Remote attestation is a well-established interactive technique to establish trust in the realm of connected devices. It allows a Prover device to attest its platform integrity to a Verifier device. Existing remote attestation protocols rely on classical asymmetric cryptography, which are too heavy for low-end Prover devices, and vulnerable to quantum attacks (a serious concern due to the long lifespan of IoT devices). Hash-Based Signatures (HBS) offer attractive performance and have capabilities to defeat quantum attacks. This paper presents several contributions in this context. First, we present an efficient remote attestation protocol that requires the Prover to perform only one-time HBS operations, which are very lightweight. Our protocol also proposes robust embedded techniques to refresh one-time keys that allow multiple attestations. Second, we present a simpler construction based on multi-time HBS scheme which does not depend on a trusted-third-party. Third, to demonstrate the feasibility of our protocols, we developed prototypes based on state-of-the-art HBS schemes (XMSS and WOTS+) for highly constrained platforms (Arduino 101) in both classical and post-quantum security settings. Finally, we present a comprehensive comparison between these strategies, including guidance on suitable use cases for each one of them. To summarize, our work demonstrates the feasibility of modern HBS constructions for remote attestation of highly-constrained devices.

Decades went by since Mark Weiser published his influential work on how a computer of the 21st century would look like. Over the years, some of the UbiComp features presented in that paper have been gradually adopted by industry players in the technology market. While this technological evolution resulted in many benefits to our society, it has also posed, along the way, countless challenges that we have yet to surpass. In this paper, we address major challenges from two areas that most afflict the UbiComp revolution: security and privacy. We examine open problems on software protection, long-term security, cryptography engineering, and privacy implications. We also point out promising directions towards the solutions of those problems. We claim that if we get all this right, we will turn the science fiction of UbiComp into science fact.

In this work, we propose two McEliece variants: one from Moderate Density Parity-Check (MDPC) codes and another from quasi-cyclic MDPC codes. MDPC codes are LDPC codes of higher density (and worse error-correction capability) than what is usually adopted for telecommunication applications. However, in cryptography we are not necessarily interested in correcting many errors, but only a number which ensures an adequate security level. By this approach, we reduce under certain hypotheses the security of the scheme to the well studied decoding problem. Furthermore, the quasi-cyclic variant provides extremely compact-keys (for 80-bits of security, public-keys have only 4801 bits).

We propose a new, efficient nondeterministic decoding algorithm for square-free Goppa codes over Fpfor any prime p. If the code in question has degree t and the average distance to the closest codeword is at least (4/p)t + 1, the proposed decoder can uniquely correct up to (2/p)t errors with high probability. The correction capability is higher if the distribution of error magnitudes is not uniform, approaching or reaching t errors when any particular error value occurs much more often than others or exclusively. This makes the method interesting for (semantically secure) cryptosystems based on the decoding problem for permuted and punctured Goppa codes.