Deep & Reinforcement Learning (CY-802 (B)) - Unit 5 Short Notes

UNIT 5: Lightweight Cryptography

1.0 Introduction & Fundamental Concepts

Lightweight Cryptography refers to cryptographic primitives and protocols specifically designed for resource-constrained environments (e.g., IoT nodes, RFID tags, wireless sensors) where traditional algorithms (AES, RSA) are impractical due to severe limitations in:

• Power/Energy (battery-operated, often energy-harvesting)

• Processing speed (low clock frequencies, simple CPUs)

• Memory (RAM in kilobytes, ROM/flash in tens of kilobytes)

• Cost (per-unit cost sensitivity)

• Physical size (minimal gate area for ASIC/FPGA)

[!TIP] Exam Focus: Be prepared to list specific constraints (power, memory, cost) and why AES/RSA fail (e.g., AES-128 requires ~3.4k GE for hardware; RSA key generation is computationally heavy).

Comparison with Traditional Cryptography:

"Operations" in Computing Context: A fundamental unit of computation (e.g., a logical gate, an addition, a lookup). Metrics like gate count (hardware area) or CPU cycles (software speed) measure the cost of these operations.

2.0 Core Cryptographic Primitives for Lightweight Systems

2.1 Block Ciphers

Design Strategies & Philosophies:

• Hardware Optimization: Minimize gate count (GE). Achieved via:

  • Bit-oriented operations (vs. byte-oriented in AES).

  • Smaller S-Boxes (4-bit vs. 8-bit).

  • Simplified, lightweight key schedule.

  • Fewer rounds with efficient round function.

• Software Optimization: Minimize RAM/ROM footprint. Use:

  • Table-based implementations (small lookup tables).

  • Operations efficient on 8-bit microcontrollers.

• Core Trade-off: Security (resistance to cryptanalysis) vs. Efficiency (speed, energy, area).

Specific Cipher Families:

[!TIP] Exam Question: "Describe design philosophies behind PRESENT and CLEFIA."

PRESENT: Extreme hardware focus, bit-serial processing, minimal GE.

CLEFIA: Software-friendly on 8-bit CPUs, Feistel structure, larger block size.

Substitution Boxes (S-Boxes):

• Purpose: Provide confusion (non-linear relationship between plaintext and ciphertext), core resistance against linear/differential cryptanalysis.

• Lightweight S-Box Design: Must be small (typically 4-bit input → 4-bit output), have low implementation cost (few logic gates, small lookup table), and maintain good cryptographic properties (non-linearity, differential uniformity).

• Example: PRESENT uses a single 4-bit S-Box (16 entries) reused throughout.

2.2 Modes of Operation

• Concept: Using a block cipher (fixed block size) to encrypt data longer than the block size.

• Lightweight-Specific Modes: Prioritize minimal overhead (small IV/nonce, low state size).

  • CTR (Counter) Mode: Highly parallelizable, only requires encryption (not decryption), efficient for streaming. Needs unique nonce.

  • ECB (Electronic Codebook): Simplest, but insecure for repeated blocks. Rarely recommended except for single-block messages in very constrained cases.

  • Other: Lightweight variants of CBC, OFB may be used if state size is critical.

• Considerations: Parallelizability (CTR > CBC), IV/nonce management overhead, error propagation (CBC propagates errors, CTR does not).

2.3 Stream Ciphers

• Design for Efficiency: Often based on:

  • LFSR (Linear Feedback Shift Register): Simple, fast, but linear → vulnerable if not combined with non-linear component.

  • NFSR (Non-Linear Feedback Shift Register): Provides non-linearity.

  • Hybrid: LFSR for long period, NFSR for non-linearity (e.g., Trivium, Grain in eSTREAM portfolio).

• Security Vulnerabilities & Mitigations:

  • Birthday Attack Context: For a stream cipher with n-bit internal state, the expected repetition (collision) occurs after ~$$\displaystyle 2^{n/2} $$ bits. Must ensure period >> expected message length.

  • Optimization: Design ensures long period (e.g., $$\displaystyle 2^{80} $$+ bits), good statistical properties, and resistance to distinguishing attacks while keeping gate count low.

2.4 Cryptographic Hash Functions

• Purpose: Integrity (detect modification), commitment, key derivation (KDF), digital signatures (with public-key).

• Lightweight Hash Designs: Often based on sponge construction (absorb/p squeeze phases) or iterated compression functions with small internal state.

  • Examples: SPONGENT, QUARK, PHOTON (also offer authenticated encryption).

• Real-World Applications in Constrained Devices:

  • Message Authentication Codes (MACs): e.g., using a lightweight hash in HMAC or CMAC mode.

  • Key Derivation Functions (KDFs): Deriving session keys from a master key.

  • Digital Signatures: Paired with lightweight public-key schemes (e.g., ECC with small curve).

3.0 Symmetric Key Management for Lightweight Systems

3.1 Core Concepts & Challenges

• Key Management Lifecycle: Generation → Distribution → Storage → Usage → Revocation → Destruction.

• Specific Challenges for Constrained Devices:

  • Secure Storage: Limited secure memory (e.g., no secure element).

  • Energy Cost: Key establishment protocols (e.g., Diffie-Hellman) are expensive.

  • Lack of True RNG: Weak randomness compromises key generation.

  • Scalability: Managing keys for thousands/millions of devices.

3.2 Centralized vs. Distributed Key Management

3.3 Integration into Standard Protocols

• Adapting IPSec/TLS for Constrained Environments:

  • Cipher Suites: Replace AES with PRESENT or CLEFIA.

  • Handshake Optimization: Reduce round trips (e.g., 1-RTT or 0-RTT), minimize message sizes (compact certificates, smaller ephemeral keys).

  • Session Resumption: Use lightweight session tickets or PSK modes to avoid full handshake.

  • Challenge: Maintaining forward secrecy and authentication with minimal computational/communication overhead.

3.4 Group Key Management for IoT

• Purpose: Secure multicast/broadcast (e.g., firmware updates, sensor data dissemination) in sensor networks, smart grids.

• Key Evaluation Considerations for New Protocols:

  • Scalability: Support for large group sizes (N).

  • Re-keying Efficiency: Cost (messages, computation) to add/remove a member.

  • Forward Secrecy: Compromise of a node's key should not reveal past group keys.

  • Backward Secrecy: Removal of a node should prevent it from accessing future keys.

  • Resilience: To node capture and insider attacks.

  • Energy Profile: Total energy per re-keying operation.

  • Topology Fit: Star (gateway-centric), mesh (distributed), tree (hierarchical).

• Integrating Symmetric Key Management:

  • Use a lightweight group key agreement based on symmetric primitives (e.g., using a group controller with a tree-based key distribution).

  • Hierarchical Approach: Partition large group into clusters, each with a cluster head managing a subgroup key. Reduces re-keying cost from O(N) to O(log N) or O(1) per member change.

4.0 Security Analysis & Design Principles

4.1 Critical Role of Open Design and Public Scrutiny

• Kerckhoffs's Principle: Security should depend only on the key, not on secrecy of the algorithm. → Open design is mandatory.

• Importance of Public Cryptanalysis: Wide scrutiny by research community finds subtle weaknesses (e.g., weak S-Box, related-key attacks) before adversaries exploit them.

• Long-term Viability: Algorithms with no published attacks after years of public review gain confidence (e.g., AES).

• Challenge for Lightweight Ciphers: Smaller design teams, less initial scrutiny → higher risk of undiscovered flaws. NIST standardization process (see 5.2) mitigates this.

4.2 Threat Model for Tiny Devices

• Physical Attacks:

  • Side-channel: Power analysis, timing attacks (extract keys from physical leakage).

  • Fault Injection: Glitching, laser attacks to induce errors and reveal secrets.

  • Reverse Engineering: Microprobing, decapsulation to read memory.

• Network Attacks: Eavesdropping, spoofing, replay attacks, node capture (physical seizure → full key extraction).

• Resource Exhaustion: Battery drain attacks, DoS via repeated connection attempts.

• Key Difference from Traditional: Physical access is assumed (adversary can capture device). Extreme resource limits prevent complex defenses (e.g., heavy RSA signatures for authentication).

4.3 Symmetric vs. Asymmetric Cryptography in Constrained Settings

[!TIP] Exam Question: "What is the key difference between symmetric and asymmetric cryptography?"

Answer: Symmetric uses the same secret key for both operations; asymmetric uses a public/private key pair. This makes asymmetric suitable for key exchange/ signatures but too slow for bulk encryption on constrained devices.

5.0 Evaluation & Future Directions

5.1 Metrics for Evaluating Lightweight Solutions

5.2 Standardization Efforts

• NIST Lightweight Cryptography Project: Finalists/winner (ASCON) chosen for authenticated encryption with associated data (AEAD). Other finalists: GIMLI, Xoodoo, SPARKLE.

• Other Bodies: ISO/IEC (lightweight crypto standards), CAESAR (competition for authenticated encryption, included lightweight candidates).

5.3 Application-Specific Considerations

• Tailor choice to application:

  • Healthcare (wearables): Ultra-low power, small data packets → prioritize energy/bit, simple key management (pre-shared with hub).

  • Smart Metering: Periodic larger data bursts, need for strong integrity → prioritize throughput, robust group key management for firmware updates.

  • Industrial IoT (IIoT): Real-time control, high reliability → prioritize low latency, deterministic re-keying, hierarchical key management.

\boxed{\text{Core Exam Takeaways:}}

1. Lightweight Crypto trades some security margin for drastic reductions in area, power, memory.

2. Design Strategies: Bit-oriented ops, small S-Boxes, simple key schedules (e.g., PRESENT).

3. Modes: CTR is often preferred for parallelism and simplicity.

4. Key Management: Centralized (simple, single point of failure) vs. Distributed (complex, resilient).

5. Security Relies on Open Design (Kerckhoffs) and public scrutiny.

6. Symmetric crypto is for bulk data; asymmetric (ECC) is for key establishment/signatures in hybrid systems.

7. Evaluation Metrics: GE (hardware), RAM/ROM (software), attack resistance (security).

8. NIST ASCON is a leading standardized lightweight AEAD cipher.