I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the app and MCU. I've tried something like SipHash which essentially appends a hash of the message with a plain text message and this is particularly useful against man-in-the-middle attacks. The other method I tried is encrypting the command packets between the two using AES. However both these methods require storing a secret key on the app and the device. Assuming this goes into production, there will be multiple devices and app downloads. It would be quite insecure to have the same key on all the MCU devices. Is there a way to get a random key on the device and then somehow have the app get this key?
You can use diffie hellman algorithm (https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) to share a secret over a public chanel. In your case I think you should also have a central server that keeps track of who owns which device. Each device should have a unique identifier and when a user purchases a device there should be a registration process that marks the device as owned by that user in the central database.