I've come across something out of Philips Research called HIMMO Key Pre-Distribution Scheme (https://eprint.iacr.org/2016/410.pdf and https://www.ietf.org/proceedings/96/slides/slides-96-cfrg-2.pdf) that seems to solve an IoT need I have. It also seems too good to be true. It appears I can get rid of the hardware and power expense of a public key exchange with HIMMO. What Am I missing? I've not been able to find any critiques of the approach. I've also not seen any verilog or software implementations of the HIMMO lattice so it is hard to estimate the silicon cost to implement the whole solution without doing the work. I would value any feedback, pointers to reviews of HIMMO and alternatives for lightweight devices.

My specific challenge: I need to build security between a family of IoT devices with limited bandwidth (ZigBee or Bluetooth BLE) that has severe power restrictions. My messages text will usually be small, about 10 bytes and have limited time value (seconds). During these few seconds there could be minor financial loss and perhaps a minor theoretical safety risk. But I do need to occasionally send some secure account info that will be larger (~16 bytes) that needs stronger authentication and there would be some benefit from non-repudiation. My security will be re/authorizing a time limited "services" between an IC (an ASIC without an on chip CPU) built into each network node. The ICs do the "service" so if I can secure the ICs to IC link I should be golden. We can not trust the CPUs supplying underlying communications in the nodes so we will must build security into the ICs. Provisioning at manufacturing-time is perfectly acceptable. Adding the gates for a public key infrastructure would be expensive so HIMMO seems attractive on its surface.


Is HIMMO For Real? ... I've not been able to find any critiques of the approach.

First up, let me quote the HIMMO website itself which described it as broken at the time you asked your question:

HIMMO has been shown to have limited collusion resistance capabilities...

Beyond that, several papers - describing potentials but also weaknesses - have been published over time. Some of the more interesting examples would be:

Last but not least, the probably most interesting HIMMO-related paper at the time of writing this answer is the following publication from 2016:

  • $\begingroup$ Isn't the last and most interesting paper's abstract.essentially describing a recent break-and-repair iteration, a well known sign that a cryptographic algorithm is not ready for prime time? $\endgroup$ – fgrieu May 17 '17 at 11:22
  • 1
    $\begingroup$ @fgrieu Indeed. As noted, the HIMMO website itself already said it's broken at the time the Q was asked. The reason for saying "probably the most interesting" was that the original paper describing the attack isn't available anymore. Neither via their site, nor anywhere else (as far as I was able to research). That last paper mentioned comes closest to describing the attack(s) on HIMMO and (just like you said) even though they try to present fixes, it still shows things aren't as great as they seemed to be. In the end, initial breaks surely are clear warning sign… and fixes rarely fix it all. $\endgroup$ – e-sushi May 17 '17 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.