Sensor Network Security through Identity-Based Encryption Nigel Boston Department of Mathematics, University of South Carolina Departments of Mathematics and ECE, University of Wisconsin

Overview of Talk Challenges faced Existing approaches Identity-based encryption Benefits of IBE for sensor networks Conclusions and future work

UW Sensor Networks UW WiSeNet Consortium (wisenet.engr.wisc.edu) Eric Bach (Computer Sciences) Akbar Sayeed (ECE) Several students (Matt Darnall, Kamal Srinivasan, Harris Nover, …) Affiliated faculty from ECE, CS, CE, …

Challenges of Sensor Networks Limited memory, storage, and power Unreliable communication, conflicts, and latency Exposure to physical attacks, remote, decentralized management

Security Requirements Data confidentiality Data integrity Data freshness Availability Self-organization Time synchronization Secure localization Authentication

Attacks Denial of service attacks Sybil attack Traffic analysis attacks Node replication attacks Attacks against privacy Physical attacks

Key Distribution Attacks Want shared secret keys between nodes which may have been pre-initialized without prior contact. Want nodes able to communicate without involving base station. Want additional nodes able to join existing network, unauthorized nodes prevented.

Encryption Techniques Symmetric key (stream ciphers or block ciphers) SPINS TinySec Random graph theory (Eschenauer-Gligor) Impractical for large scale sensor networks

TinySec Message authentication, integrity, confidentiality are provided. Based on Skipjack, 80-bit symmetric cipher. Secure, reasonably efficient (time, transmission overhead, memory) If no rekeying, then compromising one node compromises the whole network.

Limitations of Secret Key Key distribution Protection of key material - resilience Rekeying, if possible, incurs additional energy consumption Public-key cryptography improves on these

Public-Key Cryptography Encryption key public, decryption key private - broken by solving a hard math problem. Originally regarded as too slow and consuming too much power. RSA with exponent 3 (idea - cheap encryption, more powerful receiver does more expensive decryption). Hard problem - factoring integers. Rabin-Williams (RSA with exponent 2).

RSA-200 Factored May, 2005 - RSA-200 factored, using number field sieve by Jens Franke et al 2799783391 1221327870 8294676387 2260162107 0446786955 4285375600 0992932612 8400107609 3456710529 5536085606 1822351910 9513657886 3710595448 2006576775 0985805576 1357909873 4950144178 8631789462 9518723786 9221823983 equals 3532461934 4027701212 7260497819 8464368671 1974001976 2502364930 3468776121 2536794232 0005854795 6528088349 x 7925869954 4783330333 4708584148 0059687737 9758573642 1996073433 0341455767 8728181521 3538140930 4740185467

Problems with RSA A polynomial-time factoring algorithm would render RSA probably useless. A quantum computer can factor in polynomial-time (record so far - 15). In constrained environments (smart cards, PDAs, …), long keys are impractical. Companies want comparable security with much shorter key lengths.

Elliptic Curves The solutions of in a field naturally form a group (can add pts) Hard problem: given points P, Q, find integer n such that Q = P+…+P (n terms).

Elliptic Curve Addition

Elliptic Curve Cryptography ECC ever more popular for mobile devices 160-bit ECC same security as 80-bit symmetric, as 1024-bit RSA Hyperelliptic curve cryptography (HCC) apparently offers no advantage Malan (2004) implemented sensor net ECC Sun Microsystems (2005) announced Sizzle

World’s Smallest Secure Server

Authentication As sensor devices improve, ECC ever better. Problem - in public-key crypto, A writes to B using B’s public key. Trusted authority signs B’s public key so A, by checking this signature, can verify B’s identity. Recursive checking expensive if low-power.

Identity-Based Encryption 1984 - Shamir asked if arbitrary bit strings (B’s name) can be used as public keys. After B receives A’s message, B computes (with trusted authority) a private key Note - burden of checking is on the receiver - in sensor networks weak sends to strong!

Identity-Based Encryption II 2001 - Boneh and Franklin give solution using the Weil pairing on elliptic curves. Can also use other pairings (Tate, eta, Ate, …) - Ate is up to 6 times faster than the others. Cocks’s IBE scheme based on quadratic residues suffers from ciphertext expansion.

Pairings E is an elliptic curve defined over GF( ), The points on E form an abelian group and we consider a bilinear non-degenerate pairing (computed by Miller’s algorithm)

IBE Details Identity-based systems allow any party to generate a public key from a known identity value such as an ASCII string. A trusted third party, called the Private Key Generator (PKG), generates the corresponding private keys. To operate, the PKG first publishes a "master" public key, and retains the corresponding master private key. Given the master public key, any party can compute a public key corresponding to the identity i by combining the master public key with the identity value. To obtain a corresponding private key, the party authorized to use identity i contacts the PKG, which uses the master private key to generate the private key for identity i.

Other Advantages of IBE Advantages in sensor network - (1) Physically secured master device is trusted authority (2) Each node given private key in advance - private key generator can then be destroyed

Simultaneous Research Several groups have apparently come up with this idea simultaneously. The group (Doyle et al.) at DCU, Dublin has gone furthest in implementation - found the energy performance of key negotiation using an IBE scheme based on Tate pairing on the ARM platform was 0.44J (cf. nodes limited to 1000J battery capacity).

Some Questions IBE uses hashing - what features desirable for sensor networks? Efficient Weil pairing computation uses randomization - possible to eliminate?

Conclusions Sensor networks face novel security problems due to constraints and method of deployment The key distribution problem can be addressed by using IBE to negotiate a shared secret key Calculation of pairs of keys demands reasonable power consumption