Empirical Evaluation of Memory-Erasure Protocols

Reynaldo Gil-Pons; Rolando Trujillo-Rasua; Sjouke Mauw

REVIEW 2 major objections 4 minor 20 references

Empirical Evaluation of Memory-Erasure Protocols

T0 review · 2 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Memory erasure on cheap IoT devices is feasible—but no protocol wins

desk verdict The first side-by-side empirical benchmark of memory-erasure protocols, with real data and a no-dominance result that mostly holds up; worth publishing after the authors fix the abstraction mismatch and label the full-memory extrapolations. read the letter →

arxiv 2509.10224 v1 pith:U5ENG6YH submitted 2025-09-12 cs.CR

Reynaldo Gil-Pons , Sjouke Mauw , Rolando Trujillo-Rasua This is my paper · ORCID

classification cs.CR

keywords memoryerasureIoTsecuritymalwareremovalproofofempiricalevaluationconstraineddeviceshashfunctionsprotocols

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is the first head-to-head empirical comparison of software-based memory-erasure protocols on real low-cost IoT hardware, where a verifier tells a constrained device to overwrite its memory and send back a proof. The authors implemented seven protocols across three off-the-shelf microcontrollers, each combined with six hash-function implementations, and measured how long each combination takes to erase a fixed block of memory and produce a proof. The paper's central claim is that these protocols are practically feasible: even slow devices complete erasure, though they may take several seconds to more than two minutes. The measurements show that no protocol dominates every setting—the fastest choice depends on device clock speed, memory size, network cost, and the desired security level. On this basis the paper offers a decision framework that, given a target security level, selects the protocol with the best performance-and-guarantee trade-off.

What carries the argument

The central objects are the seven implemented protocols, which span three design families: graph-labelling functions (DFKP, KK, PoSEgraph), hash-based filling (KL, PoSElight), and verifier-sent random nonces (PT, PoSErandom). The evaluation machinery is a portable C implementation of each protocol on three microcontrollers, compiled for code size, communicating with a laptop verifier over Bluetooth, with six hash functions including hardware-accelerated AES and SHA-256 variants. Each run erases a fixed compile-time array of 2–8 KB, and the PoSE protocols use a round-trip parameter r=71, fixing their erasure guarantee at 90% with failure probability $10^{-3}$. The setup separates erasure time from verification time and splits total time into computation versus communication, which is what exposes the unexpectedly large role of network cost and hidden constants.

What would settle it

Run the same seven protocols on the same three devices while erasing the full data memory (10–88 KB) with a deployment-ready implementation; if the relative ranking of protocols changes—for example, if a protocol labelled fastest stops being fastest—the framework's practical recommendation loses support.

Watch

Extended reading notes

Core claim

The paper establishes that software-based memory-erasure protocols—two-party protocols in which a verifier instructs a constrained device to overwrite its memory with random data and return a proof of erasure—run successfully on unmodified low-cost microcontrollers without secure hardware. With seven protocol implementations, six hash functions, and three devices of different computational capability, every tested combination completed the erasure and proof-generation phases. Performance, however, was highly environment-dependent: total execution times ranged from under a second to more than two minutes, and network speed plus hidden constants in the protocol specifications often influenced running time more than asymptotic complexity did. The paper concludes that no protocol is universally best and presents a framework that, for a given security level, identifies which protocol offers the best trade-off between performance and erasure guarantees.

Load-bearing premise

The load-bearing assumption is that erasing a fixed compile-time array of 2–8 KB is representative of real full-memory erasure, which the paper itself flags by noting the implementations are limited to performance testing and would need adaptation for deployment.

Editorial extensions

If this is right

Deployers can stop relying on asymptotic complexity alone; the paper's decision table maps network cost, clock speed, memory size, and security level to the fastest protocol.
Because hash choice can change execution time by an order of magnitude or more, benchmarking several hash implementations on the target hardware becomes a necessary pre-deployment step.
Protocols that send the full memory contents over the network (PT, PoSErandom) are only competitive when network cost is low, so communication-heavy designs should be avoided on Bluetooth stacks with high per-message overhead.
DFKP's quadratic complexity does not stop it from being fastest on small memories, but its advantage erodes as memory grows, implying a crossover point beyond the tested 8 KB where other protocols take over.
For high-security requirements, PoSElight stands out as the only protocol with a formal proof, bounded attacker success probability, no-isolation resistance, and no poor performance rating on any measured feature.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The fixed-array benchmark means the framework's rankings are validated only for partial-memory erasure; if full-memory erasure scales the computation component, graph-based protocols with larger constants may fall further behind, while random-nonce protocols would only see larger messages.
The finding that hardware-accelerated hashing was not always faster suggests that accelerator driver overhead can outweigh raw speed; a natural test is to repeat the measurements with different driver versions or hash implementations on the same accelerator.
Since network cost proved so influential, an implicit design lesson is to reduce the number of round trips rather than the byte size of messages, especially on devices whose Bluetooth stack adds fixed per-message overhead.
The paper's decision framework could be turned into a predictive model by fitting the measured time curves to memory size and network parameters, then using the fitted model to extrapolate beyond the tested 8 KB limit.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear colleague, quick take: this is the first common benchmark for software-based memory-erasure protocols, and that alone is a useful contribution. They implement seven protocols on three TI microcontrollers, with six hash options, measure erasure and total times, and package the results into a selection framework. Code is linked, and the setup is described in enough detail to re-implement.

The core empirical finding—no single protocol dominates once you vary device speed, memory size, network cost, and security level—holds up. They also show that hidden constants and Bluetooth costs outweigh asymptotic complexity at the tested sizes. DFKP, with quadratic complexity, beats the quasi-linear PoSE variants on a small array. That is a real, practical insight.

The main soft spot is exactly what the stress-test note flags: the benchmark erases a compile-time array of 2–8 KB, not the device's full memory, and Section 3.4 openly says the implementations are for performance testing only. The selection framework (Table 11) then makes 'large memory' recommendations at sizes no experiment covered. The paper does flag the extrapolation, so it is not deceptive, but the table cells should be labeled as extrapolations rather than direct results. Ideally they run one larger-memory point on the CC2652 to anchor the trend.

Second, the abstract says erasure takes 'several seconds,' but the slowest measured full run is 31.1 seconds for a 2 KB erase on the F5529 (PoSEgraph, blake3). The conclusion correctly says full-memory erasure could take several minutes. The abstract understates the cost, which matters for anyone skim-reading—fix that.

Third, the security columns in the comparison tables are taken from the literature, not independently verified. Since three of the seven protocols are the authors' own PoSE designs, there's a mild self-preference risk in the security/performance coupling. It doesn't invalidate the timing data, but an independent look at the security labels would strengthen confidence.

Overall: the empirical core is sound, the contribution is new, and the limitations are acknowledged more than in most benchmark papers. I'd bring it to a reading group, I'd cite it, and I'd send it to peer review. Required revisions: reconcile the abstract with the conclusion, mark the large-memory cells as extrapolated, and be explicit that the benchmark does not erase full device memory.

Referee Report

2 major / 4 minor

Summary. The paper reports the first comparative empirical evaluation of seven software-based memory-erasure protocols on three low-cost IoT microcontrollers, measuring erasure time, total execution time, memory footprint, and communication cost across several hash function implementations. The authors conclude that the protocols are feasible in practice, that no single protocol dominates across all settings, and they propose a decision framework (Table 11) that chooses the most performant protocol for a given combination of network cost, clock speed, memory size, and required security level. The experimental methodology, including open-source implementations, is described in enough detail to be reproduced.

Significance. If its conclusions are accepted, this is a useful first benchmark for a class of protocols that has mostly been studied theoretically. The paper provides open-source implementations, transparent timing measurements, and a reproducible experimental setup, which are clear strengths. The empirical non-dominance result follows from the reported timings. However, the significance is moderated by the fact that all measurements erase a small fixed array rather than the device's full memory, and the proposed selection framework extrapolates from these limited measurements to full-memory deployment scenarios.

major comments (2)

[Section 3.4, Section 4.3, Table 11] The empirical core measures erasure of a fixed compile-time array: 2 KB on F5529 and FR5994, and 2, 4, 8 KB on CC2652, whereas the devices' data memories are 10 KB, 8 KB, and 88 KB respectively (Table 2). Section 3.4 explicitly states that the implementations are 'limited to performance testing' and would need to be adapted for deployment. Nevertheless, Table 11 is derived by 'extrapolating the behaviour of the protocols' across 'large' and 'small' memory sizes, and Section 6 concludes that 'erasing the full memory securely could take several minutes for the slower devices.' No data support these extrapolations: the only scaling experiment (Section 4.3) stops at 8 KB on one device, and because DFKP is quadratic while the PoSE variants are linear, relative rankings can change at larger memory sizes. The feasibility claim and the protocol-selection framework therefore rest on an untested extrapolation, which is load-bearing for the paper's headline conclusions.
[Section 2, Table 1, Section 5, Table 11] The security-relevant columns (Proof, Prob., No-Isolation, Erasure) and the security labels used in the decision framework are taken as claimed in the literature, with no independent verification or even a sensitivity analysis. Since three of the seven evaluated protocols are the authors' own designs from Bursuc et al., errors or contested assumptions in those original security claims would propagate directly into the recommendations of Table 11 without the paper providing any means to detect them. The paper should either verify these properties on the implementations or explicitly state that the framework inherits unverified literature claims, and it should discuss how sensitive the recommended choices are to the reliability of those labels.

minor comments (4)

[Section 4.1] The text contains typos: 'FF5529' should be 'F5529' and 'sha265hw' should be 'sha256hw'.
[Section 6] The sentence 'We implemented6 7 protocols' appears to be a formatting artifact from a footnote marker and reads as 'implemented 67 protocols'; it should read 'implemented 7 protocols'.
[Tables 9 and 10] The notes 'For PoSE random it was 6.8 seconds' are placed outside the table body and are easy to miss; they should be integrated into the main table or referenced clearly in the caption.
[Section 4] The tables report point estimates without variance, confidence intervals, or the number of repetitions. Given that Bluetooth communication can be noisy, some indication of measurement spread would strengthen the ranking conclusions and the claimed differences between protocols.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the performance benchmark is self-contained; security/erasure columns are explicitly literature claims rather than derived predictions.

full rationale

The paper's central empirical contribution is a direct measurement of protocol execution times on three devices; no parameter is fitted from the data and then renamed as a prediction, and no equation equates an output to an input by construction. The timing results in Tables 5-10 and Figure 2 are obtained from concrete implementations with a fixed 2-8 KB erased array, and the scaling discussion in Section 4.3 explicitly acknowledges that the memory threshold for DFKP remains to be determined. The security and erasure columns in Tables 1 and 12 are introduced as literature claims ('as claimed in the literature'), including the PoSE columns taken from the authors' own Bursuc et al. 2024a/b work; these are formal results with stated assumptions, and the empirical rankings do not reduce to them. Section 3.4's concession that the implementations are limited to performance testing and Section 4.3's acknowledgement that further experiments are needed are validity limitations about extrapolation to full memory, not circularity. No self-definitional, fitted-input, or self-citation-chain reduction is present, so the honest finding is no significant circularity.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities; its contribution is a benchmark and a decision framework. The framework's security categories are inherited from prior protocol papers rather than newly postulated.

free parameters (2)

r (number of round-trip-time measurements for PoSE protocols) = 71
Set by the authors in Section 3.3 to achieve 90% erasure guarantee with probability (1 - 10^-3); it directly affects the execution time of PoSEgraph, PoSElight, and PoSErandom, so the comparative results depend on this choice.
Erased memory array size = 2 KB (F5529, FR5994); 2, 4, 8 KB (CC2652)
Chosen in Section 3.4 as a fixed compile-time array that fits each device's data memory; not the full device memory, which limits generalization of the timings.

assumptions (4)

domain assumption Security, erasure, and complexity features of the evaluated protocols are as claimed in their original papers (Table 1).
Section 2 states the table shows to what extent each protocol satisfies relevant features 'as claimed in the literature.' For the PoSE protocols, this literature is the authors' own work (Bursuc et al. 2024a, 2024b), and those claims are not independently verified in this paper.
domain assumption Timing measurements on a fixed 2 KB to 8 KB array are representative of real memory erasure.
Section 3.4 erases a compile-time array rather than the full device memory, and the authors note the implementations 'will need to be adapted for deployment in a real setting.' If full-memory timings differ substantially, the framework's advice may not carry over.
domain assumption The hash function implementations used are correct and their relative performance is representative.
The paper compares six hash implementations, including the unpublished 'aeshash' (Section 3.2), whose code is not analyzed and whose security is not established; performance differences could be artifacts of these specific implementations.
domain assumption The Bluetooth setup and 1-meter distance model realistic verifier-to-prover distances.
Section 3.5 fixes the distance at approximately 1 meter and uses different Bluetooth stacks on different devices (HC-05 for two devices, built-in Bluetooth 5.2 for CC2652), so communication overhead measurements may not generalize to other channels or distances.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Empirical Evaluation of Memory-Erasure Protocols." pith.science (2026). https://pith.science/paper/U5ENG6YH

@misc{pith2026250910224,
  author       = {Pith},
  title        = {Pith review of: Empirical Evaluation of Memory-Erasure Protocols},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/U5ENG6YH}},
  note         = {Machine review of arXiv:2509.10224}
}

read the original abstract

Software-based memory-erasure protocols are two-party communication protocols where a verifier instructs a computational device to erase its memory and send a proof of erasure. They aim at guaranteeing that low-cost IoT devices are free of malware by putting them back into a safe state without requiring secure hardware or physical manipulation of the device. Several software-based memory-erasure protocols have been introduced and theoretically analysed. Yet, many of them have not been tested for their feasibility, performance and security on real devices, which hinders their industry adoption. This article reports on the first empirical analysis of software-based memory-erasure protocols with respect to their security, erasure guarantees, and performance. The experimental setup consists of 3 modern IoT devices with different computational capabilities, 7 protocols, 6 hash-function implementations, and various performance and security criteria. Our results indicate that existing software-based memory-erasure protocols are feasible, although slow devices may take several seconds to erase their memory and generate a proof of erasure. We found that no protocol dominates across all empirical settings, defined by the computational power and memory size of the device, the network speed, and the required level of security. Interestingly, network speed and hidden constants within the protocol specification played a more prominent role in the performance of these protocols than anticipated based on the related literature. We provide an evaluation framework that, given a desired level of security, determines which protocols offer the best trade-off between performance and erasure guarantees.

Figures

Figures reproduced from arXiv: 2509.10224 by the authors.

**Figure 2.** Total execution time in seconds on device CC2652, partitioned by [PITH_FULL_IMAGE:figures/full_fig_p015_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 20 canonical work pages

[1]

N., Basheer, M

Aman, M. N., Basheer, M. H., Dash, S., Wong, J. W., Xu, J., Lim, H. W., and Sikdar, B. (2020). HAtt : Hybrid Remote Attestation for the Internet of Things With High Availability . IEEE Internet of Things Journal

work page 2020
[2]

Ammar, M., Daniels, W., Crispo, B., and Hughes, D. (2018). Speed: Secure provable erasure for class-1 iot devices. In Eighth ACM Conference on Data and Application Security and Privacy

work page 2018
[3]

Aumasson, J.-P., Neves, S., Wilcox-O'Hearn , Z., and Winnerlein, C. (2013). BLAKE2 : Simpler , Smaller , Fast as MD5 . In Applied Cryptography and Network Security

work page 2013
[4]

Banks, A., Kisiel, M., and Korsholm, P. (2021). Remote Attestation : A Literature Review . ArXiv

work page 2021
[5]

Bormann, C., Ersue, M., and Keranen, A. (2014). RFC 7228: Terminology for constrained-node networks. IETF RFC

work page 2014
[6]

Bursuc, S., Gil-Pons , R., Mauw, S., and Trujillo-Rasua , R. (2024a). Software-based memory erasure with relaxed isolation requirements. In Proc. 37th IEEE Computer Security Foundations Symposium ( CSF '24)

work page 2024
[7]

Bursuc, S., Gil-Pons , R., Mauw, S., and Trujillo-Rasua , R. (2024b). Software- Based Memory Erasure with relaxed isolation requirements: Extended Version . arXiv preprint arXiv:2401.06626

work page Pith review arXiv 2024
[8]

Dobraunig, C., Eichlseder, M., Mendel, F., and Schl \"a ffer, M. (2021). Ascon v1.2: Lightweight Authenticated Encryption and Hashing . Journal of Cryptology

work page 2021

Show all 20 references

[9]

Dziembowski, S., Kazana, T., and Wichs, D. (2011). One-time computable self-erasing functions. In Theory of Cryptography Conference

2011
[10]

and Hansen, T

Eastlake, D. and Hansen, T. (2006). US Secure Hash Algorithms ( SHA and HMAC-SHA ). Technical Report RFC4634, RFC Editor

2006
[11]

Karame, G. O. and Li, W. (2015). Secure erasure and code update in legacy sensors. In International Conference on Trust and Trustworthy Computing . Springer

2015
[12]

Karvelas, N. P. and Kiayias, A. (2014). Efficient proofs of secure erasure. In International Conference on Security and Cryptography for Networks , Amalfi, Italy. Springer

2014
[13]

Kuang, B., Fu, A., Susilo, W., Yu, S., and Gao, Y. (2022). A survey of remote attestation in Internet of Things : Attacks , countermeasures, and prospects. Computers & Security

2022
[14]

and Dustdar, S

Lachner, C. and Dustdar, S. (2019). A Performance Evaluation of Data Protection Mechanisms for Resource Constrained IoT Devices . In 2019 IEEE International Conference on Fog Computing ( ICFC )

2019
[15]

and Tsudik, G

Perito, D. and Tsudik, G. (2010). Secure code update for embedded devices via proofs of secure erasure. In European Symposium on Research in Computer Security . Springer

2010
[16]

and Prema, K

Rao, V. and Prema, K. V. (2019). Comparative Study of Lightweight Hashing Functions for Resource Constrained Devices of IoT . In 2019 4th CSITSS

2019
[17]

Reardon, J., Basin, D., and Capkun, S. (2013). SoK : Secure data deletion. In 2013 IEEE Symposium on Security and Privacy

2013
[18]

A., Barraca, J

Silva, C., Cunha, V. A., Barraca, J. P., and Aguiar, R. L. (2024). Analysis of the Cryptographic Algorithms in IoT Communications . Information Systems Frontiers , (4)

2024
[19]

Trujillo-Rasua , R. (2019). Secure memory erasure in the presence of man-in-the-middle attackers. Journal of Information Security and Applications

2019
[20]

Tsudik, G. (1992). Message authentication with one-way hash functions. ACM SIGCOMM Computer Communication Review

1992

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

N., Basheer, M

Aman, M. N., Basheer, M. H., Dash, S., Wong, J. W., Xu, J., Lim, H. W., and Sikdar, B. (2020). HAtt : Hybrid Remote Attestation for the Internet of Things With High Availability . IEEE Internet of Things Journal

work page 2020

[2] [2]

Ammar, M., Daniels, W., Crispo, B., and Hughes, D. (2018). Speed: Secure provable erasure for class-1 iot devices. In Eighth ACM Conference on Data and Application Security and Privacy

work page 2018

[3] [3]

Aumasson, J.-P., Neves, S., Wilcox-O'Hearn , Z., and Winnerlein, C. (2013). BLAKE2 : Simpler , Smaller , Fast as MD5 . In Applied Cryptography and Network Security

work page 2013

[4] [4]

Banks, A., Kisiel, M., and Korsholm, P. (2021). Remote Attestation : A Literature Review . ArXiv

work page 2021

[5] [5]

Bormann, C., Ersue, M., and Keranen, A. (2014). RFC 7228: Terminology for constrained-node networks. IETF RFC

work page 2014

[6] [6]

Bursuc, S., Gil-Pons , R., Mauw, S., and Trujillo-Rasua , R. (2024a). Software-based memory erasure with relaxed isolation requirements. In Proc. 37th IEEE Computer Security Foundations Symposium ( CSF '24)

work page 2024

[7] [7]

Bursuc, S., Gil-Pons , R., Mauw, S., and Trujillo-Rasua , R. (2024b). Software- Based Memory Erasure with relaxed isolation requirements: Extended Version . arXiv preprint arXiv:2401.06626

work page Pith review arXiv 2024

[8] [8]

Dobraunig, C., Eichlseder, M., Mendel, F., and Schl \"a ffer, M. (2021). Ascon v1.2: Lightweight Authenticated Encryption and Hashing . Journal of Cryptology

work page 2021