How would you secure the remote garage door so that sniffing and replaying no longer work? What does each measure contribute?
Layer it: encrypt the link (WPA2/3), protect the connection end to end and authenticate both sides (TLS with certificates), and make every command authenticated and fresh (MAC over a counter or nonce), as real garage remotes do with rolling codes.
| Measure | Stops | Does not stop |
|---|---|---|
| WPA2/WPA3 on the Wi-Fi | Outsiders reading or joining the network | Anyone with the Wi-Fi password, or compromise beyond the Wi-Fi |
| TLS from device to server | Reading and changing the traffic anywhere on the path, replaying a recorded session | Clients that are not authenticated, unless the server checks client certificates |
| Client authentication (client certificate or per-device key) | Requests from any device or laptop without a valid key | A stolen key, if the key can be read out of the device |
| Freshness (counter, nonce, timestamp inside the authenticated message) | Replaying any captured command | Nothing more by itself, so it is combined with authentication |
Garage and car remotes solved this decades ago with rolling codes: each press sends a new code derived from a shared secret and a counter, and the receiver accepts only codes ahead of the last one it saw. A recorded press is worthless once it has been used.
The device side matters as much. A per-device key protects nothing if anyone with physical access can read it from flash, so this goes together with flash encryption and secure boot.
Go deeper:
Wikipedia — Rolling code — how garage remotes defeat replay, and the jamming attack that still beats weak versions.- Wikipedia — Wi-Fi Protected Access — WPA2 and WPA3 and what each protects.
- ESP-IDF — ESP HTTP client — HTTPS from the ESP32, including server and client certificates.