Deep & Reinforcement Learning (CY-802 (B)) - Unit 4 Short Notes

UNIT 4: Lightweight Cryptography

1.0 Introduction & Motivation

• Definition: Lightweight Cryptography designs cryptographic primitives (ciphers, hashes) optimized for resource-constrained environments.

• Primary Constraints:

  • Power/Energy: Battery-operated devices need minimal energy per operation.

  • Processing Speed: Low clock frequencies (kHz-MHz).

  • Memory: Extremely limited RAM (bytes) and ROM/Flash (KB).

  • Hardware Area: Minimal gate count (GE - Gate Equivalents) for chip size/cost.

• Why Traditional Crypto Fails?

  • AES: 128-bit block, 10+ rounds, S-Box ~160 GE (too large for <1K GE targets).

  • RSA/ECC: Computationally intensive (modular exponentiation), large keys, high memory.

  • SHA-2: Large internal state (256/512-bit), high round count.

• Security Threats for Tiny Devices: Physical tampering, side-channel attacks (power analysis), node capture in IoT networks, constrained network attacks (replay, DoS).

[!TIP] Exam Focus: Be ready to list specific constraints (power, area, memory) and specific examples of traditional algorithms (AES-128 S-Box size, RSA key size) that make them unsuitable.

2.0 Lightweight Block Ciphers: Core Design & Analysis

2.1 Design Philosophies & Strategies

Core Trade-off: Security (rounds, component strength) vs. Efficiency (area, speed, energy). Design choices involve:

• Reducing round count vs. simplifying round function.

• Optimizing S-Box and permutation layer for target platform.

2.2 Specific Cipher Families & Examples

[!TIP] Exam Question (14m): For "design philosophies behind two ciphers", structure your answer: 1) Introduction to each cipher's goal/context. 2) Compare their structure (SPN vs Feistel). 3) Compare S-Box design (size, implementation). 4) Compare permutation/diffusion layer. 5) Summarize the resulting trade-offs (area vs. speed vs. security level).

2.3 Critical Components

• S-Box (Substitution Box):

  • Function: Provides non-linearity (confusion), resists linear/differential cryptanalysis.

  • Lightweight Design: Small size (4-bit), simple implementation (combinational logic), low area. Must balance non-linearity with minimal gate count.

• Permutation Layer (P-Layer):

  • Function: Provides diffusion, spreads bit influence across rounds.

  • Lightweight Design: Bit-shuffling (PRESENT) is extremely cheap in hardware. Byte-rotations (CLEFIA) are cheap in software.

• Key Schedule:

  • Challenge: Must be lightweight but resist related-key attacks.

  • Strategy: Often simpler than AES (e.g., PRESENT uses constant key register update + round constant XOR). Trade-off: Simplicity vs. vulnerability.

2.4 Security Evaluation

• Importance of Public Design & Open Cryptanalysis:

  • "Security by Obscurity" is flawed. Public scrutiny allows global expert community to find flaws.

  • Long-term viability depends on withstanding years of published attacks (linear, differential, integral, algebraic, meet-in-the-middle).

  • Example: Many early lightweight ciphers were broken; only those surviving extensive public analysis (e.g., PRESENT, SIMON) gain trust.

• Common Attack Vectors:

  • Linear/Differential: Analyze S-Box and P-Layer properties.

  • Algebraic: Represent cipher as system of equations (vulnerable if components too simple).

  • Meet-in-the-Middle: Effective against ciphers with simple key schedules or low round count.

[!TIP] Exam Question (14m): For "importance of open design", argue: 1) Peer review is cornerstone of modern crypto. 2) Public analysis finds implementation & design flaws. 3) Builds community trust & standardization (e.g., NIST LWC competition). 4) Contrast with "security through obscurity" (failed historically). 5) Cite examples of broken vs. surviving ciphers.

3.0 Lightweight Stream Ciphers

• Design Principles:

  • LFSR-based: Simple, linear, good speed. Needs non-linear filtering to avoid correlation attacks.

  • NFSR-based (e.g., Trivium, Grain): Non-linear feedback provides inherent security. Often use clock-controlled or filter mechanisms.

  • Goal: Small internal state (e.g., 80-128 bits), efficient update, good output function.

• Birthday-Type Attacks & State Compromise:

  • Vulnerability: If state size is n bits, after ~2^(n/2) outputs, state may be recoverable (birthday paradox).

  • Optimization: Increase state size (e.g., 128+ bits), use complex output function (non-linear combining), ensure high minimal polynomial for LFSRs.

• Examples:

  • Trivium (eSTREAM): 80-bit state, 288-byte key/IV load, very hardware-efficient.

  • Grain-128a: 128-bit state, includes authentication.

  • ChaCha20: Software-oriented ARX, fast on 32-bit CPUs, used in TLS for constrained devices.

4.0 Lightweight Cryptographic Hash Functions

• Purpose: Integrity, commitment, PRF, key derivation. Must resist collisions, preimages, second-preimages.

• Design Challenges:

  • Small Internal State: Reduces memory but lowers security bound (birthday attack on n-bit state gives ~2^(n/2) complexity).

  • Low Round Count: Must maintain diffusion with few rounds.

  • Output Size: Often truncated (e.g., 80-256 bits) for efficiency.

• Examples & Families:

  • Sponge-based (Keccak/SPONGENT): Flexible, absorb/squeeze phases. PHOTON uses compact permutations.

  • Piping/MI-based (Quark, SPONGENT): Very small area, but lower security margins.

  • AES-like (Lightweight SHA-3 candidates): Use small AES-like round functions.

• Real-World Applications: RFID tag authentication (hash-based challenge-response), IoT message integrity (e.g., CoAP), lightweight blockchain.

5.0 Key Management for Lightweight Environments

5.1 Fundamental Concepts & Challenges

• Definition: Lifecycle (generation, distribution, storage, update, revocation, destruction).

• Specific Challenges:

  • Secure Distribution: No secure channel; devices lack public-key crypto.

  • Storage: Secure element/EEPROM is expensive; keys often in volatile RAM.

  • Scalability: Millions of IoT devices; pairwise keys (O(n²)) impossible.

  • Update/Revocation: Devices rarely reachable; over-the-air updates insecure if key compromised.

5.2 Architectural Approaches

5.3 Protocol Integration

• Goal: Adapt standard protocols (IPSec, TLS) for constrained devices (RFC 7925).

• Strategies:

  • Pre-Shared Keys (PSK): Most common. Avoid expensive handshake.

  • Lightweight Cipher Suites: Use PRESENT, SIMON, or AES-CCM instead of AES-GCM.

  • Simplified Handshake: Reduce round trips (e.g., 1-RTT or 0-RTT in TLS 1.3).

  • Header Compression: Use 6LoWPAN to reduce IP/TLS overhead.

• Example: CoAP (Constrained Application Protocol) often uses DTLS with PSK and lightweight ciphers.

5.4 Group Key Management for IoT

• Key Evaluation Criteria (for new protocols):

  1. Communication Overhead: Messages for join/leave/rekey.

  2. Computation Cost: Per-node operations (encryptions, hashes).

  3. Scalability: Support for large, dynamic groups.

  4. Rekeying Efficiency: Cost after member join/leave (forward/backward secrecy).

  5. Collusion Resistance: Compromised nodes shouldn't learn group keys.

  6. Storage Overhead: Keys stored per node (aim for O(log n) like LKH).

• Symmetric Integration:

  • Use LKH: Node stores individual key + chain of key encrypting keys (KEKs). Rekeying updates only keys on path in key tree.

  • Use OFB-mode derivation: Group key = KDF(base_key, group_id). Changing group_id gives new key without re-encrypting to all.

[!TIP] Exam Question (7m): For "key considerations evaluating new protocol", list and briefly explain the 6 criteria above. Use IoT context: e.g., "communication overhead matters because radio transmission is energy-intensive."

6.0 Foundational & Comparative Concepts

6.1 Symmetric vs. Asymmetric Cryptography

6.2 Modes of Operation for Block Ciphers

• Purpose: Allow encrypting data > block size, provide confidentiality/authenticity.

• Common Modes: ECB (insecure), CBC (needs IV, sequential), CTR (parallelizable, random access), OFB/CFB (turn block cipher into stream).

• Relevance for Lightweight Devices:

  • CTR/OFB: Preferred. Parallelizable, no padding, random access. Good for constrained networks.

  • CCM/OCB: Provide authenticated encryption (confidentiality+integrity) in one pass, efficient for IoT.

  • Avoid CBC: Sequential, needs padding, IV management overhead.

6.3 Definition of an "Operation"

• In computational cost analysis, an operation typically refers to a basic logic/arithmetic gate (AND, OR, XOR, ADD, ROTATE) or a CPU cycle.

• Hardware Context: Cost measured in Gate Equivalents (GE). One GE ≈ area of a 2-input NAND gate.

• Software Context: Cost measured in clock cycles or instructions (e.g., an 8-bit ADD on AVR takes 1 cycle, a 32-bit MUL takes 2-4 cycles).

6.4 Summary: Why Standard Encryption Unsuitable

1. Area/Complexity: AES S-Box (~160 GE) > total area budget (<1000 GE) for many RFID tags.

2. Round Count: AES-128 has 10 rounds; lightweight ciphers target 20-40 rounds but with much simpler rounds (e.g., PRESENT-80 has 31 rounds, but each round is ~5-10 GE).

3. Key Size: RSA-2048 requires >1M cycles on 8-bit CPU; impossible for battery life.

4. Memory: AES needs 240 bytes RAM for tables; many sensors have <100 bytes RAM.

5. Energy: AES-128 on ARM Cortex-M0: ~1000 cycles/byte → high energy/bit vs. PRESENT (~500 cycles/byte).

[!TIP] Exam Question (5m): For "key difference symmetric/asymmetric", state: Symmetric uses one shared secret key; asymmetric uses a public/private key pair. Then add one line on performance: symmetric is orders of magnitude faster.