DTLS-HIMMO: Efficiently Securing a Post-Quantum World with a Fully-Collusion Resistant KPS

The future development of quantum-computers plications, e.g., e-banking, e-commerce, or ecould turn many key agreement algorithms used in the health, that depend on its security protocols Internet today fully insecure, endangering many applicaTLS and IPSec. At the same time, the Internet tions such as online banking, e-commerce, e-health, etc. of Things (IoT) is connecting billions of smart At the same time, the Internet is further evolving to enable devices deployed in critical applications like the Internet of Things (IoT) in which billions of devices deployed in critical applications like healthcare, smart cities healthcare, distributed control systems, smart and smart energy are being connected to the Internet. The cities and smart energy. The not only IoT needs IoT not only requires strong and quantum-secure security, strong and post-quantum secure solutions, as as current Internet applications, but also efficient oper­ today’s Internet, but also efficient approaches ation. The recently introduced HIMMO scheme enables to secure the data between smart devices, and lightweight identity-based key sharing and verification of between smart devices and the Internet. credentials in a non-interactive way. The collusion resisSeveral schemes have been proposed in the tance properties of HIMMO enable direct secure commu­ nication between any pair of Internet-connected devices. last years and are believed to be quantum The facts that attacking HIMMO requires lattice techniques secure since they rely on methods for which and that it is extremely lightweight make HIMMO an ideal quantum computers do not provide any signif­ lightweight approach for key agreement and information icant advantage. Example of these schemes are verification in a post-quantum world. NTRU, public-key systems based on the LearnBuilding on the HIMMO scheme, this paper firstly ing With Errors problem. The limitation of shows how HIMMO can be efficiently implemented even in resource-constrained devices enabling combined key these schemes is that they very frequently inagreement and credential verification one order of magnivolve higher computational costs, longer keys tude more efficiently than using ECDH-ECDSA. while being or both. NTRU has excellent performance, but quantum secure. We further explain how HIMMO helps requires rather long keys [14]. Schemes based to secure the Internet and IoT by introducing the DTLSon the LWE problem, e.g. [1], perform worse HIMMO operation mode. DTLS, the datagram version of than existing public-key solutions. TLS, is becoming the standard security protocol in the IoT, however, it is very frequently discussed that it does not The Transport Layer Security (TLS)[2] and offer the right performance for IoT scenarios. Our design, its Datagram version (DTLS) are two of the implementation, and evaluation show that DTLS-HIMMO most important protocols used to secure the operation mode achieves the security properties of DTLSInternet. DTLS is becoming the security stanCertificate security suite while being quantum secure and dard to secure the IoT since it is required exhibiting the overhead of symmetric-key primitives. by many Machine to Machine standards such as OneM2M, OMA LWM2M, etc. However, with the advent of quantum computers most 1 IN T RO D U C T I O N of the cipher suites of (D)TLS will become The advent of quantum computers can mean insecure. Furthermore, already today, it is very that most of the algorithms used for key frequently discussed that DTLS and its cipher agreement or information verification are not suites are too heavy for many IoT use cases. secure any more. This would have severe Thus, there is a need for a (D)TLS cipher suite consequences for the Internet and all the apthat is post-quantum secure, efficient, scalable,