Protocol Design for IoT devices having PSK using AES-GCM Handshake:


  1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv"
  
  2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag





  Client_key_256bit = Client_random_128bit + Server_random_128bit
  
  Server_key_256bit = Server_random_128bit + Client_random_128bit




Communication:

$c_{iv}=1, \space s_{iv}=1$


  Client_Encrypted_Message = AES-GCM(Message,$c_{iv} \space$,Client_key_256bit),$c_{iv} \space$,tag;
  
  Server_Encrypted_Message = AES-GCM(Message,$s_{iv} \space$,Server_key_256bit),$s_{iv} \space $,tag;


For every Subsequent Message $c_{iv}$ and $s_{iv}$ is incremented by $1$ by client and server respectively.

Client and Server makes sure every new massage's $c_{iv}$ or $s_{iv}$ is greater than the previous massage's else the session is terminated. (tcp protocol)

This is because I don't know any other way to make sure the massage/command is executed only once or to prevent replay attack.

Is there better way to do this considering the device can't keep track of time?

Would it be OK if the $iv$ used in handshake gets repeated considering the plain text is a random number?

Is this secure enough?

Here client is referred to iot_device and device_id as client_id.

psk is referred to pre_shared_key configured in the device at company and known to server.
Would it be OK if the iv used in handshake gets repeated considering the plain text is a random number?


No, it would definitely not be OK.  Reusing the IV will allow the attacker to recover the internal GCM H value - this will allow the attacker to make arbitrary modifications to encrypted messages.

For static keying (or anywhere else where it's difficult to avoid repeating the IV), GCM might not be the correct solution.  Perhaps AES-SIV would work better?