ARIS: Authentication for Real-Time IoT Systems

TL;DR

ARIS is a novel signature scheme optimized for real-time IoT systems, achieving high verification speeds, low energy consumption, and minimal delay, suitable for delay-sensitive applications despite increased storage needs.

Contribution

The paper introduces ARIS, a new signature scheme that significantly improves verification speed and energy efficiency for IoT, leveraging message encoding and elliptic curve functions.

Findings

Verifies 83,333 signatures per second on commodity hardware

Achieves the fastest signature generation with lowest energy consumption

Provides an open-source implementation for testing and verification

Abstract

Efficient authentication is vital for IoT applications with stringent minimum-delay requirements (e.g., energy delivery systems). This requirement becomes even more crucial when the IoT devices are battery-powered, like small aerial drones, and the efficiency of authentication directly translates to more operation time. Although some fast authentication techniques have been proposed, some of them might not fully meet the needs of the emerging delay-aware IoT. In this paper, we propose a new signature scheme called ARIS that pushes the limits of the existing digital signatures, wherein commodity hardware can verify 83,333 signatures per second. ARIS also enables the fastest signature generation along with the lowest energy consumption and end-to-end delay among its counterparts. These significant computational advantages come with a larger storage requirement, which is a highly favorable trade-off for some critical delay-aware applications. These desirable features are achieved by harnessing message encoding with cover-free families and special elliptic curve based one-way function. We prove the security of ARIS under the hardness of the elliptic curve discrete logarithm problem in the random oracle model. We provide an open-sourced implementation of ARIS on commodity hardware and 8-bit AVR microcontroller for public testing and verification.

Tables

Table 1. TABLE I : Experimental performance comparison of ARIS  and its counterparts on a commodity hardware

Scheme	Sign Generation Time ($\mu$s)	Private Key$†$ (KB)	Signature Size (KB)	Signature Verification Time ($\mu$s)	Public Key (KB)	End-to-End Delay ($\mu$s)
SPHINCS [11]	$13458$	$1.06$	$41000$	$370$	$1.03$	$13828$
TACHYON [12]	$138$	$0.016$	$4.4$	$18$	$864$	$156$
RSA [24]	$8083$	$0.75$	$0.41$	$48$	$0.38$	$8131$
CEDA [13]	$55$	$0.41$	$0.41$	$115$	$384.38$	$170$
ECDSA [23]	$725$	$0.03$	$0.06$	$927$	$0.03$	$1652$
Ed25519 [15]	$132$	$0.03$	$0.06$	$335$	$0.03$	$467$
Kummer [14]	$23$	$0.03$	$0.06$	$38$	$0.03$	$61$
SchnorrQ [7]	$12$	$0.03$	$0.06$	$22$	$0.03$	$34$
ARIS	$\mathrm{𝟗}$	$32.03$	$0.06$	$\mathrm{𝟏𝟐}$	$32$	$\mathrm{𝟐𝟏}$

Table 2. TABLE II : Experimental performance comparison of ARIS  and its counterparts on 8-bit AVR microcontroller

Scheme	Signature Generation Time (s)	Private Key (KB)	Signature Size (KB)	Signature Verification Time (s)	Public Key (KB)	End-to-End Delay (s)
ECDSA [23]	$1.77$	$0.03$	$0.06$	$1.80$	$0.03$	$3.57$
Ed25519 [15, 25]	$1.45$	$0.03$	$0.06$	$2.06$	$0.03$	$3.51$
$\mu$Kummer [14, 26]	$0.65$	$0.03$	$0.06$	$1.02$	$0.03$	$1.67$
SchnorrQ [7, 27]	$0.27$	$0.03$	$0.06$	$0.60$	$0.03$	$0.87$
ARIS	$0.19$	$16$	$0.06$	$0.37$	$8$	$0.56$

Full text

In this paper, we propose a new signature scheme called ARIS that pushes the limits of the existing digital signatures, wherein a commodity hardware can verify 83,333 signatures per second. ARIS also enables the fastest signature generation along with the lowest energy consumption and end-to-end delay among its counterparts. These significant computational advantages come with a larger storage requirement, which is a favorable trade-off for some critical delay-aware applications. These desirable features are achieved by harnessing message encoding with cover-free families and a special elliptic curve based one-way function. We prove the security of ARIS under the hardness of the elliptic curve discrete logarithm problem in the random oracle model. We provide an open-sourced implementation of ARIS on commodity hardware and 8-bit AVR microcontroller for public testing and verification. ††© 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

I Introduction

IoT systems often need authentication for applications that need to verify a large volume of incoming transactions or commands. While symmetric key primitives (e.g., HMAC) can provide very fast authentication, they fail to offer non-repudiation which is often vital for these applications. For instance, Visa handles millions of transactions every day [1]. Each transaction corresponds to multiple authentications of the user’s request and card information on merchant’s side, payment gateway and credit card issuer [2]. Therefore, creating more efficient solutions can significantly reduce the overall authentication overhead of such systems that results in substantial financial gains.

The need for efficient authentication becomes even more imperative for applications in which IoT devices must operate in safety-critical settings and/or with battery limitations. For instance, battery-powered aerial drones [3] might communicate and authenticate streams of commands and measurements with an operation center in a short period of time. A fast and energy-efficient authentication can improve the flight and response time of such aerial drones [4]. Other IoT applications such as smart grid systems, which involve battery-powered sensors, will also benefit from fast and energy-efficient digital signatures which minimize the authentication delay/overhead and improve the operation time of the sensors [5]. Additionally, in vehicular networks, safety significantly hinges on the end-to-end delay [6], and therefore attaining a signature scheme with the lowest end-to-end delay is always desired.

I-A Our Contributions

In this paper, we propose a new efficient signature scheme called ARIS. ARIS makes use of an Elliptic Curve Discrete Logarithm Problem (ECDLP) based one-way function and exploits the homomorphic properties of such functions to (i) linearly add the private key elements to attain a shorter signature and (ii) mask this addition with a one-time randomness $r$ to achieve a (polynomially-bounded) multiple-time signature scheme. We outline the main properties of ARIS as below.

• •

Fast Verification:* ARIS provides the fastest signature verification among its counterparts. More specifically, ARIS pushes the limits of elliptic curve (EC) based signature schemes by providing nearly $2\times$ faster verification as compared to its fastest counterpart [7].*

• •

Fast Signing: The signature generation of ARIS avoids expensive computations such as fixed-base scalar multiplication. Therefore, ARIS achieves 33% faster signing as compared to its fastest counterpart [7].

• •

Low End-to-End Delay:* Due to having the fastest signature generation and verification algorithms, ARIS achieves nearly $40\%$ lower end-to-end delay, as compared to its fastest counterpart [7]. This might encourage the potential adoption of ARIS for applications that require delay-aware authentication.*

• •

Energy Efficiency: By avoiding any computationally expensive operation in the signing and verification algorithms, ARIS achieves the lowest energy consumption as compared to its state-of-the-art efficient counterparts. Specifically, as shown in Figure 2, the verification algorithm in ARIS attains $40\%$ lower energy consumption as compared to its most energy efficient counterpart. This makes ARIS potentially suitable for IoT applications wherein the battery-powered devices authenticate telemetry and commands (e.g., aerial drones).

• •

Tunable Parameters:* ARIS enjoys from a highly tunable set of parameters. This allows ARIS to be instantiated with different properties for different applications. For instance, the parameters set that we considered for our implementation on AVR microcontroller enjoys from a smaller public key and private key pair, and if the same scheme is implemented on commodity hardware, it can enjoy from a faster signature generation ($2\times$ faster than the scheme in [7]) by incurring a few microseconds on the verification algorithm.*

**Limitations: ** All of the desired properties and efficiency gains in ARIS come with the cost of larger key sizes. For instance, in the verification efficient instantiation of ARIS (as in Table I), which has the largest key sizes, the size of the public key and private key could be as large as $32$KB. However, this can be decreased to $16$KB and $8$KB for the private key and public key sizes (respectively) while still maintaining the fastest signature generation and verification algorithms among its counterparts. We have shown that even with these parameters sizes, ARIS can be implemented on 8-bit AVR while enjoying from the most computation and energy efficient algorithms as shown in Figure 2, Figure 2 and Table II.

II Related Work

One-time signatures (e.g. HORS [8]) have been proposed to offer fast signing and verification. Following HORS, many schemes with different performance and security trade-offs such as time valid one-time signatures (i.e., TV-HORS [9]) have been proposed. However, these schemes suffer from security and performance penalties incurred due to the need for time-synchronization and their low tolerance for packet loss. Multiple-time hash-based signatures (e.g., XMSS [10]) utilize Merkle-Tree and can sign multiple messages by keeping the signer’s state. Recently, stateless variations (e.g., SPHINCS [11]) have been proposed, however such schemes suffer from large signatures ($\approx$ 41 KB) and slow signing algorithms.

Recently, a polynomially-bounded multiple-time signature scheme based on HORS design is proposed [12]. The scheme utilizes the additive homomorphic property of the underlying one-way function to obtain fast signatures where the signer only aggregates private key components during the online phase. However, despite its efficiency, it cannot meet the stringent delay requirement of some IoT applications. Another proposed scheme called CEDA [13] exploits the aggregatable property of RSA-based one-way permutation functions and message encoding (as proposed in [8]) to attain efficient signing. However, the large parameter sizes not only incur very large public keys but also make the exponentiations that takes place during signature generation and verification quite costly. Therefore CEDA, while being among the most efficient schemes, does not surpass the latest implementations of signatures on fast elliptic curves.

In the line of proposing fast elliptic curves, Renes et al. [14] presented an efficient instantiations of the scheme in [15] based on Kummer surface that shows significant performance gains as compared to its base scheme [15]. In 2016, Costello et al. [7] proposed a new implementation of [15] based on another elliptic curve called FourQ which shows to even outperform the implementation in [14].

III Preliminaries

Notation. Given two primes $p$ and $q$ we define a finite field $\mathbb{F}_{q}$ and a group $\mathbb{Z}_{p}$. We also work on $E(\mathbb{F}_{q}{})$ as an elliptic curve over $\mathbb{F}_{q}$. We commonly denote $P\in E(\mathbb{F}_{q}{}){}$ as a generator of the points on the curve. x\stackrel{{\scriptstyle\}}{{\leftarrow}}{}S$denotes randomly selecting$x$from a set$S$. We denote scalars as small letters (e.g.,$x$) and points on curve as capital letters (e.g.,$P$). We denote tables/matrices as bold capital letters (e.g.,$\mathbf{P}$). We define the bit-length of a variable as$|x|$, i.e.,$|x|=\log_{2}x$. Scalar and point multiplication is denoted as$xP$. We define two Pseudo Random Functions$\texttt{PRF}{1}:{0,1}^{*}\rightarrow\mathbb{Z}{p}{}$and$\texttt{PRF}{2}:{0,1}^{*}\rightarrow{0,1}^{\kappa}$and three hash function$\texttt{H}{}{1}:{0,1}^{}\times\mathbb{Z}{p}{}\rightarrow{0,1}^{l{1}}$,$\texttt{H}{}{2}:E(\mathbb{F}{q}{}){}\rightarrow{0,1}^{l_{2}}$, and$\texttt{H}{}_{3}:{0,1}^{}\times{0,1}^{l_{2}}\rightarrow{0,1}^{l_{1}}$for some integers$l_{1}$and$l_{2}$, to be defined in Section VI.

Definition 1**.**

(Elliptic Curve Discrete Logarithm Problem) For $E(\mathbb{F}_{q}{})$ as an elliptic curve over a finite field $\mathbb{F}_{q}$, given $P,Q\in E(\mathbb{F}_{q}{}){}$, the Elliptic Curve Discrete Log Problem (ECDLP) asks to find $k\in\mathbb{Z}_{p}{}$, if it exists, such that $Q=kP$.

Definition 2**.**

A signature scheme consists of three algorithms $\texttt{SGN}=(\texttt{Kg,Sig,Ver})$ defined as follows.

• –

$(\mathit{sk}{},\mathit{pk}{})\leftarrow\texttt{SGN.Kg}(1^{\kappa})$: Given the security parameter $\kappa$, it outputs the private and public key pair $(\mathit{sk}{},\mathit{pk}{})$.

• –

$\sigma\leftarrow\texttt{SGN.Sig}(m,\mathit{sk}{})$: Given the message $m$ and the signer’s private key $\mathit{sk}{}$, it outputs the signature $\sigma$.

• –

$\{0,1\}\leftarrow\texttt{SGN.Ver}(m,\sigma,\mathit{pk}{})$: Given a message-signature pair ($m,\sigma$), and the claimed signer’s public key $\mathit{pk}{}$, it outputs a decision bit $d\leftarrow\{0,1\}$.

In the following definition, we define the security of signature schemes based on the methodology proposed in [16]. After the initialization phase i.e., $\texttt{SGN.Kg}(\cdot)$, The adversary $\mathcal{A}$ is given access to the signature generation oracle. $\mathcal{A}$ wins, if it outputs a valid message-signature pair (that was not previously outputted from the sign oracle) after making polynomially-bounded number of queries.

Definition 3**.**

Existential Unforgeability under Chosen Message Attack (EU-CMA) experiment $\mathit{Expt}^{\mathit{EU-CMA}}_{\mathtt{SGN}}$ is defined as follows.

• –

$(\mathit{sk}{},\mathit{pk}{})\leftarrow\texttt{SGN.Kg}(1^{\kappa})$

• –

$(m^{*},\sigma^{*})\leftarrow\mathcal{A}^{\texttt{SGN.Sig}(\cdot)}(\mathit{pk}{})$

• –

If $1\leftarrow{\texttt{SGN.Ver}(m^{*},\sigma^{*},\mathit{pk}{})}$ and $m^{*}$ was not queried to $\texttt{SGN.Sig}(\cdot)$, return 1, else, return 0.

The EMU-CMA advantage of $\mathcal{A}$ is defined as $\mathit{Adv}^{\textit{EU-CMA}}_{\texttt{SGN}}=\Pr[\mathit{Expt}^{\mathit{EU-CMA}}_{\texttt{SGN}}=1]$.

IV Proposed Scheme

ARIS leverages the homomorphic property of its underlying ECDLP-based one-way function, which is due to the exponent product of powers property, to achieve (polynomially-bounded) multiple-time signatures from the one-time signature scheme proposed in [17], with more compact signatures. More specifically, in ARIS, the private key consists of $t$ randomly generated values $x_{i}$ (generated using a $\kappa$ bit seed $z$) and the corresponding public key consists of all $Y_{i}\leftarrow x_{i}P$ for $i\in\{1,\dots,t\}$.

To sign a message, the signer obtains $k$ indexes $(i_{1},\dots,i_{k})$ by hashing the message (and a random input), uses the indexes $(i_{1},\dots,i_{k})$ to retrieve the corresponding private key elements (i.e., $x_{i_{j}}$ where $j\in\{1,\dots,k\}$) and sums them along with a one-time randomness $r$. The signature consists of $s$ and $h$, which is obtained by applying the hash function $\texttt{H}{}_{2}(\cdot)$ on $R$, that is computed as the output of applying the one-way function on the one-time randomness $r$.

Verification takes place by computing the summation of the corresponding public key elements (i.e., $Y_{i_{j}}$) and their subtraction from the output of the ECDLP-based one-way function applied on $s$. The verifier outputs valid if the subtraction yields the same value of $R$ as computed in the signature generation. Additionally, ARIS uses the BPV method in [18] to convert an EC scalar multiplication to only $k$ (where $k=18$ or $k=28$ for our proposed parameter sets) EC point additions with the cost of storing a small, constant-size table.

Our scheme consists of the following algorithms. $\underline{(\mathit{sk}{},\mathit{pk}{})\leftarrow{}\texttt{{ARIS}.Kg}{}(1^{\kappa})}$: Given the security parameter $\kappa$, this algorithm selects parameters $(t,k)$ such that $\binom{t}{k}\geq 2^{\kappa}$ and z\stackrel{{\scriptstyle\}}{{\leftarrow}}{}\mathbb{Z}_{p}{}$ and works as follows.

Compute $x_{i}\leftarrow\texttt{PRF}{}_{1}(z,i)$ and $Y_{i}\leftarrow x_{i}P\mod q$ for $i\in\{1,\dots,t\}$ and set $\mathbf{Y}\leftarrow\{Y_{i}\}_{i=1}^{t}$. 2. 2.

Compute $r_{i}\leftarrow\texttt{PRF}{}_{2}(z,i)$ and $R_{i}\leftarrow r_{i}P\mod q$ for $i\in\{1,\dots,t\}$ and set $\mathbf{R}\leftarrow\{R_{i}\}_{i=1}^{t}$. 3. 3.

Output $pk\leftarrow\mathbf{Y}$ and $\mathit{sk}{}\leftarrow(z,\mathbf{R})$ as the public key and private key, respectively.

$\underline{\sigma\leftarrow{}\texttt{{ARIS}.Sig}{}(m,\mathit{sk}{})}$: Given a message $m\in\{0,1\}^{*}$ to be signed, this algorithm works as follows.

Compute $(i^{\prime}_{1},\dots,i^{\prime}_{k})\leftarrow\texttt{H}{}_{1}(m,z)$ where $|i^{\prime}_{j}|\leq|t|$ for $j\in\{1,\dots,k\}$. 2. 2.

Compute $r_{i^{\prime}}\leftarrow\texttt{PRF}{}_{2}(z,i^{\prime}_{j})$ for $j\in\{1,\dots,k\}$, set $r\leftarrow\sum_{i^{\prime}=1}^{k}r_{i^{\prime}}\mod p$. 3. 3.

Retrieve $R_{i^{\prime}}\leftarrow\mathbf{R}[i^{\prime}_{j}]$ for $j\in\{1,\dots,k\}$, compute $R\leftarrow\sum_{i^{\prime}=1}^{k}R_{i^{\prime}}\mod q$ and $h\leftarrow\texttt{H}{}_{2}(R)$. 4. 4.

Compute $(i_{1},\dots,i_{k})\leftarrow\texttt{H}{}_{3}(m,h)$ (where $|i_{j}|\leq|t|$) and $x_{i}\leftarrow\texttt{PRF}{}_{1}(z,i_{j})$ for $j\in\{1,\dots,k\}$. 5. 5.

Compute $s\leftarrow r-\sum_{i=1}^{k}x_{i}\mod p$ and output $\sigma\leftarrow(s,h)$.

$\underline{{\{0,1\}}\leftarrow{}\texttt{{ARIS}.Ver}{}(m,\sigma,\mathit{pk}{})}$: Given a message-signature pair $(m,\sigma)$ and $pk$, this algorithm works as follows.

Parse $(s,h)\leftarrow\sigma$ and compute $(i_{1},\ldots,i_{k})\leftarrow{}\texttt{H}{}_{3}(m,h)$, where $|i_{j}|\leq|t|$ for $j\in\{1,\dots,k\}$. 2. 2.

Retrieve $Y_{i}\leftarrow\mathbf{Y}[i_{j}]$ for $j\in\{1,\dots,k\}$) and set $Y\leftarrow\sum_{i=1}^{k}Y_{i}\mod q$. 3. 3.

Compute $R^{\prime}\leftarrow sP+Y\mod q$ and check if $\texttt{H}{}_{2}(R^{\prime})=h$ holds output valid, and *invalid * otherwise.

V Security Analysis

We prove that ARIS is EU-CMA secure, as defined in Definition 3, in the Random Oracle Model (ROM) [19]. The proof uses the Forking Lemma [20].

Theorem 1**.**

In the ROM, if adversary $\mathcal{A}$ can $(q_{S},q_{H})$-break the EU-CMA security of ARIS after making $q_{H}$ and $q_{S}$ random oracles and signature queries, respectively; then we can build another algorithm $\mathcal{B}$ that runs $\mathcal{A}$ as a subroutine and can solve an instance of the ECDLP (as in Definition 1).

Proof.

We let Y^{*}\stackrel{{\scriptstyle\}}{{\leftarrow}}{}E(\mathbb{F}{q}{}){}$be an instance the ECDLP for algorithm$\mathcal{B}$to solve. On the input of$Y^{*}$and$z\stackrel{{\scriptstyle$}}{{\leftarrow}}{}\mathbb{Z}{p}{}$,$\mathcal{B}$ works as follows.

Setup: $\mathcal{B}$ keeps three lists $\mathcal{L}_{i}$ for $i\in\{1,2,3\}$ to keep track of the outputs of the random oracles and a list $\mathcal{L}_{m}$ to store the messages submitted to the sign oracle. $\mathcal{B}$ sets up the random oracle $RO$-$Sim(\cdot)$ to handle the hash functions and generates the users’ public keys as follows.

• •

Setup $RO$-$Sim(\cdot)$: $\mathcal{B}$ implements $RO$-$Sim(\cdot)$ to handle queries to hash functions $\texttt{H}{}_{1},\texttt{H}{}_{2}$ and $\texttt{H}{}_{3}$, which are modeled as random oracles, as follows.

$\alpha_{1}\leftarrow RO$-$Sim(m,z,\mathcal{L}_{1})$: If $(m,z)\in\mathcal{L}{}_{1}$, it returns the corresponding value $\alpha_{1}$. Else, it returns \alpha_{1}\stackrel{{\scriptstyle\}}{{\leftarrow}}{}{0,1}^{l_{1}}$as the answer and adds$(m,z,\alpha_{1})$to$\mathcal{L}{}_{1}$. 2. 2.

$\alpha_{2}\leftarrow RO$-$Sim(R,\mathcal{L}_{2})$: If $R\in\mathcal{L}{}_{2}$, it returns the corresponding value $\alpha_{2}$. Else, it returns \alpha_{2}\stackrel{{\scriptstyle\}}{{\leftarrow}}{}{0,1}^{l_{2}}$as the answer and adds$(R,\alpha_{2})$to$\mathcal{L}{}_{2}$. 3. 3.

$\alpha_{3}\leftarrow RO$-$Sim(m,h,\mathcal{L}_{3})$: If $(m,h)\in\mathcal{L}{}_{3}$, it returns the corresponding value $\alpha_{3}$. Else, it returns \alpha_{3}\stackrel{{\scriptstyle\}}{{\leftarrow}}{}{0,1}^{l_{1}}$as the answer and adds$(m,h,\alpha_{3})$to$\mathcal{L}{}_{3}$.

• •

Setup Public Key: Given the parameters $(p,q,P,t,k)$, $\mathcal{B}$ works as follows to generate the user public key.

Select j\stackrel{{\scriptstyle\}}{{\leftarrow}}{}[1,t]$and sets the challenge public key element$Y_{j}\leftarrow Y^{*}$. 2. 2.

Generate x_{i}\stackrel{{\scriptstyle\}}{{\leftarrow}}{}\mathbb{Z}_{p}{}$for$i\in{1,\dots,t}$and$i\neq j$. 3. 3.

Compute $Y_{i}\leftarrow x_{i}P$ for $i\in\{1,\dots,t\}$ and $i\neq j$. 4. 4.

Set $\mathit{sk}{}\leftarrow\{x_{i}\}_{i=1,i\neq j}^{t}$ and $\mathit{pk}{}\leftarrow\{Y_{1},\dots,Y_{t}\}$.

$\mathcal{A}$’s Queries: $\mathcal{A}$ queries the hash functions $\texttt{H}{}_{i}$ for $i\in\{1,2,3\}$ and the sign oracle for up to $q_{H}$ and $q_{S}$ times, respectively. $\mathcal{B}$ works as follows to handle these queries.

• •

Hash Queries: $\mathcal{A}$’s queries to hash functions $\texttt{H}{}_{1},\texttt{H}{}_{2}$ and $\texttt{H}{}_{3}$ are handled by the $RO$-$Sim(\cdot)$ function described above.

• •

Signature Queries: $\mathcal{B}$ works as follows to answer $\mathcal{A}$’s signature query on message $m$. If $m\in\mathcal{L}{}_{m}$, $\mathcal{B}$ retrieves the corresponding signature from $\mathcal{L}{}_{m}$ and returns to $\mathcal{A}$. Else, if $m\notin\mathcal{L}{}_{m}$, it works as follows.

Select s\stackrel{{\scriptstyle\}}{{\leftarrow}}{}\mathbb{Z}_{p}{}$and compute$S\leftarrow sP$. 2. 2.

Select $k$ indexes (i_{1},\dots i_{k})\stackrel{{\scriptstyle\}}{{\leftarrow}}{}[1,\dots,t]$. 3. 3.

Set $R\leftarrow S-\sum_{i=1}^{k}Y_{i}$ and $\alpha_{2}\leftarrow\{0,1\}^{l_{2}}$ and add $(R,\alpha_{2})$ to $\mathcal{L}{}_{2}$. 4. 4.

If $(\langle i_{1},\dots i_{k}\rangle,h)\in\mathcal{L}{}_{3}$ abort. Else, add $(m,h,\langle i_{1},\dots i_{k}\rangle)$ to $\mathcal{L}{}_{3}$. 5. 5.

Output $\sigma=(s,h)$ to $\mathcal{A}$ and add $(m,\sigma)\in\mathcal{L}{}_{m}$.

$\mathcal{A}$’s Forgery: Eventually, $\mathcal{A}$ outputs a forgery $\sigma^{*}=(s^{*},h^{*})$ on message $m^{*}$ and public key $pk$. Following the EU-CMA definition (as in Definition 3), $\mathcal{A}$ only wins the game if $\texttt{{ARIS}.Ver}{}(m^{*},\sigma^{*},pk)$ returns $valid$ and $m^{*}$ was never submitted to signature queries in the previous stage (i.e., $m^{*}\notin\mathcal{L}{}_{m}$).

Solving the ECDLP: If $\mathcal{A}$ does not output a valid forgery before making $q_{H}$ hash queries and $q_{S}$ signature queries, $\mathcal{B}$ also fails to solve the instance of ECDLP. Otherwise, if $\mathcal{A}$ outputs a valid forgery $(m^{*},\sigma^{*}=\langle s^{*},h^{*}\rangle)$, using the forking lemma, $\mathcal{B}$ rewinds $\mathcal{A}$ with the same random tape as in [20], to get a second forgery $(m^{\prime},\sigma^{\prime}=\langle s^{\prime},h^{\prime}\rangle)$ where, with an overwhelming probability $s^{*}\neq s^{\prime}$ and $h^{*}=h^{\prime}$. Based on [20, Lemma 1], $\texttt{H}{}_{3}(m^{*},h^{*})\neq\texttt{H}{}_{3}(m^{*},h^{\prime})$, therefore, given $(m^{*},h^{*})\in\mathcal{L}{}_{3}$ and $(m^{*},h^{\prime})\in\mathcal{L}{}_{3}$, $\mathcal{B}$ can solve a random instance of the ECDLP problem (i.e., $Y^{*}$) if one of the following conditions hold.

• •

Case 1: For $(i^{*}_{1},\dots,i^{*}_{k})\leftarrow\texttt{H}{}_{3}(m^{*},h^{*})$ and $(i^{\prime}_{1},\dots,i^{\prime}_{k})\leftarrow\texttt{H}{}_{3}(m^{*},h^{\prime})$ we have $j\in(i^{*}_{1},\dots,i^{*}_{k})$ and $j\notin(i^{\prime}_{1},\dots,i^{\prime}_{k})$.

• •

Case 2: For $(i^{*}_{1},\dots,i^{*}_{k})\leftarrow\texttt{H}{}_{3}(m^{*},h^{*})$ and $(i^{\prime}_{1},\dots,i^{\prime}_{k})\leftarrow\texttt{H}{}_{3}(m^{*},h^{\prime})$ we have $j\notin(i^{*}_{1},\dots,i^{*}_{k})$ and $j\in(i^{\prime}_{1},\dots,i^{\prime}_{k})$.

If any of the above cases holds, $\mathcal{B}$ works as follows. If Case 1 holds, $x_{j}\leftarrow s^{*}-\sum_{\eta=1,\eta\neq j}^{k}x_{i^{*}_{\eta}}-s^{\prime}-\sum_{\eta=1}^{k}x_{i^{\prime}_{\eta}}\mod p$. Else, if Case 2 hold, $x_{j}\leftarrow s^{\prime}-\sum_{\eta=1,\eta\neq j}^{k}x_{i^{\prime}_{\eta}}-s^{*}-\sum_{\eta=1}^{k}x_{i^{*}_{\eta}}\mod p$. ∎

VI Performance Evaluation

We have fully implemented ARIS on Four$Q$ curve [21] which is known to be the fastest EC that provides 128-bit of security. We provide implementations of ARIS  on both commodity hardware and 8-bit microcontroller to evaluate its performance since most IoT applications are comprised of them both (e.g., commodity hardware as servers or control centers and microcontrollers as IoT devices connected to sensors). We compare the performance of ARIS with state-of-the-art digital signature schemes on both of these platforms, in terms of computation, storage and communication. Our implementation is open-sourced at the following link.

https://github.com/rbehnia/ARIS

VI-A Performance on Commodity Hardware

VI-A1 Hardware Configurations

We used a laptop equipped with Intel i7 Skylake processor @ $2.60$ GHz and $12$ GB RAM.

VI-A2 Software Libraries

We implemented ARIS using the open-sourced Four$Q$ implementation [21], that offers the fastest EC operations, specifically EC additions that is critical for the performance of ARIS. We used an Intel processor as our commodity hardware and leveraged Intel intrinsics to optimize our implementation. Specifically, we implemented our PRF functions with Intel intrinsics (AES in counter mode). We used blake2 as our hash function [22] due to its efficiency.

We ran the open-source implementations of our counterparts on our hardware to compare their performance with ARIS.

VI-A3 Parameter Choice

Since we implement ARIS on Four$Q$ curve, we use its parameters given in [21], which provide $128$-bit security. Other than the curve parameters, the choice of $t,k$ also plays a crucial role for the security of ARIS. Specifically, $k$-out-of-$t$ combinations should also provide $128$-bit security to offer this level of security overall. On the other hand, we can tune these parameters to achieve our desired security level with different performance trade-offs. If we increase $t$ and decrease $k$, this results in a larger storage with faster computations, and vice versa. For our commodity hardware implementation, we choose $t=1024$ and $k=18$, that we believe offers a reasonable trade-off between storage and computation as well as offering the desired $128$-bit security level. We set $l_{1}=180$ and $l_{2}=256$.

VI-A4 Experimental Results

We present the results of our experiments in Table I. We observe that ARIS offers very fast signature generation and verification. It only takes 9 microseconds to generate a signature and 12 microseconds to verify it. This is the fastest among our counterparts, where the closest is SchnorrQ. Furthermore, if we use the same parameters set as for the AVR microcontroller, we can further speed up the signature generation to $6.5$ microseconds, with the cost of a few microseconds on the verification speed. In SchnorrQ, a scalar multiplication is required in signature generation and a double scalar multiplication in verification. In ARIS, EC additions are required for signature generation and verification is done with a scalar multiplication and EC additions. This corresponds to a $33\%$ faster signature generation and $83\%$ faster verification for ARIS, compared to SchnorrQ. Therefore, we believe ARIS can be an ideal alternative for real-time applications.

ARIS signature size is the same with its EC-based counterparts [23, 15, 14, 7] , that is significantly lower than its RSA-based and hash-based counterparts [24, 13, 11]. On the other hand, ARIS comes with a larger private and public key, that is $32$ KB.

VI-B Performance on 8-bit AVR

VI-B1 Hardware Configurations

We used an 8-bit AVR ATmega 2560 microcontroller as our IoT device to implement ARIS. ATmega 2560 is equipped with $256$ KB flash memory, $8$ KB SRAM and $4$ KB EEPROM, with a maximum clock frequency of $16$ MHz. ATmega 2560 is extensively used in practice for IoT applications (especially in medical implantables) due to its energy efficiency [28].

VI-B2 Software Libraries

We implemented ARIS on ATmega 2560 using the 8-bit AVR implementation of Four$Q$ curve [27], that provides the basic EC operations and a blake2 hash function. We implemented our scheme with IAR embedded workbench and used its cycle-accurate simulator for our benchmarks.

As for our counterparts, we used their open-sourced implementations [25, 26, 27, 29]. Note that we only compare ARIS with its EC-based counterparts, due to their communication and storage efficiency. Moreover, resource-contrained processors such as ATmega 2560 may not be suitable for heavy computations (e.g., exponentiation with 3072-bit numbers in RSA [24] and CEDA [13]).

VI-B3 Parameter Choice

As mentioned, ARIS can be instantiated with different $t,k$ values that offers a trade-off between storage and computation. Since ATmega 2560 is a storage-limited device, we select our parameters as $t=256$ and $k=28$ to offer storage efficiency. Moreover, this allows us to store the private components ($x_{i}$ and $r_{i}$), instead of deterministically generating them at signature generation, and still have a tolerable storage even for an 8-bit microcontroller. We also set $l_{1}\leftarrow 224$ and $l_{2}\leftarrow 256$.

VI-B4 Experimental Results

Table II shows the performance of ARIS compared with its counterparts. The speed improvements of ARIS can also be observed for ATmega 2560. ARIS is $42\%$ faster in signature generation and $76\%$ faster in signature verification compared to its closest counterpart [7]. This can translate into a significant practical difference when considered real-time applications that require fast authentication. Note that these benchmarks are obtained with a more “storage friendly” parameter choice, and can be further accelerated with different parameter choices where the microcontroller is not memory-constraint.

One may notice that due to our parameter choice, the key sizes in our 8-bit microcontroller implementation are smaller. As aforementioned, this is because we select a different parameter set for $t,k$. Moreover, we store the private components as well, that correspond the 8 KB of the signer storage. Since we store these keys on the flash memory of ATmega 2560, they only correspond to $6\%$ and $3\%$ of the total memory, for private key and public key, respectively. Therefore, although we have significantly larger keys than our EC-based counterparts, it is still feasible to store them even on highly resource-constrained 8-bit microcontrollers.

VI-B5 Energy Efficiency

It is highly desirable to minimize the energy consumption of cryptographic primitives in IoT applications to offer a longer battery life. For microcontrollers, energy consumption of the device can be measured with the formula $E=V*I*t$, where $V$ is voltage, $I$ is current and $t$ is the computation time [30]. Considering that the voltage and the current of a microcontroller are constant when the device is active, the energy consumption linearly increases with the computation time. Since ARIS offers the fastest signature generation and verification, energy consumption of ARIS is the lowest among its counterparts, and therefore would be preferred in applications that require longer battery life.

VII Conclusion

In this paper, we presented a new efficient signature scheme to meet the strict minimum delay requirements of some real-time IoT systems. This is achieved by harnessing the homomorphic property of the underlying ECDLP-based one-way function and the precomputation technique proposed in [18]. Our experimental results showed that the proposed scheme outperforms its state-of-the-art counterparts in signing and verification speed as well as in energy efficiency. The proposed scheme is shown to be secure, in the Random Oracle Model, under the hardness of the ECDLP. We open-sourced our implementation to enable public testing and verification.

**Acknowledgment. ** This work is supported by the Department of Energy award DE-OE0000780 and NSF award #1652389.