# Security Threats and Cryptographic Protocols for Medical Wearables
## 4 Cryptographic Protocols to Secure Medical Devices  
Healthcare systems have reduced computation and storage capabilities and they are highly-constrained interconnected devices where current cryptographic algorithms, designed for desktop/server environments, are not suitable. Apart from the device capabil  
Figure 4: Simulation of malware spreading after infecting a WHMS network made of 15 devices with 34 sensors each one. Figure 3: Simulation of malware spreading after infecting a WHMS network made of 10 devices with 6 sensors each one. ities, the implementation of a cryptographic protocol considers the hardware and software characteristics and possibilities [65]. In 2015, the national institute of standards and technology (NIST) initiated a process to find a suitable standard lightweight cryptographic algorithm to be used in constrained and restricted environments where the current NIST cryptographic standards are not acceptable or are inadequate [68]. This process is called Competition for Authenticated Encryption: Security, Applicability, and Robustness (CAESAR). During the evaluation process, three criteria were considered to accept or discard algorithms: cryptographic security, performance, and cost in its implementation. For the second-round selection of candidates, other characteristics where analyzed: functionality, underlying components, design approaches, and supported key and tag sizes [69]. In March 2021, from the initial list of 57 proposals, a list of the following 10 finalists was announced: Ascon, Elephant, GIFT-COFB, Grain128-AEAD, ISAP, Photon-Beetle, Romulus, Sparkle, TinyJambu, and Xoodyak [70; 71]. Several authors performed different analysis to the NIST candidates. The modes of operation and the efficiencies of the schemes were provided in [72]; the costs, performance and security were analyzed in [73]; the metrics considered in [74] were performance, area, energy, and area \(\times\) energy; and the area, the time the number of cycles to encrypt one block, the energy, the block size, and power coefficients were used as input parameters for a general metric whose purpose was a comparison of lightweight algorithms [75]. In the proposal of a new LWC system, quantum threats should be considered. During the NIST selection of candidates, the post-quantum security property was considered in case multiple candidates had similar characteristics about security and performance. Integer factorization, discrete logarithm, and elliptic-curve discrete logarithm problems, which are the robustness of public key cryptography, can be efficiently broken with a quantum computer [76]. Quantum resistant algorithms are able to reduce the computation time to break symmetric cryptosystems and make their security similar to the same protocols with half-length keys [77]. In the case of asymmetric cryptography, the NIST is in the process of selecting quantum-resistant cryptographic algorithms that are not vulnerable to quantum computers [78]. In any case, LWC is based on symmetric-key cryptography with the goal of as low as possible implementation costs of hardware and the implementation efficiency as high as possible, assuring security [79]. One of the NIST LWC CAESAR competition finalists was explicitly designed for quantum resistance, and it is permutation-based lightweight, which makes the proposal to have a simple structure and fast running speed. Ascon (its variant Ascon-80 pq) is resistant to side-channel attacks, with a key size \(k\leq 160\) bits and a 320-bit permutation, and provides authenticated encryption with associated data (AEAD) and hashing functionality. Two more candidates from the second round provided security against quantum adversaries: Gimli (permutation-based) and SATURNIN (block cipher based), but these were not considered as finalists. Thus, Ascon is the only one that can be considered as the best option for a quantum-resistant algorithm [70].