One-Time Keys From Elliptic Curves Aim to Lighten IoT Authentication

Researchers have proposed a new one-time password and one-time key generation protocol designed for Internet of Things devices, where limited processing power, memory, and battery life make heavyweight cryptographic authentication difficult to deploy. The scheme, described by Sweta Mishra and Rishi Kumar Jha in Cluster Computing, builds one-time credentials directly from elliptic curve arithmetic rather than from the hash-based constructions that dominate current practice. At its core, the protocol generates one-time keys through efficient scalar multiplication on elliptic curves.

The implementation relies on the endomorphism ring of the curve and computes the multiplication-by-n mapping using recursive doubling and addition formulas. This differs from post-quantum isogeny-based constructions, which depend on the hardness of finding paths between elliptic curves. The proposed scheme instead stays within the classical group structure of the curve, so its security rests on the Elliptic Curve Diffie-Hellman Problem, the same assumption that underpins widely deployed elliptic curve key exchange.

For computational stability and side-channel resistance, the authors implement their scalar multiplication with Montgomery ladder-based computation. The Montgomery ladder processes bits of the scalar in a fixed pattern, which helps reduce the timing variations that attackers can exploit when a device leaks information about secret values through its power consumption or execution time. The proposal targets a specific pain point in IoT security.

As smart devices interconnect and generate large volumes of data for automation and remote monitoring, each new connection widens the attack surface. Privacy risks accumulate quickly, yet the hardware constraints of typical IoT devices rule out many robust solutions. One-time passwords have long been considered a lightweight authentication option for such environments, and the authors position their scheme as a way to strengthen that option with elliptic curve techniques.

Unlike conventional one-time password systems, the protocol produces session-specific one-time passwords and dynamically diversified keys. According to the authors, this enhances key freshness, meaning each authentication session works with newly derived key material instead of reusing secrets across sessions. The scheme also provides forward secrecy, so compromise of a long-term secret does not expose past session keys, and it is designed to resist replay, brute force, and dictionary attacks.

The evaluation is based on a real implementation rather than simulation alone. The authors compare their approach with two established standards: HMAC-based One-Time Password, known as HOTP, and Time-based One-Time Password, known as TOTP. Both standards derive one-time codes from hash message authentication codes, with HOTP using event counters and TOTP using time steps.

The proposed elliptic curve protocol was measured against them across different metrics. The reported results indicate superior scalability, faster key generation, and reduced one-time password generation times compared with the hash-based alternatives. The performance advantage was particularly pronounced with Curve25519, a widely used elliptic curve favored for its efficiency on constrained hardware.

The authors present these findings as evidence that the protocol can serve as a lightweight and robust authentication solution for resource-limited IoT environments. The distinction between this scheme and isogeny-based constructions carries practical weight. Isogeny path-finding problems attracted attention as candidates for post-quantum cryptography because they appear resistant to attacks by quantum computers.

The proposed protocol does not make that claim; its security depends on the classical ECDHP assumption, which quantum algorithms such as Shor's approach could threaten in principle. The authors frame their contribution as an efficiency-oriented design for today's IoT devices, not as a post-quantum replacement. As with any newly proposed protocol, the reported performance and security properties come from the authors' own implementation and comparative evaluation.

For now, the work offers a concrete alternative for designers seeking one-time authentication that draws on elliptic curve arithmetic, session-specific keys, and side-channel-aware computation, while keeping the computational burden low enough for energy-constrained smart devices.

Subject of Research: Cryptography and IoT security

Article Title: A novel one-time key generation scheme based on ECDHP and efficient scalar multiplication

Article References: Mishra, S., & Jha, R. K. (2026). A novel one-time key generation scheme based on ECDHP and efficient scalar multiplication. Cluster Computing, 29(16), 903. https://doi.org/10.1007/s10586-026-06571-2

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06571-2

Keywords: IoT, cryptography, one-time password, elliptic curves, ECDHP, Curve25519, Montgomery ladder, key generation, authentication, forward secrecy, novel, one-time