5 ms·
Are there any specifics on how the underlying Spark platform handles security? On their product page it says that Spark Cloud "creates a secure environment with
by skue 13y ago
Are there any specifics on how the underlying Spark platform handles security? On their product page it says that Spark Cloud "creates a secure environment without forcing your web browser and the Core to speak the same language, which would be taxing on a low-power, low-cost microcontroller." Which isn't reassuring.
They don't provide any specifics in the docs either, only this:
"Security is hard. It’s especially hard on an embedded system, because encryption is resource intensive. But it’s also important, because you don’t want anyone turning on and off your lights, or worse, locking and unlocking your front doors.We hand-picked a set of rock-solid security protocols that are secure and efficient, so they work great on an embedded system. They’re baked into the Spark Protocol, which is open source and ready to be extended to other products."
I get that encryption may be difficult on embedded systems, but I would also argue that if a small embedded system can't handle strong encryption then it's not ready to connect devices to the web. I can't find any links to source code - anyone know what sort of encryption they use?
- amanfredi 13y agohttps://github.com/spark/core-communication-lib/tree/master/lib/tropicssl/include/tropicssl https://github.com/spark/core-communication-lib/tree/master/...
- towynlin 13y agoRSA encrypt initial handshake message to cloud: https://github.com/spark/core-communication-lib/blob/master/src/spark_protocol.cpp#L102 https://github.com/spark/core-communication-lib/blob/master/... Return message from cloud is decrypted with an RSA private key on the Core: https://github.com/spark/core-communication-lib/blob/master/src/handshake.cpp#L53 https://github.com/spark/core-communication-lib/blob/master/... An HMAC signature is verified: https://github.com/spark/core-communication-lib/blob/master/src/spark_protocol.cpp#L1022 https://github.com/spark/core-communication-lib/blob/master/... If everything checks out, AES-128-CBC session key is saved and IV is rotated with every message exchanged: encrypt: https://github.com/spark/core-communication-lib/blob/master/src/spark_protocol.cpp#L989 https://github.com/spark/core-communication-lib/blob/master/... decrypt: https://github.com/spark/core-communication-lib/blob/master/src/spark_protocol.cpp#L267 https://github.com/spark/core-communication-lib/blob/master/... Cheers, Zachary Crockett Spark CTO ;)
- skue 13y agoThanks!! Please consider adding that some of this to the Security documentation, and more prominent links to the source code as well. I actually found your GitHub profile and should have realized that core-communication-lib is what I wanted, but it appears new and doesn't have many stars yet, so I missed it.
- towynlin 13y agoGreat suggestion! I just added this as a security overview section of the README. https://github.com/spark/core-communication-lib https://github.com/spark/core-communication-lib