A Survey of Efficient Lightweight Cryptography for Power-Constrained Microcontrollers

Abstract

Protecting sensitive data, such as data collected from sensors, is crucial for ensuring the accurate assessment of sensing devices and preventing unauthorized access. In this regard, Internet of Things (IoT) devices offer a promising alternative for in situ monitoring. However, IoT sensing devices are often constrained by limited processing power and memory. Therefore, lightweight and efficient security algorithms are essential. This review paper assesses the implementation of lightweight cryptographic algorithms for power-constrained microcontrollers in IoT systems using symmetric cryptography. The implemented algorithms analyze the resource constraints of the IoT devices and compare their performance for the efficient implementation of secure monitoring systems. Experimental results demonstrate the performance of various lightweight encryption algorithms on low-power microcontrollers. The analysis reveals the comparative performance of these algorithms in terms of average power and energy consumption, memory usage, latency, and throughput.

1. Introduction

Wireless sensor networks (WSNs) play a crucial role in extending the Internet’s reach to a diverse range of devices and environments [1,2,3,4,5]. These networks comprise numerous small, low-power devices equipped with sensors to gather data from their surroundings. WSNs are widely employed in various applications, such as vehicular networks [6], Internet of Medical Things [7], industrial automation [8], environmental monitoring [9], and healthcare [10]. Even though WSNs offer great versatility and are great options for implementing applications, these networks are susceptible to security vulnerabilities due to their open wireless nature and limited device resources.

WSNs and Internet of Things (IoT) devices face several performance challenges and energy constraints that are critical issues impacting their functionality and efficiency; as the implementation of these devices in several applications is increasing over time, understanding their limitations is essential for optimizing their operations. IoT devices rely on batteries or energy-harvesting methods, resulting in restrictions over operational time and processing capabilities [11]; also, tasks such as data processing, security measures, and communication protocols introduce additional computational and energy requirements on resource-constrained devices [12,13]. On top of that, effective communication protocols are required in WSNs to ensure that data are transmitted reliably without excessive energy use, hindering overall network performance [14]. In addition to this, IoT and WSN devices typically have low processing power, making it difficult to efficiently execute complex algorithms or process large amounts of data [14].

Safeguarding sensitive data within WSNs is a paramount challenge. Additionally, ensuring secure integration, preserving privacy, and mitigating risks associated with the vast amount of data transmitted across wireless devices are other critical WSN security concerns [15]. Cyberattacks targeting IoT devices can have severe consequences, including data breaches, network congestion, and physical damage to devices. There are mechanisms designed to minimize the vulnerabilities of IoT systems to avoid cyberattacks; unfortunately, traditional security mechanisms are not well suited for IoT due to its interconnected nature and the limited resources of IoT devices [16,17]. Figure 1 shows the security mechanisms used in IoT to counter attacks targeting the network or its devices; one of the most relevant and crucial mechanisms in the context of IoT is cryptography, as it facilitates secure communication between devices, in addition to data protection and user privacy [18]. Despite this, traditional cryptography is not a viable mechanism for IoT devices as it is highly resource demanding [19]. As an alternative to traditional cryptography, and considering the resource-constraints of these devices, a new branch of cryptography, known as lightweight cryptography, has been introduced and designed specifically for this type of environment [20]. Lightweight cryptography is a rapidly evolving field aimed at providing security for devices with resource constraints, such as those used for IoT and WSNs. For this reason, recent advances in this field focus on the development of novel approaches by improving the performance of existing algorithms, either by optimizing its implementations or by improving their design [21,22,23].

The feasibility of using lightweight cryptography to secure IoT devices with limited power and computational resources has recently started being investigated. Lightweight cryptography is developed to efficiently implement algorithms on resource-constrained devices. This technique optimizes hardware and software implementations, minimizing power consumption, memory footprint, and computational overhead. In conventional cybersecurity implementations, symmetric and asymmetric techniques are used to maximize the security of applications, with each approach offering distinct advantages and limitations. However, symmetric cryptography is generally the preferred choice for low-power consumption implementations, especially in resource-constrained devices like IoT devices. For this reason, this survey focuses on symmetric cryptography, where ten cryptography algorithms are evaluated, comparing the algorithms’ resource usage and their ability to ensure secure monitoring applications. This is performed through the implementation of relevant lightweight cryptographic algorithms for power-constrained devices reviewed in the state of the art for IoT security. The implemented algorithms are analyzed and compared for the efficient implementation of secure monitoring systems. The experimental results obtained as a product of this work are of great value for determining the performance of the different lightweight algorithms reviewed and for determining their best use on low-power microcontrollers, depending of their application.

The following sections are organized as follows: Section 2 shows related works about the use of cryptographic algorithms and their performance. Section 3 describes the lightweight ciphers implemented in this work. In Section 4, the methodology of this work and the performance metrics used to evaluate the lightweight cipher algorithms are described, in addition to the development boards where the lightweight ciphers were implemented, whose results are shown and discussed in Section 5. Section 6 discusses the findings in this work and outlines the integration of symmetric algorithms with more complex systems. Finally, the conclusions for this work are presented in Section 7.

2. Related Work

Within cryptography itself, there are two types of methods used to protect transmitted information: symmetric and asymmetric encryption [24]. In the former, a single key is used to encrypt and decrypt messages, analogous to how a key is used to open and close a lock. In the latter, a pair of keys (a public and a private key) are used, where a key is used to encrypt a message that can only be decrypted using the other key. Asymmetric encryption in comparison with symmetric encryption requires significant computational power and memory, making them less suitable for resource-constrained devices [25,26]. Also, asymmetric encryption is generally slower than symmetric methods; in comparison with the latter, there are only a few asymmetric algorithms accessible for this kind of cipher [27]. For this reason, the work presented in this paper focuses only on the first method, symmetric encryption; thus, more will be said about this type of algorithms. The operation of these algorithms is easy to understand at a large scale; Figure 2 displays the operation of this cipher. The message $M$ can be encrypted with the $AES$ function as the encryption algorithm in combination with the key $K_1$, producing an encrypted message $EM$. If the inverse $AE{S}^{-1}$ is performed using the same key and the encrypted message $EM$, a message $M^{\prime }$ is produced, identical to $M$.

There are two types of symmetric encryption algorithms: block cipher and stream cipher. They both fulfill the function of encrypting or decrypting a message; the main difference between these two is that the block cipher works with blocks of fixed size, in which operations are performed using bits of the message and the key [28], whereas the stream cipher generates a pseudo-random vector called “stream key” and encrypts the message with it using an XOR operation [29]. Figure 3 describes the encryption and decryption process used in a block cipher, and Figure 4 illustrates that of a stream cipher. Both ciphers use the same process shown in Figure 2; the main difference between them is that in a block cipher, a function is needed to encrypt and the inverse of that function is needed to decrypt, but in a stream cipher, the same function is used for encryption as well for decryption, as the inverse XOR operation is the same operation.

Symmetric cryptography has recently started to be studied for its use in IoT; Hatzivasilis et al. [30] conducted a survey on 52 lightweight block ciphers both in software and hardware, all of which were evaluated according to their security (as shown in the reviewed state of the art) and performance in terms of memory consumption, energy, and implementation complexity. This survey highlights vulnerabilities in the algorithms and emphasizes the need for further analysis of the new lightweight algorithm proposals. Similarly, Jassim S. and Farhan A. [31] conducted a survey focused on 27 lightweight stream ciphers, evaluating their design patterns, key size, vulnerabilities shown in previously performed studies, and adaptability for constrained devices. Both Hatzivasilis et al. [30] and Jassim S. and Farhan A. [31] highlight the necessity of lightweight cryptography for IoT to ensure security; however, these surveys do not specifically mention the devices used to implement the algorithms for its evaluation, causing uncertainty for developers wanting to implement such solutions on devices of their preference.

T. Meng et al. [32] implemented and evaluated both block and stream cipher algorithms, focusing mostly on the amount of memory and CPU usage required to execute the algorithms, along with the execution time and throughput for encryption and decryption. This paper does not evaluate a vast number of algorithms like the previous surveys, but it identifies performance metrics for the ciphers used and compares them with each other. Unfortunately, the implementation of the studied algorithms is performed on devices with a substantially high quantity of resources; for this reason, the comparison between the results obtained in this paper with studies using devices with constrained resources is not ideal.

R. Kureshi and B. Mishra [33] performed an evaluation of block cipher algorithms on a Raspberry Pi 3B+ development board. It should be noted that the algorithms used in this study are not lightweight, and the board itself has a large amount of resource compared with those commonly used in IoT; therefore, this study focuses on traditional encryption algorithms for IoT.

A. Sevin and A. Osman [34] presented a study of 50 lightweight block ciphers implemented in software for IoT to evaluate their performance with respect to execution time, latency, ROM and RAM usage, and energy. The algorithms presented are implemented on an 8-bit ATmega128 microcontroller with low power consumption, commonly used in IoT applications. This study aids IoT developers regarding the selection of an appropriate block cipher algorithm for the requirements of their specific applications and platforms. In addition to this study, the authors suggest that these algorithms studied should be used and tested on different platforms such as development boards with 16-bit and 32-bit architectures, as well as pointing out the need to evaluate stream ciphers.

L. Jiao et al. [35] reviewed the history of stream ciphers and how they have been developed over the years in such a way that these ciphers can be efficient on hardware implementations without neglecting an adequate level of security, even with resource constraints. This review classified stream ciphers into groups according to their design principles, then used this groups to discuss their strengths and weaknesses as well as design proposals to improve their performance. A theoretical and analytical approach to the compared stream ciphers rather than implementing them is taken in this paper, helping to understand the operation of such ciphers in order to establish a basis for future designs. This paper is not suitable for the performance evaluation of the algorithms presented as no variables of interest are shown that can be useful to developers looking for specific needs.

V. Thakor et al. [36], similarly to [30], conducted a survey of 50 popular block ciphers used in IoT devices, evaluating them regarding their design features, performance, and security measures. Security issues were also addressed, taking into consideration the constrained resources of IoT devices, stressing the importance of lightweight cryptography for secure data transfer. The algorithms shown were implemented on microcontrollers from the NXP, AVR, and ARM platforms. The algorithms were evaluated based on their structure design, assisting their comparison and helping in the decision making of the developers, depending on their needs. Despite briefly mentioning stream cipher algorithms, this paper does not evaluate algorithms of this type, as the authors consider that block ciphers are preferred over stream ciphers due to the security level they provide along with their versatility and simplicity of design.

The previously mentioned papers are valuable contributions providing an overview of the options available when looking for a suitable symmetric encryption algorithm to be used on IoT applications with specific needs. However, the field still needs to be thoroughly explored in order to provide more information and have a wider scope of all available options. One of the branches that should be further studied involves stream ciphers, given that they are a good alternative for data protection and that most of the papers mentioned in this section does not include them.

3. Symmetric Cipher

This section describes the algorithms evaluated in the development of this work; these are organized according to the type of symmetric cipher they belong to: block cipher or stream cipher.

Symmetric ciphers have a crucial role in the IoT environment, ensuring the security of information between devices and their data [32]. Traditional encryption algorithms used in computers, such as the AES standard, are a valuable tool used to protect information; however, they require a considerable amount of memory and processing power, affecting the performance of IoT devices as well as their lifetime [37]. Therefore, it is highly advisable to use lightweight encryption algorithms that use the least quantity of computational resources possible and guarantee a strong level security as a security mechanism for IoT.

The selection of cryptographic algorithms was performed, taking into account the wide diversity of design architectures in order to provide a wide range of use cases and possible threats as well as determining which type of algorithm is most suited depending on the selected devices. Also, recognized algorithms in the cryptographic community were considered. Ultimately, only algorithms within the “lightweight” category were accounted for.

The following algorithms were evaluated in this study.

3.1. Lightweight Block Ciphers

• PRESENT [38]: This algorithm is designed for environments with limited resources, such as RFID cards and small embedded systems. It uses a 64-bit data block and an 80-bit or 128-bit key. Its design is optimized for hardware implementation, with a major focus on low power consumption. Tests have shown that it is resistant to brute force attacks, although it was also shown that the key used for encryption can be recovered by differential fault analysis attacks [39].
• SPECK [40]: Developed by the National Security Agency (NSA), this cipher was designed for efficient performance in resource-constrained environments, and it employs different blocks sizes as well as key sizes. It has been revealed that this cipher has vulnerabilities when subjected to different cryptoanalysis attacks, especially in scenarios where a small number of rounds are used for encryption [41]. Despite this, the algorithm is considered a great alternative due to its high performance in IoT applications.
• Piccolo [42]: It is an ultra-lightweight algorithm that operates with a block size of 64 bits and an 80-bit or 128-bit key size designed to be efficient in hardware implementations. Several vulnerabilities have been found when performing different crypto-analytic attacks [43,44]. Despite the fact that this cipher is efficient, the vulnerabilities presented in it must be taken into consideration if the level of privacy and security is high.
• CRAFT [45]: This cipher uses a 128-bit and a 64-bit block in addition to a third input known as a “tweak” for added security. It is designed primarily to be resistant to differential error attacks without neglecting an efficient resource management. Although its design contemplates resistance against attacks, potential vulnerabilities have been detected, such as weak keys and susceptibility to side-channel attacks [46]. Given that this algorithm was developed recently, further research is needed to mitigate the possible attacks that this cipher is susceptible to.
• Hummingibird-2 [47]: It is a lightweight cryptography algorithm designed for resource-constrained devices that uses a 128-bit secret key and a 64-bit initialization vector. In addition to the data encryption, this algorithm can also produce an authentication tag for each message processed. This algorithm has been susceptible to attacks capable of recovering the secret key used to encrypt messages [48].

Table 1. Features of the studied block ciphers.

Cipher Algorithm	Key Size (bits)	Block Size (bits)	Rounds
PRESENT	80, 128	64	31
SPECK	64, 72, 96, 128, 144, 1292, 256	34, 48, 64, 96, 128	22, 23, 26, 27, 28, 29, 32, 33, 34
Piccolo	80, 128	64	25, 31
CRAFT	Key: 128 Tweak: 64	64	31
Hummingbird-2	Key: 128 IV: 64	16	4

summarizes the features of the lightweight block ciphers algorithms discussed above.

3.2. Lightweight Stream Ciphers

• ASCON [49]: This algorithm was designed specifically to be lightweight and simple to implement; it uses a 128-bit key and an initialization vector of the same length; if required, it can also produce an authentication tag of the same length. It was standardized by the National Institute of Standards and Technology (NIST) in the year 2023 after winning the CAESAR competition for its efficiency and security [50]. It was designed specifically to withstand various cryptographic attacks; however, additional measurements are required to ensure its security in practical implementations [51].
• ACORN [52]: Designed to be lightweight and efficient, this algorithm uses a 128-bit key and a 128-bit initialization vector; it can also produce an authentication tag of the same size if required. It was one of the candidates for standardization in the CAESAR competition along with the current standard, ASCON. This cipher possesses vulnerabilities to different types of cryptanalytic attacks, especially when the initialization vector is reused to encrypt messages [53]; thus, further studies are necessary to determine whether the algorithm is appropriate to ensure the security of IoT devices.
• Lizard [54]: It is a lightweight cryptographic algorithm designed for energy-constrained devices, offering a balance of security and efficiency. It uses a 120-bit key and 64-bit initialization vector. While it provides robust security against the most common cryptographic attacks, it has been shown to have vulnerabilities that can be exploited to obtain the secret key used for encryption [55].
• Fruit-80 [56]: A cryptographic algorithm designed for communications in resource-constrained environments. Its ultra-lightweight design uses an 80-bit key and a 70-bit initialization vector. It stands out as a highly efficient algorithm with major optimizations for hardware implementation. Several security analyses have detected potential vulnerabilities when it falls victim to correlation attacks [57]. Despite this, Fruit-80 offers strong resistance against known attacks and is a viable option for IoT due to its efficiency.
• TRIVIUM [58]: This algorithm is designed for the efficient operation of both hardware and software. It uses an 80-bit key and an initialization vector of the same length. Its design stands out for its simplicity, efficiency, and high speed, for which it has been the subject of security and efficient implementation research. New variants and security improvements have been proposed to mitigate cryptographic attacks that the cipher is vulnerable to [59]. These proposals highlight the efforts to reinforce stream ciphers against potential attacks while maintaining their efficiency and, if possible, improving it.

The features of the stream ciphers mentioned above can be seen in

Table 2. Features of the studied stream ciphers.

Cipher Algorithm	Key Size (bits)	Block Size (bits)	Rounds
ASCON	128	64, 128	128
ACORN	128	293	128
Lizard	120	121	64
Fruit-80	80	80	70
TRIVIUM	80	288	80

.

3.3. Security Resilience of the Selected Algorithms

Lightweight cryptography offers significant advantages over conventional options for resource-constrained devices. However, these advantages are counterbalanced by trade-offs at the cost of security. These trade-offs exist due to the time, design, and cost constraints that are present in the IoT and WSN ecosystems.

Table 3. Comparison between security resilience and vulnerabilities for the selected algorithms.

Algorithm	Security Resilience	Vulnerabilities
PRESENT	Low resource consumption, strong against differential and linear cryptanalysis.	Advance cryptanalysis techniques if the number of rounds is reduced.
SPECK	Designed for efficiency, resistance to differential and linear cryptanalysis	Susceptible to certain types of differential attacks if improperly implemented.
Piccolo	Strong against differential attacks, optimized for low-resource environments.	Vulnerable to specific linear attacks and key recovery methods if the key size is not adequate.
CRAFT	Resilient against known cryptanalytic attacks	Vulnerable to brute-force attacks due to smaller key sizes in some configurations.
Hummingbird-2	High resistance to side-channel attacks, suitable for constrained devices	Potential weaknesses in key management and side-channel attack depending on implementation.
ASCON	Designed to resist side-channel attacks and provide high security. Winner of the NIST LWC competition.	Potential vulnerabilities may emerge over time.
ACORN	Strong security claims against known vulnerabilities.	Potential weaknesses in key management or implementation flaws.
Lizard	Resilient against differential and linear attacks	Potential vulnerabilities may be discovered as it is less widely studied.
Fruit-80	Resistant to several cryptanalytic attacks	Vulnerable to specific types of cryptanalyses if the implementation does not adhere to best practices.
TRIVIUM	Strong against algebraic attacks	Susceptible to algebraic attacks if key management is weak or the initialization vector is predictable.

shows a comparison between the strengths and weaknesses of the selected algorithms [60,61,62,63,64,65,66,67,68,69].

4. Lightweight Cryptography Algorithms Analysis

In this section, the methodology used to perform the evaluation of the symmetric encryption algorithms studied is described, alongside the devices used for their implementation as well as the software and tools used. Lastly, the performance metrics used for the evaluation of the algorithms are explained. Figure 5 illustrates the methodology used for this research. Each stage of the procedure is described below.

4.1. State of the Art Research and Opportunity Ideas Identification

Relevant information regarding the current overview in security for embedded systems used in IoT was collected in order to have an overview about the topic. Subsequently, opportunities for improvements in the security for these systems were studied, thus defining the key challenge to be addressed: the current lack of security in embedded systems.

4.2. Lightweight Cryptographic Algorithms Selection

After reviewing the state of the art, cryptographic algorithms were selected only if they qualified as “lightweight”, meaning that they have a reduced resource consumption. The selected algorithms were chosen due to being some of the most relevant and studied based on the literature reviewed [31,32,33,34,35,36,37]. Only 10 algorithms were selected due to time considerations for this research. The selected algorithms are mentioned in Section 3 above. In addition, the international standardization and guidelines compilation, currently stated in the international standard ISO/IEC 29192 Lightweight Cryptography, describes guidelines for scaling lightweight cryptographic algorithms when used in IoT-based networks.

4.3. Hardware and Software Selection

Development boards were chosen among the most popular for IoT projects according to the state of the art methods reviewed [70,71,72] that had low amounts of memory and processing, but not so small that the algorithms selected could not be implemented on them. The specifications of the selected development boards are mentioned below in

Table 4. Specifications for the development boards used.

Development Board	ESP32 Dev Module	NodeMCU ESP8266	MSP430 Launchpad	NUCLEO-G0B1RE	Arduino Nano
Data width	32-bit	32-bit	16-bit	32-bit	8-bit
Clock [MHz]	240	160	16	64	16
RAM [kB]	520	64	0.5	144	2
ROM [kB]	448				1
FLASH [kB]		512	16	512	32
Pins	30–36	30	24	64	30
Supply voltage [V]	5	5	3.6	5	7–12
I/O voltage [V]	3.3	3.3	3.6	3.6	5

.

4.4. Code Implementation

The code used to evaluate the lightweight cryptographic algorithms were implemented in C/C++ language, given that it is one of the most popular programming languages for IoT, along with its high efficiency. Public implementations of the algorithms were sought for reuse; if no such implementations were found, the code was then implemented based on the documentation provided by the algorithm designers.

The ASCON and SPECK algorithms were implemented using the Arduino Crypto library developed by Rhys Wheatherley [73], included in Appendix A, which provides traditional and lightweight cryptography algorithms. The PRESENT and Piccolo algorithms were implemented based on the code published on GitHub [74,75] that was modified for its use in development boards. The remaining algorithms, CRAFT, Hummingbird-2, Acorn128, Lizard, Fruit-80, and TRIVIUM, were developed based on the provided description of the algorithms according to their respective documentation.

4.5. Performance Metrics Definition

To evaluate the previously mentioned algorithms, performance metrics were defined. The definition of those metrics and how they were measured are mentioned below:

• RAM memory: The minimum amount of RAM memory required to implement an algorithm. This metric was obtained by programming each development board with a no-content code to obtain the minimum memory used by the board. After this, the same development board was programmed with each of the cryptographic algorithms, resulting in a new memory value. The difference in memory in both measurements is the desired metric. The amount of RAM memory consumed by the code is displayed on the compiler when the compilation process is finished.
• ROM/FLASH memory: The amount of ROM or FLASH memory required by the algorithm to be implemented. This parameter was obtained in the same way as the RAM memory.
• Encryption/Decryption latency: Average time required by the algorithm to produce one single byte of encrypted or decrypted data. Each of the algorithms were ran 5000 times, and the time required to carry out these executions was measured. The execution time of these iterations was calculated with a coded function in each development board, as shown in Figure 6. The time required per byte was calculated using Equation (1):

$$latency \left[{\displaystyle \frac{\mathrm{s}}{\mathrm{bytes}}}\right]={\displaystyle \frac{executionTime \left[\mathrm{s}\right]}{5000\ast dataSize \left[\mathrm{bytes}\right]}}$$

• Encryption/Decryption throughput: The average amount of bytes that the algorithm can produce per second when running on a development board. This parameter was obtained by measuring the time required to run each of the algorithms 5000 times with the same implementation previously used to calculate the execution time for latency, as shown in Figure 6. Then, using this time and the data size of the processed message, the metric was obtained using Equation (2):

$$throughput \left[{\displaystyle \frac{\mathrm{bytes}}{\mathrm{s}}}\right]={\displaystyle \frac{5000\ast dataSize \left[\mathrm{bytes}\right] }{executionTime \left[\mathrm{s}\right]}}$$

• Current: The average value of the electrical current each development board required for encryption/decryption. Each of the algorithms were run indefinitely on each development board and powered with a 5 V voltage source with a margin of error of $\pm 0.01 \mathrm{V}$. The current was measured by connecting an ammeter in series between a voltage source and the development board. A diagram of this connection is shown in Figure 7.

• Power: The average transfer rate of electrical energy required by each of the algorithms to encrypt/decrypt. This parameter was calculated using the current measured mentioned above and the 5 V supply voltage value as shown in Equation (3):

$$Power \left[\mathrm{W}\right]=Voltage \left[\mathrm{V}\right]\ast Current \left[\mathrm{A}\right]$$

• Energy: Required energy to produce a single byte of encrypted/decrypted data. This parameter was obtained using the power measured for each algorithm and the latency that it takes to process a byte of data as shown in Equation (4):

$$Energy \left[{\displaystyle \frac{\mathrm{J}}{\mathrm{byte}}}\right]=Power \left[\mathrm{W}\right]\ast latency \left[{\displaystyle \frac{\mathrm{s}}{\mathrm{bytes}}}\right]$$

4.6. Lightweight Cryptographic Algorithms Evaluation

For the evaluation of the selected algorithms, an ideal test scenario was used, which consisted of implementing only the code of each algorithm in the development boards previously mentioned. To verify the correct operation of the algorithms, different messages were encrypted depending on the maximum data length allowed by each block cipher, and 16-byte data was used for stream cipher testing. Once the message was encrypted, it was decrypted to obtain the original text, thus verifying their correct operation. Figure 8 illustrates the connection between the development board tested and the computer used to visualize the correct operation of the implemented algorithms. The development boards were used to execute the symmetric cryptographic algorithms and evaluation according to the performance metrics mentioned before. The development boards were connected to a computer to visualize the correct operation of the algorithms and visualize results. The implementation and visualization of the algorithms were performed using the PlatformIO extension available in the Visual Studio Code IDE, supported by the Arduino framework, for easy implementation and using its serial monitor to display results. It is worth mentioning that the same code corresponding to each algorithm was used to program each of the development boards mentioned.

4.7. Conclusions Writing

After implementing and evaluating all proposed algorithms in each of the development boards, a conclusion was drawn.

5. Results

This section shows the results obtained from the implementation of each of the symmetric encryption algorithms studied as well as their analysis, evaluation, and comparison. All the code implementations used for the evaluation of the algorithms are available in a GitHub repository link included in Appendix A. To facilitate comparison, the results are shown as graphs. In addition to this, comparison tables of all the results obtained are shown in Appendix B.

5.1. Memory Usage

Figure 9 shows the amount of RAM memory required by each symmetric algorithm, both RAM and ROM/FLASH. Focusing on Figure 9a, the results obtained reveal significant variations among the algorithms and an even greater variation among the boards used. It can be easily noted that the development boards that require the largest amount of RAM memory to implement the algorithms are the ESP32 and Arduino Nano boards, followed closely by the ESP8266 board. On the other hand, the development boards that require the least amount of RAM memory are the NUCLEO-G0B1RE and MSP430 Launchpad boards. The code used to implement the algorithms in all of the boards is the same for each of the boards analyzed, so the difference in RAM consumption may be due to differences in the architecture of the processors. Another reason for why the consumption is different between boards is the compilation process used by the PlatformIO compiler for each of the cards; this huge difference between boards mainly occurs as the compilation performed by PlatformIO is not well optimized for the ESP family boards, especially ESP32, as it has a considerable amount of RAM. As for the comparison between algorithms, the one with the highest RAM requirement consistently across all boards is the SPECK algorithm, reaching up to 676 bytes for the ESP32 board implementation, implying that its implementation may not be ideal for applications where memory is a critical resource. On the other hand, algorithms such as PRESENT and CRAFT proved to be the most efficient on various boards. In particular, PRESENT only requires 20 bytes of RAM when implemented on the NUCLEO-G0B1RE development board, standing out as the most economical option in terms of RAM memory. Similar behavior is observed in terms of RAM requirements by the cryptographic algorithms for each of the board’s implementations, so it is inferred that the memory consumption per algorithm may be strongly linked to the design used for each of the algorithms.

Similar to the previous point, Figure 9b shows the ROM/FLASH memory usage required to implement each of the cryptographic algorithms studied. The experimental results show different performance characteristics in terms of the development boards; the ESP32 platform shows a significantly higher requirement in comparison with the other boards used for all of the algorithms implemented. This can be attributed to the complexity of the architecture of the microcontroller in addition to the instruction set it uses. Conversely, the Arduino Nano board exhibits a more efficient use of ROM/FLASH memory compared with the other development boards evaluated, with implementations requiring only 1.57 KB, as is the case in the Piccolo80 algorithm. These results indicate that the Arduino Nano board is a platform that is designed to implement applications with limited memory considerations. Meanwhile, the ESP32 board is designed to support more demanding and robust applications. The remaining boards have a higher memory requirement compared with the Arduino Nano, but not as high as in the case of ESP32, making them a middle grown between the two. The latter methods are more efficient when it comes to implementing moderate algorithms.

5.2. Encryption and Decryption Latency

Figure 10, Figure 11, Figure 12, Figure 13 and Figure 14 show the algorithm latency for processing a single byte of data for both encryption and decryption measured on the ESP32, ESP8266, MSP430 Launchpad, NUCLEO-G0B1RE, and Arduino Nano boards, respectively. Firstly, when the results among boards are compared, it can be observed that the encryption and decryption latencies are lower on the ESP32 board when compared with the other platforms evaluated. Moreover, the ESP8266 and NUCLEO-G0B1RE boards show consistently moderate times, suggesting limitations in computing power when compared with ESP32. Finally, the MSP430 Launchpad and Arduino Nano boards were the slowest platforms by a large margin when compared with the previous ones. The difference in latency times for the boards evaluated is mainly due to the difference in architecture between boards, but more importantly, the clock speed of each board evaluated; the execution times for each of the boards are related to the clock speed used, so the higher the clock speed, the smaller the latency.

When comparing algorithms, it is noted that SPECK is consistently the fastest of the algorithms evaluated in all platforms, which makes it an ideal algorithm for real-time applications, where fast encryption and decryption of data is critical. By contrast, algorithms such as PRESENT and lizard show significantly longer latency times, which could limit their use in time-sensitive applications, making them even more unfeasible for most applications. It is also worth noting that the execution times for encryption and decryption are similar in most cases, which is to be expected as the decryption process is inversely proportional to the encryption process.

Significant differences are noted when comparing latency among the algorithms; the PRESENT block cipher stands out as the lowest in most of the development boards evaluated, except for the NUCLEO-G0B1RE board, where the algorithm with the highest latency is lizard. This high latency means that these algorithms require more time to process one byte of data compared with the other algorithms. On the other hand, the SPECK algorithm has the lowest latency among all algorithms evaluated in all development boards, showing great performance and suitability for low-power and real-time applications.

5.3. Throughput for Encryption and Decryption

Figure 15, Figure 16, Figure 17, Figure 18 and Figure 19 show the throughput for the encryption and decryption of the selected algorithms implemented on ESP32, ESP8266, MSP430 Launchpad, NUCLEO-G0B1RE, and Arduino Nano boards. Comparing these results with previous ones, latency and throughput are inversely proportional to each other, which is expected as, if less time is required to process one byte of data, more bytes can be processed in each period. When the boards’ performances are compared, it is noted that ESP32 has the highest throughput capabilities among all evaluated boards. ESP8266 exhibits lower processing capabilities than the previous one but is still adequate for most of the algorithms implemented on it. Once again, the differences in throughput capabilities across all boards are mainly attributed to the clock speed used in each board, in addition to its architecture.

The NUCLEO-G0B1RE board is placed at an intermediate level, so extra considerations regarding throughput requirements should be taken into account when implementing encryption algorithms on this platform. Finally, the MP430 Launchpad and Arduino Nano boards show significantly low throughput capabilities, which makes most of the implemented algorithms not feasible for real applications, as is the case for the PRESENT and lizard algorithms.

As for the comparison across algorithms, once again the SPECK algorithm stands out as the highest throughput capacity over all platforms with a high margin, making it a great candidate for applications where data need to be produced in a short time. On the other hand, algorithms such as lizard and PRESENT show the worst throughput on all of the evaluated boards, especially on the MSP430 Launchpad and Arduino boards. This behavior suggests significant limitations for their implementation in applications where the production of a large volume of data in the shortest possible time is a major concern, making it even unfeasible on the beforementioned development boards due to their low throughput. The throughput capacity of each of the algorithms evaluated is different from each other, which is mainly due to their characteristic design. However, these capabilities should be taken into account for viable applications of each of the algorithms on each development board selected.

5.4. Electric Current Usage

Figure 20 shows the average current usage of each development board during the execution of every algorithm for both encryption and decryption. The values obtained in each of the implementations are very similar to each other, so it is not considered that there is a significant difference in terms of the electrical current requirements among algorithms. However, if these requirements are compared between boards, clear differences are observed; the ESP32 board requires the highest electrical current consumption among all platforms studied, being closely followed by the ESP8266 board. The MSP430 Launchpad has a medium current consumption rate compared with all of the boards studied. Finally, the Arduino Nano and NUCLEO-G0B1RE boards show a significantly lower power consumption than all of the previously mentioned boards, where the latter requires on average a value of 5.577 mA to execute cryptographic algorithms.

Similarly, the average differences between the encryption and decryption processes are remarkably small in most of the platforms, so the variation presented in the data is not considered significant. The consistency in current usage between encryption and decryption processes on most platforms indicates a well-optimized implementation of the algorithms, which is of utmost importance in energy-constrained applications.

5.5. Electric Power Rate

Figure 21 shows the power requirement for all of the development boards while running each of the algorithms for encryption and decryption. As in Figure 20, the power required to run any of the algorithms is similar across all of them, so there is no significant difference in power required per algorithm. The difference in power required is noted when the development boards are compared; the NUCLEO-G0B1RE and Arduino Nano boards are the ones that require less electric power compared with the other boards studied, maintaining a remarkably low and consistent power consumption for both encryption and decryption so that they are better options when power restrictions are present. The ESP32 and ESP8266 boards have a higher power requirement compared with the other boards. The ESP family boards do not show significant differences in terms of power; however, the ESP32 board requires slightly more compared with the ESP8266 board. It is particularly noted that the NUCLEO-G0B1RE maintains a more efficient and stable power consumption compared with the other boards evaluated, which positions it as an optimal choice when power efficiency is critical.

5.6. Energy Usage per Byte

Figure 22, Figure 23, Figure 24, Figure 25 and Figure 26 provide the required energy to process a single byte of data, both encryption and decryption, for each cryptographic algorithm on the development boards evaluated. The results reveal significant differences in energy required among the algorithms, as well as among the development boards used.

Comparing the results across boards, it is observed that the NUCLEO-G0B1RE board presents the lowest energy requirement compared with the other evaluated boards, followed by ESP32. MSP430 Launchpad presents a significantly higher energy requirement compared with all boards, which is a crucial factor to consider in the design of energy-constrained IoT systems. This lower efficiency is directly related to the encryption and decryption latencies that each of the algorithms and boards have, in addition to the power requirements for encryption and decryption. This leads to higher energy consumption. Likewise, the ESP32 and ESP8266 boards have lower energy consumption due to them, despite requiring more electrical power to perform their operations. Comparing the results across all of the algorithms implemented on the development boards, it is observed that SPECK proves once again to be one of the most energy-efficient algorithms on all evaluated platforms, requiring only 0.06 µJ on the NUCLEO-G0B1RE board, also showing similarly efficient values on the other platforms. In contrast, PRESENT exhibits one of the highest energy consumptions on all platforms, with particularly notable values on MSP430 Launchpad. The differences in energy requirements are mainly due to the execution time of each algorithm since, as discussed before, this is strongly linked to the energy power consumption of each of the algorithms. It is worth noting that the PRESENT algorithm presented a significant disparity in terms of encryption energy requirements compared with decryption, being almost 50% on the MSP430 Launchpad board, something that had not been presented in the previous figures in such a drastic way.

6. Discussion

6.1. Performance Discussion of Lightweight Symmetric Algorithms

From the results, it can be inferred that the SPECK and TRIVIUM symmetric algorithms exhibit remarkable memory efficiency while maintaining high processing speed, even surpassing the recent standard, ASCON. In contrast, PRESENT, lizard, and Fruit-80 face challenges in terms of efficiency and processing power. Additionally, although SPECK is energy-efficient and fast, it requires higher RAM and ROM/FLASH memory consumption for implementation. This makes SPECK a suitable choice for implementations that prioritize energy efficiency, regardless of memory constraints. On the contrary, algorithms such as PRESENT exhibit exceptionally low RAM/FLASH memory requirements. However, this advantage is counterbalanced by a high energy consumption and high latency. Consequently, algorithm selection depends on the specific IoT application and the device’s memory constraints. For instance, the ASCON standard represents a moderate-consumption algorithm that strikes a balance between resource consumption and higher computational requirements.

To facilitate the decision making of developers, Figure 27 shows a comparison matrix of the resource consumption versus throughput. This matrix illustrates the advantages and disadvantages of the cryptographic algorithms evaluated and complements the results obtained. This classification helps in the selection of the most suited algorithm according to the specific requirements of each IoT application, highlighting how memory energy consumption and speed can influence this decision.

6.2. Symmetric and Asymmetric Encryption Integration

While symmetric encryption offers faster computing speed and better performance to encrypt large amounts of data, it generally provides a lower level of security compared with asymmetric encryption. A promising alternative to take advantage of both techniques is the integration of both types of cryptography in a single system; this solution is called a hybrid cryptosystem. This approach combines the efficiency and speed of symmetric encryption for encrypting large volumes of data while enhancing the system’s security through the definition of a secret key using a key exchange method via asymmetric encryption [76]. However, this strategy increases computational complexity, which can be challenging for resource-constrained IoT devices [77,78].

Another innovative approach is the implementation of identity-based encryption (IBE) and identity-based broadcast encryption (IBBE) [79,80]. These methods eliminate the need for complex public key infrastructures, making them especially attractive for IoT devices with computational and storage constraints. These techniques can improve security while reducing overhead, aligning with the lightweight requirements demanded by IoT systems.

In addition to exploring hybrid and identity-based methods, future studies should include specific security assessments for lightweight symmetric algorithms, as such assessments are critical for ensuring the long-term reliability and security of lightweight cryptographic solutions in IoT applications.

7. Conclusions

Lightweight cryptography is an indispensable security mechanism for a secure implementation of Internet of Things (IoT), given that it is of major importance to guarantee the security and privacy for the data transmitted between devices across these networks. A total of ten lightweight symmetric algorithms, half block ciphers and half stream ciphers, were evaluated, focusing mainly on their use in development boards typically employed in IoT environments. The evaluation of these algorithms was successful, as all the chosen algorithms were correctly implemented and all performance metrics defined were measured on the selected development boards. As a by-product of this research, a repository was developed that contains implementations of the mentioned algorithms in C++ language, which are implemented as C++ libraries so that these can be adapted to any platform that uses this programming language, as is the case of the development boards compatible with the Arduino platform. The results of this evaluation have provided valuable information on the performance and characteristics of each algorithm, highlighting the strengths as well as weaknesses of each algorithm with respect to its resource requirements. The memory usage evaluation shows significant differences in RAM and ROM/FLASH requirements among boards and algorithms. Boards such as the ESP32 and Arduino Nano boards exhibit higher RAM consumption, which is attributed to the microcontroller architecture and less optimized compiler configurations. On the other hand, the NUCLEO-G0B1RE and MSP430 Launchpad boards require minimal RAM, making them better suited for memory-constrained environments. Similarly, algorithms such as SPECK have more memory requirements, while PRESENT is efficient in memory usage, especially in resource-constrained boards. In terms of encryption and decryption latency, ESP32 consistently stands out against other boards due to its higher clock speed and complex architecture, making it an ideal choice for real-time applications.

Ciphers such as SPECK and TRIVIUM prove to be very efficient in memory usage while remaining fast, even above the recent standard, ASCON. In contrast, PRESENT, lizard, and Fruit-80 have challenges in terms of efficiency and processing power. It was observed that algorithms such as SPECK stand as being energy-efficient and having fast processing; however, this is traded off by a higher RAM and ROM/FLASH memory consumption required to be implemented, making this algorithm viable for implementations that require energy efficiency, regardless of memory consumption. On the contrary, algorithms such as PRESENT show an exceptionally low RAM/FLASH memory requirement, but this is counterbalanced by a high energy consumption and high latency. For this reason, this algorithm is only viable for applications where devices have memory restrictions. There are also moderate consumption algorithms, such as the ASCON standard, with a balance between resource consumption and the level of security they offer. Due to its high-complexity design, it offers greater security at the cost of higher requirements; for this reason, this kind of algorithm is better suited for IoT devices with energy constraints. Lastly, algorithms with high resource requirements and high latency, such as PRESENT, are not optimal for applications with strict resource constraints; instead, these are better suited for applications where confidentiality and privacy of the data transmitted are critical.

The energy requirement analysis highlights the trade-offs between power efficiency and computational performance. While ESP32 and ESP8266 consume more energy, their lower consumption per byte is due to shorter processing times. In contrast, NUCLEO-G0B1RE shows exceptional energy efficiency, positioning it as the most suitable choice for power-constrained systems.

The performance of the development boards evaluated also have potential and practical applications; ESP32′s combination of high throughput and low latency makes it suitable for real-time applications that require fast encryption and decryption, such as IoT gateways and smart home systems. Similarly, the ESP8266 board with moderate latencies and throughput is ideal for IoT applications that need secure communication but operate in less demanding environments, such as wearable devices and smart sensors. The NUCLEO-G0B1RE board excels in power efficiency, making it ideal for power-constrained systems such as remote environmental sensors and battery-powered devices. The Arduino Nano board, with its balanced performance, is suitable for scenarios where power conservation is critical, even at the cost of latency, like embedded medical devices and wireless sensor networks. Lastly, the MSP430 Launchpad constrained-resources configuration is ideal for scenarios where resource management is critical, like low-cost prototyping and testing.

It should be noted that, while the results shown provide valuable guidance for the selection of cryptographic algorithms, there is still a need for further research to address the identified limitations and vulnerabilities. In addition, a comprehensive approach is required that not only takes into account cryptographic security but other challenges that arise in IoT, such as authentication, key management, protection against network attacks, and denial of service, among others.

As future research, there is a need for the evaluation of more cryptographic algorithms under development using more devices with different specifications, as well as the consideration of asymmetric encryption algorithms as another alternative to protect transmitted data, considering that, due to the rapid evolution of cyber threats, it is essential to keep up with research and development in the field of lightweight cryptography. The research in the field of asymmetric cryptography is low in comparison with symmetric cryptography due to the higher complexity and extremely challenging adaptability innovations for lightweight options of the first mentioned algorithms. Also, there are more security mechanisms, such as authentication and intrusion detection, that are needed for the secure implementation of an IoT system; for this reason, is necessary to adopt these algorithms in conjunction with cryptography to ensure a higher level of security in IoT systems.

Lastly, while these mechanisms do help in protecting IoT systems against threats, it is crucial that security education and awareness is promoted among developers, users, and stakeholders in the IoT ecosystem, as all of these mechanisms are useless if people are not aware of the risks that exist and how to identify them in order to avoid compromised security incidents.