1
$\begingroup$

I am studying a key exchange protocol based on public key cryptography technique specifically designed for mobile devices.

I noticed there is no importance given to battery usage by these protocols. I want to ask how important is this criteria? And if it is important, why is it ignored by certain researchers?

Here are some examples where it is ignored: https://www.researchgate.net/profile/Srinivasan_Bala/publication/266161322_A_PRACTICAL_FRAMEWORK_FOR_MOBILE_SET_PAYMENT/links/54b649650cf26833efd36dc2.pdf

http://ieeexplore.ieee.org/document/6158876/?arnumber=6158876&tag=1 (Symmetric key technique)

$\endgroup$
  • $\begingroup$ Resources are often negligible when it comes to security. That doesn't mean there aren't any 'better' alternatives. $\endgroup$ – Yorick de Wid Dec 21 '16 at 11:09
  • $\begingroup$ One could argue that you can do key exchange only seldomly so the amortized cost could be made negligible... $\endgroup$ – Alexandre Yamajako Dec 21 '16 at 12:40
  • $\begingroup$ when it comes to running code, high battery = slow perf, and most apps are more concerned about fast perf than battery life, though the result is the same. $\endgroup$ – dandavis Dec 22 '16 at 4:12
  • $\begingroup$ So basically it is a trade off between battery saving and performance.. Classic. $\endgroup$ – Pranav Vyas Dec 22 '16 at 10:03
3
$\begingroup$

The Kungpisdan Et al. paper you cite does make mention of battery powered devices with "low-computational capabilities" in section 2.2 "Mobile Payment – Problems and Limitations" although they do not describe exactly why they feel this is a limitation leaving the reader to infer the obvious 'the battery might go flat and make the user unhappy' or 'it's too slow'

But it seems they think it's very important as it is the whole motivation for the protocol they describe.

Modern 'smart phones' perform many many key exchanges, encryption, decryption, signing and so on all day every day. I'm not sure I see the problem.

You SHOULD NOT degrade the security of a system to save a few micro-amps of power.

Even embedded systems that are required to run for many years off a single battery sill use the best possible security. For example LoRaWAN uses authenticated AES with 128 bits keys.


Just to clarify my statement that battery conservation is "the whole motivation" for the protocol that was my opinion. They do also mention data costs and "wireless networks also have limitations on low bandwidth and poor reliability". Firstly protocols, be they security related or not, should be designed to be reliable on the principle that all networks are inherently unreliable be they on your phone or PC. So far as the cost is concerned the customer has already committed to downloading 100's of KB for the privilege of purchasing something via their smart phone so can probably sink the costs of using the existing secure payment service. The consumer is never going to know if they are using SET or SET/A+ or care.

The origional SET/A protocol was published in 1998 and at that time all of the above concerns were valid. Not so in 2015 when SET/A+ was proposed.

|improve this answer|||||
$\endgroup$
  • 1
    $\begingroup$ Agree - Remember that battery life is affected by WiFi/Bluetooth/... so weak encryption is not going to save you massive amounts of power $\endgroup$ – Eugene Styer Dec 21 '16 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.