Encryption basics

Key takeaways

Your device has proven its identity and is connected to the network, and now it is about to send sensor data to the cloud. Without encryption, that data travels as plaintext and is readable by anyone who intercepts it. This page explains the two fundamental types of encryption used in IoT, how they work together, and how TLS and DTLS protect your data in transit.

What you'll learn

Why encryption matters when data crosses networks you don't control

IoT devices transmit over radio waves and public networks — base stations, core networks, and internet infrastructure outside your control. Encryption ensures that even if someone captures your packets, they cannot read the contents. It answers two questions: confidentiality (can anyone other than the intended recipient read this data?) and integrity (has anyone modified this data in transit?).

How symmetric encryption works and why AES suits constrained devices

Symmetric encryption uses the same key to both encrypt and decrypt data functioning as a shared secret between two parties. The most common symmetric algorithm in IoT is AES (Advanced Encryption Standard), which is fast, efficient, and well-suited to resource-constrained devices because it needs relatively little processing power. The catch is key distribution: both sides need the same key, and getting a unique key securely onto thousands of devices is hard.

How asymmetric encryption solves the key distribution problem

Asymmetric encryption uses a pair of mathematically related keys: a public key and a private key. Data encrypted with the public key can only be decrypted with the private key, and vice versa. The two most common algorithms in IoT are:

• RSA: Widely supported but computationally expensive.
• ECC (Elliptic Curve Cryptography): Equivalent security with shorter keys and less computation, a better fit for constrained devices.

Because you can share the public key openly and only the private-key holder can decrypt, asymmetric encryption solves key distribution. But it is much slower than symmetric encryption, so it is not used for bulk data transfer.

How TLS combines both types of encryption

In practice, IoT systems use TLS (Transport Layer Security) to combine the strengths of both. A simplified handshake:

• The device and server exchange public keys and certificates.
• They use asymmetric encryption to securely agree on a shared session key.
• All subsequent data is encrypted with the faster symmetric encryption using that session key.
• When the session ends, the key is discarded.

This gives you the security of asymmetric key exchange with the performance of symmetric bulk encryption.

How to choose between TLS and DTLS for your protocol

When a device communicates over TCP (such as with MQTT or HTTPS) standard TLS is the industry-standard choice. But many IoT devices use lightweight UDP-based protocols like CoAP or LwM2M. Because standard TLS relies on TCP's reliability, it cannot run over UDP. DTLS (Datagram TLS) provides the same high-level security guarantees but is purpose-built for connectionless UDP. Use DTLS for UDP-based protocols (CoAP, LwM2M) and TLS for TCP-based ones (MQTT, HTTP), and never transmit data in plaintext. This matters for LPWA (Low-Power Wide-Area) technologies like NB-IoT: the SGP.32 eSIM specification mandates CoAP over DTLS because it drastically reduces "radio-on" time versus TCP-based HTTPS. When a device must last ten to fifteen years on a single battery, every byte and every handshake counts.

How certificate pinning adds an extra layer of trust

Even with strong encryption, your connection is only as trustworthy as the Certificate Authority (CA) that issued your server's certificate. If a CA is compromised, an attacker could issue a fraudulent certificate and perform a man-in-the-middle attack. Certificate pinning mitigates this: instead of trusting any certificate signed by a recognized CA, you hardcode the expected server certificate fingerprint into your device firmware, so the device only connects to a server presenting that exact certificate. The trade-off is that pinned certificates must be updated when they expire, which requires a reliable, secure firmware update mechanism.

Lesson 6.2 Self-assessment

Frequently asked questions