Elliptic Curve Cryptography for Lightweight IoT and Industrial IoT Security: A Focused Comparative Review of Three Design, Evaluation, and Architectural Approaches

Abstract

Elliptic curve cryptography (ECC) is a public-keycrypto primitive that is widely used because it achieves securitylevels that are roughly equivalent to those of the conventionalpublic-key schemes with smaller key sizes; thus, a 256-bit ECC keycan provide security levels comparable to those of a 3072-bit RSAmodulus. This paper presents a selective review rather than acomprehensive survey. Three recent peer-reviewed studies havebeen chosen following a well-defined procedure, given that theycome at different points in the process of proposing, breaking andsystematizing lightweight security schemes: propose–break–systematize. The first provides a protocol that integrates ECC witha physically unclonable function (PUF) and applies a passwordretrieval mechanism based on the Chinese Remainder Theorem,with security analysis carried out with BAN logic and ProVerif.The second one tests a formally proven anonymous ECCauthentication and key-agreement system and shows animpersonation attack on the end-device of a system in whichephemeral randomness can be leaked under an adversarial model,which is then confirmed by AVISPA. The third proposes afederated learning framework for the industrial IoT with theadoption of certificateless ECC, similarity-based updatescreening, and blockchain-based checkpoints. The three methodsoperate on different architectures, threat models, platforms andworkloads, so the results of the measured performance are notdirectly comparable. The review shows that the security claims arecritically dependent on what adversary model is assumed; thatnone of the three reviewed studies reports any failure of theunderlying elliptic-curve arithmetic; and that the reviewedliterature does not provide the same reference configuration toevaluate efficiency claims. A minimum reporting standard isproposed to fill this void.