# A Hybrid-Cryptography Engine for Securing Intra-Vehicle Communications
## 4 Crypto-Engine Implementation in the EMERGE Project
### Validation and Performance Evaluation  
#### Experiments setup  
The validation and performance evaluations were carried out on two SBC platforms. The platforms are compliant to the EMERGE project requirements for the Crypto-Engine platform and exhibit the following main features:  
* Raspberry PI 3B+ board, (abbr. **RPI**) equipped with a 1.4 GHz 64-bit quad-core ARM Cortex A53 processor, 1 GB of LPDDR2 (800 MT/s) RAM running Raspberry PI OS (Raspbian) 64-bit Linux;* Intel NUC 11 Pro, (abbr. **NUC**) model NUC11 TNHi3, equipped with a Intel i3-1115G4, clock frequency 1.7 GHz to 4.1 GHz (boost), 8 GB of DDR4 (3200 MT/s) RAM, running Ubuntu 20.04 LTS 64-bit Linux.  
For each platform, we conducted three experiments and estimated the performance of the main tasks of the Crypto-Engine according to the indexes listed in Table 1. In carrying out the experiments, attention was paid to make the impact of the underlying operating system features negligible (e.g., process context switching, caching, page faults, etc.) on the measurements taken. In particular, each experiment has been run with the highest priority allowed (i.e., the minimum _niceness_ level available, in both platforms, has been set to \(-20\)). This allowed us to reduce cache misses (usually affecting payload sizes larger than \(\sim\)512 bytes) and page faults (mostly affecting payload sizes larger than 4096 bytes, which is the default page size for both platforms).  
The adopted ECTAKS scheme configuration uses the standard NIST P-256 curve [55], AES symmetric key cipher with 256 bits keys in CCM mode (i.e., Counter mode for encryption and CBC-MAC as authentication tag), PBKDF2 (_Public Key Key Derivation Function #_) as Key derivation function, and SHA-256 as cryptographic hash function.  
The set of raw measurements obtained from the experiments are available at GitHub [68].  
**Experiment 1: Generation of ECTAKS Key Components**  
As described in [53], ECTAKS requires the pre-distribution of the sets of Key Components to the nodes according to the ANT. This step is intended to be performed offline at deployment time and whenever a change in the ANT occurs.  
This first experiment aimed to evaluate the time required by the Crypto-Engine and ECTAKS to generate a full set of key components for a full-mesh ANT. This topology has been chosen since it can be intended to represent a worst-case scenario: indeed all the ANTs allow secure linked from one node to all the others, with a number of key components that grow exponentially with the number of nodes. In this way, we can evaluate the _Worst-Case Execution Time_ (WCET) for the Key component generation, a typical metric for assessing the performance in real-time systems.  
The average results obtained by evaluating the ECTAKS Key Generation on the target platforms are shown in Figure 5.  
As expected, the reported measurements show an exponential growth for a scenario in which a whole full-mesh ANT is setup from scratch. Although, on one hand, such an ANT setup might take a non-negligible time (up to 200 s for RPI and 50 nodes), on the other hand the update of an ANT with a new node (i.e., generating a local key component while adding \(N-1\) topology vectors and \(N-1\) transmit key components) requires a linearly increasing time and is significantly faster (\(<\)1 s) in the retrieved measures. It is also evident that the NUC platform overperforms the RPI in the key component, in particular by a factor of 13.4 that tends to be almost constant while increasing the number of nodes.  
\begin{table}
\begin{tabular}{l c c} \hline \hline \# & **Experiment** & **Metric of Interest** \\ \hline
1 & ECTAKS Key Generation & Time required vs. number of nodes (full-mesh) \\
2 & Encryption/Decryption & Time required vs. payload size (bytes) \\
3 & Sign/Verification & Time required vs. payload size (bytes) \\ \hline \hline \end{tabular}
\end{table}
Table 1: Set of experiments and indexes for validation and performance evaluation of the Crypto-Engine.