The lightweight cryptosystem TinyJambu: security and applications in IoT environments

Differential cryptanalysis is one of the fundamental cryptanalysis techniques to evaluate the security of the block cipher. In many cases, resistance to differential cryptanalysis is proven through the upper bound of the differential characteristic probability, not the differential probability. Since the attacker uses a differential rather than a differential characteristic, resistance based on a differential characteristic tends to overestimate the security level of the block cipher. Such an overestimation is notably observed in lightweight block ciphers SKINNY, Midori, and CRAFT. In this paper, we examine the gap between the differential characteristics and the differential probability of lightweight block ciphers. We present practical methods for computing differential probability using a multistage graph. Using these methods, we count the exact number of maximum differential characteristics with fixed plaintext/ciphertext difference and activity pattern. By the exact number of maximum differential characteristics, we can calculate the probability that is closer to the real differential probability. In addition, by modifying the method, we compute a more accurate differential probability by considering the characteristics of the lower probability. We find differential distinguishers of 9-round Midori64 with probability 2−61.58, 9-round SKINNY64 with 2−58.67 and 14-round CRAFT with 2−60.32. Furthermore, we find a related-tweakey differential distinguisher of 11-round SKINNY64-64 with 2−55.93 and a related-tweak differential distinguisher of 17-round CRAFT with probability 2−63.37. Finally, we explain why these gaps are notable in Midori64, SKINNY64 and CRAFT by relating the S-box differential distribution table.

The purpose of this paper is to show that there exist DES-like iterated ciphers, which are provably resistant against differential attacks. The main result on the security of a DES-like cipher with independent round keys is Theorem 1, which gives an upper bound to the probability of r-round differentials, as defined in [3] and this upper bound depends only on the round function of the iterated cipher. Moreover, it is shown that there exist functions such that the probabilities of differentials are less than or equal to 22 − n where n is the length of the plaintext block. We also show a prototype of an iterated block cipher, which is compatible with DES and has proven security against differential attacks.

In this paper, we analyze the security of two recently proposed ultra-lightweight block ciphers, SLIM and LCB. SLIM is designed based on the Feistel paradigm, operating on 32-bit blocks and has an 80-bit key. The designers claim that SLIM is immune to differential cryptanalysis after they were only able to find a trail of up to 7 rounds by using a heuristic method. LCB is another ultra-lightweight block cipher with a 32-bit block and instead uses a 64-bit secret key. It was designed based on a hybrid of Feistel and substitution-permutation network structures. Although no concrete security analyses were performed, the designers claim that 10 rounds of the cipher is secure enough against various attacks including differential cryptanalysis. We verify these claims by proposing differential attacks on both ciphers. For SLIM, we first report optimal (i.e., having the best differential probability) trails for up to 32 rounds found using an SMT solver. We then propose practical key recovery attacks on up to 14 rounds that recover the final round key with time complexity \(2^{32}\). Next, a close inspection of LCB’s design revealed a lack of nonlinearity, whereby its S-box could be modelled as a permutation. As such, differential trails that hold with probability 1 can be trivially derived for any number of rounds of the cipher. A trivial distinguishing attack can be performed with just one known-ciphertext. We fix this flaw and go on to show that LCB is actually more secure (against differential cryptanalysis) than SLIM given the same number of rounds. To the best of our knowledge, these are the first third-party cryptanalysis attacks against both ciphers.KeywordsSLIMLCBDifferential cryptanalysisLightweight block cipherSMT

Statistical attacks on block ciphers make use of a property of the cipher so that an event occurs with different probabilities depending on whether or not the correct key is used. For instance, differential cryptanalysis [3] and truncated differential cryptanalysis [5] consider characteristics or differentials which show that a particular output difference should be obtained with a relatively high probability when a particular input difference is used. Hence, when the correct key is used, the predicted differences occur more frequently.

Many regions in the world have recently sought to integrate and apply advanced technologies in various aspects of life. IoT applications have become popular in different areas such as smart homes, e-health, smart cities, smart connected devices, and many more. However, the growth and spread of IoT technology increase the security and privacy risks that users may experience. Security and privacy problems cannot be eradicated but can be mitigated. Therefore, it is necessary to explore and update dedicated solutions to alleviate them. This paper aims to provide and identify a comprehensive overview of privacy issues and a set of enhanced solutions to protect user privacy in IoT environments. Moreover, it surveys the opinion of researchers and experts regarding challenges and solutions related to IoT privacy. Finally, a set of recommendations and guidelines are suggested to enhance privacy in IoT environments.

Differential cryptanalysis and linear cryptanalysis are two classic analytical methods for block ciphers, and they are of great significance for evaluating the security of block ciphers. In practical security evaluations, a commonly used approach is to study lower bounds on the number of active F-functions in multi-round differential characteristics and linear approximations of the cipher structure, thereby establishing upper bounds on the maximum differential characteristic probability and the maximum linear approximation probability. If these upper bounds are sufficiently small, the cipher structure is considered to have resistance against differential and linear cryptanalysis. Based on this, this paper conducts a detailed study on the resistance of a class of four-branch extended generalized Feistel networks against differential and linear cryptanalysis. Under the condition that the F-function is bijective, it is proven that the lower bound on the number of active F-functions in \(k\)-round (\(k \ge 1\)) differential characteristics or linear approximations is \(k - 1\). Thus, if the maximum differential probability and the maximum linear approximation probability of the F-function are denoted as \(p\) and \(q\), respectively, the upper bounds on the \(k\)-round differential characteristic probability and linear approximation probability are \({p}^{k - 1}\) and \({q}^{k - 1}\), respectively.

Large volumes of sensitive data are being transferred among devices as the Internet of Things (IoT) grows in popularity. As a result, security measures must be implemented to ensure that unauthorized parties do not obtain access to the data. It is well acknowledged that IoT devices have restricted resources, such as limited battery life, memory, and hence reaction time. Classical encryption approaches and methods become inefficient for IoT devices due to memory limits. Large volumes of sensitive data are being transferred between devices as the Internet of Things (IoT) grows in popularity. This involves the implementation of security safeguards to ensure that unauthorized parties do not obtain access to the data. IoT devices are notorious for having limited resources, such as battery life, memory, and hence response time. Classical encryption approaches and methods become inefficient for IoT devices due to memory limits. As a result, a Lightweight cryptosystem that fits the needs of Lightweight devices and ubiquitous computing systems has emerged. The goal of this study is to present a Lightweight cryptosystem (LWC) that may be used as a plugin to secure data transfers in IoT devices and pervasive computing. To that goal, the researchers employ several simple measuring techniques. The suggested system was then implemented on a field-programmable gate array (FPGA) board using the Verilog programming language to demonstrate its appropriateness for actual security applications. FPGA is also utilized in hardware applications to assess the system’s resource usage and performance. Finally, a comparison of the proposed system with previous lightweight cryptography systems is performed to reinforce the major goal of this work, which is to present a new lightweight cryptosystem.

This paper analyzes the security of the RC5 encryption algorithm against differential and linear cryptanalysis. RC5 is a new block cipher recently designed by Ron Rivest. It has a variable word size, a variable number of rounds, and a variable-length secret key. In RC5, the secret key is used to fill an expanded key table which is then used in encryption. Both our differential and linear attacks on RC5 recover every bit of the expanded key table without any exhaustive search. However, the plaintext requirement is strongly dependent on the number of rounds. For 64-bit block size, our differential attack on nine-round RC5 uses 245 chosen plaintext pairs (about the same as DES), while 262 pairs are needed for 12-round RC5. Similarly, our linear attack on live-round RC5 uses 247 known plaintexts (about the same as DES), and the plaintext requirement is impractical for more than six rounds. We conjecture that the linear approximations used in our linear cryptanalysis are optimal. Thus, we conclude that Rivest's suggested use of 12 rounds is sufficient to make differential and linear cryptanalysis of RC5 impractical.

Along with the enormous growth of ICT, its security and threats are a big concern to the research community. The major contributions of ICT growth are coming from the IoT industry. IoT security is a major challenge in the current world scenario. Statistically, about 26.66 billion IoT devices exist according to a survey by Statista 2019, this number is growing exponentially. There are immense applications of IoT in real-time and it is striving to make our lives more comfortable and easy. The IoT devices generates lots of data from the sensing environment, it generates over 2.5 quintillion bytes of data every second. These physical devices continuously exchange useful and sensitive information within themselves and with the servers thus need to ensure that these communications take place securely is a crucial aspect. Also, the immense amounts of data must be stored in a secure environment. Hence, this chapter is aimed to review few security threats in the IoT environment and to understand some solutions to such threats. Block chain is focused more as a solution in IoT because most of the data in this environment stored as blocks and communicates in similar fashion; hence its effectiveness in solving IoT related security threats are addressed.

In an era of interconnected devices, robust cybersecurity is essential. This research presents a deep learning-based forensics framework for investigating and identifying cyber-attacks in IoT ecosystems. At its core, a hybrid CNN-LSTM model, enhanced by particle swarm optimisation (PSO), dynamically optimises parameters for peak performance. Integrating federated learning (FL), the framework ensures effective generalisation across diverse IoT datasets while preserving data privacy. This lightweight yet highly accurate solution outperforms existing models in accuracy and efficiency. The proposed framework achieves 97.66% accuracy and improves time efficiency by 76.82%, detecting various cyber-attacks across IoT applications such as vehicle networks, smart homes, and smart cities. This advancement strengthens IoT security and provides an efficient method for tracing malicious activities.

Constrained Application Protocol (CoAP) and Message Queue Telemetry Transport (MQTT) are two IoT application layer protocols that are seeing increased attention and industry deployment. CoAP uses a request-response model and runs over UDP, while MQTT follows a publish-subscribe model running over TCP. For more constrained IoT devices, MQTTSensor Networks (MQTT-SN) provides a UDP-based transport between the sensor and an MQTT-SN gateway, while using TCP between that gateway and the MQTT broker. Quick UDP Internet Connections (QUIC) is a new protocol and although not originally designed for IoT devices, some design features such as reduced connection establishment time may be useful in an IoT environment. Each of these protocols seeks optimizations in features and implementation complexity based on application domains rather than having the full flexibility and adaptability of traditional transport protocols such as TCP. We investigate and analyze four protocols, namely, CoAP, MQTT, MQTT-SN and QUIC, to understand the overhead of obtaining data from an IoT device at a sink to potentially disseminate this data downstream. These constrained IoT devices often operate under challenging, varying network conditions, and it is important to understand the limitations of the protocols in such conditions. Thus, we evaluate the performance of these protocols under varying loss, delay and disruption conditions to identify the most effective environment for their operation and understand the limitations of their dynamic range. Results show that with non-confirmable CoAP a more adaptive wait timer is required; and a more streamlined QUIC protocol may be a potential alternative IoT protocol.

The term of energy security has evolved since the oil shocks of the 1970s and the concept of environmental security was used in the political debates and the scientific discourse since 1989 when the Cold War was winding down. The key thesis of this chapter is that since the early 1990s the concept of security has been fundamentally reconceptualized: It was widened (from the narrow political and military focus to include also the economic, societal and environmental dimensions), deepened (by broadening the reference object from the state [in national and international security] to human beings and humankind [in human security]) and it was sectorialized [by creating many sectoral concepts of food, water, health, soil, climate security et al.].This chapter primarily reviews this reconceptualization of the security concept that has direct implications for the understanding of the notions of environmental security (a new dimension) and energy security (a sectoral concept). This chapter also briefly discusses potential applications for the European cross-border energy supply infrastructure (e.g. of oil and gas pipelines) linking Russia, the Central Asian states and the MENA region with energy-deficient European countries. Oil and gas pipelines face a dual challenge of both geophysical (earthquakes) and hydro meteorological (e.g. forest fires) natural disasters as well as deliberate attacks on them by terrorist groups (e.g. in Iraq and in Algeria), and new political problems between Russia, the Ukraine and NATO countries. This chapter addresses selected environmental security challenges and impacts of both globalization and global environmental change (GEC), environmental security tasks and tools and possible environmental security applications and conceivable forms of institutionalization; it will conclude with a brief discussion of the potential contribution of integrated environment monitoring systems for the cross border energy supply infrastructure. The contextual change of the implications of Russia’s annexation of the Crimea peninsula for pan-European energy security will remain a key political and security challenge for the future relations between NATO countries and Russia.KeywordsEnvironmental and energy securityCross-border energy supply infrastructureEurope

In this paper we examine a class of product ciphers referred to as substitution-permutation networks. We investigate the resistance of these cryptographic networks to two important attacks: differential cryptanalysis and linear cryptanalysis. In particular, we develop upper bounds on the differential characteristic probability and on the probability of a linear approximation as a function of the number of rounds of substitutions. Further, it is shown that using large S-boxes with good diffusion characteristics and replacing the permutation between rounds by an appropriate linear transformation is effective in improving the cipher security in relation to these two attacks.

In this paper we examine a class of product ciphers referred to as substitution-permutation networks. We investigate the resistance of these cryptographic networks to two important attacks: differential cryptanalysis and linear cryptanalysis. In particular, we develop upper bounds on the differential characteristic probability and on the probability of a linear approximation as a function of the number of rounds of substitutions. Further, it is shown that using large S-boxes with good diffusion characteristics and replacing the permutation between rounds by an appropriate linear transformation is effective in improving the cipher security in relation to these two attacks.

Evaluating resistance of ciphers against differential cryptanalysis is essential to define the number of rounds of new designs and to mount attacks derived from differential cryptanalysis.In this paper, we propose automatic tools to find the best differential characteristics on the SKINNY block cipher. As usually done in the literature, we split this search in two stages denoted by Step 1 and Step 2. In Step 1, we aim at finding all truncated differential characteristics with a low enough number of active Sboxes. Then, in Step 2, we try to instantiate each difference value while maximizing the overall differential characteristic probability. We solve Step 1 using an ad-hoc method inspired from the work of Fouque et al. whereas Step 2 is modelized for the Choco-solver library as it seems to outperform all previous methods on this stage.Notably, for SKINNY-128 in the SK model and for 13 rounds, we retrieve the results of Abdelkhalek et al. within a few seconds (to compare with 16 days) and we provide, for the first time, the best differential related-tweakey characteristics up to 14 rounds for the TK1 model. Regarding the TK2 and the TK3 models, we were not able to test all the solutions Step 1, and thus the differential characteristics we found up to 16 and 17 rounds are not necessarily optimal.