12
votes
Accepted
Lightweight cipher using only 8-bit operations
SPECK was actually designed with 8-bit CPUs in mind. I use Simon and Speck extensively, and there's example source code and comparisons out there, as well as a good paper. The references are good ...
- 4,948
11
votes
Lightweight cipher using only 8-bit operations
I second Richie Frame's observation that AES is an excellent choice. I'd use AES-128 in CTR mode, which has the advantage that decryption is the same as encryption (thus is as fast, contrary to some ...
- 146k
10
votes
Accepted
Signing dynamic data on an embedded system
Signature algorithms of the ECDSA family are amenable to precomputations. Indeed, when you want to sign message m with ECDSA, the process goes thus:
We work in a curve (or a subgroup of a curve) of ...
- 87.8k
8
votes
Accepted
Replay attack prevention in connectionless UDP encrypted communication
The simplest way to deal with replay attack prevention (in some narrow sense of that, where the goal is to avoid that the receiver allows the same command to be played to it several times) is to have ...
- 146k
7
votes
Accepted
BN-Curves for 256-bit symmetric security
A BN-curve over a 256-bit prime field $\mathbb{F}_p$ has, being an elliptic curve, a 256-bit group attached to it, say of order $N$. As the best known attacks take $\approx\sqrt{N}$ times, this gives ...
- 3,509
6
votes
Accepted
Combination of TLS_PSK and TLS False Start
There is no real problem with applying "false start" to PSK cipher suites. The "false start" thing is about beginning to use the negotiated key to encrypt data before having ...
- 87.8k
6
votes
Accepted
Key derivation on Arduino
Generally you should try and avoid deriving keys from passwords on embedded devices or passwords. There are a few strategies that could be used.
First of all, you can try and design a system that ...
- 94.5k
6
votes
Accepted
Does still make sense to use SHA1?
No, use SHA256.
If you look at https://bench.cr.yp.to/results-hash.html it seems that SHA256 would probably be the better choice concerning speed as well. Therefore I don't see a good reason to go ...
- 4,933
6
votes
Utilizing block cipher (AES) while saving bandwith
That technique from the code is known as "ciphertext stealing". We usually use it with CBC, but your client seem to be using ECB.
So yes, it has the flaw of using the insecure ECB mode.
- 9,795
5
votes
Utilizing block cipher (AES) while saving bandwith
This is a custom 18-byte block cipher using two 16-byte keyed substitution steps:
It has some slight flaws, the two most striking of which being:
if the first 16 bytes of plaintext match, then the ...
- 146k
4
votes
Lightweight cipher using only 8-bit operations
I do not have benchmarks on this particular processor, so this answer is opinion / guesswork.
Gimli is fast and low-memory, but is just a permutation. Ciphers can be pretty trivially implemented on ...
- 5,899
4
votes
Key derivation on Arduino
There aren't many KDFs that will be faster on an AVR than PBKDF2. In your case, it's likely that the only thing you can do is find a hash which can be implemented efficiently on an ATmega2560, and ...
- 15.5k
4
votes
Storing a Secure Boot image with AES-GCM instead of AES + RSA signature
Yes, if you already have a shared symmetric key then this would be something to consider.
Note the following:
you do not need to store a private key in the embedded systems in your previous scheme;
...
- 94.5k
4
votes
Accepted
Encryption of small data with fixed key and incremental IV
Can a passive listener break this encryption and/or craft legitimate messages?
A passive listener should not be able to reverse AES, so getting the plaintext should be impossible, unless each session ...
- 94.5k
3
votes
Authenticated encryption scheme for one-way radio telemetry
There's two reasonable strategies:
symmetric crypto + database to speed up search
relies on nonces being mostly sequential and not too many messages getting lost
asymetric crypto
Note:both ...
- 1,751
3
votes
Accepted
Securing communication between limited embedded systems
A rule in cryptographic protocols is to never implement them on your own. Unfortunately I did not find anything that matches this use case.
Have you considered DTLS? That tries to address the same ...
- 151k
3
votes
Tiny Firmware Authentication
The title says authentication, that is we want only the real firmware to load and run, unmodified. There are fast, practical code signature techniques for that. Most importantly they require no secret ...
- 146k
2
votes
secure embedded/microcontroller crypto using AES-ctr with hmac-sha2
Considering the OP specifically mentions replay attacks, which I believe requires a unique CTR for replay protection even with SIV mode, then I believe SIV may only create a potential false sense of ...
2
votes
How to implement access control for Automotive Embedded Systems using mbedTLS?
As stated in the comments we can't / won't advise on whether PolarSSL is suitable to perform the operations required.
However, for your needs $N_1=N_2=N_3=32$ sounds like a reasonable choice, giving ...
- 46.4k
2
votes
Accepted
Hash for use in embedded HMAC application
As cheaper alternatives to HMAC with modest security goals, consider:
SipHash—cheaper than MD5 because you don't have to pay for collision resistance; security is limited by the 64-bit output size
...
- 49.5k
2
votes
Authenticated encryption scheme for one-way radio telemetry
Caution: truly anonymous transmission is hard!
It's stated this constraint:
An attacker must not be able to identify which device sent a specific telemetry packet
That's hard, because a powerful ...
- 146k
2
votes
Why is a certificate needed at client side
I think you are confusing something in the mbedTLS ssl_client1 example. The example does not specifiy the server certificate, but the CA (Certificate Authority) certificate. The client loads the CA ...
- 786
2
votes
Accepted
ECDH/ECDSA key exchange on embedded devices
You can assign each device its own unique certificate with a signature issued by the CA (for example, could be the manufacturer) on the certificate. So each device stores the following: its own unique ...
- 845
1
vote
Accepted
DIY TRNG on an embedded system for Ethereum private key generation
Bottom line up-front: don't do it.
First of all, what threat modeling have you done? In other words, if someone physically has the wallet (device) and they crack it open, the source of entropy is ...
- 232
1
vote
Why is a certificate needed at client side
Part of the TLS handshake is that the server sends the client its certificate before setting up the secured connection. The client should verify that the certificate is valid, e.g. check whether the ...
- 46
1
vote
Break large exponent calculation into smaller calculations?
Is there a way to break this exponentiation into smaller
exponentiations that the modular exponentiation function can handle?
Yes there is. Normally one would do this with pre-computatations to ...
- 46.4k
1
vote
Break large exponent calculation into smaller calculations?
One method uses the factorisation the exponent: If $a=bc$ then $x^a \equiv x^{bc}\equiv (x^b)^c \mod m,$
i.e. first compute $y=x^b\mod m$ and then $y^c \mod m$.
This method will work, if the ...
- 1,005
1
vote
Lightweight cipher using only 8-bit operations
SAFER++ might also be a good choice as it has only 8-bit operations, however it requires 512 bytes of ROM for tables.
Speck has one rotation by 8 and one by 3 per round. Rotation by 8 was probably ...
- 1,702
1
vote
How is the inter and the intra distance of a PUF calculated?
I believe Roel Maes gives a very good answer to your question in his PhD thesis, pages 20-23.
In essence, ideally, you need to calculate an array of the Hamming Distance between every pair of ...
1
vote
Is there a secure source of entropy on a typical microcontroller?
I have done some experiments here: https://github.com/kuro68k/xrng
TL;DR using the LSB of an Atmel XMEGA's internal temperature sensor and VCC/10 inputs to the ADC, then feeding that through a CRC32 ...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible