talking to at all, but instead encrypts the data so that only the ultimate recipient can decrypt these. In this case the client can use protocols like PGP, S/MIME or similar to encrypt the data for the final recipients by having the recipients certificate.
- Often it is also necessary that the recipient of some data knows for sure which device is sending/creating the data to make sure that it does not get fake data from unauthorized devices. Again certificates are used for this: either in the form of client certificates within mutual authentication in protocols like TLS. Or by digitally signing the data using a device specific certificate.
Or also for encrypting communication?
Certificates use public key (asymmetric) cryptography, i.e. RSA or ECC. This kind of cryptography is not suitable to encrypt large amounts of data. Instead symmetric cryptography is used for this (i.e. AES and similar). Certificates still play an important role in encryption in that they are used to protect the symmetric keys used for encryption, for example in the key exchange in TLS or to encrypt the symmetric key with the recipients public key in protocols like PGP or S/MIME.
I am assuming that sensors etc are too small to get certificates and use them?
Public key cryptography as the central part of certificate is not that resource intensive as one might think. It is for example already implemented in smart cards or TPM chips which means that it can probably be implemented also in most IoT devices which are capable enough to do some kind of network communication. The usual use cases for public key cryptography within IoT require only the occasional creation or verification of digital signatures or encryption of small data, which means that speed of the operation is usually not that critical.