PQC IoT SENTINEL

DEMO DATA

PROTOCOL FLOW // 11 GATES

Anatomy of one secure message

Follow the cryptographic and transport path. Every gate must pass before plaintext is accepted.

01

BOOT

Persistent boot

EasyFlash restores identity, keys and freshness state.
02

NETWORK

Network connection

BL602-LAB routes through Pi 1 toward the receiver.
03

PUBLIC KEY

Receiver public key

The sender requests the receiver public key.
04

PIN

Fingerprint pinning

Computed and provisioned SHA-256 fingerprints must match.
05

KEM

KEM encapsulation

ML-KEM-512-style encapsulation yields ciphertext and a shared secret.
06

HKDF

Key derivation

HKDF-SHA-256 derives the AES-256 session key.
07

ENCRYPT

Payload encryption

AES-256-CCM protects the 22-byte application message.
08

DEVICE AUTH

Sender authentication

HMAC-SHA-256 binds the message to an authorized sender.
09

SEQUENCE

Replay protection

The new sequence must exceed persistent receiver state.
10

RECEIVE

Receiver verification

HMAC, freshness, KEM, HKDF and AEAD gates pass in order.
11

ACK

Authenticated acknowledgement

CoAP 2.04 Changed returns as an authenticated ACK.

IDENTITY CHECK

BB82BC4DF5D6608F7C596E0BC5814E5C62039F62D99FD01147219B9D465929F5

OBSERVED BL602 EXPERIMENTAL MEASUREMENT

KEM
9–11ms
HKDF
0–1ms