Efficient and Side-Channel Resistant Ed25519 on ARM Cortex-M4

Abstract: An estimated 14.7 billion Internet of Things (IoT) devices will be connected to the Internet by 2023. The ubiquity of these devices creates exciting new opportunities, while at the same time introducing new concerns about privacy and security. To address these concerns, efficient cryptographic algorithms are needed to secure communication between IoT devices. In this work, we present an optimized implementation of one such algorithm, the Edwards Curve Digital Signature Algorithm (EdDSA) with operations Keygen, Sign, and Verify using the Ed25519 parameter on the ARM Cortex-M4 implemented in assembly code. The ARM Cortex-M4 is used in millions of devices world-wide, and is a popular choice for a wide range of IoT applications. We discuss the optimization of field and group arithmetic on this platform to produce high-throughput cryptographic primitives. Then, we present the first SCA-resistant implementation of the Signed Comb method, and Test Vector Leakage Assessment (TVLA) measurements. Our fastest implementation performs Ed25519 Keygen in 200,000 cycles, Sign in 240,000 cycles, and Verify in 720,000 cycles on the ARM Cortex-M4.

Publication: D. Owens, R. El Khatib, M. Bisheh-Niasar, R. Azarderakhsh, M. Mozaffari Kermani, “Efficient and side-channel resistant Ed25519 on ARM Cortex-M4,” in Proc. SSH-SoC at DAC 2023, May 2023.

Development of an Open-source SDN-based Testbed for 5G SA

Project Summary: Since the introduction of the first-generation mobile network in the 1980s, mobile wireless communication requirements have been growing significantly over the past decade, from analog phone calls to real-world applications such as autonomous vehicles, remote surgeries, and advanced robotics. These real-world applications depend on three fundamental building blocks required for 5G networks: Enhanced Mobile Broadband (eMBB), Ultra-Reliable Low Latency Communications (URLLC), and Massive Machine Type Communications (mMTC) that will allow more devices to connect at once, faster data rates, and lower latency. In order to deliver these requirements, it is necessary to apply different technologies to provide customization, flexibility, and management in the 5G network, such as Software-Defined Networks (SDN) and Network Function Virtualization (NFV). SDN and NFV will help to manage the resources better, enable scalability, manage the network from a centralized perspective, and restore system functionality after an attack. Also, it is possible to apply different mitigation services against anomalies in the network using machine learning.  

This project builds a 5G SDN testbed using open-source tools such as Openstack and Onos for SDN capabilities, Open5Gs for the core network, and srsRAN for the gNB simulation. This testbed can be used for various research purposes including network management, security protocols, and performance analysis of 5G services.  

This project is funded by US National Science Foundation and NSA.  


People: Diana Pineda, Ricardo Harrilal-Parchment, Isabela Fernandez Pujol, Dr. Kemal Akkaya, Dr. Alexander Perez-Pons, Dr. Ahmed Ibrahim
Publications: D. Pineda, R. Harrilal-Parchment, K. Akkaya, A. Ibrahim and A. Perez-Pons, “Design and Analysis of an Open-Source SDN-based 5G Standalone Testbed,” IEEE INFOCOM 2023 – IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Hoboken, NJ, USA, 2023, pp. 1-6, doi: 10.1109/INFOCOMWKSHPS57453.2023.10225862.

Performance Evaluation of Quantum-resistant Open Fronthaul Communications in 5G

Abstract: As 5G is offering new services that include improved security for its core functions, there is an effort to secure all domains in 5G, including control, data, and synchronization. This has turned the attention to 5G fronthaul communication security, which has not been considered crucial for past generations of cellular technologies. With overall information security efforts increasing preparation for the deployment of post-quantum cryptographic algorithms, there is also a need to assess the feasibility and overhead when such algorithms are considered for 5G Open Fronthaul communications between the radio heads in base stations and distributed units within the network. This is crucial for protocols such as eCPRI which has certain real-time requirements to meet. To this end, this paper first proposes an integrated security solution that combines IEEE 802.11AE (MACsec) along with a post-quantum-based EAP-TLS authentication within a typical ethernet-based fronthaul topology. We then implement a proof of concept to integrate all these components in a virtualized setting for the first time and evaluate the associated transmission delay with the eCPRI messages under various settings. The results demonstrate that MACsec can be a viable option that can satisfy the real-time requirements when used with post-quantum-based EAP-TLS1.3 that offers perfect forward secrecy.

Publication:  R. Harrilal-Parchment, I. Fernandez Puyol, and K. Akkaya, "Performance Evaluation of Quantum-resistant Open Fronthaul Communications in 5G", in the Proceedings of INFOCOM Workshop on Wireless-Sec: 5G and Beyond Wireless Security2023, Hoboken, NJ, May 2023. 

Publications

1.  Fully Hybrid TLSv1.3 in WolfSSL on Cortex-M4

2.  Highly Optimized Curve448 and Ed448 Design in wolfSSL and Side-Channel Evaluation on Cortex-M4

3.  Performance Evaluation of Secure and Privacy-Preserving DNS at the 5G Edge

4.  Performance Evaluation of Quantum-resistant Open Fronthaul Communications in 5G

5.  Design and Analysis of an Open-Source SDN-based 5G Standalone Testbed

6.  Efficient and Side-Channel Resistant Ed25519 on ARM Cortex-M4

7.  Development of an Open-source SDN-based Testbed for 5G SA

Design and Analysis of an Open-Source SDN-based 5G Standalone Testbed

Abstract:  The fifth generation of mobile wireless communication represents a significant evolution of mobile networks due to its promises of Enhanced Mobile Broadband (eMBB), Ultra-Reliable Low Latency Communications (URLLC), and Massive Machine Type Communications (mMTC) to be applied to real-world applications. Even though there have been 5G Network deployments in some parts of the world that depend on 4G/LTE Core Networks, 5G is still a work in progress, with ongoing research and development to improve and develop this technology. 5G testbeds are essential for ongoing research to propose a solution, simulate, configure, test, and evaluate the impact of different network parameters on the system. Therefore, this paper presents a comprehensive approach to deploying a Standalone (SA) SDN-based 5G testbed for researchers to study and improve the performance of 5G Networks. Our testbed includes integrating several open-source projects to provide two testing scenarios where we assess the throughput and latency performance, Network Slicing configuration, and the feasibility of SDN capabilities. The testbed provides a helpful instrument and lessons learned for the research community to improve and contribute to the successful deployment of 5G Networks in the real world.

Publication: D. Pineda Andrade, R. Harrilal-Parchment, K. Akkaya, A. Ibrahim and A. Pons, "Design and Analysis of an Open-Source SDN-based 5G Standalone Testbed" in the  Proceedings of INFOCOM Workshop on Computer and Networking Experimental Research using Testbeds (CNERT 2023), Hoboken, NJ, May 2023. 

Highly Optimized Curve448 and Ed448 Design in wolfSSL and Side-Channel Evaluation on Cortex-M4

Abstract:  The compact key sizes and the low computational latency of the Elliptic Curve Cryptography (ECC) family of curves sparked high interest in their integration into network protocols. The recently suggested Curve448, assuring 224-bit security, is an ideal curve choice for integrating into cryptographic libraries according to a late study on backdoors on other ECC instances compromising their security, which results in the integration of Curve448 into the TLS1.3 protocol. Curve448 and its birationally equivalent untwisted Edwards curve Ed448, used for key exchange and authentication, respectively, present a perfect fit for low-end embedded cryptographic libraries due to their minimal memory requirements. In this work, we present the first adoption of highly optimized ECDH and EdDSA based on Curve448 and Ed448 into the widely employed IoT-focused cryptographic library wolfSSL. We evaluate the performance of the newly integrated architectures against the NIST recommended Cortex-M4 STM32F407-DK ARM-based platform. Additionally, we perform thorough security evaluation of the side-channel robustness of the implementation via powerful TVLA analysis revealing DPA data leakage. We integrate countermeasures to protect the design, evaluate their effectiveness and analyze the latency overhead. We achieve SCA robust Curve448 and Ed448 at the performance cost of ∼ 1,200KCC and ∼ 1.36× the execution time, however, observe faster results when benchmarking wolfSSL, based on the WiFi quipped STM32F413-DK microcontroller, due to the handcrafted assembly implementation.

Publication: M. Anastasova, R. El Khatib, A. Laclaustra, R. Azarderakhsh, M. Mozaffari Kermani, “Highly optimized Curve448 and Ed448 design in wolfSSL and side-channel evaluation on Cortex-M4,” In  Proc. DSC 2023, pp. 1-8, 2023.

Fully Hybrid TLSv1.3 in WolfSSL on Cortex-M4

Abstract:  To provide safe communication across an unprotected medium such as the internet, network protocols are being established. These protocols employ public key techniques to perform key exchange and authentication. Transport Layer Security (TLS) is a widely used network protocol that enables secure communication between a server and a client. TLS is employed in billions of transactions per second. Contemporary protocols depend on traditional methods that utilize the computational complexity of factorization or (elliptic curve) logarithm mathematics problems. The ongoing advancement in the processing power of classical computers requires an ongoing increase in the security level of the underlying cryptographic algorithms. This study focuses on the analysis of Curve448 and Edwards curve Ed448, renowned for their superior security features that offer a 224-bit level of security as part of the TLSv1.3 protocol. The exponential advancement of quantum computers, however, presents a substantial threat to secure network communication that depends on classical crypto schemes, irrespective of their degree of security. Quantum computers have the capability to resolve these challenges within a feasible timeframe. In order to successfully transition to Post-Quantum secure network protocols, it is imperative to concurrently deploy both classical and post-quantum algorithms. This is done to fulfill the requirements of both enterprises and governments, while also instilling more assurance in the reliability of the post-quantum systems. This paper presents a detailed hybrid implementation architecture of the TLSv1.3 network protocol. We showcase the first deployment of Curve448 and Crystals-Kyber for the purpose of key exchanging, and Ed448 and Crystals-Dilithium for verifying the authenticity of entities and for X.509 Public Key Infrastructure (PKI). We rely upon the widely used OpenSSL library and the specific wolfSSL library for embedded devices to provide our results for server and client applications. 

Publication:  M. Anastasova, R. Azarderakhsh, and M. Mozaffari Kermani, “Fully Hybrid TLSv1.3 in WolfSSL on Cortex-M4,” in  Proc. ACNS, LNCS, 2024. 

Performance Evaluation of Secure and Privacy-Preserving DNS at the 5G Edge

Abstract:  With the improved network performance and efficiency, 5G has been a very appealing alternative for various applications and devices, including but not limited to Industrial IoT (IIoT) applications. However, since IIoT applications require real-time transmission guarantees for time-critical data, optimizing the 5G network performance has attracted much research recently by pushing critical services to the 5G edge. One of such services is Domain Name System (DNS) which is typically offered by ISPs to serve 5G networks. However, due to its heavy role on Internet traffic, DNS has seen many attacks in the past in terms of its authenticity of records and exposure of user requests. Therefore, there have been many variants of DNS protocol such as DNSSEC and DNS over TLS (DoT) to address these security and privacy issues. As such these new protocols need to be integrated into 5G edge and their overhead should be investigated for their potential use in time-critical applications. In this paper, we consider deploying secure and privacy-preserving DNS to the 5G base stations and investigate the feasibility and performance of such an edge computing approach. To this end, we utilize SDN capabilities and forward packets to a local SDN controller for extracting and processing DNS queries. Thus, the DNS packets are served at the 5G edge with optional security and privacy features without being forwarded to remote ISP servers. Our approach is implemented in a virtualized 5G testbed network, and we present various DNS performance results via different metrics and scenarios.

Publication: Y. Hanna, D. Pineda Andrade, K. Akkaya, A. Aydeger, R. Harrilal-Parchment, and H. Albalawi, “Performance evaluation of secure and privacy-preserving DNS at the 5G Edge”, in the  Proceedings of the IEEE 20th International Conference on Mobile Ad Hoc and Smart Systems   (IEEE MASS 2023), Toronto, Canada, Sept. 2023.