# Tag Info

Accepted

### Lightweight cipher using only 8-bit operations

SPECK was actually designed with 8-bit CPUs in mind. I use Simon and Speck extensively, and there's example source code and comparisons out there, as well as a good paper. The references are good ...
• 4,212

### Lightweight cipher using only 8-bit operations

I second Richie Frame's observation that AES is an excellent choice. I'd use AES-128 in CTR mode, which has the advantage that decryption is the same as encryption (thus is as fast, contrary to some ...
• 122k
Accepted

### Signing dynamic data on an embedded system

Signature algorithms of the ECDSA family are amenable to precomputations. Indeed, when you want to sign message m with ECDSA, the process goes thus: We work in a curve (or a subgroup of a curve) of ...
• 84.5k

### Least-weak way to authenticate using only AES ECB/CBC

Is there any worthwhile way to authenticate the message using only these functions and simple checksums? As usual, of course there is: AES-CCM! AES-CCM basically is CTR mode with a tagged-on CBC-MAC ...
• 44.6k
Accepted

### Replay attack prevention in connectionless UDP encrypted communication

The simplest way to deal with replay attack prevention (in some narrow sense of that, where the goal is to avoid that the receiver allows the same command to be played to it several times) is to have ...
• 122k

### Fast PKI for embedded device

Given that the bottleneck on the embedded device is local non-interactive public-key signature verification, the best industry standard for that is RSA (with a standard signature padding, such as PKCS#...
• 122k
Accepted

### BN-Curves for 256-bit symmetric security

A BN-curve over a 256-bit prime field $\mathbb{F}_p$ has, being an elliptic curve, a 256-bit group attached to it, say of order $N$. As the best known attacks take $\approx\sqrt{N}$ times, this gives ...
• 3,389
Accepted

### Does still make sense to use SHA1?

No, use SHA256. If you look at https://bench.cr.yp.to/results-hash.html it seems that SHA256 would probably be the better choice concerning speed as well. Therefore I don't see a good reason to go ...
• 4,691
Accepted

### Combination of TLS_PSK and TLS False Start

There is no real problem with applying "false start" to PSK cipher suites. The "false start" thing is about beginning to use the negotiated key to encrypt data before having ...
• 84.5k

### secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

Fgrieu has already posted a good answer, which I won't try to repeat. However, here are a few additional observations: For an embedded system, you may want to consider using CMAC-AES instead of HMAC,...
• 44.2k
Accepted

### Key derivation on Arduino

Generally you should try and avoid deriving keys from passwords on embedded devices or passwords. There are a few strategies that could be used. First of all, you can try and design a system that ...
• 84.6k

### secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

I understand the system as follows: data blocks are enciphered per AES-CTR, using key encryption_key, with an IV made by concatenating ...
• 122k

### Lightweight cipher using only 8-bit operations

I do not have benchmarks on this particular processor, so this answer is opinion / guesswork. Gimli is fast and low-memory, but is just a permutation. Ciphers can be pretty trivially implemented on ...
• 4,934

### Storing a Secure Boot image with AES-GCM instead of AES + RSA signature

Yes, if you already have a shared symmetric key then this would be something to consider. Note the following: you do not need to store a private key in the embedded systems in your previous scheme; ...
• 84.6k

### Key derivation on Arduino

There aren't many KDFs that will be faster on an AVR than PBKDF2. In your case, it's likely that the only thing you can do is find a hash which can be implemented efficiently on an ATmega2560, and ...
• 12.9k
Accepted

### Encryption of small data with fixed key and incremental IV

Can a passive listener break this encryption and/or craft legitimate messages? A passive listener should not be able to reverse AES, so getting the plaintext should be impossible, unless each session ...
• 84.6k

### Tiny Firmware Authentication

The title says authentication, that is we want only the real firmware to load and run, unmodified. There are fast, practical code signature techniques for that. Most importantly they require no secret ...
• 122k
Accepted

### How to handle entropy and CTR DRBG for TLS on embedded system?

Unless you have documentation about the RNG interface that states that it's using a cryptographic PRNG seeded by an entropy source, use it only as a seed to a PRNG. (Seed initially, and re-seed from ...
Accepted

### Securing communication between limited embedded systems

A rule in cryptographic protocols is to never implement them on your own. Unfortunately I did not find anything that matches this use case. Have you considered DTLS? That tries to address the same ...
• 131k

### Fast PKI for embedded device

One alternative to RSA that may bear looking at is hash based signatures, perhaps as worked out in this IETF draft. Here, the signature validation consists of evaluating a series of perhaps a few ...
• 131k

### Is there an existing AE protocol with forward secrecy for embedded devices?

I've finally found a solution - some variants of key ratcheting, e.g. the one used in SCIMP, provide perfect forward secrecy assuming an initial shared secret is established without any asymmetric ...
• 150

### How to implement access control for Automotive Embedded Systems using mbedTLS?

As stated in the comments we can't / won't advise on whether PolarSSL is suitable to perform the operations required. However, for your needs $N_1=N_2=N_3=32$ sounds like a reasonable choice, giving ...
• 44.6k

### secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

Considering the OP specifically mentions replay attacks, which I believe requires a unique CTR for replay protection even with SIV mode, then I believe SIV may only create a potential false sense of ...

### Why is a certificate needed at client side

I think you are confusing something in the mbedTLS ssl_client1 example. The example does not specifiy the server certificate, but the CA (Certificate Authority) certificate. The client loads the CA ...
• 726
Accepted

### Hash for use in embedded HMAC application

As cheaper alternatives to HMAC with modest security goals, consider: SipHash—cheaper than MD5 because you don't have to pay for collision resistance; security is limited by the 64-bit output size ...
• 45.6k
1 vote

### Break large exponent calculation into smaller calculations?

One method uses the factorisation the exponent: If $a=bc$ then $x^a \equiv x^{bc}\equiv (x^b)^c \mod m,$ i.e. first compute $y=x^b\mod m$ and then $y^c \mod m$. This method will work, if the ...
• 1,015
1 vote

### How is the inter and the intra distance of a PUF calculated?

I believe Roel Maes gives a very good answer to your question in his PhD thesis, pages 20-23. In essence, ideally, you need to calculate an array of the Hamming Distance between every pair of ...
1 vote

### Why is a certificate needed at client side

Part of the TLS handshake is that the server sends the client its certificate before setting up the secured connection. The client should verify that the certificate is valid, e.g. check whether the ...
• 46
1 vote

### Encrypting and Authenticating The Simplex Communication Between Embedded Devices

For my answer, I'll assume that you have symmetric keys pre-shared between your heater and your sensors. If your devices have enough computational power to support asymmetric cryptography (which will ...
• 44.6k

Only top scored, non community-wiki answers of a minimum length are eligible