Security in plain words: what protects your weights, records and passwords

In short

• No internet on the device: it has no network connection at all, so nobody can reach it from the internet. It talks only to the phones and computers next to it.
• Everything over Bluetooth is encrypted on PRO and ENTERPRISE (AES-128): weights, settings, sales, users. A listener sees only random bytes.
• New keys for every connection. They are thrown away afterwards, so a recording of today's connection stays closed even if somebody steals the device later.
• The app checks that it really talks to your scale (a digital signature), so nobody can sit in between.
• Only your devices, if you want: ENTERPRISE scales can let in only the phones and computers you registered.
• Passwords never cross the air in plain text, and the scale stores only a salted, slow hash of them.
• Records you can check: a SHA-256 chain links the entries of the activity log, and reports are sealed so that anybody can check them.
• Only standard algorithms (AES, ECDH, ECDSA, SHA-256, HKDF, PBKDF2) from well-known crypto libraries: no cipher of our own.

Two kinds of data bridge

The cable/connection between your scale and the adapter stays where it is: plain RS-232, as the scale sends it. Everything that leaves the bridge by radio to the app is encrypted.

The encrypted link TRY 14 DAYS FREEPROENTERPRISE

On PRO and ENTERPRISE it is on by default; the switch is in the settings box USB, BLE & ESP-NOW. What happens when your app connects (it takes about one second):

1. Hello: the app asks the scale for its state and its public key. Only public things go openly here, nothing secret.
2. A one-time key on both sides: the app and the scale each make a brand-new key pair for this connection only (ECDH P-256).
3. The scale signs: it signs its one-time key with its own permanent key. The app checks that signature. On an ENTERPRISE scale with a seal certificate the app checks the key against our certificate; otherwise it remembers the key at the first connection and asks you if it ever changes. A device posing as your scale fails here.
4. The same keys on both sides, without sending them: both compute them from the two one-time keys (HKDF-SHA256). One key for app → scale, and one key for scale → app for each connection, so two phones never share one.
5. Every packet is encrypted with AES-128 and gets a counter and a 128-bit check code. A packet that was changed, sent again or sent to the wrong place is thrown away; after 16 such packets the scale drops the connection.
6. When you disconnect, the keys are wiped from memory. The next connection starts again from step 1 with new keys.

Manual: Encrypted Link, registered apps

Who may connect

Manual: users, password rules, registered apps

Passwords

• Never in plain text over the air: the app puts the password into an envelope that only this scale can open (encrypted with its key) - and on PRO and ENTERPRISE that envelope travels inside the encrypted link as well.
• Never stored as they are: the scale keeps only a salted hash, made slow on purpose (PBKDF2, 10,000 rounds), so that guessing is hard even for somebody who reads out the memory.
• Nobody can read them back - not even we. A forgotten password is set new by another ADMIN.
• Rules if you need them: lockout after 5 wrong tries, an optional maximum age, and a password set by an ADMIN must be changed at the first login.

Records you can check ENTERPRISE

• Activity log in the scale: the last 10,000 events (who changed or did what, and when). Each entry carries the SHA-256 fingerprint of the one before it: change, remove or insert one, and the chain shows it.
• Power cuts: an entry is written in steps that a power cut cannot mix up. If the power goes off in the middle, the scale finishes or leaves out that one entry at the next start, so the chain stays whole, and it notes the interruption in the log. Saved entries, users and settings are not affected; a lost Bluetooth connection changes nothing.
• Sealed files: reports, PDF files and exports are sealed by the scale with its own key (ECDSA P-256), and our licence key vouches for that scale. Anybody can check a file on up-scales.com/check - in the browser, nothing is uploaded.
• Sales records PRO are numbered and chained by the scale, with the weight it measured itself.

This is tamper-evident: a change or a gap cannot be hidden unnoticed. The memory of the scale and the files on your disk can still be overwritten or deleted - keep the record files on read-only, backed-up storage. In detail: audit trail & data integrity, sealed sales records, how it works.

Licence, updates and the app

• Updates only from you: new firmware is installed by you, by USB from your computer. Nobody can push one to your scale over the air.
• Signed licence keys: a licence key is signed by us (ECDSA P-256) and bound to the chip of your scale; the scale checks it with our public key.
• The app never calls home: it runs in your browser, also offline. The online lookup of a lost licence or a seal certificate happens only after you say OK, and only the Device ID is sent.
• Your data stays on your scale and in your browser - no cloud, no account.

What is not encrypted - on purpose

Your own Bluetooth programs (like the example sketches for developers) cannot read an encrypted link: switch it off for them.

The limits - honestly

Tested: the app against a full emulation of the scale (signature check, wrong signature, replay, changed packets, registration, refused devices), and the whole connection. The algorithms are standard; the way they are put together is our own protocol. This is a description of what we built, not a certification.

For your IT: the algorithms

The scale uses mbedTLS (ESP-IDF), the app the Web Crypto API of your browser.

Replay: the scale takes an app packet only with a higher counter than the one before; the app takes each counter once inside a window of 64. Up to 4 connections at once. Need more for a security review? Write to us: joan[at]farm23.es.

For good! → · audit trail & data integrity → · for laboratories →