Other developers have developed a custom in-house RF protocol for our upcoming IoT devices. I would like to replace our use of AES-CTR with AE - our encryption library supports CCM which should therefore have the lowest barriers to implementation.
CCM requires two tunable parameters -
M, with corresponding security tradeoffs. Given a preference for single key negotiation and short transactional messages, what are good values to choose for
As the devices support scheduling, I estimate an upper limit of roughly 100 messages per day over installed lifespan, which I might generously estimate at 30 years. Messages are typically under 10 bytes (the protocol supports up to 64kib). We wouldn't be using associated data.
I would also like to choose nonces at random, in part to save on storage synchronization and in part because I'm not 100% confident I understand the statement at Wikipedia: "One key insight is that the same encryption key can be used for both, provided that the counter values used in the encryption do not collide with the (pre-)initialization vector used in the authentication." clearly. This should then lower the expected lifetime of the key due to the birthday paradox.
Will this provide adequate security if I pick
M=8? Or would I need to add key renegotiation if we expect a lifetime of 30 years?
Edit: please note that I am much more concerned about the choice of
L, which appears to create a security tradeoff (nonce length vs message length), than of
M which is a more typical performance/security tradeoff.