Security and Robustness Analysis of Encrypted Communications for Local Home Automation: Esphome Native API and MQTT Over TLS 1.3

International Journal of Network Security & Its Applications (IJNSA)

ISSN: 0974 - 9330 (Online); 0975 - 2307 (Print)

Webpage URL: https://airccse.org/journal/ijnsa.html

Security and Robustness Analysis of Encrypted Communications for Local Home Automation: Esphome Native API and MQTT Over TLS 1.3

Carlos Roberto Gonzalez-Escarpeta, Juan Eduardo Garcia Sanchez , Jose Antonio Hernandez Reyes and Ricardo Francisco Martinez-Gonzalez, Tecnologico Nacional de Mexico – IT de Veracruz, Mexico

Abstract

The expansion of the Internet of Things (IoT) in residential and local automation environments has highlighted the limitations of considering the internal network as an inherently trusted domain. Man-in-themiddle (MitM) attacks, such as those based on ARP spoofing, can allow traffic interception or manipulation when communications lack appropriate confidentiality, integrity, and authentication mechanisms. This paper presents a systematized review of the security mechanisms used by two communication alternatives between ESP-family microcontrollers and the Home Assistant platform: MQTT protected through TLS 1.3 and the ESPHome Native API, whose encryption mechanism is based on the Noise Protocol Framework using the Noise_NNpsk0_25519_ChaChaPoly_SHA256 pattern. The analysis considers four dimensions: cryptographic robustness, attack surface, implementation complexity, and resource consumption in constrained devices. The review identifies significant differences resulting from the architecture and cryptographic model adopted by each alternative. TLS 1.3 provides a widely standardized framework compatible with public-key infrastructure and formal identity-management mechanisms, although it introduces greater configuration complexity and computational overhead during secure-session establishment. The ESPHome Native API employs a more specialized cryptographic scheme with lower operational complexity, eliminates dynamic algorithm negotiation, and uses ChaCha20-Poly1305 to protect communications. The resource-consumption analysis is based on measurements published by the projects and manufacturers themselves, not on an experimental test bench, and this limitation is explicitly acknowledged. The results identify the conditions under which each mechanism is appropriate for local home-automation architectures and provide a basis for designing IoT systems that require a balance among security, interoperability, and resource constraints.

Keywords

ChaCha20-Poly1305, ESPHome, Home Assistant, Internet of Things, MQTT, Noise Protocol Framework, IoT security, TLS 1.3, systematized review

Abstract URL: http://aircconline.com/abstract/ijnsa/v18n5/18526ijnsa02.html

Original Source URL: https://aircconline.com/ijnsa/V18N5/18526ijnsa02.pdf

Volume URL: https://airccse.org/journal/jnsa26_current.html