Device A which will communicate with multiple devices on a network (BLE and/or NFC).
All the devices will be handled a Token upon authentication which somehow needs to be transferred over to the
Device A over network securely and confidentially.
What is the best possible way to achieve it.? I guess something like SSL handshaking will be secure, but a simpler solution will be preferred.
Device A needs to act as a server.
Research done so far has led me to the following flow:
Device Amanages to send a public key to client.
- The client uses the key to encrypt the Token and send it to
Device Acan read the Token and authenticate the client.
Problems with this approach (and their solutions, as per my limited knowledge while dealing with security systems):
The token is same and the public key might repeat as well, giving a weak point in the system.
- The token will be transferred over the network with a nonce.
MIM attack: Any
Device Xcan mimic
Device Aand send a public key to client and initiate transaction. Now
Device Xknows the Token and mimic the client.
Device Ashould possess some kind of digital certificate to prove its authenticity. The digital certificate will be assigned by a server written in Python/Django. And the all the clients should be able to verify the certificate without interacting with server.
- Since I need this for mobile devices, I need the public private key pair to be as short as possible but yet secure.
- How can I implement the last part algorithm? Is there any open source python library available for generating, issuing and verifying certificates?
- Is the algorithm secure ? I'm a newbie in security and would like any valuable feedback.
Thanks in Advance!!