The 10 Laws of Smart Object Security Design

There are two basic credential types, namely symmetric as well as asymmetric credentials. However, these credentials can be further categorized into the amount of entropy a symmetric key provides (e.g. a password that can be remembered by a human vs. a randomly created shared secret with 128 bits), into the type of asymmetric credential, and also whether there is a need to integrate the credential into a certain legacy infrastructure (e.g. cellular infrastructure). Historically, there has not been an agreement on a credential type that has to be supported in all environments. The reasons are manifold and it is very unlikely that there will be an agreement for a single credential type for smart objects as well. It is also not wise to assume a single end user registration and credential provisioning approach since many different approaches are in place today and they depend on the level of security that shall be achieved, the user experience, the business model, the device capabilities (e.g. presence of a display, and input devices) and the availability of certain communication networks. It should also be understood that energy or CPU considerations do not necessarily preclude use of asymmetric key cryptography. Even though public key cryptography can be CPU intensive, protocols such as TLS can cache computed session keys, and public key cryptography can also be used in provisioning of symmetric keys. Examples for caching keying materials can be found with TLS