Not your keys, not your hardware

Key takeaways

• AES, based on the Rijndael cipher developed by Joan Daemen and Vincent Rijmen, is a widely used and well-established encryption standard. AES-128 remains resistant to practical brute-force attacks when implemented correctly and used with securely managed keys, while offering efficient encryption for IoT devices.
• The strength of encryption depends not only on the algorithm but also on how its keys are generated, stored and controlled. Owning a device without access to the keys needed to decrypt its data can create dependence on the key holder.
• When only the provider controls the keys, customers may be unable to decrypt their device data independently or choose how it is processed. This can increase vendor lock-in, even when the provider retains the keys for legitimate security or operational reasons.
• Access to the encryption keys can enable independent data decryption and greater flexibility in choosing data processing services. Integration with other systems or switching providers also depends on compatible interfaces, documented data formats and the device’s configuration options.
• Controlling encryption keys does not mean having to operate the entire system independently. ACRIOS offers customers the option to retain their keys while using managed data collection and delivery services, subject to the agreed key management arrangements.
• Before choosing IoT hardware, check which encryption methods it supports, who generates and controls the keys, whether they can be securely transferred to the customer and how they are protected throughout the device’s lifecycle.

‍

It all started with a cipher. In 1997, Belgian cryptographers Joan Daemen and Vincent Rijmen entered a competition held by the U.S. National Institute of Standards and Technology (NIST). Their submission, Rijndael, not only won, it became the basis for what we know today as AES (Advanced Encryption Standard). It was the first publicly available cipher adopted by the U.S. National Security Agency (NSA) for encrypting classified documents.

AES has since become one of the most trusted encryption standards worldwide. Even its “lightest” version, AES-128, is mathematically so strong that brute-forcing it would require 2128 attempts – an astronomical number beyond any real-world threat. At the same time, AES is fast and computationally efficient, which makes it ideal for large-scale use in modern IT and IoT environments.

The weak point of AES? The ownership of the key

Every encryption method has a weak spot. And in the case of AES, it’s the key. It’s the one thing that allows you to encrypt and decrypt your data. If you don’t have access to the key, you don’t have full access to your data either. This is particularly relevant in the IoT world. You may own the physical hardware, but without the AES keys, you depend on whoever holds them. Your data is routed through someone else’s infrastructure, and you have no way to independently verify what’s delivered or who else might access it.

It doesn’t necessarily imply bad intentions. Manufacturers or providers might withhold keys to reduce complexity or manage security risks for less technical users. Still, the result is the same. You lose control over:

• Your data
• Your hardware
• Your choice of service provider

Why owning the AES encryption keys matters

If you do hold the keys, the benefits are substantial. You gain real ownership and control. Here’s what that looks like in practice:

• Direct access to your data: You can independently verify what your device records and control who can access it.
• Freedom to integrate and customise: You’re free to connect the device to your own system, extend its functionality or use it beyond the original ecosystem.
• The ability to switch service providers: You’re not locked into one platform or cloud – change providers when it suits you.
• Stronger negotiating power: When you hold the keys, you set the terms. Not your vendor.

Holding the keys doesn't mean you're on your own

Prefer a fully managed service? That’s fine too. Owning the keys doesn’t mean you're left alone, just that you have a choice. At ACRIOS, we enable AES encryption (AES-CBC and AES-CTR) across all our devices, including wM-Bus and M-Bus converters. Our customers always have the option to keep the keys for themselves. And if they prefer, we can still manage data collection and delivery for them. It’s entirely up to the user.

How to get AES encryption keys for your IoT hardware

Want encryption on your terms? Here’s what to do:

1. Check what security options your device supports. AES is the de facto standard. If your hardware doesn’t offer it, look elsewhere.
2. Ask for the encryption keys at time of purchase. At ACRIOS, we generate keys as a combination of device ID and message sequence number and we can deliver them directly to the customer.‍
3. Protect your keys. Key security is everything. Whoever holds the key holds access to your data.

Glossary of terms used

• AES (Advanced Encryption Standard): a symmetric block cipher standardised by NIST and widely used to protect data, supporting key lengths of 128, 192 and 256 bits
• AES-128: the AES variant with a 128-bit key, which gives 2¹²⁸ possible keys
• AES-CBC and AES-CTR: modes of operation that define how AES encrypts data across multiple blocks; CBC chains blocks together, while CTR uses a counter to generate a keystream
• Brute-force attack: an attempt to find a key by systematically trying possible values until the correct one is found
• Converter: a device that converts a signal or data from one interface or format into another, enabling different sensors, meters or communication systems to work together
• CRA (Cyber Resilience Act): the EU regulation establishing cybersecurity requirements for products with digital elements and related obligations throughout their lifecycle, including vulnerability handling and security updates
• Encryption key: a secret cryptographic value used by an encryption algorithm to protect data and, in symmetric encryption, to decrypt it
• Key provisioning: securely loading and managing the cryptographic keys a device needs for authentication and encryption
• NIST (National Institute of Standards and Technology): the US standards body that ran the public competition that led to the selection of AES
• Symmetric encryption: encryption in which the same key is used to encrypt and decrypt data
• Vendor lock-in: dependence on a single supplier or proprietary technology that makes switching to another solution difficult or costly