ulhub 5de7b4d7a2 Add BLE challenge-response for short-lived MQTT session certs ...

BLE-only locators can't hold the MQTT/TLS connection themselves — a phone
relays their data — so handing the phone a device's permanent client-cert
key would export its identity to every phone it pairs with. Instead the
device signs a server-issued nonce with its permanent key over BLE; once
verified, the backend mints a short-lived session certificate for the
phone's actual MQTT connection, keeping the permanent key on-device always.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-13 20:51:58 +00:00

2.5 KiB

Raw Blame History

View Raw