7
\$\begingroup\$

Let's say I have a PIC and an EEPROM memory IC. I store sensitive data in the EEPROM. If I want to encrypt the data what is a good encryption algorithm? It should be executed by the PIC but that does have time for that. So I want to store ~100 bytes and the encryption shouldn't take longer than ~5s on 40MHz.

\$\endgroup\$
  • 1
    \$\begingroup\$ Does your PIC have any kind of accelerator for encryption? Usually the answer here is AES, though I don't know how fast it will run (should be much less than 5s though for this amount of information). \$\endgroup\$ – Gustavo Litovsky Jan 29 '13 at 19:19
  • 1
    \$\begingroup\$ Microchip provides ready made libraries: microchip.com/stellent/… \$\endgroup\$ – Gustavo Litovsky Jan 29 '13 at 19:30
  • 1
    \$\begingroup\$ Notice that the encryption/decryption key is probably part of the program and therefore contained in flash. I don't know PIC, but I do know it is rather trivial to read both EEPROM and Flash from an AVR unless properly protected by its fuses. Encrypting EEPROM data is useless without proper protection of the keys. \$\endgroup\$ – jippie Jan 29 '13 at 19:49
  • 4
    \$\begingroup\$ It's not terribly difficult for a determined and technical attacker to circumvent the protection fuses and read the PIC's flash anyway. See the google results for "circumventing microcontroller read protect fuse" for ideas. \$\endgroup\$ – Phil Frost Jan 29 '13 at 20:36
  • 2
    \$\begingroup\$ As @PhilFrost states, if someone is determined to extract keys/algorithms from a device, they will manage. The fact that you don't have an electron microscope yourself, doesn't mean that nobody else hasn't access to one. Good security algorithms and systems are open (in contrast to security by obscurity), peer reviewed by many ... and probably sooner or later broken and thus you always have to be prepared for the next step (different algorithm/hardware/...). The only secret ought to be the key, not the algorithm. Many examples for security broken by design exist, the internet is full of them. \$\endgroup\$ – jippie Feb 1 '13 at 23:49
7
\$\begingroup\$

Microchip provides ready made encryption library. Typically AES is the most commonly used and available, and I see no reason to use anything else.

Due to export restrictions, you will need to contact them directly to obtain the source code.

\$\endgroup\$
  • \$\begingroup\$ I agree here, AES is pretty easy to do on chip and would be my choice if I wanted security. \$\endgroup\$ – Kortuk Feb 8 '13 at 23:27
3
\$\begingroup\$

A much less resource consuming algorithm than AES, specificially for embedded applications, is XTEA. The wiki page gives the source code and you can find test vectors which are used to verify your implementation. You should also consider XXTEA.

\$\endgroup\$
  • 2
    \$\begingroup\$ I am not sure I agree with this, AES is actually very doable and on even small block sizes quite secure. XTEA has a multiple published breaks of the cipher on the wiki page alone, to my knowledge all such attacks on AES are side channel attacks. \$\endgroup\$ – Kortuk Feb 6 '13 at 2:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy