Cryptography · Study deck

Elliptic-Curve Cryptography for IoT

Picture a small tracker that must prove who sent an update without carrying a large key.

Shield Shelly is your guide for this deck.

elliptic-curveecdhecdsa
Shield Shelly, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Explain: Deterministic nonce generation protects the private-key calculation, but approval also depends on signing the intended bytes, mapping the verification key to the real authority, and enforcing identity, rollback, and expiry.
  • Explain: ECDH output is raw key material: validate the peer's public key, then derive scoped keys through a context-bound KDF, and use ephemeral keys (ECDHE) for forward secrecy.
  • Explain: A large-scale quantum computer would break ECC, so long-lived devices should plan a post-quantum or hybrid migration (NIST ML-KEM and ML-DSA).
  • Explain: The raw ECDH result is never used directly.
iotclass.org

Major section

Overview: Strong Public-Key Security in a Small Package

ECDH or X25519 establishes session material; ECDSA or EdDSA approves artifacts or identities.

  • This route connects ECC's compact representation to an evidence-backed lifecycle rather than a benchmark-only decision.

Why it matters

Keeping those keys and jobs separate prevents a convenient implementation choice from widening authority.

ECC design starts from the security role, then narrows to an approved curve, a private-key boundary, and release evidence, rather than choosing a curve by benchmark alone.
ECC design starts from the security role, then narrows to an approved curve, a private-key boundary, and release evidence, rather than choosing a curve by benchmark alone.
iotclass.org

Major section

Practitioner: Pick the Role, the Curve, and the Validation

Validation rejects the wrong group or malformed value before computation; the KDF binds transcript, role, and endpoint context; and separate outputs become scoped session keys.

  • The raw ECDH result is never used directly.
  • This sequence connects the mathematical agreement to the authenticated, purpose-bound channel the system actually needs.
Key agreement output is usable only after the peer's public value is validated and the shared secret is run through a context-bound KDF; the raw secret is never the key.
Key agreement output is usable only after the peer's public value is validated and the shared secret is run through a context-bound KDF; the raw secret is never the key.
iotclass.org

Major section

Under the Hood: The Hard Problem, the Curves, and the Sharp Edges

Deterministic nonce generation protects the private-key calculation, but approval also depends on signing the intended bytes, mapping the verification key to the real authority, and enforcing identity, rollback, and expiry.

  • The visual connects the nonce hazard to the complete evidence chain rather than letting one correct signature equation stand in for policy.
ECC signature evidence from canonical bytes to release decision
ECC signature evidence from canonical bytes to release decision
iotclass.org

Major section

Fit a Signed Update Into the Radio Budget

The private signing key never needs to travel with the update.

  • An X25519 public key is 32 bytes on the wire.
  • A P-256 point instead needs 33 bytes in compressed form or 65 bytes uncompressed.
  • ECC security also depends on validating inputs and using the operation correctly.
ECC design starts from the security role, then narrows to an approved curve, a private-key boundary, and release evidence, rather than choosing a curve by benchmark alone.
ECC design starts from the security role, then narrows to an approved curve, a private-key boundary, and release evidence, rather than choosing a curve by benchmark alone.
iotclass.org

Major section

Summary

Key agreement (ECDH, X25519) and signatures (ECDSA, EdDSA) are separate roles that should use separate keys.

  • ECDH output is raw key material: validate the peer's public key, then derive scoped keys through a context-bound KDF, and use ephemeral keys (ECDHE) for forward secrecy.
  • ECDSA needs a unique, unpredictable per-signature nonce; reuse leaks the private key, so prefer deterministic ECDSA (RFC 6979) or EdDSA (Ed25519).
  • A large-scale quantum computer would break ECC, so long-lived devices should plan a post-quantum or hybrid migration (NIST ML-KEM and ML-DSA).
iotclass.org

Deck summary

Key takeaways

ECDH or X25519 establishes session material; ECDSA or EdDSA approves artifacts or identities.

  • Validation rejects the wrong group or malformed value before computation; the KDF binds transcript, role, and endpoint context; and separate outputs become scoped session keys.
  • Deterministic nonce generation protects the private-key calculation, but approval also depends on signing the intended bytes, mapping the verification key to the real authority, and enforcing identity, rollback, and expiry.
  • The private signing key never needs to travel with the update.
  • Key agreement (ECDH, X25519) and signatures (ECDSA, EdDSA) are separate roles that should use separate keys.
iotclass.org

Retrieval practice

Recall check 1 of 5

Shield Shelly says: answer from memory, then check your reasoning.

Q1Why is ECC often preferred over RSA on small, battery-powered IoT devices?

AECC removes the need to protect private keys on small devices.
BECC reaches a comparable security level with much smaller keys and signatures.
CECC automatically handles encryption and identity in one algorithm.
DECC makes the private key unnecessary because the curve is public
Show answer

Answer: B For a given security level an elliptic-curve key is far smaller than an RSA key, which is exactly the advantage constrained devices need.

iotclass.org

Retrieval practice

Recall check 2 of 5

Shield Shelly says: answer from memory, then check your reasoning.

Q2A device and cloud service need an elliptic-curve group. What makes the selection reviewable?

AChoose only the smallest key label because it implies protocol approval and endpoint support.
BLet each endpoint choose a different group because the protocol automatically negotiates a shared group.
CInvent a new product curve without vetting, protocol approval or tested endpoint support.
DChoose a vetted, protocol-approved group supported by both endpoints and any terminating gateway.
Show answer

Answer: D Each participating endpoint must support the group; a forwarding gateway and the CA have different cryptographic roles.

iotclass.org

Retrieval practice

Recall check 3 of 5

Shield Shelly says: answer from memory, then check your reasoning.

Q3A device and a cloud endpoint need fresh session keys for an authenticated transport session. A KDF will bind shared-secret material to the transcript and roles to derive scoped traffic keys. Which ECC role supplies that starting material?

AUse ECDH or X25519 key agreement to establish shared secret material.
BUse ECDSA firmware signing with the release key to generate the session keys
CCopy a public verification key into every telemetry packet to act as the session key
DUse the raw ECDH shared secret directly as the AES key to save a step
Show answer

Answer: A Key agreement sets up the shared secret, and the KDF, bound to transcript and role, turns it into separate, scoped session keys.

iotclass.org

Retrieval practice

Recall check 4 of 5

Shield Shelly says: answer from memory, then check your reasoning.

Q4A long-lived device fleet may need a new curve or trust anchor later. What should its design include now?

AReuse signing and session keys so the old anchor approves the new one.
BFreeze the first curve for the entire fleet life.
CGovern and verify curve or trust-anchor updates with rollback evidence.
DAccept any replacement key without identity checks.
Show answer

Answer: C Migration keeps a fielded device from depending forever on one cryptographic choice.

iotclass.org

Retrieval practice

Recall check 5 of 5

Shield Shelly says: answer from memory, then check your reasoning.

Q5A constrained device signs messages with ECDSA but its weak random generator produces the same per-signature value for two different messages. What is the consequence?

ANothing happens, because the signatures are still mathematically valid
BOnly the two affected messages can be forged, and the private key stays safe
CSwitching to a larger curve fixes the problem without changing the nonce
DNonce reuse can reveal the ECDSA private signing key.
Show answer

Answer: D ECDSA's security depends on a unique, unpredictable nonce per signature.

iotclass.org

Print reference

Answers 1 of 2

Answer key.

  1. B · For a given security level an elliptic-curve key is far smaller than an RSA key, which is exactly the advantage constrained devices need.
  2. D · Each participating endpoint must support the group; a forwarding gateway and the CA have different cryptographic roles.
  3. A · Key agreement sets up the shared secret, and the KDF, bound to transcript and role, turns it into separate, scoped session keys.
  4. C · Migration keeps a fielded device from depending forever on one cryptographic choice.
iotclass.org

Print reference

Answers 2 of 2

Answer key.

  1. D · ECDSA's security depends on a unique, unpredictable nonce per signature.
iotclass.org