Internet-of-Things (IoT) devices have become increasingly popular in the last 10 years, yet
also show an acceptance for lack of security due to hardware constraints. The range of sophistication in IoT devices varies substantially depending on the functionality required, so
security options need to be flexible. Manufacturers typically either use no security, or lean
towards the use of the Advanced Encryption Standard (AES) with a 128-bit key. AES-128
is suitable for the higher end of that IoT device range, but is costly enough in terms of
memory, time, and energy consumption that some devices opt to use no security. Short
development and a strong drive to market also contribute to a lack in security. Recent work
in lightweight cryptography has analyzed the suitability of custom protocols using AES as a
comparative baseline. AES outperforms most custom protocols when looking at security, but
those analyses fail to take into account block size and future capabilities such as quantum
computers. This thesis analyzes lightweight cryptographic primitives that would be suitable
for use in IoT devices, helping fill a gap for "good enough" security within the size, weight,
and power (SWaP) constraints common to IoT devices. The primitives have not undergone
comprehensive cryptanalysis and this thesis attempts to provide a preliminary analysis of
confidentiality. The first is a single-stage residue number system (RNS) pseudorandom number generator (PRNG) that was shown in previous publications to produce strong outputs
when analyzed with statistical tests like the NIST RNG test suite and DIEHARD. However, through analysis, an intelligent multi-stage conditional probability attack based on the
pigeonhole principle was devised to reverse engineer the initial state (key) of a single-stage
RNS PRNG. The reverse engineering algorithm is presented and used against an IoT-caliber
device to showcase the ability of an attacker to retrieve the initial state. Following, defenses
based on intentional noise, time hopping, and code hopping are proposed. Further computation and memory analysis show the proposed defenses are simple in implementation,
but increase complexity for an attacker to the point where reverse engineering the PRNG is
likely no longer viable. The next primitive proposed is a block cipher combination technique
based on Galois Extension Field multiplication. Using any PRNG to produce the pseudorandom stream, the block cipher combination technique generates a variable sized key matrix
to encrypt plaintext. Electronic Codebook (ECB) and Cipher Feedback (CFB) modes of
operation are discussed. Both system modes are implemented in MATLAB as well as on a
Texas Instruments (TI) MSP430FR5994 microcontroller for hardware validation. A series
of statistical tests are then run against the simulation results to analyze overall randomness,
including NIST and the Law of the Iterated Logarithm; the system passes both. The implementation on hardware is compared against a stream cipher variation and AES-128. The
block cipher proposed outperforms AES-128 in terms of computation time and consumption
for small block sizes. While not as secure, the cryptosystem is more scalable to block sizes
used in IoT devices. / Master of Science / An Internet-of-Things (IoT) device is a single-purpose computer that operates with less
computing resources and sometimes on battery power. The classification of IoT can range
anywhere from motion sensors to a doorbell camera, but IoT devices are used in more than
just home automation. The medical and industrial spaces use simple wireless computers for
a number of tasks as well. One concern with IoT, given the hardware constraints, is the lack
of security. Since messages are often transmitted through a wireless medium, anybody could
eavesdrop on what is being communicated if data is not encrypted prior to transmission.
Cryptography is the practice of taking any string of data and obfuscating it through a
process that only valid parties can reverse. The sophistication of cryptographic systems has
increased to the point where IoT manufacturers elect to use no security in many cases because
the hardware is not advanced enough to run them efficiently. The Advanced Encryption
Standard (AES) is usually the choice for security in the IoT space, but typically only higherend devices can afford to use AES. This thesis focuses on alternative lightweight systems to
AES. First, a single-stage residue number system (RNS) pseudorandom number generator
(PRNG) is analyzed, which has been proven to generate statistically random outputs in
previous publications. PRNGs are a cheap method of producing seemingly random outputs
through an algorithm once provided with an initial state known as a seed. An intelligent
attack on the PRNG is devised, which is able to reverse engineer the initial state, effectively
breaking the random behavior. Three defenses against the attack are then implemented to
protect against the reported vulnerability. Following, a block cipher combination technique
is presented, using the aforementioned PRNG as the source of randomness. A block cipher is
a method of encrypting large chunks of data together, to better obfuscate the output. Using
a block cipher is more secure than just using a PRNG for encryption. However, PRNGs
are used to generate the key for the proposed block cipher, as they offer a more efficient
method of security. The combination technique presented serves to increase the security of
PRNGs further. The cipher is shown to perform better on an IoT-caliber device in terms of
computation time and energy consumption at smaller block sizes than AES.
| Identifer | oai:union.ndltd.org:VTETD/oai:vtechworks.lib.vt.edu:10919/112304 |
| Date | 05 May 2021 |
| Creators | George, Kiernan Brent |
| Contributors | Electrical and Computer Engineering, Michaels, Alan J., Ball, Arthur Hugues, Gerdes, Ryan M. |
| Publisher | Virginia Tech |
| Source Sets | Virginia Tech Theses and Dissertation |
| Detected Language | English |
| Type | Thesis |
| Format | ETD, application/pdf |
| Rights | In Copyright, http://rightsstatements.org/vocab/InC/1.0/ |
Page generated in 0.0025 seconds