Search code examples
google-cloud-iot

Using long-term MQTT domain mqtt.2030.ltsapis.goog with TLS_RSA_xx cipher suites

According to https://cloud.google.com/iot/docs/how-tos/mqtt-bridge#downloading_mqtt_server_certificates TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 using P-256 is recommended for mqtt.2030.ltsapis.goog

The IoT module that I'm using (Quectel M66) supports only the following cipher suites.

  • TLS_RSA_WITH_AES_256_CBC_SHA
  • TLS_RSA_WITH_RC4_128_SHA
  • TLS_RSA_WITH_RC4_128_MD5
  • TLS_RSA_WITH_3DES_EDE_CBC_SHA
  • TLS_RSA_WITH_AES_128_CBC_SHA
  • TLS_RSA_WITH_AES_256_CBC_SHA256

Is it possible to connect to mqtt.2030.ltsapis.goog using one of the above cipher suites?

Thanks

Solution

  • Unfortunately, it will not be possible.

    The long term MQTT domain is intended to aid in using a TLS configuration for a long period of time. As such, the TLS features listed in the documentation could be seen as "minimum standard needed" to ensure security.

    You can read more about Google's minimum standards for TLS clients here

    Do note that you can test the following points:

    1. TLS 1.2 must be supported.
    2. A Server Name Indication (SNI) extension must be included in the handshake and must contain the domain that's being connected to.
    3. The cipher suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 must be supported with P-256 and uncompressed points.

    In this link https://cert-test.sandbox.google.com/

    It is unlikely support will be added to those older cipher suites, since it could potentially lead to botnets and other security issues over time. You can also verify the security of cipher suites in this link which is updated regularly.

    The recommendation would be to look for devices that support TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 using P-256 and uncompressed points for the cipher suite, which will have a higher likelihood of working uninterrupted for a few years.