Every day, we’re connecting more and more devices over the internet. No longer does a household have a single connected computer — there are smartphones, tablets, HVAC systems, deadbolts — you name it, it’s been connected. As the Internet of Things proliferates, it has become readily apparent that security is an issue in this space. [Andreas Spiess] has been working on this very problem, by bringing HTTPS to the ESP8266 and ESP32.
Being the most popular platform for IOT devices, it makes sense to start with the ESP devices when improving security. In his video, [Andreas] starts at the beginning, covering the basics of SSL, before branching out into how to use these embedded systems with secure cloud services, and the memory requirements to do so. [Andreas] has made the code available on GitHub so it can be readily included in your own projects.
Obviously implementing increased security isn’t free; there’s a cost in terms of processing power, memory, and code complexity. However, such steps are crucial if IOT devices are to become trusted in wider society. A malfunctioning tweeting coffee pot is one thing, but being locked out of your house is another one entirely.
We’ve seen other takes on ESP8266 security before, too. Expect more to come as this field continues to expand.
[Thanks to Baldpower for the tip!]
VPNing the pipe between you and your device.
For very light VPN I use tinc. It just works and is very light
Does tinc have a port to ESP32 ?
I’m interested in this as well, have you found a ESP32 compatible VPN yet?
I was using HTTPS on this thng thanks to the arduino library porters over two years ago.
Here’s the git repo: https://github.com/Matthew-Bradley/ESP8266Examples
It would be interesting if this attempt has actually implemented the cert chain though.I eventually lost interest when I had to change fingerprints every week as google changed theirs.
Looking more closely, this is just a tutorial on how to use the existing port. Oh well.
Thats what I found.
There is no new code (apart from perhaps the python code to convert a cert file to the cert format hex that the examples use, and he may have got that code from somewhere else and re-purposed it)
“However, such steps are crucial if IOT devices are to become trusted in wider society.”
I’m not sure if I agree. Connection to IoT devices should be encrypted, but why use inefficient http/https instead of some dedicated protocols?
“but why use inefficient http/https instead of some dedicated protocols?”
Uh, for the vast majority of standard tcp based web traffic, TLS is the standard… What are you suggesting? tcpcrypt??
If I’m running an IOT device that’s hosting a web-app, it should be using TLS…
The Web is predominantly REST-based, and using a dedicated/legacy protocol just adds to semantic complexity.
Yes, transport layer security is required. No, that does not imply HTTPS is the solution. You can use a standardised protocol specifically developed in the IETF for constrained IoT devices, called CoAP, which is REST-based, and can run over UDP (and DTLS) or TCP (and TLS).
Most people using the ESPs (or IOT things in general) tend to use MQTT over TLS sockets, the underlying protocol is small and you have better guarantee of delivery. There are a bunch of libraries and functionality provided without jumping through hoops. If you wanted to setup COAP on something like AWS IOT to stream data over DTLS the path for that isn’t exactly clear, and some desired COAP functionality may not even be capable on ESP at the moment (https://github.com/esp8266/Arduino/issues/2932).
Internet of Trash should simply not exist. Nobody needs this and it creates massive amounts of data. Call me old-fashioned if you want…
Nah, just wise :-)
IoT is ok as long as you know what you’re doing.
Well… but perhaps we should need an amateur IoT license to be allowed to do IoST without the S…
As always: Ask “Cui bono?”!
I can think of plenty of cases where IoT is good:
1. Door locks – I can now granularly control who has access to my house. I can set up unique passwords for each person, or take data from other sources to allow remote entry.
2. Various sensors – these can gather basic data ranging from temp probes in rooms and refridgerator/freezer, PIR devices for occupancy, door/window open sensors, cameras, and more. These don’t inherently *do* something but provide ‘senses’ to deciding algorithms.
3. Servos and Motors – with mechanical stuffs available, actions can be done on a script or based upon input from sensors.
—
What can you do with these things? I can walk in a room, and the lights gently turn on. There’s a camera doing basic item recognition, and can tell its me, so the lights turn to the colors I like. It sees me with a laptop and then lowers the lights to what I’ve had it before.
I close the laptop, and watch a movie on the tv. I like drinking wine during a movie, so it establishes a connection with a delivery driver for alcohol (legal where I live). 15 minutes later, the delivery driver gets here and I provide ID. It was already paid for.
I start feeling warm, and want the temp to turn down some. So I say “Computer, turn down temperature to 65f”, and it does so. It notes that the front door was open, so temp regulation is not ideal, since it’s a lot colder outside.
—
The problem with IoT like this, is its NOT simple to connect these together for your benefit. Right now, the sensors and actuators are tied to specific devices and to other peoples’ corporate clouds. In effect, *they* control your hardware, not yourself. Look at Nest, Yale locks, Alexa, and plenty others. Your data is whisked away, and you have no understanding or control of what happens.
That’s why I created this: https://hackaday.io/project/12985-multisite-homeofficehackerspace-automation . It uses a cloud, of only your devices. I started from a basis of “My hardware, using protocols I can use, glued together with open source, along with Tor for cloud computing”. The only thing I use that isn’t mine is the internet, and Tor. Everything else is open sourced, down to the gerbers.
Good idea!
There is way too much reliance on “The Cloud”, particularly as the cloud in question belongs to someone else.
I do like the idea of a local cloud, with remote access via an secure VPN or something like that.
I agree with @some guy, most IoT is just a way of generating data to the company (often they give the service free as long as you sign your privacy away).
I don’t want most of my IoT to head out to the internet and back, I want it to stay in my home. Sadly I won’t be generating enough data to use AI/ML to do something useful in my home but I also won’t be marketing chips that the some company owns.
I’d recommend HPKP. HSTS and strong cipher suites and blocking old versions of TLS doesn’t protect you from public hacking tools.. That’s all if a vulnerability doesn’t get published too..
Disabling old versions of TLS does protect you if the hacking tool exploits a vulnerability in an older version of TLS… I get what you’re saying though, and implementation vulnerabilities will always be a thing.
HPKP is good. Perhaps even more importantly, not accepting that all CAs some hooligans at google or mozilla decided to put in your trust store should actually stay there is a good thing.
I read that with [Andreas]‘s accent.
Once Ironclad Encryption adapts their key management system for IOT devices it won’t be an issue.
iot dot Mozilla makes it easy for everyone to have their own https server at home
iot.mozilla uses LetsEncrypt transparently to the user, to setup an IOT server on a Raspberry Pi in the home
Chip whisperer.
Your shits already stolen.
Their demo is breaking TLS v1.2
Link to ChipWhisperer breaking ESP32 encryption?
Best I can find is the hardware to attempt it:
https://www.mouser.com/new/newae-technology/newae-esp32-ufo-target-board/
A direct connection of the chips with a weak processor to the Internet is a stupid thing.
Internet of stupid and vulnerable and dangerous things.
This man did it and he deserves to be recognizable:
https://github.com/earlephilhower
His secure version of networking libraries were added in the esp8266/Arduino master branch. It was available as pull requests at least at Feb of 2017.
I find this post quite misleading, specifically
“[Andreas Spiess] has been working on this very problem, by bringing HTTPS to the ESP8266 and ESP32. ”
I love Andreas’ videos and posts, but he had not brought HTTPS to ESP8266 or ESP32
The code for HTTPS has been in the Arduino core for the the ESP32 and the ESP8266 for some time, and was not written by Andreas
Looking in github,
https://github.com/espressif/arduino-esp32/commit/8ab3231e31cb3b94d80cbfd7dd1c1eac6f646236#diff-128c1c3e119ace535e4836daddf75c26
It shows that that WifiSecure was …
“copercini authored and me-no-dev committed on Feb 11, 2017”
Andrea’s python code just converts the cert file to the text format needed for the Arduino example.
It is probably closer to September 2015 that SSL was added for ESP8266 by igrr (Ivan Grokhotkov):
https://github.com/esp8266/Arduino/commits/master/libraries/ESP8266WiFi/src/WiFiClientSecure.h
I didn’t watch the whole video, I’m curious if he mentions the ESP8266 likely lacks enough memory to handle modern day sized asymmetric keys. But yeah, this guy didn’t do much to bring HTTPS to the ESP8226 and ESP32 other than make a video, sort of detracts from the real work work that devs have been doing for over three years now.
Roger, you saw the video. I never said I invented anything. I just wanted to explain https that it can be used by others. My main goal was to still be able to access cloud services when they do no more accept http connections. I had no plans to save the world ,-)
I said the Hackaday post was misleading. Not the video.
One other thing I’d like to see, data signing. I have a board, an ESP8266 IR transceiver, that signs the data. It adds a small chip (looks like an smt transistor) that you can use to create the signature. It ups the layer of trust a bit further.
While I’d like to think that what I’m sending is of little value to someone else it seems to be enough that big companies want to sell me their IoT cloud service. I’m not really sure what they are doing with the data and that worries me.
That’s sounds great anything that has to do with, making your own things on or about you and what you do keeping it yours am all in and down for it sounds great sounds more then great actually can’t wait to try it out, thanks for the insight and heads up Lt me know when is up and ready shoot it to me if possible, thanks Be Safe and God Bless …… Nathan Trujillo ………
I hope he works too on the https for the esp8266/32 webserver!
When you make a PWA (progressive web app) and you want to send requests directly to an ESP, you can not because browsers block ‘mixed content’ (HTTPS of your PWA but HTTP for your device).
It’s sad for some simple projects.
Try this instead: https://github.com/me-no-dev/ESPAsyncWebServer
…but watch out for the many bugs in it :)
Have you found a solution? I want to do the same think use pwa that calls directly my intranet esp8266!
Now there is a bearSSL implementation on esp, but is still not easy to manage with certificate expiring.
No… I’m still looking for something simple and reliable :s
I use the following HTTPS stack and SSL stack. It is super easy to use and comes with a ton of tutorials and videos. It’s a commercial product, but free for personal projects.
https://realtimelogic.com/downloads/sharkssl/ESP8266/
Why didn’t you name the article ESP8266/ESP32 SSL Client?
As this is clearly not an SSL server and all current ones out there are sheit for this platform.
One has no http auth, the other doesnt handle ssl well the third segfaults etc. There is no good HTTPS server library.
This guy created absolutely nothing. He is using the WiFiClientSecure().
Another waste of my 5 god damn minutes article. Spinass is spinat.
OMG, what a lot of weird comments and incorrect assumption on how TLS certificates and trust is managed. I suggest reading the following to get a better understanding of how to manage trust in embedded devices:
https://realtimelogic.com/articles/Certificate-Management-for-Embedded-Systems
“being locked out of your house”
Ok, I get its not the most ideal solution….but supposing you left no possible way of opening an outside door without power and internet, does no one know how to kick a door anymore? And before anyone tries some ‘but im so tiny and the door is so strong’ Every small stature female cop you have ever seen can kick the standard front door in. ….I mean, to be fair they can also kick a dudes balls into orbit if they had to, and not some gentle low earth orbit Im talking JWST better watch out kind of orbit….but still! Kick twice the distance from shackle to the knob, and do it like you mean it. Youre trying to kick something beyond the door and the door is just in your way. Or you can ram it with a shoulder. Either way, either the door will buckle or the jamb will shatter. Unless you have a metal door and frame. In that case youll need a crowbar and a hydraulic spreader. Or just break a window…actually, youd be surprised how easily a sliding window can be popped out of its runner….Point is if your HA setup locked you out, you have failed on two fronts…….