Pairing a sensor with no screen

A hub key that never leaves the chip, a household key handed out at pairing, revocation by deleting a row.

Security was designed before the firmware. The hub creates its private key on first boot, keeps it in the chip, and gets a signed certificate from a certificate request; it talks to the backend over mutual TLS. Nodes ship with nothing secret, only their unique ID.

Pairing gives a node its secret. The owner clicks Add in the dashboard and holds the node's button; the node sends a join request, and the hub answers with the household network key, encrypted. Every frame after that is encrypted with that key, flash encryption protects both sides, and deleting a device's row revokes it.

sequenceDiagram
  Owner->>Dashboard: Add node
  Owner->>Node: hold button
  Node->>Hub: join request
  Hub->>Dashboard: new node found
  Hub->>Node: join accept with network key

Takeaway

Nothing secret goes onto a node at the factory that pairing can hand out instead.