1
$\begingroup$

i'm building a low-power wireless sensor network in which each slave node has a public/private ECC key pair -- generated by the node itself during manufacturing.... the slave node is also provisioned with the public key of a distinquished master node, at which time the slave can compute a shared secret used during direct communication with the master -- say, to receive an over-the-air firmware update.... assume further that the master node has access to the public keys of any slave nodes it might detect....

in normal operation, the master is doing little more than broadcasting information to the other nodes -- time-of-day, current operating parameters, and so forth.... i would like to add some sort of "mini-signature" to the master's broadcast messages that would give a slave node detecting this broadcast some degree of confidence that the transmitting master is genuine....

i'm using P-256 for my EC, which means i can always append a 64-byte signature to my broadcast packets.... since each slave node has the master's public key, they can verify the encrypted digest in the usual way....

my problem, of course, is that sending a 64-byte signature along with (say) a 10-byte message creates undue strain on my power-budget due to excessive use of the radio.... what i'm looking for is some sort of 4-8 byte "mini MAC" which the master node could encrypt/sign with his private key and which the slave nodes could then decrypt/verify using the master's public key....

obviously, this scheme gives up some of level security that comes from using a full 64-byte signature -- but that's acceptible for this particular application....

any thoughts on how to approach this problem would be much appreciated....

$\endgroup$
  • $\begingroup$ HMAC allows you to truncate the tag to an arbitary length without reducing security to less than that of the bitlength of the final tag. Keep in mind that the smaller the tag, the greater the risk of a malicious collision succeeding at some point in time for some node in the network. Also, HMAC relies on a shared secret, and should be unique per communicating pair (for each node/server). They should also occasionally be replaced to reduce risk of long term key compromise $\endgroup$ – Natanael Apr 27 at 14:31
  • 1
    $\begingroup$ If you are limited to NIST P-256, not much can be done. If you can switch to another curve, you could rotate keys (say) daily and maybe get away with a smaller curve. If you can switch to another signature scheme, you could also maybe use BLS signatures, which are about half the size but have a less stable and less well-understood security story. $\endgroup$ – Squeamish Ossifrage Apr 27 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.