I understand SSL/TLS is the most commonly data transmission protocol for a secured communication. I need to implement the same in one of the IoT device (ARM® Cortex®-M4 Core at 80 MHz). This will be TLS Client implementation.

Since the device is a small scale device, I am looking for a light weight SSL Library (bearSSL, mbedSSL, ..) to use.

Device needs to store as well as transmit data to server; and I need to ensure a secured communication with data confidentiality and integrity; avoiding any possible attack (MITM,..).

However as I got to read, there are vulnerabilities/pitfalls in SSL/TLS also, does just using a right library will ensure addressing them? Or there are specific things I need to do in my code implementation to address them?

Like right ciphersuite selection; generating and securely storing the keys (key management); ...

request for some insight into this.

  • Question is too broad. TLS client needs root CA store which can be updated, or pinned certs or keys which can be updated. A way to get current date. For session resumption, a way to store session ticket. For revocation checking, revocation lists or OCSP stapling or rotate the pin. You should use only TLS1.3 if you can, or if you must allow 1.2 (why?) limit to only same cipher suites as those allowed in 1.3. Use X25519 ECDHE. Use RSA-2048 certs. ChaPoly should be better than AES on you chip, but test. I personally trust BearSSL more than anything except openssl.
    – Z.T.
    Jun 12 '20 at 7:31
  • If you want TLS client auth with client certs, that's another can of worms, choose a signature device can perform fast. Key storage for client cert depends on what your hardware can do.
    – Z.T.
    Jun 12 '20 at 7:33
  • Do you know your device can't handle a fully implemented and up to date library or are you assuming?
    – Pedro
    Jun 12 '20 at 14:10
  • @Pedro I am not sure if my device can handle that! I am looking for a light weight library hence (like BearSSL). My basic question is apart from selecting a right library, how do I ensure a secured SSL communication which addresses the vulnerabilities in TLS/SSL!! Jun 22 '20 at 12:37
  • If your library is correctly implemented, the rest is around configuration and certificate management.
    – Pedro
    Jun 22 '20 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.