CryptoDB
Quantum-Resistant Security for Software Updates on Low-power Networked embedded Devices
| Authors: | |
|---|---|
| Download: | |
| Presentation: | Slides |
| Abstract: | As the Internet of Things (IoT) rolls out today to devices whose lifetime may well exceed a decade, conservative threat models should consider attackers with access to quantum computing power.The IETF SUIT standard defines a security architecture for IoT software updates, standardizing metadata and cryptographic tools---namely, digital signatures and hash functions---to guarantee the legitimacy of software updates. SUIT's performance has previously been evaluated in pre-quantum contexts, but not in a post-quantum context. Taking the open-source implementation of SUIT available in RIOT as a case study, we survey post-quantum considerations, focusing on low-power, microcontroller-based IoT devices with stringent constraints on memory, CPU, and energy consumption. We benchmark a selection of proposed post-quantum signature schemes (LMS, Falcon, and Dilithium) and compare them with current pre-quantum signature schemes (Ed25519 and ECDSA) on a variety of IoT hardware including ARM Cortex-M, RISC-V, and Espressif (ESP32), which form the bulk of modern 32-bit microcontroller architectures. Interpreting the results in the context of SUIT, we estimate the real-world impact of post-quantum alternatives for a range of typical software update categories. |
BibTeX
@misc{rwc-2022-35502,
title={Quantum-Resistant Security for Software Updates on Low-power Networked embedded Devices},
note={Presentation at \url{https://iacr.org/submit/files/slides/2022/rwc/rwc2022/18/slides.pdf}},
howpublished={Talk given at RWC 2022},
author={Gustavo Banegas and Koen Zandberg and Adrian Herrmann and Emmanuel Baccelli and Benjamin Smith},
year=2022
}