A Review of “A lightweight remote attestation using PUFs and hash-based signatures for low-end IoT devices” [Póster]

Abstract

This work proposes to include a low-cost Root of Trust for Measuring and Reporting (RoTMR) in an Internet-of-Thing (IoT) device acting as prover, based on the combination of a Physically Unclonable Function (PUF) and an Attestation Read Only Memory (A-ROM), and to use hash-based digital signatures (HBS) in the attestation protocol. The secret keys required by the digital signatures are not stored but reconstructed using the PUF. The use of HBS makes the solution quantum-resistant. The proposed attestation protocol takes advantage of the fact that One-Time Signature (OTS) generation and Many-Time Signature (MTS) verification are very well suited for low-end devices. The proposal was validated experimentally with the ESP32 microcontroller by using its SRAM as PUF and implementing WOTS+, the One-Time Signature of Smart Digital Signatures scheme (SDS-OTS), and the MTS schemes constructed with them. The OTS schemes require smaller codes, are fast, and are efficient in terms of communication bandwidth.