A SPECK Based 3G Authentication Algorithm for Download onto IoT Security Modules

3G/4G mobile standards benefit from an authentication algorithm called MILENAGE that supports mutual authentication, protection against replay attack and generates session keys to protect confidentiality and integrity. Its usefulness attracts interest beyond the original usage, such as in securing diverse wireless and wired bearers used in Machine-to-Machine and Internet of Things (IoT) systems. The long-term reliance on one algorithm is a risk, and recently an alternative algorithm, called TUAK, was standardised as a safe-guard, should the Advanced Encryption Standard (AES) core of MILENAGE ever be found vulnerable. Previous performance evaluation of TUAK on Subscriber Identity Modules (SIM), found that it needed to be implemented in low level native code to satisfy system timing requirements; indeed this is usually the case for MILENAGE. However, deployed security modules, anticipated for the Internet of Things (IoT), generally provide access at an application layer, abstracted from the underlying hardware. Application layer implementation of TUAK was shown to be too slow to comply with standardised requirements and so an alternative faster algorithm was sought that could be downloaded and run in a compliant manner from the application level. The National Institute of Standards and Technology (NIST) has standardised a lightweight block-cipher called SPECK, and this paper describes work to create a SPECK alternative to MILENAGE and compares its performance with earlier results from TUAK.