494
B. Russell
user to the IoT machine to ensure that only authorized users are able to access the
web server and make configuration changes.
Short range Radio Frequency (RF) protocols also make use of cryptography.
Bluetooth-LE for instance uses cryptography for pairing devices, bonding (where
pairing keys are stored for the future), device authentication, and encryption.
ZigBee makes use of the IEEE 802.15.4 protocol for security services. 802.15.4 defines
security protections at the APS, Network and MAC layers of the wireless frames. At the
APS and Network layers, the AES algorithm in Counter mode is used with CBC MAC for
message integrity. The MAC layer also uses AES in Counter mode for confidentiality and
AES in CCM when integrity is required.
Key Management is an important aspect of cryptography. Take, for example,
the ZigBee protocol. There are three primary types of keys that can be employed
within a ZigBee network. Master keys are often pre-installed by the vendor and
protect the exchange between two ZigBee nodes as they generate link keys. Link
keys support node-to-node communications, and network keys support broadcast
communications. All of these keys need to be sufficiently secured across their entire
lifecycle.
Remember also that there are tools available that can harvest data and attempt
to crack encryption keys. When encryption keys are weak this becomes trivial
to accomplish. AirCrack, for example, is an example of an 802.11 cracking tool.
AirCrack can be used against WEP, WPA, and WPA2- Pre-Shared Key (PSK)
security and features several modes of operation for cracking keys including the
use of dictionary attacks and brute force.
Popular IoT messaging protocols also require cryptographic protections. Message Queue Telemetry Transport (MQTT), for example, requires higher-layer
cryptographic services as there are not inherent encryption features built into
the MQTT protocol. The use of the Transport Layer Security (TLS) protocol is
recommended when using MQTT. MQTT by itself simply passes the username and
password of the node or broker in cleartext.
Another popular IoT messaging protocol – the Constrained Application Protocol
(CoAP) – is UDP-based; it employs Datagram Transport Layer Security (DTLS) for
cryptographic services. DTLS can use various types of keys, including preshared
keys or symmetric keys which can also be used to establish group communications.
DTLS can use public keys which are not bound to certificates and can also use X.509
certificates.
A Note on confidentiality of API Keys: establish policies that API keys and other credentials
not be stored in public-facing source control systems (e.g., gitlab/github) and establish API
key management procedures. Do not hardcode API keys into firmware, mobile applications
or any client-based application. Monitor at least quarterly to verify that API keys and other
credentials are not stored in public-facing source control systems.
B. Russell
user to the IoT machine to ensure that only authorized users are able to access the
web server and make configuration changes.
Short range Radio Frequency (RF) protocols also make use of cryptography.
Bluetooth-LE for instance uses cryptography for pairing devices, bonding (where
pairing keys are stored for the future), device authentication, and encryption.
ZigBee makes use of the IEEE 802.15.4 protocol for security services. 802.15.4 defines
security protections at the APS, Network and MAC layers of the wireless frames. At the
APS and Network layers, the AES algorithm in Counter mode is used with CBC MAC for
message integrity. The MAC layer also uses AES in Counter mode for confidentiality and
AES in CCM when integrity is required.
Key Management is an important aspect of cryptography. Take, for example,
the ZigBee protocol. There are three primary types of keys that can be employed
within a ZigBee network. Master keys are often pre-installed by the vendor and
protect the exchange between two ZigBee nodes as they generate link keys. Link
keys support node-to-node communications, and network keys support broadcast
communications. All of these keys need to be sufficiently secured across their entire
lifecycle.
Remember also that there are tools available that can harvest data and attempt
to crack encryption keys. When encryption keys are weak this becomes trivial
to accomplish. AirCrack, for example, is an example of an 802.11 cracking tool.
AirCrack can be used against WEP, WPA, and WPA2- Pre-Shared Key (PSK)
security and features several modes of operation for cracking keys including the
use of dictionary attacks and brute force.
Popular IoT messaging protocols also require cryptographic protections. Message Queue Telemetry Transport (MQTT), for example, requires higher-layer
cryptographic services as there are not inherent encryption features built into
the MQTT protocol. The use of the Transport Layer Security (TLS) protocol is
recommended when using MQTT. MQTT by itself simply passes the username and
password of the node or broker in cleartext.
Another popular IoT messaging protocol – the Constrained Application Protocol
(CoAP) – is UDP-based; it employs Datagram Transport Layer Security (DTLS) for
cryptographic services. DTLS can use various types of keys, including preshared
keys or symmetric keys which can also be used to establish group communications.
DTLS can use public keys which are not bound to certificates and can also use X.509
certificates.
A Note on confidentiality of API Keys: establish policies that API keys and other credentials
not be stored in public-facing source control systems (e.g., gitlab/github) and establish API
key management procedures. Do not hardcode API keys into firmware, mobile applications
or any client-based application. Monitor at least quarterly to verify that API keys and other
credentials are not stored in public-facing source control systems.