2

I would like to ask a question that I have about MQTT client broker communication. Let's say, a client C1 is connected to the broker with user name and password (with no encryption).

What happens when a new client C2 (a malicious one) tries to publish or subscribe to a topic without actually initiating connection and pretending to be C1? Are there any means by which the server can figure out that C1 is not the one trying to communicate?

This question arises because after the connection process, the broker does not really check for credentials each time it is trying to subscribe or publish to a topic (as far as I am aware - may be wrong altogether).

Improve this question
1
  • perhaps you may wish to ask about credential checking instead, since that appears to be the actual knowledge gap
    – jsotola
    Oct 19, 2020 at 16:04

1 Answer 1

Reset to default
5

As with nearly any unencrypted protocol, there is no man in the middle protection.

If this is a treat model you need to protect against then running MQTT over SSL/TLS is the solution.

Improve this answer
2
  • Using Secure MQTT with SSL is definitely a great option. Provisioning the cryptomaterial is the hurdle we actually have. Thanks for your comment.
    – Rijo Varghese
    Oct 20, 2020 at 12:58
  • All you need to provide for basic TLS support is a CA certificate, assuming a long enough life time for that cert that shouldn't be a problem. Unlike having to security distribute private keys for TLS client authentication
    – hardillb
    Oct 21, 2020 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.