New safety standards have been applied to the Internet of Things (IoT), covering the tens of billions of devices in the ecosystem that have appeared with the advent of 5G.

Tools released this week by the National Institute of Standards and Technology (NIST) aim to secure data from the IoT device ecosystem, as well as miniature electronics ranging from RFID tags to smart appliances.

There are an estimated 75 billion IoT devices in use today, a number buoyed by the advent of 5G, which is designed to handle a massive number of connected IoT devices simultaneously, and enable near-instantaneous communication between them and the network.

Forrester has warned that 5G will create new security challenges for IoT, including insecure communications, weak authentication, and unprotected APIs.

By nature, small devices are vulnerable to side-channel attacks, in which a bad actor can extract protected information by observing physical properties such as timing or power consumption.

Lightweight cryptography solutions

In response, NIST has touted lightweight cryptography as the best way to protect such data. The cryptographic technique, which it has developed since 2013, encrypts data with minimal memory, power, and energy consumption.

In 2023, NIST selected the Ascon cipher family as the basis for its lightweight cryptography standard, developed by a team of cryptographers from Graz University of Technology, Infineon Technologies, and Radboud University.

The four tools released this week include the Ascon-128 authenticated encryption with associated data (AEAD), which both encrypts data and verifies its authenticity, useful for RFID tags, implanted medical devices, and car-mounted toll registers.

The Ascon-Hash 256 can encrypt all of a device’s data into a hash made up of minimal characters, acting like a fingerprint of the data.

Hash capabilities also come from the Ascon-XOF 128 and Ascon-CXOF 128, which allow users to modify the size of the hash, with the latter variant allowing adding to the hash a customized, minimal label for domain variation. This can be helpful if many small devices perform the same encryption operation, potentially outputting an identical hash.

IoT products that meet security standards already bear the U.S. Cyber Trust Mark based on the NIST cybersecurity framework. But with the release of the lightweight cryptography standard, NIST has applied cybersecurity at the base level for numerous resource-constrained devices that were not previously protected.

“We encourage the use of this new lightweight cryptography standard wherever resource constraints have hindered the adoption of cryptography,” said NIST computer scientist and project co-lead Kerry McKay. “One thing [small] electronics have in common is the need to fine-tune the amount of energy, time, and space it takes to do cryptography. This standard fits their needs.”

“There are additional functionalities people have requested that we might add down the road, such as a dedicated message authentication code. We plan to start considering these possibilities very soon.”