Practical Internet of Things Security - Second Edition

Symmetric keys

Symmetric key material may also be used to authenticate, as mentioned in Chapter 6, Cryptographic Fundamentals for IoT Security Engineering. Message Authentication Codes (MACs) are generated using a MAC algorithm (such as HMAC and CMAC) with a shared key and known data (signed by the key). On the receiving side, an entity can prove the sender possessed the pre-shared key when the computed MAC is shown to be identical to the received MAC. Unlike a password, symmetric keys do not require the key to be sent between the parties (except ahead of time or agreed on using a key establishment protocol) at the time of the authentication event. The keys will either need to be established using a public key algorithm, input out of band, ...