25

Absolutely, because: A secure device and channel means that you can trust the data. Yes, the actual temperature is not very private, but an attacker can provide false temperatures and cause an undesirable response (e.g turning heating on unneccesarily). This is how stuxnet worked, by misreporting the speed of the centrifuges, causing the control system to ...


9

You may be interested in the Skein family of cryptographic hash functions, which are designed to be efficiently implemented on a wide variety of small and large processors. You can trade RAM for speed, or vice versa. The hash can be implemented with as few as 100 bytes of state. The Skein primitive is the basis for both hashing and encryption. The home ...


8

Sensor reports to a current thermostat reading feel very private to me. A burglar could use the data to find out when a person is at home. After the house got robbed the owner might decide it's a good idea to sue the manufacturer of the thermostat violating their privacy and thus enabling the burglary. Is this the kind of legal risk a manufacturer of the ...


6

Yes, there is advantage to encrypting all communications. You wouldn’t post asking of there is any advantage to locking your house, would you? There question is not of whether, but of how much, advantage there can be. One of the greatest security experts Bruce Schneier, who has a great blog, btw, will tell you that you can't make things totally secure. ...


5

It's always a choice of the designer/developer. But using encryption and other security measures becoming a necessity in these days. As per an example, sensor that reports the current thermostat reading, can be taken control by an intruder to send you false signals. (They can have some strategy to rob you by doing so, who knows ?) You may have heard that ...


5

I'd like to know what are some specific actual real world use cases As per IOTA FAQ What are the main use cases of IOTA? IOTA's main features (in its current form) are feeless micropayments and secure data transfer and data anchoring. The primary focus area is obviously the Internet of Things, especially in areas such as Smart Cities, Infrastructure and ...


5

In addition to other answers, if the data is sent in plaintext it can be modified. Apart from mentioned problems faking data can cause (turning heat to the max due to lying thermometer in the middle of hot summer might lead to fire hazard, for example) manipulating data can lead to compromise of IoT device, and everything that accesses it (for example, you ...


4

Yes, any modern IoT endpoint software stack will support what you're looking for. I'm not sure that 'signed' is the most accurate way to describe this, but encrypted messaging is a basic requirement. The messaging encryption is likely to use TLS, but you need at least to ensure: Firmware is 'trusted' Over the Air firmware updates are possible, and trusted ...


3

The canonical cryptographic answer would be client certificates or secrets of some sorts on each device. Consider this example where Microchip details how to authenticate the ATECC608A versus the Google IoT Cloud. The details are given here. You'll need a secret private key and a secure algorithm. Of course, that means that you'll have to securely deploy ...


3

I'd like to know what are some specific actual real world use cases Visit "Implementing first Industry 4.0 Use Cases with IOTA DAG Tangle — Machine Tagging for Digital Twins" to read about an actual use case by Innogy SE (energy company based in Germany, a subsidiary of the German energy company RWE). To quote briefly from the article: In this blogpost ...


3

Public keys by definition are public (no need to keep them secret). So there is no reason it can't be available for download via http or at a push published as a retained message on a known MQTT topic.


1

In general terms, this is called mutual authentication, most often by using TLS and client certificates, although other schemes are possible. Individual device certificates are signed by the manufacturer using a issuer private key, and that signature is verified during communication handshake when presented by the client. This is how the server "knows" the ...


Only top voted, non community-wiki answers of a minimum length are eligible