# Can we use elliptic curve cryptography in wireless sensors?

Can we use elliptic curve cryptography in wireless sensors?

If so, how do you map points to message characters?

-
One nice (not too detailed) overview paper I found: research.microsoft.com/en-us/um/people/klauter/ieeefinal.pdf –  Paŭlo Ebermann Apr 29 '12 at 17:47

## 2 Answers

Yes, one can use Elliptic Curve Cryptography in wireless sensors.

A typical use of ECC in this domain would be to authenticate the sensor and establish a symmetric session key using a combination of ECDSA and ECDH. That symmetric session key would then protect application data, insuring confidentiality and integrity using AES-GCM. This is hybrid cryptography.

Notice that in this typical use case, there is no mapping of points on elliptic curve to "message characters" representing application data; rather, application data is dealt with by mean of symmetric cryptography.

The main benefit of using ECC rather than RSA or Rabin in resource-constrained devices like wireless sensors is that for equivalent security, ECC needs less RAM, and shorter keys and messages; and also less CPU power when computing a signature, or establishing a session key, or (hybrid) DEcryption. On the other hand, for signature verification or straight Public Key ENcryption, RSA uses less CPU power (and allows shorter signed messages as well for many real-life use cases, including certificates).

As a consequence, ECC has an edge when there needs to be a public method to authenticate the data coming from the sensor (which implies ability to protect confidentiality of a private key in the sensor), or when RAM is extremely constrained, or when the amount of data exchanged during key establishment needs to be reduced to the max.

For other uses, including protecting the sensor from rogue commands and insuring confidentiality of the data sent by the sensor (basically the only goals still achievable when it is impossible to protect long term confidentiality of key material held in the sensor), RSA or Rabin is often a better choice than ECC. More RAM is required, but 1kByte is plenty enough for 2048 bit modulus, and it is used only temporarily during signature verification or PK encryption.

-
"and allows shorter signed messages as well for many real-life use cases, including certificates" what do you mean by that? –  CodesInChaos Apr 11 '12 at 12:45
@CodeInChaos: Using an RSA signature scheme with message recovery, a signed message needs only be slightly bigger than the original message: 22 bytes over the message or the modulus size, whichever is bigger, when using ISO/IEC 9796-2 scheme 1 with SHA-1, common in the Smart Card industry. Schemes 2 and 3 have provable security. One bearable drawback is that a portion of the message can only be recovered using the public key. –  fgrieu Apr 12 '12 at 7:07

Of course wireless sensors can use elliptic curve cryptography, why wouldn't they be able to? TinyECC provides elliptic curve crypto for TinyOS. If you are on another OS, you'll have to find a library that will work for your platform.

As for mapping a message to points, the problem is the same whether you are on a sensor or a desktop computer. It is, however, a little trickier than in other cryptosystems (e.g., RSA). Section 16.2.3 of "Introduction to Cryptography with Coding Theory" has this to say about the general idea:

The problem of encoding plaintext messages as points on an elliptic curve is not as simple as it was in the conventional case. In particular, there is no known polynomial time, deterministic algorithm for writing down points on an arbitrary elliptic curve $E\pmod p$. However, there are fast probabilstic methods for finding points, and these can be used for encoding messages.

Instead of typing out the entire section, I'll assume you can get access to the book and see the method described. There are others that you should be able to find online with out much trouble (TinyECC might even have the methods pre-coded for you).

-