<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hello Noisy folk,</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I’ve been working for a while on a protocol framework based on Noise and also BLINKER, called "STROBE lite". It is designed to be used for IOT and other constrained devices in place of more complex protocols such as TLS. I believe that the design is now ready for its first real public release, v0.2.</div><div class=""><br class=""></div><div class="">The design is lightweight, weighing in under 2kiB of code and a couple hundred bytes of stack on ARM-Thumb2 last I checked. It isn’t fast, but it isn’t horribly slow either. Maybe 250 CPB on an M3.</div><div class=""><br class=""></div><div class="">The goal is to use a sponge construction (Keccak-F[800] should run well on 32-bit micros) for all the symmetric crypto in a given system. This reduces the code size and memory consumption, and considerably simplifies the protocol design and code. For example, if you look at the long-running discussion on prehash and hash modes for EC signatures on CFRG right now, things are much simpler here: the framework has a Schnorr signature operation which is performed on the state of the protocol (or symmetric cryptosystem), so it requires no prehash, it takes all context into account, and it requires no additional hash functions.</div><div class=""><br class=""></div><div class="">Other exciting features:</div><div class="">* You can use this framework for other things, like code signing, static encryption, random number generation and key diversification. Of course, you could do these things with other symmetric libraries, but it’s really straightforward with STROBE lite.</div><div class="">* For complex protocols (TLS replacements), version fallbacks are handled gracefully and with minimal risk of a downgrade vulnerability.</div><div class="">* It is trivial to encrypt handshake messages, such as certificates, just as Noise does.</div><div class="">* There is a rough outline for how to modify the protocol for full steganographic mode (length padding, etc).</div><div class="">* Consideration is given to protocol-level DPA resistance.</div><div class=""><br class=""></div><div class="">Weaknesses:</div><div class="">* This design isn’t very good for asynchronous protocols. You can implement Axolotl using this as the symmetric crypto, but it’s not going to be much simpler than Axolotl itself.</div><div class="">* Not standard, obviously.</div><div class="">* Not super fast without hardware acceleration, and not parallelizable. Thus, this is primarily for lightweight applications.</div><div class="">* Only on version 0.2; may contain bugs.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Documentation and Python sample code are at: <a href="https://github.com/bitwiseshiftleft/strobelite/" class="">https://github.com/bitwiseshiftleft/strobelite/</a></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Please tell me what you think.</div><div class=""><br class=""></div><div class="">Cheers,</div><div class="">— Mike</div></body></html>