Reproducible AES-128 Benchmarking and Security-Assessment Boundary for Resource-Constrained IoT Environments

Abstract

To meet the constraints of resource-constrained Internet of Things (IoT) devices, the encryption mechanism must provide confidentiality while adding little complexity and memory usage. This work presents a reproducible Advanced Encryption Standard (AES) -128 performance benchmarking and security boundary analysis for constrained IoT applications. Before any benchmarking, the AES-128 implementation was tested against a standard cryptographic test vector. Encryption and decryption were verified based on the successful plaintext recovery. To enhance methodological rigour and reproducibility, the experimental design used 250 runs over four IoT-relevant payload sizes (16 bytes, 1 KB, 10 KB, and 1 MB) executed in a controlled execution environment. The evaluation consisted of performance metrics that include encryption time, decryption time, execution stability, standard deviation and memory variation, analysed in a controlled execution environment. Results show that while AES-128 exhibits stable run-to-run timing for small and medium payloads, execution overhead and timing variance increased for 1 MB workloads in the implementation presented using Python. It also points out that process-level memory profiling is limited for small workloads since they are impacted by noise and variability in the measurement. Reduced-key brute-force attack analysis is shown only as a pedagogical example of key-space growth and makes no claim about the security of full AES configurations. Likewise, side-channel attack concerns are qualitatively addressed because attack analysis was performed. The study provides an AES-128 benchmarking methodology for IoT security evaluation that is statistically founded and fully reproducible.