Lightweight Cryptography (CY-802 (C)) - Unit 2 Short Notes

UNIT 2: Lightweight Cryptography - Core Concepts & Applications

I. Introduction & Motivation for Lightweight Cryptography

Definition: Lightweight cryptography refers to cryptographic primitives (ciphers, hash functions, etc.) specifically designed for resource-constrained environments where traditional algorithms are impractical.

Why Traditional Algorithms (AES, RSA) Are Unsuitable:

Primary Design Goals: Area (gate count), Speed (throughput), Energy consumption, Security margin.

[!TIP] Exam Focus: Be prepared to list at least two specific resource constraints (e.g., gate count, RAM, energy) and explain their impact.

II. Lightweight Block Ciphers

A. Design Strategies & Philosophies

Core Principles:

• Simplicity: Fewer, simpler operations (XOR, rotation, substitution).

• Small S-Boxes: 4-bit S-Boxes are common (vs. AES's 8-bit).

• Lightweight Round Function: Minimal mixing layers.

• Minimal Key Schedule: Often simpler than the round function itself.

Trade-off: Security (resistance to cryptanalysis) vs. Efficiency (area, speed, energy).

Contrast with Traditional Ciphers (e.g., AES):

B. Specific Cipher Examples & Analysis

1. PRESENT

• Structure: 31-round SPN.

• Block Size: 64 bits.

• Key Sizes: 80-bit or 128-bit.

• Round Function: AddRoundKey → S-Layer (16 parallel 4-bit S-Boxes) → P-Layer (bit permutation).

• Key Schedule: Simple, generates 32-bit round keys.

2. CLEFIA

• Structure: Feistel-type with two 32-bit branches.

• Block Size: 128 bits.

• Key Sizes: 128, 192, 256-bit.

• Round Function: Uses two 8-bit S-Boxes and a 32-bit diffusion function (F).

• Rounds: 18 (128-bit key), 22 (192-bit), 26 (256-bit).

• Key Schedule: More complex than PRESENT but still lightweight.

[!TIP] Exam Answer Structure (14m Question): For PRESENT/CLEFIA, state: (1) Structure type, (2) Block/key size, (3) Number of rounds, (4) S-Box details, (5) One key design feature.

C. Core Components & Concepts

• Substitution Box (S-Box):

  • Purpose: Provides non-linearity and confusion. Resists linear and differential cryptanalysis.

  • Lightweight Design: Small size (4-bit) for minimal area/power. Designed for efficient hardware (look-up table) or software (bit-slicing).

  • Criteria: Balanced, high non-linearity, low differential uniformity.

• Mode of Operation:

  • Definition: A method to repeatedly apply a block cipher to encrypt data longer than its block size.

  • Necessity: Block ciphers can only encrypt a single fixed-size block (e.g., 64/128 bits).

  • Lightweight-Suitable Modes:

    • CTR (Counter): Parallelizable, random access, needs unique nonce. Often preferred.

    • ECB (Electronic Codebook): Extremely simple but insecure (identical plaintext blocks → identical ciphertext). Only for single-block or non-security-critical data.

    • Other: CBC can be used but has sequential dependency.

[!TIP] Common Pitfall: Never recommend ECB for general encryption. Always state its insecurity due to pattern leakage.

D. Security Evaluation

• Public Design & Open Scrutiny: Essential for building confidence. Allows global community to attempt cryptanalysis (Kerckhoffs's principle).

• Cryptanalysis Types:

  • Linear/Differential: Find approximations to the cipher's behavior.

  • Algebraic: Model cipher as a system of equations.

  • Meet-in-the-Middle: Attacks on the key schedule or multiple rounds.

• Security Margin: Number of rounds that can be broken vs. total rounds. A good cipher has a high margin (e.g., breaking 15/31 rounds is a 16-round margin).

III. Lightweight Stream Ciphers

• Design Goal: Generate a pseudo-random keystream bit-by-bit/byte-by-byte with minimal state and operations.

• Common Structures:

  • LFSR-based (Linear Feedback Shift Register): Simple, but vulnerable if used alone.

  • NLFSR-based (Non-linear): Adds non-linearity for security.

  • Counter-based: Like a block cipher in CTR mode (e.g., Trivium uses a hybrid).

• Vulnerability: Birthday Attack

  • Principle: In a stream cipher with internal state size n, after generating ~$$\displaystyle 2^{n/2} $$ keystream bits, collisions (two identical internal states) become likely.

  • Consequence: An attacker can recover the internal state and predict future keystream.

• Design Optimization to Resist Attacks:

  • Sufficient State Size: State size n should be large enough so $$\displaystyle 2^{n/2} $$ is infeasible (e.g., n ≥ 128 bits).

  • Proper Initialization: Key and IV must thoroughly mix into the state before keystream output.

  • Avoid Weak Keys/IVs: Design must ensure no weak combinations that lead to short cycles or low-entropy state.

  • Balance: Maximize security per unit of state and per operation.

IV. Lightweight Cryptographic Hash Functions

• Purpose: Data integrity, authentication (MACs), key derivation, digital signatures.

• Design Approaches:

  • Sponge Construction: Absorbs input, then squeezes output. Flexible (can output any length). Basis for Keccak (SHA-3).

  • HAIFA: HAsh Iterative FrAmework. Adds salt and output length to the compression function.

• Examples & Applications:

  • PHOTON, SPONGENT, QUARK: Sponge-based, designed for ultra-low area.

  • Real-World Application: Message Authentication Codes (MACs) in IoT protocols (e.g., CoAP). Used for deduplication in cloud storage (proofs of ownership).

V. Key Management for Resource-Constrained Devices

A. Fundamental Concepts

• Key Lifecycle: Generation → Distribution → Storage → Usage → Revocation → Destruction.

• Centralized vs. Distributed:

  | Aspect | Centralized (KDC) | Distributed (e.g., DH) | | :--- | :--- | :--- | | Model | Trusted third party mediates | Peers establish keys directly | | Advantages | Simple for nodes, single point for policy | No single point of failure, scalable for mesh | | Disadvantages | Single point of failure/failure, bottleneck | Complex, high communication/computation overhead | | Security | Trust in KDC is critical | Resilience to KDC compromise |

B. Specific Challenges for Constrained Devices

• Secure Storage: Limited tamper-resistant memory. Keys often stored in plain software.

• Energy-Efficient Establishment: Asymmetric operations (DH) are expensive. Use pre-shared keys or optimized protocols.

• Scalability: Managing keys for 1000s of nodes. Centralized becomes a bottleneck.

• Revocation/Compromise: How to efficiently revoke a captured node's keys across the network with minimal messages.

C. Integration into Standard Protocols

• Adapting IPSec/TLS: Define lightweight cipher suites (e.g., using PRESENT instead of AES) and lightweight hash suites (e.g., PHOTON instead of SHA-256).

• Profile Definitions: Create stripped-down protocol profiles (e.g., OSCORE for CoAP security) that remove unnecessary features.

• Trade-off: Stronger security (longer keys, more rounds) increases overhead. Must balance based on device capability and threat model.

D. Group Key Management for IoT

• Need: Broadcast/multicast commands (e.g., firmware update, alarm).

• Key Considerations for Evaluation:

  1. Communication Complexity: Messages required per node join/leave.

  2. Computational Cost: Per-node computation for key update.

  3. Forward Secrecy: Compromised node cannot decrypt past group communications.

  4. Backward Secrecy: Departing node cannot decrypt future group communications.

  5. Resilience: Impact of node capture on group key secrecy.

  6. Scalability: Performance as group size N increases (ideally sub-linear).

• Integrating Symmetric Key Management:

  • Centralized Group Controller (GC): GC maintains pairwise keys with members. Computes and distributes group key encrypted with each member's pairwise key.

  • Distributed (Tree-based): Members organized in a logical tree. Key updates are propagated along tree paths. Each node stores keys for its subtree.

[!TIP] Exam Keywords: For group key management, always mention forward secrecy and communication complexity.

VI. Security Threats & Model for Tiny Devices

How Threat Models Differ:

Adversary Model: Often assumes an adversary can capture a subset of devices and extract their secret keys/material.

VII. Foundational Concepts (Clarification)

• "Operation" in Computer Context: A fundamental computational step (e.g., XOR, AND, rotate, lookup in S-Box). Efficiency is measured in operations per byte/block or gate count per operation.

• Symmetric vs. Asymmetric Cryptography:

  | Symmetric | Asymmetric | | :--- | :--- | | Same key for encryption/decryption | Public/private key pair | | Very fast, low resource | Extremely slow, high resource | | Used for bulk data encryption | Used for key exchange, signatures | | Primary choice for lightweight systems | Often avoided or heavily optimized (e.g., ECC) |

SUMMARY: EXAM QUICK-MAP