Authenticated Encryption

Confidentiality ensures that a ciphertext reveals no information about the original plaintext to anyone without the secret key. In Authenticated Encryption, this is achieved through a symmetric block cipher (like AES) operating in a secure mode of operation.

• Primary Mechanism: Encryption using a secret key transforms readable plaintext into unintelligible ciphertext.
• Threat Mitigated: Eavesdropping and data exposure.
• Example: Without confidentiality, sensor data transmitted from a medical device could be read by an unauthorized party.

Integrity guarantees that the received data has not been altered. Authenticity verifies that the data originated from a known, legitimate source possessing the secret key. These are provided jointly by a Message Authentication Code (MAC).

• Primary Mechanism: A cryptographic tag (the MAC) is generated from the ciphertext and/or associated data using the secret key and appended to the message.
• Threats Mitigated: Data tampering, injection, and forgery.
• Verification: The receiver recalculates the MAC and compares it to the transmitted tag. A mismatch causes the entire message to be rejected.

Associated Data is information that must be authenticated but does not require encryption. This is a critical feature for packetized network protocols and file headers where metadata must be protected in plain sight.

• Purpose: Authenticates unencrypted headers (e.g., IP addresses, packet sequence numbers, protocol flags) alongside the encrypted payload.
• Mechanism: The AD is included in the MAC calculation but bypasses the encryption cipher.
• TinyML Use Case: In a firmware update, the firmware version number and target hardware ID can be sent as AD—authenticated to prevent downgrade attacks but left unencrypted for routing efficiency.

A nonce is a unique value that must be used only once with a given key. It ensures that encrypting the same plaintext multiple times produces different ciphertexts, preventing replay and pattern-analysis attacks.

• Requirement: Uniqueness is critical; repetition with the same key breaks security.
• Forms: Can be a counter, a random number, or a timestamp.
• TinyML Constraint: Devices must have a reliable source of uniqueness (e.g., a hardware monotonic counter) and secure nonce storage to state across reboots.

Authenticated Encryption is implemented via specific, standardized algorithms that combine encryption and authentication securely.

• AES-GCM (Galois/Counter Mode): The most widely used AEAD (Authenticated Encryption with Associated Data) cipher. It combines AES encryption in CTR mode with authentication using Galois field multiplication. It is fast and commonly hardware-accelerated.
• AES-CCM: Combines AES in CBC-MAC mode for authentication with CTR mode for encryption. Common in wireless standards like IEEE 802.11 (Wi-Fi) and Bluetooth.
• ChaCha20-Poly1305: A stream cipher and MAC combination often faster than AES in software, making it popular for TLS and on microcontrollers without AES hardware acceleration.

AE provides robust but specific security guarantees. Understanding its boundaries is essential for correct implementation.

• Guarantees: Resists chosen-ciphertext attacks (CCA). An adversary cannot create a valid (ciphertext, tag) pair without the key.
• Key Requirement: The same secret key is used for both encryption and authentication. Key management is therefore paramount.
• Critical Limitations:
  • Does not provide non-repudiation (requires asymmetric digital signatures).
  • Does not protect against physical side-channel attacks (e.g., Differential Power Analysis).
  • Security fails completely if the nonce is reused.

In TinyML, protecting proprietary machine learning models and sensitive inference data stored on a microcontroller's flash memory is critical. AE encrypts the model weights and biases while simultaneously providing an integrity check. This defends against physical attacks where flash memory is read directly, ensuring the model cannot be stolen or altered without detection. It also secures sensor data logs before they are transmitted.

When a TinyML device sends sensor telemetry or inference results to the cloud, AE protects the data in transit. Using protocols like TLS 1.3 (which uses AEAD ciphersuites internally) or a custom CoAP/DTLS layer, it guarantees that sensitive operational data (e.g., health metrics, production counts) is private and has not been modified in flight. This is a core requirement for data integrity in regulatory environments.

The initial provisioning of cryptographic keys and device credentials into a microcontroller during manufacturing is a high-risk operation. AE secures this provisioning channel. The provisioning server encrypts and authenticates the device-unique keys (e.g., for a Hardware Security Module or Secure Element) before injection. This prevents credential theft at the factory and ensures only authorized devices join the network.

A dedicated, tamper-resistant physical device that performs cryptographic key management and operations. In embedded contexts, an HSM provides a secure vault for AE keys, isolating them from the application processor.

• Functions: Secure key generation, storage, and usage; acceleration of AE operations (e.g., AES-GCM); true random number generation.
• Integration: Can be a discrete chip or a certified secure core integrated into a microcontroller (e.g., a Secure Element).
• Critical Role: Acts as the root of trust for AE, ensuring keys never exist in plaintext in general-purpose memory, thus mitigating software extraction attacks.

A hardware-enforced chain of trust that verifies the cryptographic signature of all firmware before execution. AE is used within Secure Boot to protect the integrity and confidentiality of firmware updates.

• Process: The boot ROM uses a hard-coded public key to verify the digital signature of the bootloader, which then verifies the next stage, creating a chain.
• AE's Role: Encrypted and authenticated firmware images (using an AEAD mode) prevent both tampering and intellectual property theft during SOTA updates.
• Outcome: Guarantees the device only runs authorized code, establishing a clean foundation for subsequent AE-protected application data.

An isolated, secure area within the main processor that protects sensitive code and data. A TEE provides a protected space for performing AE operations and handling plaintext keys.

• Isolation: Uses hardware features (like ARM TrustZone) to create a "Secure World" separate from the "Normal World" rich OS.
• AE Context: Sensitive data (e.g., model parameters, user credentials) remains encrypted in normal memory but is decrypted and processed only inside the TEE.
• Benefit: Mitigates attacks from compromised application software, ensuring AE keys and operations are shielded from other processes on the same chip.

A cryptographic checksum that provides integrity and authenticity for a message. A MAC is a core component of AE schemes, generated using a secret key.

• How it works: The sender computes a MAC tag from the plaintext and secret key. The recipient recomputes the tag and verifies it matches.
• AEAD Integration: In modes like AES-GCM or ChaCha20-Poly1305, the MAC (e.g., GMAC, Poly1305) is computed over the ciphertext and any associated data, providing authentication.
• Key Difference from Hash: A MAC requires a secret key, whereas a hash (like SHA-256) does not. This prevents forgery by anyone without the key.

A specific, widely standardized Authenticated Encryption with Associated Data (AEAD) mode of operation. AES-GCM is a dominant AE standard for TLS, storage, and increasingly, embedded systems.

• Mechanism: Combines the Counter (CTR) mode for confidentiality with the Galois field multiplication-based GMAC for authentication.
• Performance: Offers high-speed parallelizable encryption and authentication, with hardware acceleration common in modern MCUs.
• TinyML Consideration: While efficient, its use of 128-bit multiplication can be challenging on the smallest 8/16-bit microcontrollers, where lightweight ciphers may be preferred.