IoT Security

# IoT security: TLS MQTT client + signed payload verification
# pip install paho-mqtt cryptography

import json, time, hmac, hashlib
import paho.mqtt.client as mqtt

# HMAC-based message authentication
# Device and server share a secret key
SECRET_KEY = b"your-32-byte-secret-key-here!!!!"

def sign_payload(payload_dict):
    # Add HMAC-SHA256 signature to payload
    body = json.dumps(payload_dict, sort_keys=True).encode()
    sig  = hmac.new(SECRET_KEY, body, hashlib.sha256).hexdigest()
    payload_dict['sig'] = sig
    return json.dumps(payload_dict)

def verify_payload(payload_str):
    # Verify HMAC signature, return payload or None if invalid
    try:
        d = json.loads(payload_str)
        received_sig = d.pop('sig', None)
        if not received_sig:
            return None
        body = json.dumps(d, sort_keys=True).encode()
        expected = hmac.new(SECRET_KEY, body, hashlib.sha256).hexdigest()
        if hmac.compare_digest(received_sig, expected):
            return d
        return None  # signature mismatch
    except:
        return None

# TLS MQTT client setup
def create_tls_client(client_id):
    client = mqtt.Client(client_id=client_id)
    # For local Mosquitto with self-signed cert:
    # client.tls_set(ca_certs="/etc/mosquitto/ca.crt",
    #                certfile="/etc/mosquitto/client.crt",
    #                keyfile="/etc/mosquitto/client.key")
    # client.tls_insecure_set(False)
    return client

# Test HMAC signing
payload = {"temp": 23.5, "hum": 55.2, "device": "esp32-01"}
signed = sign_payload(payload.copy())
print(f"Signed:   {signed}")

verified = verify_payload(signed)
print(f"Verified: {verified}")

# Tampered payload should fail
tampered = json.loads(signed)
tampered['temp'] = 99.9  # attacker changes temperature
tampered = json.dumps(tampered)
result = verify_payload(tampered)
print(f"Tampered: {result}")  # None = rejected