On April 18th, 2018, the National Institute of Standards and Technology (NIST) began an effort to develop a little-explored cryptographic concept. The concept is called “lightweight cryptography”, and its purpose according to NIST is “to develop cryptographic algorithm standards that can work within the confines of a simple electronic device.” NIST made their announcement in response to the burgeoning development of the Internet of Things (IoT), a network of sensors, monitors, cameras, and devices working together to create smart infrastructure. Several existing, upcoming, and necessary technological advancements including autonomous vehicles, smart energy grids, and more depend on the IoT to communicate between themselves and function properly. Without the IoT, none of these systems could carry out the numerous, simultaneous communications necessary for their existence.
What is lightweight cryptography?
Lightweight cryptography, also known as lightweight encryption, is a form of encryption designed for resource-constrained devices. Lightweight encryption technology uses less memory, fewer computing resources, and a smaller amount of power to provide secure solutions for limited resources in a network.
While AES and SHA are very good together at the interface of computing, they are unable to cope with an IoT environment where they consume excess computing capacity. In recent years numerous lightweight, cryptographic primitive devices have been developed and used to support limited resource requirements. Both international and NIST organizations have outlined several methods that are possible for lightweight cryptography and they are useful for IoT/RFID devices.
Lightweight cryptography use cases
- Great for securing IoT devices
- Protect wireless sensor networks
- Lower complexity, same security level
Why do we need lightweight cryptography?
Lightweight cryptography requires less RAM, fewer computing resources and less power supply to resolve data security challenges of IoT sensor networks. In general, lightweight cryptography is simpler and more efficient than typical cryptography at securing connected devices in particular.
The benefits of lightweight cryptography
According to NIST, the small and simple nature of the millions of electronic devices making up the IoT makes them unequipped to process current cryptographic algorithms. Lightweight cryptography would demand far fewer resources from the devices and take less time to complete their essential processes. Using costly heavy-weight solutions for every small device in the IoT would also make the cost of devices impractical for the organizations implementing solutions. For these reasons, lightweight cryptography would function better to secure the sensitive data transmissions occurring every second on the IoT.
Simple device solutions usually rely on symmetric cryptography: a version of cryptography in which senders and recipients of messages have the same digital key to encrypt and decrypt messages. NIST specifies that lightweight cryptographic algorithms must use “authenticated encryption with associated data,” or AEAD.
AEAD means that the recipient of a message can use authentication to verify the integrity of both the encrypted and unencrypted information within the message. This ensures that messages are coming from who they say they are, and that the content of the message has not been altered in transit.
Next steps and implementation
The 2018 announcement came along with a request for help from the cryptographic community. NIST released a request form called Draft Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process. The purpose of this exercise, a “crypto algorithm bake-off” if you will, is to seek submissions from leading cryptographers and industry experts in order to visualize and plan the implementation of lightweight cryptography within the IoT.
According to the NIST website, their goal is to “produce the sort of encryption algorithms that developers agree will help.” The submission period is now closed, and the candidate algorithms are available for review on the NIST website. The chosen top respondents to the draft are currently participating in workshops to further develop their plans for the new algorithms. These talks are scheduled to continue through the end of 2019, at which point more information will be released to the public.
Lightweight cryptography is approaching on the horizon of cryptographic solutions. As the IoT expands and projects such as self-driving vehicles or the smart city develop around it, lightweight cryptography will likely become an integral part of daily urban life. To keep up to date on this important initiative in IoT data security, be sure to check back with Futurex for the latest news and developments.
Where does Futurex factor in?
Whether it’s symmetric key cryptography or asymmetric encryption, Futurex’s solution suite is ideally suited to lightweight cryptography. We have the resources for hardware implementation and software implementation, on-premises and in the cloud.
Our line of hardware security modules (HSMs) support the widest array of encryption algorithms, lightweight cryptographic primitives, and cryptographic interfaces. Not only do organizations gain access to symmetric key cryptography (which underlies lightweight cryptography), but they gain access to virtually every data encryption functionality needed to secure communication systems. The consistency of Futurex systems makes it feasible to standardize lightweight cryptographic algorithms for future asymmetric encryption.
Futurex also offers key management servers to manage the encryption keys used in lightweight cryptographic systems. No matter the key size, key length, or key schedule required. In addition to fulfilling lightweight cryptography use cases, our key management solutions form the basis for public key cryptography in the form of PKI and CA. Lightweight cryptography for resource-constrained devices requires considering keys and management functions within the actual applications.
Requirements for lightweight cryptography
The following factors must be taken into account to create light cryptographic systems. In some cases, a device may be implemented with a certain dimension. Power has a special importance with RFID and energy harvesting devices, while power consumption has an impact on batteries-operated devices. High throughput of electronic equipment is required for the processing of big-format data like cameras or vibration sensors while low delay is essential in real-time for control of the vehicle system / control system.
Trends in Lightweight Cryptography
It was started in 2004 with a project in Europe that was recently revived by M2MO-IoT processes. IEC 29192 “light weight cryptography” has been developed by the ISO/IEC JTC1/SC 27. In 2013, NIST initiated a lightweight cryptography project in 2013, and announced its public application call for lighter cryptography in 2017. It is considered an important precursor to lightweight cryptography. The document was released in 2007 with a certification ISO-IEC-29192.
Security threats for IoT, Countermeasures Based on Encryption
IoT systems pose a significant vulnerability to traditional IT systems that collect data and send it to cyber attackers. IoT can improve the productivity of production plants by analyzing and automating production processes in the real time. During the processing of sensors the incorrect results may result in the production of false data.
IoT systems using real-world data are also susceptible to cyberattacks. Hence, the countermeasure against encryption is now gaining more significance. Lightweight encryption is one encryption technique with a minimal footprint and low computational complexity. It will extend cryptography to restricted devices, and its international standards compilations are currently underway. Authentically encrypting encrypted data has received considerable attention lately.
Lightweight cryptographic algorithms
Is AES lightweight cryptography? Yes. AES is the standard in symmetric encryption and presented as a lightweight encryption protocol.
