I'm designing a HTTP service for an embedded device and wondering if the following security concept is good enough:
SSL(Up to Version 3) is enabled by default, TLS is not by limitations of the platform.
SSL Key strength is RSA 2048
All HTTP requests are redirected to HTTPS if SSL is enabled.
HSTS header is sent by default.
Authorization by a MD5 hashed secret in a custom header field. Request is executed if secret is valid.
After too many requests with an invalid authorization secret, the API is locked for a time.
SSL certificate can be extracted or replaced in a way that require physical access to the device and knowledge of the authorization secret.
In my understanding the following attack vectors are covered with this.
- MITM: If the user has already installed the certificate, the attacker must trick the user to accept another certificate or try to exploit the weaknesses in SSL3.
- XSRF: Since the header field is custom, it's not sent by the browser automatically. If the attacker is able to craft custom packets he must brute force the secret.
The service is vulnerable to DOS by abusing the API locking mechanism but since the resources of the device are limited I can't do anything about it.