HW (linux) <---Eth---> Official PC (win,mac,linux)
----> Man-in-the-middle eavesdrop
I'm looking to prevent an unauthorized party inside the LAN to make sense of communications between an official PC and a custom piece of HW.
The custom protocol used to communicate works on top of TCP. It can be assumed the unauth party won't have access to the filesystem of the official PC.
My current design involves using self-signed client certificates that we'd use in the official PC. Self-signed server certificates would be present inside the custom HW. The software would wrap the current socket comms in TLS, via libtls.
The certificates would be generated once with the openssl command and last for a couple of years.
Does this look reasonable or is it junk? Any gotchas?
Commenting on some of the points in Steffen Ullrich's answer:
The client and server certificates would only be used to connect from specific official PCs to the device, and not for any other kind of communication to other devices or software. The distribution of the client certificate is controlled. The server certificate details can be made known to the official PCs, and the client certificate details can be made known to the custom HW.
- 1st point: In the client, we can validate the server certificate using its fingerprint. In the server, we can validate the client certificate using its fingerprint too, if needed.
- 2nd point: The distribution of the client certificate is strictly controlled, so nobody outside of the official PCs should have it. IIUC, that means other connections without the client certificate would be rejected (right? Otherwise, would it help to invert client/server?)
- 3rd point: We can update client/server certificates (both or just one of the two) as needed.