2023年2月20日

美国国家标准与技术研究院(NIST)选择了一套算法作为保护物联网(IoT)中小型设备产生的数据的标准。这种加密算法被称为Ascon，由英飞凌技术公司和奥地利格拉茨大学共同开发，并将在今年晚些时候作为NIST的轻量级加密标准发布。所选择的算法旨在保护数据不受传感器和执行器以及植入医疗设备、道路和桥梁内的应力探测器以及车辆无钥匙进入fobs的影响。这些都需要轻量级加密，没有沉重的处理开销。Ascon于2014年由来自格拉茨理工大学、英飞凌科技、Lamarr安全研究和内梅亨大学的密码学家团队开发。它在2019年被选为CAESAR竞赛最终产品组合中轻量级认证加密的主要选择。NIST的克里·麦凯(Kerry McKay)说:“世界正朝着使用小型设备完成从传感到识别到机器控制等许多任务的方向发展。由于这些小型设备资源有限，它们需要具有紧凑实现的安全性。”“这些算法应该能覆盖大多数有这类资源限制的设备。”为了确定最强和最有效的轻量级算法，NIST举办了一个历时数年的开发项目，首先与行业和其他组织进行沟通，了解他们的需求，然后在2018年向世界密码学社区请求潜在的解决方案。在收到57份提案后，麦凯和数学家梅尔特姆Sönmez图兰(Meltem Sönmez Turan)管理了一个多轮公开评审过程，在这个过程中，密译家们检查并试图找到候选人的弱点，最终将他们减少到10名决赛选手，最后选择阿斯康为获胜者。 “We considered a number of criteria to be important,” said McKay. “The ability to provide security was paramount, but we also had to consider factors such as a candidate algorithm’s performance and flexibility in terms of speed, size and energy use. In the end we made a selection that was a good all-around choice.” Seven crypto variant There are currently seven members of the Ascon family, some or all of which may become part of NIST’s published lightweight cryptography standard. As a family, the variants give a range of functionality that will offer designers options for different tasks. Two of these tasks are among the most important in lightweight cryptography: authenticated encryption with associated data (AEAD) and hashing. AEAD protects the confidentiality of a message, but it also allows extra information — such as the header of a message, or a device’s IP address — to be included without being encrypted. The algorithm ensures that all of the protected data is authentic and has not changed in transit. AEAD can be used in vehicle-to-vehicle communications, and it also can help prevent counterfeiting of messages exchanged with the radio frequency identification (RFID) tags that often help track packages in warehouses. Hashing creates a short digital fingerprint of a message that allows a recipient to determine whether the message has changed. In lightweight cryptography, hashing might be used to check whether a software update is appropriate or has downloaded correctly. Currently, the most efficient NIST-approved technique for AEAD is the Advanced Encryption Standard (defined in FIPS 197) used with the Galois/Counter Mode (SP 800-38D), and for hashing, SHA-256 (defined in FIPS 180-4) is widely used. McKay said that these standards remain in effect for general use. “The goal of this project is not to replace AES or our hash standards,” she said. “NIST still recommends their use on devices that don’t have the resource constraints that these new algorithms address. There are native instructions in many processors, which support fast, high-throughput implementations. In addition, these algorithms are included in many protocols and should continue to be supported for interoperability purposes.” Neither are the new algorithms intended to be used for post-quantum encryption. “One of the Ascon variants offers a measure of resistance to the sort of attack a powerful quantum computer might mount. However, that’s not the main goal here,” said McKay. “Post-quantum encryption is primarily important for long-term secrets that need to be protected for years. Generally, lightweight cryptography is important for more ephemeral secrets.” The specification of Ascon includes multiple variants, and the finalized standard may not include all of them. The NIST team plans to work with Ascon’s designers and the cryptography community to finalize the details of standardization.