Specifications

This document describes E4, a security and key management protocol for MQTT, and potentially other transport protocols.

Table of Contents

• Integration
  • Client integration
  • Server integration (C2)
    • Services
    • Database
    • Requirements
    • Disaster recovery
    • High availability
    • Fault tolerance
    • Logging
  • Key provisioning
• Client specification
  • Client internal state
  • Client local API (rx)
    • protect_message(message, topic)
    • unprotect(message, topic)
  • Client remote API (rx)
    • RemoveTopic(topichash)
    • ResetTopics()
    • SetIdKey(key)
    • SetTopicKey(topichash, key)
    • RemovePubKey(id) [PK mode]
    • ResetPubKeys() [PK mode]
    • SetPubKey(id, pubkey) [PK mode]
    • SetC2Key(pubkey) [PK mode]
  • Key transition logic
• C2 specification
  • C2 internal state
  • C2 API
    • new_client(id, key) [local]
    • remove_client(id) [local]
    • new_topic_client(id, topic) [remote]
    • remove_topic_client(id, topic) [remote]
    • reset_client(id) [remote]
    • new_topic(topic) [local]
    • remove_topic(topic) [local]
    • new_client_key(id) [local & remote, SK mode]
    • reset_client_pubkeys(id) [remote, PK mode]
    • send_client_pubkey(iddst, idsrc) [remote, PK mode]
    • remove_client_pubkey(iddst, idsrc) [remote, PK mode]
    • new_c2_key() [local & remote, PK mode]
  • C2 human interface
• Messages encoding
  • Client and C2 messages encoding [SK mode]
  • Client messages encoding [PK mode]
  • C2 messages encoding [PK mode]
• Cryptography primitives
  • Authenticated encryption
  • Hashing
  • Password-based key derivation
  • Signature [PK mode]
  • Key agreement [PK mode]
• Protocol variants
  • FIPS mode
  • Post-quantum mode
• Additional components
  • Automation engine
  • Monitoring & analytics