Importance of security End node security is important in the Internet of Things mbed provides a platform for IoT with security baked into the core Entropy is a corner stone for security

1. ©ARM 2016
The importance of strong entropy
for IoT device security
Peter Aldworth
Embedded World 2017
Director systems technology, IoT
15/3/17

2. ©ARM 20162
Importance of security
§ End node security is important in the Internet of Things
§ mbed provides a platform for IoT with security baked into the core
§ Entropy is a corner stone for security

3. ©ARM 20163
What is entropy?

4. ©ARM 20164
What is entropy/random?
§ Strong entropy ≈ true random data
§ true random data = the perfect 50/50 coin-flip
§ No information is available that can predict the future or tell about the past

5. ©ARM 20165
What is entropy/random?
Tux the Penguin, the Linux mascot. Created in 1996 by Larry Ewing with The GIMP.

6. ©ARM 20166
Rating entropy sources: Strong or weak?
§ Weak
§ Hardware Clock / MCU tick counter (Predictable)
§ Random seed compiled into binary
§ Timing / content of incoming network traffic
§ Reasonable
§ Device-specific seed in non-volatile storage
§ Strong
§ Hardware entropy source, e.g.True Random Number Generator (TRNG), in MCU
§ External TRNG on board
!

7. ©ARM 20167
Importance of entropy

8. ©ARM 20168
Bad entropy -> Bad security
§ All security protocols depend on good entropy somewhere in the chain
§ Public/Private key pairs / identities
§ Unique AES keys
§ Unique initialization vectors
§ And thus bad entropy also affects security of:
§ Session keys (e.g. SSL/TLS, SSH)
§ Encrypted files
§ The problem is that it still looks protected
and encrypted to the naked eye
Everybody can see that ECB
mode is bad if you use
it with a picture

9. ©ARM 20169
What do these have in common?
2008: 2014:
2013:
The Last HOPE, Jacob Appelbaum, Dino Dai Zovi, Karsten Nohl
https://trailofbits.files.wordpress.com/2008/07/hope-08-openssl.pdf
https://threatpost.com/weak-random-number-generator-threatens-ios-7-kernel-exploit-mitigations/104757/
https://blog.cryptographyengineering.com/2013/09/20/rsa-warns-developers-against-its-own/

10. ©ARM 201610
mbed OS
and strong entropy

11. ©ARM 201611
mbed OS 5 device side software for Cortex-M
IoT brings a disruptive jump in complexity for embedded software requires a
platform OS. mbed OS is built to address these challenges in devices built for IoT
mbed
OS
Cortex-M
RTOS
kernel
Portable
drivers
Integrated
security
IoT
connectivity
Management
services
Development
tools
Developer
community
Partner
ecosystem
Open collaboration across the ecosystem
accelerates IoT system development

12. ©ARM 201612
§ Platform OS with IoT-
specialized features
§ RTOS core based on
CMSIS-RTOS
§ Cortex-M processors
and Radio IP supported
§ Industry leading device
to cloud security
§ Hardware enforced and
communications security
§ mbed TLS widely
adopted
§ Unified support for key
IoT connectivity
standards
§ Designed for integrated
radio SoCs and Modules
§ Leading innovation on
Thread and LoRa
mbed OS 5 at a glance

13. ©ARM 201613
mbed security architecture
Cloud application platforms
Lifecycle security
Communication
security
Device security
mbed TLS
Connectivity
Client
Provisioning
Client
Update
Client
Connectivity
Service
Provisioning
Service
Update
Service
Device Hardware
mbed uVisor
mbed TLS
Prov TLCrypto TL Update TLConn TL
Deployment ManagementData Flow Management
mbed Cloud
mbed OS

14. ©ARM 201614
Features:
§ SSL / TLS (SSL 3.0 up to TLS 1.2)
§ Extensive TLS Extension support
§ X.509 certificate handling
§ Abstraction layers
§ DTLS
Cryptographic blocks:
§ Symmetric encryption (AES, etc)
§ Hash algorithms (SHA-2, etc)
§ Public Key algorithms (RSA, Elliptic Curves, etc)
§ Random number generation (CTR_DRBG, etc)
mbed TLS - Features and Standards Supported
Full list of features and standard:
• https://tls.mbed.org/core-features
• https://tls.mbed.org/standard-compliance
SSL/TLS
Cipher Layer
(Sym
Encryption)
MD Layer
(Hash) Public Key Layer X.509 Modules
Random
Number Gen
(RNG)
Platform Abstraction

15. ©ARM 201615
Delivering strong entropy in mbed OS
§ mbed TLS is the core library for security functions
§ mbed TLS uses mbed HAL to get access to hardware entropy sources
§ This relies on the developer selecting hardware targets that implement a strong
entropy source (TRNG)

16. The trademarks featured in this presentation are registered and/or unregistered trademarks of ARM Limited
(or its subsidiaries) in the EU and/or elsewhere. All rights reserved. All other marks featured may be
trademarks of their respective owners.
Copyright © 2016 ARM Limited
©ARM 2016