3 ms·

The biggest use case for these algorithms is IoT, and other resource constrained embedded devices. Quite frankly, I'm surprised you didn't consider it seeing a

The biggest use case for these algorithms is IoT, and other resource constrained embedded devices. Quite frankly, I'm surprised you didn't consider it seeing as insecure IoT devices have been in the news pretty much since they hit the market. Embedded devices, especially specialised ones arent poweful enough to operate sufficiently while also providing protection via the current "standard" crypto algorithms.

loeg 5y ago
A lot of the problems with IoT devices are things like hardcoded keys or passwords shared across all units. LWC doesn’t fix that kind of design problem. I agree LWC has value but I think most IoT products are less cpu-limited and more engineer-limited.
mindslight 5y ago
The problem with Internet of Trash devices isn't a lack of cryptography - it's closed, poorly developed, throw-away software. In comparison to implementing a whole wifi stack, some dedicated hardware for AES is trivial. Given that NSA has been trying to get us to use "lightweight cryptography" for decades (eg 512 bit RSA), this seems quite uncompelling. Furthermore for even smaller devices without Wifi, the "Internet" of things (where Internet means communicating directly over the WAN rather than to a more-capable local device) won't be compelling until the software situation has been sorted out. For example the best practices for using current Wifi smart plugs is to stick them on their own VLAN with no Internet access, communicating only with a local Home Assistant or whatever. There's no reason they themselves need to be on the WAN.
hannob 5y ago
Pretty much every IoT device uses Wifi, and that doesn't seem to be a problem right now. They all seem to be perfectly capable of speaking WPA2 with AES.
- JoachimS 5y ago
  Or BTE, ZigBee, LoRa. Esp for longer distances (things out in forests, industrial parks) Wifi is not the radio being used.

loeg 5y ago

A lot of the problems with IoT devices are things like hardcoded keys or passwords shared across all units. LWC doesn’t fix that kind of design problem. I agree LWC has value but I think most IoT products are less cpu-limited and more engineer-limited.

mindslight 5y ago

The problem with Internet of Trash devices isn't a lack of cryptography - it's closed, poorly developed, throw-away software. In comparison to implementing a whole wifi stack, some dedicated hardware for AES is trivial. Given that NSA has been trying to get us to use "lightweight cryptography" for decades (eg 512 bit RSA), this seems quite uncompelling. Furthermore for even smaller devices without Wifi, the "Internet" of things (where Internet means communicating directly over the WAN rather than to a more-capable local device) won't be compelling until the software situation has been sorted out. For example the best practices for using current Wifi smart plugs is to stick them on their own VLAN with no Internet access, communicating only with a local Home Assistant or whatever. There's no reason they themselves need to be on the WAN.

hannob 5y ago

Pretty much every IoT device uses Wifi, and that doesn't seem to be a problem right now. They all seem to be perfectly capable of speaking WPA2 with AES.

JoachimS 5y ago
Or BTE, ZigBee, LoRa. Esp for longer distances (things out in forests, industrial parks) Wifi is not the radio being used.