4

Elliptic Curve Cryptography(ECC) is one of the powerful cryptographic methods that requires less computational effort.

IoT requires a cryptosystem that secures smart services and applications (5As i.e. anywhere, anytime, anyhow, any device and network agnostic) via its Intelligent Smart Card (ISC).

Would this be a suitable cryptosystem for Internet of Things(IoT)?

|improve this question
  • 1
    yeah, lots of low power stuff uses ECC, smartcards included – dandavis Jul 4 '16 at 0:21
  • multimedia, internet phone calls and internet multimedia video conferences also employ ECC, since it offers the same level of security as the public key cryptography with a smaller key size. – BitsInForce Jul 5 '16 at 12:50
  • comparable, not the same. there are different ups and downs to ECC than RSA – dandavis Jul 5 '16 at 18:51
4

Yes, why not. Key generation (including key generation for ECDH) and private key operations are relatively efficient compared to other cryptosystems such as RSA.

There are some things to keep in mind:

  • standard ECC operations such as ECDSA do require a good random number generator to be present (this can be avoided by using deterministic signature schemes such as described in RFC 6979;
  • the small key size makes it relatively simple to use quantum computers to break the system (calculations on smaller number mean less qubits required).

RSA keys of the same strength are only 4 times harder to crack on a QC if current research is any indication. That may not be much of a difference when push comes to shove.

Note that although ECC is relatively efficient compared to RSA, it still requires a fast (Montgomery) multiplier. On smart cards this is usually implemented in hardware - and with good reason. Compared with symmetric crypto, it's still a dog; doing 256 bit modular exponentiation on a 8 bit processor may take - ahem - some time to complete.

You might also require side channel attack protection as well.

|improve this answer
  • 2
    You can securely generate ECDSA signatures without a randomness source; see RFC 6979. Of course, good randomness is required for key generation. – Thomas Pornin Jul 9 '16 at 20:26
  • @ThomasPornin I tried to avoid that comment by using the word "standard", then again I wouldn't know why deterministic ECDSA could not be used for IoT protocols... – Maarten Bodewes Jul 9 '16 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.