10 votes
Accepted

Lightweight cipher using only 8-bit operations

SPECK was actually designed with 8-bit CPUs in mind. I use Simon and Speck extensively, and there's example source code and comparisons out there, as well as a good paper. The references are good ...
user avatar
  • 4,212
10 votes

Lightweight cipher using only 8-bit operations

I second Richie Frame's observation that AES is an excellent choice. I'd use AES-128 in CTR mode, which has the advantage that decryption is the same as encryption (thus is as fast, contrary to some ...
user avatar
  • 122k
10 votes
Accepted

Signing dynamic data on an embedded system

Signature algorithms of the ECDSA family are amenable to precomputations. Indeed, when you want to sign message m with ECDSA, the process goes thus: We work in a curve (or a subgroup of a curve) of ...
user avatar
8 votes

Least-weak way to authenticate using only AES ECB/CBC

Is there any worthwhile way to authenticate the message using only these functions and simple checksums? As usual, of course there is: AES-CCM! AES-CCM basically is CTR mode with a tagged-on CBC-MAC ...
user avatar
  • 44.6k
8 votes
Accepted

Replay attack prevention in connectionless UDP encrypted communication

The simplest way to deal with replay attack prevention (in some narrow sense of that, where the goal is to avoid that the receiver allows the same command to be played to it several times) is to have ...
user avatar
  • 122k
7 votes

Fast PKI for embedded device

Given that the bottleneck on the embedded device is local non-interactive public-key signature verification, the best industry standard for that is RSA (with a standard signature padding, such as PKCS#...
user avatar
  • 122k
7 votes
Accepted

BN-Curves for 256-bit symmetric security

A BN-curve over a 256-bit prime field $\mathbb{F}_p$ has, being an elliptic curve, a 256-bit group attached to it, say of order $N$. As the best known attacks take $\approx\sqrt{N}$ times, this gives ...
user avatar
6 votes
Accepted

Does still make sense to use SHA1?

No, use SHA256. If you look at https://bench.cr.yp.to/results-hash.html it seems that SHA256 would probably be the better choice concerning speed as well. Therefore I don't see a good reason to go ...
user avatar
  • 4,691
6 votes
Accepted

Combination of TLS_PSK and TLS False Start

There is no real problem with applying "false start" to PSK cipher suites. The "false start" thing is about beginning to use the negotiated key to encrypt data before having ...
user avatar
5 votes

secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

Fgrieu has already posted a good answer, which I won't try to repeat. However, here are a few additional observations: For an embedded system, you may want to consider using CMAC-AES instead of HMAC,...
user avatar
5 votes
Accepted

Key derivation on Arduino

Generally you should try and avoid deriving keys from passwords on embedded devices or passwords. There are a few strategies that could be used. First of all, you can try and design a system that ...
user avatar
  • 84.6k
4 votes

secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

I understand the system as follows: data blocks are enciphered per AES-CTR, using key encryption_key, with an IV made by concatenating ...
user avatar
  • 122k
4 votes

Lightweight cipher using only 8-bit operations

I do not have benchmarks on this particular processor, so this answer is opinion / guesswork. Gimli is fast and low-memory, but is just a permutation. Ciphers can be pretty trivially implemented on ...
user avatar
4 votes

Storing a Secure Boot image with AES-GCM instead of AES + RSA signature

Yes, if you already have a shared symmetric key then this would be something to consider. Note the following: you do not need to store a private key in the embedded systems in your previous scheme; ...
user avatar
  • 84.6k
4 votes

Key derivation on Arduino

There aren't many KDFs that will be faster on an AVR than PBKDF2. In your case, it's likely that the only thing you can do is find a hash which can be implemented efficiently on an ATmega2560, and ...
user avatar
  • 12.9k
4 votes
Accepted

Encryption of small data with fixed key and incremental IV

Can a passive listener break this encryption and/or craft legitimate messages? A passive listener should not be able to reverse AES, so getting the plaintext should be impossible, unless each session ...
user avatar
  • 84.6k
3 votes

Tiny Firmware Authentication

The title says authentication, that is we want only the real firmware to load and run, unmodified. There are fast, practical code signature techniques for that. Most importantly they require no secret ...
user avatar
  • 122k
3 votes
Accepted

How to handle entropy and CTR DRBG for TLS on embedded system?

Unless you have documentation about the RNG interface that states that it's using a cryptographic PRNG seeded by an entropy source, use it only as a seed to a PRNG. (Seed initially, and re-seed from ...
user avatar
3 votes
Accepted

Securing communication between limited embedded systems

A rule in cryptographic protocols is to never implement them on your own. Unfortunately I did not find anything that matches this use case. Have you considered DTLS? That tries to address the same ...
user avatar
  • 131k
2 votes

Fast PKI for embedded device

One alternative to RSA that may bear looking at is hash based signatures, perhaps as worked out in this IETF draft. Here, the signature validation consists of evaluating a series of perhaps a few ...
user avatar
  • 131k
2 votes

Is there an existing AE protocol with forward secrecy for embedded devices?

I've finally found a solution - some variants of key ratcheting, e.g. the one used in SCIMP, provide perfect forward secrecy assuming an initial shared secret is established without any asymmetric ...
user avatar
  • 150
2 votes

How to implement access control for Automotive Embedded Systems using mbedTLS?

As stated in the comments we can't / won't advise on whether PolarSSL is suitable to perform the operations required. However, for your needs $N_1=N_2=N_3=32$ sounds like a reasonable choice, giving ...
user avatar
  • 44.6k
2 votes

secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

Considering the OP specifically mentions replay attacks, which I believe requires a unique CTR for replay protection even with SIV mode, then I believe SIV may only create a potential false sense of ...
user avatar
2 votes

Why is a certificate needed at client side

I think you are confusing something in the mbedTLS ssl_client1 example. The example does not specifiy the server certificate, but the CA (Certificate Authority) certificate. The client loads the CA ...
user avatar
2 votes
Accepted

Hash for use in embedded HMAC application

As cheaper alternatives to HMAC with modest security goals, consider: SipHash—cheaper than MD5 because you don't have to pay for collision resistance; security is limited by the 64-bit output size ...
user avatar
1 vote

Break large exponent calculation into smaller calculations?

One method uses the factorisation the exponent: If $a=bc$ then $x^a \equiv x^{bc}\equiv (x^b)^c \mod m,$ i.e. first compute $y=x^b\mod m$ and then $y^c \mod m$. This method will work, if the ...
user avatar
  • 1,015
1 vote

How is the inter and the intra distance of a PUF calculated?

I believe Roel Maes gives a very good answer to your question in his PhD thesis, pages 20-23. In essence, ideally, you need to calculate an array of the Hamming Distance between every pair of ...
user avatar
1 vote

Why is a certificate needed at client side

Part of the TLS handshake is that the server sends the client its certificate before setting up the secured connection. The client should verify that the certificate is valid, e.g. check whether the ...
user avatar
  • 46
1 vote

Encrypting and Authenticating The Simplex Communication Between Embedded Devices

For my answer, I'll assume that you have symmetric keys pre-shared between your heater and your sensors. If your devices have enough computational power to support asymmetric cryptography (which will ...
user avatar
  • 44.6k

Only top scored, non community-wiki answers of a minimum length are eligible