I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the app and MCU. I've tried something like SipHash which essentially appends a hash of the message with a plain text message and this is particularly useful against man-in-the-middle attacks. The other method I tried is encrypting the command packets between the two using AES. However both these methods require storing a secret key on the app and the device. Assuming this goes into production, there will be multiple devices and app downloads. It would be quite insecure to have the same key on all the MCU devices. Is there a way to get a random key on the device and then somehow have the app get this key?
Secure communication between a mobile app and a microcontroller
security;communication;hashing;encryption