I've a Device A
which will communicate with multiple devices on a network (BLE and/or NFC).
All the devices will be handled a Token upon authentication which somehow needs to be transferred over to the Device A
over network securely and confidentially.
What is the best possible way to achieve it.? I guess something like SSL handshaking will be secure, but a simpler solution will be preferred.
Basically Device A
needs to act as a server.
Research done so far has led me to the following flow:
Device A
manages to send a public key to client.- The client uses the key to encrypt the Token and send it to
Device A
. - Only
Device A
can read the Token and authenticate the client.
Problems with this approach (and their solutions, as per my limited knowledge while dealing with security systems):
The token is same and the public key might repeat as well, giving a weak point in the system.
- The token will be transferred over the network with a nonce.
MIM attack: Any
Device X
can mimicDevice A
and send a public key to client and initiate transaction. NowDevice X
knows the Token and mimic the client.- The
Device A
should possess some kind of digital certificate to prove its authenticity. The digital certificate will be assigned by a server written in Python/Django. And the all the clients should be able to verify the certificate without interacting with server.
- The
Concerns:
- Since I need this for mobile devices, I need the public private key pair to be as short as possible but yet secure.
Questions:
- How can I implement the last part algorithm? Is there any open source python library available for generating, issuing and verifying certificates?
- Is the algorithm secure ? I'm a newbie in security and would like any valuable feedback.
Thanks in Advance!!