CODEWITHSUNDEEP
cryptographyaesstm32
Guillaume Petitjean
Guillaume Petitjean

Reputation: 2718

Good practices for AES key derivation and storage on STM32

I'm developing a device on STM32L4x6. It is connected through BLE to a smartphone and it exchanges encrypted data with it.

Encryption is AES-GCM and I'm using the reference implementation provided by STMicro.

I have implemented a shared secret exchange mechanism using Diffie-Hellman protocol on Curve25519. Right now I am using this shared secret directly as AES key.

However I am confused on 2 points:

Thank you

Upvotes: 2

Views: 3733

Answers (1)

J_S
J_S

Reputation: 3282

As for deriving a session key - you may want to look into the topic of Key Derivation Function (KDF). Googling it returns a lot of useful informations related to establishing session keys. You may also ask your question on https://crypto.stackexchange.com/.

As for storing keys in STM32 - it depends what your requirements are. Do the keys need to persist between sessions or can you generate a new one each time a connection is established? Generating a new key each time a new connection is made will be safer due to two reasons:

  1. It's different for each connection so even if someone manages to get the key for a session from the past, it may only be used to decrypt that session.

  2. If you generate a new key for each new session, you don't have the need to store it anywhere such as Flash memory, as you may keep it in RAM only. Powering down the device will wipe the key. Enabling read protection prevents access to RAM as well as to internal Flash.

Regarding 2nd point however - STM32 is NOT considered a "Secure Microcontroller". It lacks hardware elements that prevent hardware attacks - power voltage glitch detection, side-channel prevention, secure mesh etc. With enough resources and determination an attacker will be able to obtain the cryptographic keys that you use, for example by grinding down the chip package and optically reading your data. That touches on the aspect of how secure does the device really have to be - development time cost, hardware security cost. With STM32 all you can do is to make it harder (keep the keys in RAM and only when you need it, then overwrite them with noise) and limit the scope of the attacker (change session keys as often as possible, e.g. each session).

Upvotes: 6

Related Questions