Challenges in authentications

Question

I have a case where I have a set of low compute capable processors connected to a gateway processor. I need a way of authenticating these processors to gateway processor. The main things are:

I need to prevent some other processor from connecting to gateway processor
I am looking at a way where after authentication, I will be using encryption so that sniffing will be impossible
So I thought of doing authentication and then encryption
The main challenges are computing power of the processors are very less. At at time I can send 64 bits of data only. I also need to minimize the no of data send during authentication.
These are embedded processors

score 1 · Answer 1 · answered Dec 17 '13 at 02:23

1

You might think of reinventing the wheel and rolling your own protocol. Don't.

This is what SSL/TLS is for. SSL/TLS is a surprisingly lightweight protocol that works great on embedded processors. This is especially true if you control both the client and server in which case you can remove the algorithm negotiation phase and stick to a single implementation.

answered Dec 17 '13 at 02:23

Our processors don't have computing power to handle SSL/TLS – user2315 Dec 17 '13 at 02:25
2

@user2315 Thomas Pornin says otherwise. http://security.stackexchange.com/a/3213/10211 – Dec 17 '13 at 02:35

score 0 · Answer 2 · answered Dec 17 '13 at 02:10

If they have enough storage, you can consider a hashchain-like scheme which makes use of only hash functions. The prover does not need to do any computations while the verifier needs to compute one hash operation only.

There are many research papers out there but basically the scheme works like this. The processors first hash a secret key, K repeatedly for N times and store all the N hash digests (This step maybe pre-computed by a third party but the processor will still have to store all the hash digests). Next, we pass the final hash digest, H^N{K} to the gateway to serve as a "commitment". In order to authenticate the processor, the latter sends the previous hash output, i.e. H^N-1{K} to the gateway. The gateway computes one hash operation and verify that H{H^N-1{K}} == H^N{K}.

If the hash function is assumed to be pre-image resistant then the user with the pre-image is likely to be legitimate. Hope this helps.

Challenges in authentications

2 Answers2