Cryptography · Study deck

Elliptic-Curve Cryptography for IoT

Picture a small tracker that must prove who sent an update without carrying a large key.

Shield Shelly is your guide for this deck.

elliptic-curveecdhecdsa

Shield Shelly, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: Deterministic nonce generation protects the private-key calculation, but approval also depends on signing the intended bytes, mapping the verification key to the real authority, and enforcing identity, rollback, and expiry.
Explain: The chapter’s comparison places that curve near a 128-bit security target, while an RSA alternative is roughly 3,072 bits, or 3072/8=384 bytes, before its own encoding.
Explain: Validation rejects the wrong group or malformed value before computation; the KDF binds transcript, role, and endpoint context; and separate outputs become scoped session keys.
choose standard curves and algorithms for IoT roles

Major section

Overview: Strong Public-Key Security in a Small Package

ECDH or X25519 establishes session material; ECDSA or EdDSA approves artifacts or identities.

This route connects ECC's compact representation to an evidence-backed lifecycle rather than a benchmark-only decision.

ECC design starts from the security role, then narrows to an approved curve, a private-key boundary, and release evidence, rather than choosing a curve by benchmark alone.

Major section

Practitioner: Pick the Role, the Curve, and the Validation

Validation rejects the wrong group or malformed value before computation; the KDF binds transcript, role, and endpoint context; and separate outputs become scoped session keys.

The raw ECDH result is never used directly.
This sequence connects the mathematical agreement to the authenticated, purpose-bound channel the system actually needs.

Key agreement output is usable only after the peer's public value is validated and the shared secret is run through a context-bound KDF; the raw secret is never the key.

Major section

Under the Hood: The Hard Problem, the Curves, and the Sharp Edges

Deterministic nonce generation protects the private-key calculation, but approval also depends on signing the intended bytes, mapping the verification key to the real authority, and enforcing identity, rollback, and expiry.

The visual connects the nonce hazard to the complete evidence chain rather than letting one correct signature equation stand in for policy.

ECC signature evidence from canonical bytes to release decision

Major section

Fit a Signed Update Into the Radio Budget

The private signing key never needs to travel with the update.

The chapter’s comparison places that curve near a 128-bit security target, while an RSA alternative is roughly 3,072 bits, or 3072/8=384 bytes, before its own encoding.
ECC security also depends on validating inputs and using the operation correctly.

Deck summary

Key takeaways

ECDH or X25519 establishes session material; ECDSA or EdDSA approves artifacts or identities.

Validation rejects the wrong group or malformed value before computation; the KDF binds transcript, role, and endpoint context; and separate outputs become scoped session keys.
Deterministic nonce generation protects the private-key calculation, but approval also depends on signing the intended bytes, mapping the verification key to the real authority, and enforcing identity, rollback, and expiry.
The private signing key never needs to travel with the update.

Retrieval practice

Recall check 1 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q1Why is ECC often preferred over RSA on small, battery-powered IoT devices?

AECC removes the need to protect the private key

BECC is a single algorithm that automatically handles both encryption and identity

CECC reaches a comparable security level with much smaller keys and signatures.

DECC makes the private key unnecessary because the curve is public

Show answer

Answer: C For a given security level an elliptic-curve key is far smaller than an RSA key, which is exactly the advantage constrained devices need.

Retrieval practice

Recall check 2 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q2A device and a cloud endpoint need fresh session keys for an authenticated transport session. Which ECC role is the right starting point, and what must happen to its output?

AUse ECDSA firmware signing with the release key to generate the session keys

BCopy a public verification key into every telemetry packet to act as the session key

CUse the raw ECDH shared secret directly as the AES key to save a step

DUse ECDH or X25519 key agreement to establish shared secret material.

Show answer

Answer: D Key agreement sets up the shared secret, and the KDF, bound to transcript and role, turns it into separate, scoped session keys.

Retrieval practice

Recall check 3 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q3A constrained device signs messages with ECDSA but its weak random generator produces the same per-signature value for two different messages. What is the consequence?

ANonce reuse can reveal the ECDSA private signing key.

BNothing happens, because the signatures are still mathematically valid

COnly the two affected messages can be forged, and the private key stays safe

DSwitching to a larger curve fixes the problem without changing the nonce

Show answer

Answer: A ECDSA's security depends on a unique, unpredictable nonce per signature.

Print reference

Answers

Answer key.

C · For a given security level an elliptic-curve key is far smaller than an RSA key, which is exactly the advantage constrained devices need.
D · Key agreement sets up the shared secret, and the KDF, bound to transcript and role, turns it into separate, scoped session keys.
A · ECDSA's security depends on a unique, unpredictable nonce per signature.