PaperlayerView exact revision on arXiv

Source-linked AI summary

From Pre-Quantum to Post-Quantum IoT Security: A Survey on Quantum-Resistant Cryptosystems for the Internet of Things

Tiago M. Fernandez-Carames

arXiv:2402.00790v2cs.CR

TL;DR

Long-term IoT security must account for quantum threats while operating on constrained devices. The paper surveys relevant initiatives, cryptosystems, architectures, implementations, and challenges, comparing candidates across IoT hardware. It concludes by providing guidelines for developers creating quantum-resistant IoT solutions.

  • Problem

    IoT requires long-term protection despite constrained devices, while current public-key systems may become vulnerable to sufficiently capable quantum computers.

  • Method

    The paper surveys post-quantum initiatives, cryptosystem types, IoT architectures, implementations, candidate comparisons, and development challenges.

  • Results

    The survey provides comparative implementation findings across IoT hardware, including resource-constrained, fog/edge, and different-power platforms.

  • Takeaways & Limitations

    The paper provides guidelines for IoT developers seeking to create quantum-resistant solutions while considering computational resources and standardization developments.

Abstract

from arXiv · show

This article provides a survey on what can be called post-quantum IoT systems (IoT systems protected from the currently known quantum computing attacks): the main post-quantum cryptosystems and initiatives are reviewed, the most relevant IoT architectures and challenges are analyzed, and the expected future trends are indicated. Thus, this paper is aimed at providing a wide view of post-quantum IoT security and give useful guidelines to the future post-quantum IoT developers.

I. INTRODUCTION

IoT growth and resource constraints make long-term, quantum-resistant security an architectural concern. The article addresses this gap with an IoT-specific survey covering cryptosystems, architectures, implementations, initiatives, challenges, and future trends.

  • Motivation: 75 billion IoT devices were estimated to be in operation in 2025, requiring standardized protocols and suitable architectures.IoT devices are generally battery-dependent and constrained in computational power and memory, while complex processing is often centralized in servers or clouds.
  • Motivation: Public-key cryptography underpins many Internet communications, but increasing computational capability has already led to larger recommended RSA keys after 768-bit and 1024-bit implementations were broken around 2010.The recommended RSA key size is currently 2048–4096 bits, depending on the protected information.
  • Motivation: Long-term confidentiality requirements motivate cryptographic systems that remain secure as quantum computers become capable of breaking current strong public-key cryptosystems.The paper cites estimates that such quantum computers may be functional enough within the next 20 years.
  • Scope: Post-quantum cryptography denotes algorithms intended to remain secure when attacked by a quantum computer.It is also called quantum-proof, quantum-safe, or quantum-resistant cryptography.
  • Scope: Unlike prior reviews that were non-IoT-specific, introductory, or focused on particular cryptosystems, this article combines an IoT-focused review of initiatives, architectures, schemes, implementations, and challenges.Its contributions include analyses of communication links, cryptosystem trade-offs for constrained devices, NIST candidate performance across device classes, selection tables, and future trends.
  • Contributions: The survey compares post-quantum candidates on low-, medium-, and high-power IoT devices and provides tables intended to support scheme selection according to available computational resources.It also examines post-quantum IoT challenges and future cryptosystem-development trends.
  • Contributions: The paper’s remaining sections review the need for transition, initiatives, cryptosystem types, hardware implementations, IoT architectures, performance, challenges, trends, and conclusions.This organization supports a broad view of post-quantum IoT security rather than a single algorithm or platform.

II. PRE-QUANTUM VERSUS POST-QUANTUM IOT

IoT communications rely on symmetric and asymmetric cryptography, but quantum computing threatens widely used public-key systems while symmetric algorithms and hashes may remain viable with larger parameters. The paper surveys relevant projects and explains resource-constrained IoT considerations, including an underemphasis on energy consumption.

  • IoT communications rely essentially on asymmetric and symmetric cryptosystems, whose strength is traditionally measured by classical bits of security.
  • Symmetric algorithms and hash functions are considered potentially usable post-quantum by increasing key sizes or hash outputs, although some current hash functions may not qualify as quantum-safe.
  • Quantum computing threatens RSA, ECDSA, ECDH and DSA because Shor’s algorithm can efficiently solve their underlying mathematical problems on sufficiently powerful quantum computers.
  • The survey reviews post-quantum cryptography projects, including PQCrypto, SAFEcrypto, CryptoMathCREST and PROMETHEUS, alongside their research objectives and outputs.
  • Only a small part of PQCrypto and SAFEcrypto addressed resource-constrained-device challenges, with greater emphasis on computational resources than energy consumption.

B. Standardization initiatives

Post-quantum IoT development is supported by standardization and research initiatives from organizations including ETSI, NIST, IETF, ISO and IEEE. The surveyed cryptosystem families differ in their underlying hard problems and IoT implementation constraints, especially key, ciphertext, decryption and energy costs.

  • Standardization initiatives: ETSI has published quantum-security white papers, organized Quantum-Safe Cryptography Workshops, and transferred related work to its Technical Committee Cyber quantum-safe cryptography group.
  • Standardization initiatives: NIST has organized quantum-cryptography workshops and a post-quantum public-key competition that received 69 first-round candidates, with 26 advancing to the second round.
  • Standardization initiatives: IETF and CFRG are developing Internet-Drafts covering post-quantum TLS, IKEv2 extensions, classical-to-post-quantum transition, XMSS and Leighton-Micali hash-based signatures.
  • Post-quantum cryptosystem families: Code-based schemes rely on error-correction codes and syndrome decoding, while multivariate schemes rely on solving multivariate equations and face decryption inefficiency and large keys for IoT.
  • Post-quantum cryptosystem families: Lattice-based schemes offer strong security proofs and relatively simple, fast implementations, but IoT deployments must manage large keys, ciphertext overheads and energy-efficient operations.

D. Post-quantum supersingular elliptic curve isogeny cryptosystems

Supersingular elliptic-curve isogeny systems are promising post-quantum candidates, but IoT deployment remains constrained by key size, signature optimization, energy efficiency, and compression costs.

  • Supersingular isogeny cryptosystems use non-commutative supersingular curves to prevent a known quantum attack.Their security derives from the structure of the endomorphism ring, which is not commutative for the relevant curves.
  • These systems are estimated to require keys of a few thousand bits, motivating compression techniques and optimizations for IoT use.Reducing key size is necessary because IoT devices are resource-constrained.
  • Isogeny-based digital signatures require optimization for resource-constrained devices and energy-efficient implementation.The paper specifically identifies applying SIDH on constrained IoT devices as an implementation challenge.
  • Key-compression schemes for isogeny-based cryptosystems may involve computationally intensive steps.This creates an additional performance challenge for constrained IoT hardware.
  • Hybrid systems combine pre-quantum and post-quantum cryptosystems to provide double protection while post-quantum security is still being evaluated.Google’s CECPQ1 combined New Hope with X25519 while preserving backward compatibility and TLS integration.
  • Large public keys and ciphertexts in hybrid TLS-IoT deployments may cause dropped messages and potential denial-of-service attacks.The paper identifies large payload exchange as the relevant architectural challenge.
  • Among second-round NIST candidates, most are code-based or lattice-based, while SIKE is the only isogeny-based cryptosystem and no candidates are multivariate-based.The comparison covers 17 public-key encryption and key-establishment algorithms.
  • Only a few cryptosystems, including Round5 and SIKE, seem promising for current IoT end-node hardware.Most candidates use larger keys than classical systems, with public-key sizes ranging from 2,640 to 11,357,632 bits.

V. SECURITY IN IOT COMMUNICATIONS ARCHITECTURES

Post-quantum security must protect the complete IoT communications architecture rather than only end nodes. Cloud, edge, fog, and gateway layers create distinct links and resource profiles that require architecture-wide evaluation.

  • Post-quantum IoT security must cover every element of the communications architecture, including nodes, infrastructure, and cloud services.The paper links this need to computationally constrained end devices and centralized processing.
  • Traditional cloud-based IoT architectures place IoT nodes at the bottom and centralized cloud processing at the top.Nodes may use star or mesh topologies, while complex processing is commonly performed in Internet clouds.
  • Cloud-based systems have limitations for large-scale IoT deployments, motivating exploration of Edge, Fog, and Mist computing.The paper presents an Edge architecture as an alternative paradigm.
  • The Edge architecture includes IoT nodes, node gateways, an Edge layer, and the Cloud.Gateways support nodes constrained by communication range, energy consumption, or protocol compatibility.
  • The Edge layer adds sensor fusion and fog services through fog nodes and cloudlets, combining low-latency distribution with support for compute-intensive tasks.Fog nodes are physically distributed but computationally constrained, while cloudlets provide additional support.
  • Evaluation should cover cloud, edge devices, and communication protocols across resource-constrained, medium-power, and powerful hardware.The paper frames performance and energy efficiency as architecture-wide criteria.
  • Post-quantum protection must secure five communication types: node-to-node, node-to-gateway, gateway-to-gateway or edge, gateway-to-cloud, and node-to-cloud.These links span the full IoT architecture.

A. Implementations for resource-constrained IoT devices

Implementations for constrained IoT devices are evaluated on low-power microcontrollers, with results shaped strongly by hardware platform and reporting choices. NTRUEncrypt and selected Ring-LWE implementations are among the fastest in comparable tests.

  • Only a few recent studies propose post-quantum solutions specifically for resource-constrained IoT devices.Many identified efforts are associated with the Horizon 2020 PQCrypto project.
  • NTRUEncrypt implementations were evaluated across multiple security levels and found suitable for battery-operated devices.The evaluations considered performance, memory footprint, and energy consumption.
  • Table III compares key-generation, encryption, and decryption cycles for post-quantum implementations on embedded IoT hardware.The platforms are mainly ARM Cortex-M0 and 8-bit ATxmega microcontrollers.
  • Some Table III key-generation values are missing because generation was performed offline or execution time was not reported.New Hope results refer to a KEX implementation that differs from the NIST-call New Hope KEM.
  • Performance differences across evaluation hardware are significant, so cycle counts should be compared only with platform differences in mind.Among comparable ARM Cortex-M0 implementations, NTRUEncrypt and two lightweight Ring-LWE implementations are fastest; a Ring-LWE variant leads on 8-bit AVR hardware.

B. Implementations for fog/edge computing node-like hardware

The survey compares post-quantum cryptosystems on low-power hardware resembling fog and edge nodes, reporting substantial performance differences across algorithms, platforms, and security levels.

  • Table V compares key generation, encryption, and decryption cycles for post-quantum cryptosystems on fog/edge-like hardware platforms.The evaluated platforms include ARM Cortex-M4, Cortex-A72, and Cortex-A75 devices.
  • Ring-LWE performance varies substantially with platform and parameter set, with ARM Cortex-M0 requiring fewer cycles than ATxmega128A1 for corresponding configurations.For 94-bit Ring-LWE, ARM Cortex-M0 uses 999,000 cycles for encryption and 437,000 for decryption, compared with 1,573,000 and 740,000 on ATxmega128A1.
  • On ARM Cortex-M0, the memory-optimized SABER version requires 4,786,000 key-generation, 6,328,000 encryption, and 7,509,000 decryption cycles.
  • Lower-security variants of Round5, CRYSTALS-Kyber, and ThreeBears are the fastest among the compared implementations, while device clock periods affect elapsed execution time.Round5 KEM IoT encryption takes 2.77 ms on an ARM Cortex-M4 versus 2.04 ms for 128-bit FrodoKEM-AES on an ARM Cortex-A72.
  • Future IoT developers should select algorithms using security level, target hardware characteristics, and required performance as joint criteria.

C. FPGA implementations

FPGA implementations show that post-quantum cryptosystem performance depends strongly on both the algorithm and the hardware generation, with execution times ranging from microseconds to milliseconds.

  • Table VII compares post-quantum cryptosystem implementations on Xilinx FPGAs, whose models differ in power, performance, clock frequency, and logic resources.
  • NTRUEncrypt achieves encryption and decryption times below 6 µs on two older FPGA implementations.
  • A Ring-LWE FPGA implementation reaches roughly 8.1 µs per operation on a Virtex-6.
  • One McEliece implementation requires 1.079 ms for encryption and 10.726 ms for decryption on a Xilinx Spartan-3AN.
  • SIDH requires 33.7 ms for encryption and 51.4 ms for decryption on a Virtex-7, indicating algorithm-dependent performance beyond FPGA age.

D. Implementations for the cloud and cloudlets

The survey evaluates post-quantum algorithms on cloud- and cloudlet-like hardware while emphasizing that emerging quantum-resistant IoT systems still face unsettled security, standardization, and resource constraints.

  • Table VIII evaluates key generation, encapsulation/encryption, and decapsulation/decryption on hardware with power similar to cloud servers or cloudlets.
  • The cloud-platform comparisons use Intel x64 processors with differing frequencies, target platforms, and energy characteristics, limiting direct hardware-independent comparisons.
  • Post-quantum development remains constrained because quantum-resistant algorithms may face new attacks, larger keys, excessive resource demands, and uncertain standardization.The survey notes that current projects often emphasize computational consumption more than IoT energy consumption.

6) Lack of standard security level benchmarks:

The survey’s implementation tables report cycles across algorithms and hardware platforms, but comparisons remain difficult because security-level measurement lacks a standard quantum-aware benchmark.

  • The performance tables report key-generation, encryption, and decryption cycles for post-quantum algorithms across cloud, cloudlet, and processor platforms.
  • ROLLO-II requires 9,620,000, 1,520,000, and 4,960,000 cycles for key generation, encryption, and decryption at 128 bits on an Intel Core i7-7820X.
  • ROLLO-II cycle counts rise at 192 bits and 256 bits, reaching 11,410,000 key-generation cycles and 7,940,000 decryption cycles at 256 bits.
  • RQC-I, RQC-II, and RQC-III show increasing cycle counts as the listed security level rises from 128 bits to 256 bits.
  • SABER variants likewise require more cycles at higher listed security ranges, from LightSABER through FireSABER.

Classical

Post-quantum IoT development faces challenges in standardization, benchmarking, optimization, resource requirements, and physical security. Evaluation must account for heterogeneous device generations and attacks targeting implementations as well as mathematical foundations.

  • Evaluation challenges: IoT platforms should be evaluated across near-term, middle-term, and long-term device groups because current low-end hardware may not represent future devices.The paper distinguishes devices by the period in which they are expected to be considered low-end.
  • Algorithm and implementation optimization: Post-quantum algorithms require optimization for IoT execution, including faster lattice operations, reduced energy and runtime, and efficient isogeny or modular arithmetic.Examples include speeding polynomial multiplications for lattice systems and improving double-point multiplication for SIDH.
  • Algorithm and implementation optimization: Cryptographic software and microcontroller assembly must be optimized for architecture-specific speed, CPU-cycle reduction, register allocation, and energy consumption.Relevant techniques include loop optimization, instruction reordering, and optimized register allocation.
  • Resource constraints: Theoretical post-quantum systems may exceed IoT devices’ computational or power budgets, so strict requirements should be established during algorithm design.The stated goal is that at least one defined group of low-power IoT devices can run the proposed algorithms.
  • Physical security: Post-quantum IoT implementations must address physical attacks, including timing, power-analysis, and fault attacks that can expose private-key information.Suggested countermeasures include redundant noise and splitting private keys into shares.

B. Future trends

Future post-quantum IoT research should develop energy-efficient architectures, protocols, coding methods, performance models, and validation methodologies. The survey also identifies applications and security settings where such systems could have substantial impact.

  • B. Future trends: Energy-efficient post-quantum IoT systems could improve security in home automation, smart cities, precision agriculture, smart garments, and Industry 4.0 factories.Potential benefits also extend to post-quantum IoT networking architectures and applications requiring medium- and long-term security.
  • B. Future trends: Further research is needed on quantum-computing impact, resource-constrained device design, and validation of energy-efficient quantum-resistant algorithms.The survey identifies these as methodological and theoretical needs for efficient post-quantum IoT systems.
  • B. Future trends: Future work should design energy-efficient post-quantum architectures for small-, medium-, and large-scale environments.Examples include homes, smart campuses or factories, and smart cities.
  • B. Future trends: Resource-constrained devices will require dedicated energy-efficient post-quantum Internet protocols.The paper presents protocol design as a distinct future development need.
  • B. Future trends: Post-quantum IoT code-based cryptosystems will require new coding schemes and optimized techniques.The proposed direction specifically concerns code-based cryptosystem development.
  • B. Future trends: Researchers should mathematically model post-quantum IoT node and architecture performance and power consumption.Such modeling is identified alongside architecture, protocol, and cryptosystem design.
  • B. Future trends: Researchers should investigate physics-based Quantum-Key Distribution methods alongside classical key-establishment approaches.The paper names QKD as the relevant family of physics-based methods for deeper study.
  • B. Future trends: The survey concludes that post-quantum IoT application remains an active research area despite growing interest in post-quantum cryptography.It reviews security evolution, initiatives, cryptosystems, architectures, challenges, and trends.
Loading 2402.00790v2…