Security and efficiency compared for home automation encrypted connections
Security and robustness analysis of encrypted communications for local home automation: ESPHome Native API and MQTT over TLS 1.3
Cryptography and Security
Summary
Home automation devices often communicate over a local network that attackers can exploit if security is weak. The authors studied two common ways these devices encrypt their messages to protect against spying and tampering: one using a well-known internet security method called TLS 1.3, and another using a special encryption built into ESPHome devices. They compared how strong, complex, and resource-heavy each method is. Their findings help people decide which security setup fits best based on needs and device limits.
What this means in practice
- •For home automation developers: Choose the appropriate encrypted communication method for ESP-based home automation devices balancing security and device limits.
- •For iot security engineers: Design local IoT systems with secure communication options that consider cryptographic strength and operational constraints.
A survey. It maps existing work.
Authors
Carlos Roberto Gonzalez-Escarpeta, Juan Eduardo Garcia Sanchez, José Antonio Hernandez Reyes, Ricardo Francisco Martinez-Gonzalez
Abstract
The expansion of the Internet of Things (IoT) in residential and local automation environments has highlighted the limitations of considering the internal network as an inherently trusted domain. Man-in-the-middle (MitM) attacks, such as ARP spoofing, can allow traffic interception or manipulation when communications lack appropriate confidentiality, integrity, and authentication mechanisms. This paper presents a systematized review of the security mechanisms used by two communication alternatives between ESP-family microcontrollers and the Home Assistant platform: MQTT protected through TLS 1.3 and the ESPHome Native API, whose encryption is based on the Noise Protocol Framework using the Noise_NNpsk0_25519_ChaChaPoly_SHA256 pattern. The analysis considers four dimensions: cryptographic robustness, attack surface, implementation complexity, and resource consumption. The review identifies significant differences resulting from the architecture and cryptographic model of each alternative. TLS 1.3 provides a standardized framework compatible with public-key infrastructure and formal identity management, though it introduces greater configuration complexity and computational overhead during session establishment. The ESPHome Native API employs a more specialized scheme with lower operational complexity, eliminates dynamic algorithm negotiation, and uses ChaCha20-Poly1305. The resource-consumption analysis relies on measurements published by the projects and manufacturers themselves, not on an experimental test bench, and this limitation is explicitly acknowledged. The results identify the conditions under which each mechanism is appropriate for local home-automation architectures and provide a basis for designing IoT systems that balance security, interoperability, and resource constraints.