Security and Privacy in the Internet-of-Things Under Time-and-Budget-Limited Adversary Model

Internet-of-Things (IoT) represents an emerging era of networking that connects a variety of common appliances to one another, as well as with the rest of the Internet, to vastly improve our lives. Despite being significantly resource-constrained, IoT nodes are expected to participate in numerous computationally-intensive security protocols to overcome threats from the public Internet. Given that IoT nodes (e.g., smart meters) typically exchange tactical data that requires data protection for a short time span of up to a few days, we examine the use of smaller cryptographic key sizes to provide IoT security. We show that small key sizes quite drastically reduce the cryptographic computational processing requirements for IoT nodes. We estimate the cost of breaking public key crypto systems when the adversary is limited by the available resources (i.e., dollar cost) and time (i.e., number of days). We consider Moore's law, as well as More than Moore, and Less than Moore technology growth rates, in conjunction with the capabilities of a real-world key-breaker to calculate the cost estimates. Finally, we also present the trade-off between the processing load for an IoT node versus the desired time span of privacy protection.