IoT Fleet Encryption & Key Rotation

Cipher

AES-128-CCM

Fleet & Traffic

Devices in fleet 8

Packets / sec / device 1.0

Key-rotation interval 8 s

Live Readouts

Fleet energy

–

Battery life

–

Overhead

–

Next rotation

–

Key strength (brute-force @ 10¹⁵ ops/s)

–

How it works

Every sensor packet pays two energy costs: the radio transmit cost of the bytes it sends, and — if encrypted — the cost of the cipher itself running on a constrained microcontroller:

E_tx    = bytes/pkt · 0.5 µJ/byte           (radio TX, all modes)
E_crypto= payload · c_cipher µJ/byte        (0 if unencrypted)
E_rot   = 150 µJ / device, once per rotation interval T_rot
E_total = N_dev·rate·(E_tx+E_crypto) + N_dev·150/T_rot   [µJ/s]

Cipher energy constants (µJ/byte of payload, typical Cortex-M0 without AES hardware) and per-packet header/tag overhead:

None       : c=0.00   overhead=0 B   (plaintext — no confidentiality)
AES-128-CCM: c=0.30   overhead=13 B  key=128 bit
AES-256-GCM: c=0.45   overhead=16 B  key=256 bit
ChaCha20-Poly1305: c=0.20 overhead=16 B key=256 bit (fast in pure software)

Battery life is a fixed 3000 mAh / 3.7 V cell's energy (≈ 4.0×10⁷ mJ) divided by one device's share of E_total. Brute-force time uses log-scale arithmetic (never raising 2 to a 256th power directly) to avoid overflow: years ≈ 10^[(bits−1)·log₁₀2 − log₁₀(ops/s · seconds/year)].

Cipher buttons — swap the running algorithm; packet color and every readout update instantly.
Devices / Packet rate — scale the fleet's traffic; more traffic means more crypto energy but also a shorter real exposure window per bit sent.
Key-rotation interval — how often a fresh session key is negotiated. Shorter intervals shrink the practical "if this key leaks, how long is the attacker inside" window at the cost of handshake energy; the theoretical brute-force time is astronomically larger regardless, so rotation — not raw key length — is what actually bounds real-world exposure.

Plaintext ("None") has no key at all, so its exposure window is not bounded by rotation — anyone on the network path reads every packet immediately.

Encrypted packet Plaintext packet Gateway / key rotation

🔑 KEY ROTATED

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.