IoT devices have become an integral part of everyday life and are widely used in areas such as smart homes, healthcare, transportation, and industrial systems [1-3]. Recent studies in IoT security underscore the importance of adopting unified cybersecurity standards [4], enhancing information protection mechanisms [5], and developing targeted defenses to counter emerging security threats [6,7].

IoT environments generate continuous streams of data that can serve as valuable digital evidence in forensic investigations [8-11]. However, these environments pose significant challenges for investigators, as conventional digital forensic methods are often ill-suited to systems comprising sensors, RFID components, and cloud-based services. The large scale and heterogeneity of IoT infrastructures, coupled with the absence of well-defined geographical boundaries, further complicate evidence collection and preservation. During acquisition, transfer, or storage, digital evidence may be altered, lost, or compromised. Additional difficulties arise from uncertainty about where data are stored, the wide variety of device architectures, the use of multiple and often short-lived data formats, and the limited number of forensic tools designed for resource-constrained devices [12-14].

Many widely used cryptographic algorithms, including the Advanced Encryption Standard (AES) and the Rivest–Shamir–Adleman (RSA) algorithm, demand significant processing power and memory. As a result, they are often impractical for the low-power microcontrollers commonly used in IoT devices [15,16]. In addition, these traditional encryption approaches do not inherently support time-based uniqueness, which can enable replay attacks and reduce the reliability of digital evidence in forensic investigations [17,18].

To address these requirements, researchers have proposed DNA-inspired cryptographic techniques as an alternative security approach. In this model, binary data are encoded using four symbols that correspond to the DNA bases adenine (A), thymine (T), cytosine (C), and guanine (G). The encryption process is then guided by bio-inspired operations such as substitution, mutation, crossover, and logical transformations [19-22]. These methods can increase randomness, strengthen confusion and diffusion properties, and support high levels of parallel processing and data density [23,24]. Despite these advantages, most existing DNA-based cryptographic studies focus primarily on securing communications, with comparatively little attention devoted to their application in preserving the integrity of digital evidence for forensic purposes [25,26].

In IoT-based digital forensics, maintaining data integrity and confirming the origin of evidence are key priorities. Traditional approaches commonly use hash functions such as the Secure Hash Algorithm (SHA-256) and Message Digest 5 (MD5), together with cryptographic signatures. More recent techniques, including radio-frequency–based device fingerprinting, examine unique signal characteristics to authenticate devices [26]. Although these methods are effective, they generally do not integrate encryption with built-in tamper-resistant metadata, which limits their applicability in forensic investigations.

The assumed threat model includes three types of adversaries. The first group consists of remote attackers who can listen to communications, inject false data, or perform replay attacks. The second group comprises local attackers who can observe timestamps and message authentication codes, as well as manipulate transmitted packets. The third group involves attackers with brief physical access to the device, allowing them to read stored metadata or carry out limited hardware manipulation. Long-term or complete system compromise is not considered in this work [27]. Unlike earlier DNA-based cryptographic methods, which primarily address communication security, or RF-DNA fingerprinting techniques, which focus on device identification, the proposed method integrates time-dependent DNA-based key generation with tamper-detection metadata fingerprinting. This integration represents a clear distinction and contribution beyond existing approaches.

Existing studies have not combined time-dependent DNA-based key derivation functions with metadata fingerprinting to protect digital evidence in IoT devices. The proposed method fills this gap by generating high-entropy keys that change over time and by attaching metadata fingerprints that reveal any unauthorized modification. This design renders the approach highly suitable for practical IoT forensic applications. By applying temporal DNA-based key generation together with metadata fingerprinting, on-device forensic security can be substantially improved, supporting data integrity, confidentiality, and traceability throughout IoT systems.

2.1. System Framework

The proposed system combines a time-aware DNA-based key derivation function with a metadata fingerprinting scheme to protect digital evidence generated by resource-limited IoT devices. The DNA-KDF generates keys that evolve over time by applying DNA-inspired processes such as substitution, mutation, and crossover, in combination with temporal inputs including timestamps and device counters. In parallel, the metadata fingerprinting component inserts distinct DNA-based identifiers into the headers of digital evidence, allowing any tampering to be detected and enabling reliable tracking of data origin.

2.2. DNA-Based Key Derivation Function (DNA-KDF)

The DNA-KDF generates cryptographic keys that evolve over time by integrating DNA encoding with time-dependent processes. This method starts by creating a seed, which includes the device ID, timestamp, and a random value or sensor hash. This seed is then converted into a DNA sequence using a fixed mapping (00→A, 01→T, 10→C, 11→G). To introduce temporal variation, the DNA sequence is cyclically shifted based on the system timestamp. This shift makes the key more unpredictable and ensures that even if two identical seeds are used at different times, the resulting keys will be different. Additional mixing is achieved by swapping nucleotides (A↔T, C↔G) and reorganizing sequence blocks, thereby enhancing the overall randomness of the DNA sequence. Finally, the DNA sequence is converted back to binary and then compressed or hashed to generate a 128-bit key for lightweight cryptographic tasks. This process ensures that the generated keys are highly sensitive to variations in both the seed and the timestamp, thereby providing strong resistance against key reuse and replay attacks. A concise overview of the DNA-KDF procedure is presented in Table 1.

This process guarantees that the derived keys are time-variant, non-reproducible, and high-entropy, improving resilience against key reuse and replay attacks.

The proposed pseudocode is given below in Algorithm 1:

Remarks: This example shows the complete DNA-KDF process, from device-specific and time-based inputs to a high-entropy, non-repeating key suitable for secure on-device encryption. The method protects against replay attacks, key reuse, and attempts to predict the key, while being efficient enough for use on resource-limited IoT microcontrollers.

2.2.1. Security Margin and Cryptanalytic Resistance

The DNA-KDF uses several layers of mixing and nonlinearity to create a strong security margin against different types of attacks. Specifically:

• Depth of transformations: Multiple stages of substitution and block shuffling, combined with timestamp-based rotation, ensure that input randomness is thoroughly dispersed throughout the entire sequence.

• Resistance to cryptanalysis: The random nucleotide substitutions and dynamic block rearrangements prevent attackers from using simple patterns or differential analysis, making the output highly sensitive to changes in the seed and timestamp.

• Time-based variation: The timestamp-driven rotation ensures that even when the same seed is used, the outputs differ across sessions, providing protection against replay and related-key attacks.

• DNA-specific protections: The uniform nucleotide mapping, random block positioning, and rotation counter any potential attacks based on repeating patterns or biases in the nucleotide sequence, ensuring there are no predictable structures.

These features provide a clear security margin, making DNA-KDF a strong and reliable option for secure, time-based key generation, especially in resource-limited IoT devices

2.2.2. Side-Channel and Fault Injection Protection

IoT and embedded devices are vulnerable to physical attacks, such as fault injection (e.g., voltage, clock, or electromagnetic interference), which can disrupt processing and expose key material. Side-channel attacks like timing or power analysis can also leak sensitive information, even from lightweight cryptographic algorithms [28-31].

The DNA-KDF and metadata fingerprinting have been designed to resist both side-channel and fault-injection attacks, including:

• Timing Attacks: The algorithm uses constant-time operations to reduce timing variations that could reveal information about the key or fingerprint.

• Power Analysis Attacks (SPA/DPA): Randomized operations, such as time-based rotations and block shuffling, add randomness and disrupt power patterns, making it harder for attackers to link power usage to secret data.

• Fault Injection and Tampering: Integrity checks in the metadata fingerprints detect any tampering with the key derivation process or corrupted data. The system flags any inconsistencies that may arise from physical disruptions, like voltage glitches or electromagnetic interference.

These safeguards ensure that the framework delivers robust security, protecting both the confidentiality of the cryptographic keys and the integrity of the data, even in scenarios where an attacker gains physical access to the device.

2.3. Metadata Fingerprinting

To ensure the integrity and authenticity of digital evidence collected from IoT devices, each record is accompanied by a small metadata fingerprint. This fingerprint provides protection against tampering and ensures traceable provenance while being lightweight enough for resource-limited devices. The fingerprint is created as follows: a 64-bit identifier is generated using the DNA-based Key Derivation Function (DNA-KDF). This identifier includes two types of features:

1. Device-specific details, such as the MAC address, sensor IDs, and firmware version hashes, which make the identifier unique to the device.

2. Time-based DNA sequences, which encode system time and contextual entropy into nucleotide representations, linking the evidence to a specific time.

The resulting fingerprint is incorporated into the metadata header of each evidence record, optimizing storage efficiency. During forensic analysis, the fingerprint is recomputed and compared against the stored value for verification. If there’s any mismatch, it indicates potential tampering or unauthorized changes to the evidence.

This system provides three key benefits:

(i) Integrity assurance, since any change in the evidence or metadata causes a mismatch in the fingerprint.

(ii) Provenance binding, by linking each record to its specific device and time of creation.

(iii) The 64-bit fingerprint enables efficient verification, being sufficiently compact for rapid on-device checks without incurring significant cryptographic overhead.

In this way, metadata fingerprinting acts like a forensic watermark, combining DNA-inspired key derivation with compact identifiers to enhance the trustworthiness of digital evidence collected from IoT devices.

The proposed pseudocode is shown in Algorithm 2:

2.3.1. Integration Overhead and Tamper-Resilience

• Metadata fingerprinting: integration and robustness

Working alongside the temporal DNA-KDF, the metadata fingerprinting process facilitates tamper detection in device logs and sensor readings. Each fingerprint encodes essential metadata, including timestamps, device IDs, and sensor details, and leverages cryptographic compression to produce a small, verifiable signature for every data block.

• Integration overhead

On typical IoT MCUs, the extra memory needed is minimal—around 128–256 bytes per device per log entry. The computational cost is also low, adding only about 2–3% to the total time required for the DNA-KDF process, so it has little effect on real-time performance.

• Resilience against tampering.

The system has been tested for resistance to various attack scenarios, including:

1. Timestamp manipulation: Variations in key derivation ensure that any changes to timestamps result in fingerprint mismatches, triggering alerts.

2. Partial log deletion or truncation: Since fingerprints are chained or indexed by blocks, missing log entries break the verification process, making tampering obvious.

3. Sensor-value spoofing: Any changes to sensor data are detected during verification, as the sensor values are part of the fingerprint.

4. Device misattribution: The device-specific information embedded in the fingerprint prevents attackers from impersonating the device or substituting its data.

This design ensures strong protection against tampering while keeping memory and computational demands low, making it ideal for forensic applications on resource-constrained IoT devices.

2.4. Experimental Setup: Representative IoT Microcontrollers

To test the performance of the proposed DNA-based cryptographic framework in real-world conditions, six popular microcontroller units (MCUs) were chosen as representative platforms. These devices cover a range of architectures, computational power, and energy usage, providing a well-rounded view of the IoT hardware landscape:

ATmega328P: An 8-bit AVR microcontroller, commonly used in platforms like Arduino. It runs up to 20 MHz, with low power consumption (~0.2 mA/MHz) and very low sleep currents (below 1 µA), making it ideal for cost-sensitive, energy-efficient applications.

STM32F0: A 32-bit ARM Cortex-M0 microcontroller designed for low power and moderate performance. It operates at up to 48 MHz, with active power consumption around 130 µA/MHz. It’s commonly used in industrial monitoring and wearable devices due to its efficient peripherals and memory organization.

ESP32: A dual-core 32-bit Xtensa LX6 processor with a clock speed of up to 240 MHz, and built-in Wi-Fi and Bluetooth. The ESP32 supports high-performance workloads and has a wide power range—from tens of milliamperes in active mode to microamperes in deep sleep—making it suitable for diverse IoT applications.

nRF52840: A 32-bit ARM Cortex-M4 processor, designed for Bluetooth Low Energy (BLE) and mesh networks, running at 64 MHz. The device features 1 MB of Flash memory and 256 KB of RAM, with active currents of approximately 5.5 mA and deep-sleep currents below 0.5 µA, making it highly efficient for communication-centric IoT applications.

PIC24FJ64GA: A 16-bit microcontroller with a maximum clock speed of 32 MHz. It consumes ~220 µA/MHz in active mode, often used in embedded control systems that require a balance of performance and power efficiency.

MSP430: A 16-bit RISC microcontroller designed for ultra-low-power use, running at up to 25 MHz. It draws around 100 µA/MHz when active and less than 1 µA in standby, making it especially suitable for battery-powered or energy-harvesting IoT devices.

By executing the cryptographic algorithms on this heterogeneous set of microcontrollers, we can evaluate real-world performance with respect to execution time, energy efficiency, and memory utilization. The variety of hardware ensures that the findings are applicable to a broad range of IoT devices and scenarios.

2.5. Comparative Algorithms

To assess the performance and practicality of the proposed DNA-KDF, we compared it with a set of well-known lightweight cryptographic algorithms recognized for their efficiency and security in resource-constrained IoT environments. This comparison helps us assess the computational cost, memory usage, and energy efficiency of DNA-KDF relative to other commonly used ciphers in embedded systems. The selected baseline algorithms include:

PRESENT-80: A lightweight cipher based on substitution-permutation networks (SPN), designed for minimal silicon area, commonly used in RFID and low-power sensor networks.

ASCON-128: Chosen by NIST for authenticated encryption with associated data (AEAD), ASCON uses a sponge-based design for strong security and efficient implementation.

SPECK-64: "SPECK, part of the NSA’s SIMON and SPECK cipher families, is optimized for software implementation on microcontrollers with limited resources.

TWINE-80: A Generalized Feistel Network (GFN) cipher designed for low power and compact hardware, ideal for embedded devices.

HIGHT: A Feistel cipher aimed at ultra-low power IoT devices, such as RFID tags and sensor nodes.

SIMON-64/128: A block cipher designed for energy-efficient hardware, with a low gate count and minimal energy consumption, suitable for cost-sensitive embedded systems.

LED-64: An SPN-based cipher designed for ultra-lightweight hardware applications that prioritize both area and power efficiency.

QARMA: A lightweight tweakable block cipher optimized for low-latency hardware implementations.

LEA (Lightweight Encryption Algorithm): A block cipher developed in South Korea, optimized for both high-speed and lightweight environments.

SEPAR: A hybrid block-stream cipher that combines pseudo-random permutation and generator functions, designed for IoT devices.

BORON: A lightweight block cipher optimized for low-area hardware implementations.

This comparative framework offers valuable insights into the trade-offs between the DNA-KDF and conventional lightweight cryptographic algorithms, enabling systematic evaluation of metrics such as execution time, memory utilization, and energy consumption.

2.6. Evaluation Metrics

To conduct a thorough, reproducible, and practical evaluation of the proposed DNA-based cryptographic framework on resource-limited IoT devices, we use a set of benchmarking metrics that cover both theoretical security and real-world deployment. The key metrics include:

• Latency: Measured in Central Processing Unit (CPU) clock cycles and wall-clock time (e.g., microseconds or milliseconds). This encompasses the execution time of individual operations, such as a single encryption or decryption round, while also accounting for device architecture overheads, including pipeline stalls and instruction latency.

• Memory Footprint: a. Code or Static Storage: The size of the compiled binary (Flash or ROM), including static data and initialization tables. b. Dynamic Memory Usage: The peak RAM usage during operation, including memory for the stack, heap, and temporary buffers.

• Energy Consumption per Operation: Calculated by measuring current draw in active mode, multiplying it by the supply voltage, and factoring in the operation’s duration. Whenever possible, performance measurements are normalized (e.g., per data block or per byte) to enable equitable comparisons between algorithms handling varying data volumes.

• Throughput/Effective Processing Rate: The number of bytes or bits processed per unit of time during continuous or pipelined operation, which is useful for real-world data streams.

• Code Size Overhead and Implementation Complexity: Metrics include lines of code (LoC), module size, dependency requirements (e.g., lookup tables), firmware integration ratio, and the number of initialization cycles needed.

• Security Metrics: Key security attributes are measured alongside performance benchmarks: Avalanche Effect, Entropy, Collision Resistance (CR), and Key Sensitivity.

• Comparative Performance Index: This includes relative metrics like speedup/slowdown, energy savings, and a security/performance trade-off index.

• Device-Level Benchmarking Context: All performance, energy, and memory metrics are evaluated with respect to the target device’s hardware characteristics, including clock frequency, supply voltage, active current, and available ROM and RAM.

These metrics together provide a comprehensive evaluation framework that captures time, energy, memory, code complexity, and security. Reporting both fundamental measurements (e.g., cycles, memory usage, and currents) alongside derived metrics allows for rigorous comparison and evaluation of cryptographic scheme performance in research and real-world IoT applications.

2.7. Hardware Evaluation and Experimental Methodology

To accurately evaluate the performance of the cryptographic schemes, all algorithms were tested on real IoT hardware under controlled lab conditions. This setup ensured precise measurements of execution time, memory usage, and energy consumption, closely reflecting real-world deployment on resource-limited devices.

• Selected Hardware Platforms

Six MCUs commonly used in IoT applications were selected to cover a range of architectures, processing capabilities, and energy performance. Testing was conducted on standard development platforms, comprising the Arduino Uno (ATmega328P), STM32F0 Discovery (STM32F0), ESP32 DevKit, nRF52840 DK, PIC24FJ64GA board, and MSP430 LaunchPad, to assess real-world performance across diverse microcontroller architectures. Each device was operated at its standard clock frequency, with regulated power supplies at the appropriate operating voltages (e.g., 3.3V or 5V). This selection provides broad and representative benchmarking across commonly used IoT hardware platforms.

• Implementation and Platform Optimization

The cryptographic routines were written in C and optimized for each target MCU. Optimizations focused on using native instructions, reducing stack usage, and minimizing branching overhead, while ensuring the functionality remained consistent across platforms. This approach allows the observed performance differences to be attributed only to the underlying hardware.

• Execution Timing Measurement

Latency for each encryption operation was measured using the MCU’s built-in cycle counters or timers in free-running mode, with microsecond-level precision. The encryption and decryption routines were instrumented with start and stop markers to ensure precise cycle counting. To reduce measurement variability, each test was repeated 1000 times, and the average result was taken.

• Power and Energy Profiling

Dynamic power consumption was measured with a high-precision 0.1Ω shunt resistor placed in series with the MCU’s supply line. Measurements were recorded using a high-resolution oscilloscope (14-bit vertical resolution, 1 GS/s sampling rate), allowing accurate capture of current fluctuations during cryptographic operations. Energy consumption per encryption round was calculated by integrating the power over the execution time. Multiple runs were performed for each configuration to ensure reliable results.

• Environmental Control

All experiments were conducted in a temperature-controlled lab (22 ± 1 °C) to minimize temperature-related effects on power measurements. Wireless modules, peripheral devices, and unnecessary background tasks were turned off or isolated. Shielded cables and low-ripple voltage regulators were used to reduce electrical noise and maintain measurement accuracy.

• Reproducibility and Data Verification

Before testing, the instrumentation was calibrated with precision current sources. The reproducibility of the measurements was confirmed by repeating the trials and cross-checking with other power monitoring tools (such as the Monsoon Power Monitor).

This rigorous, measurement-driven methodology ensures an equitable, hardware-agnostic comparison between DNA-based cryptographic schemes and conventional lightweight ciphers, producing results that are both reproducible and directly applicable to real-world IoT scenarios.

2.7.1. Integrated Forensic Pipeline Evaluation

To test the practical use of the DNA-KDF and metadata fingerprinting, they were evaluated as part of a complete IoT forensic pipeline. This pipeline included evidence collection, local storage, secure transmission, and integrity verification. The system-level evaluation accounted for realistic factors such as context switching, interrupt handling, peripheral I/O, and multitasking on resource-constrained microcontrollers. The results from this evaluation show that:

• Latency: DNA-KDF and metadata fingerprinting add only a small delay, typically less than 5% of the total pipeline execution time, ensuring that real-time performance is maintained.

• Energy and Memory: The extra energy and memory usage are minimal and well within the limits of low-power IoT devices, making the system feasible for constrained platforms.

• Integrity and Provenance: The fingerprinting mechanism effectively detects tampering, including changes to timestamps, log deletions, and sensor value manipulations, ensuring the trustworthiness of the data throughout the process.

These results confirm that the proposed framework operates efficiently and securely within real-world IoT forensic workflows, validating both its design and performance under typical operating conditions.

Metrics include execution latency per key derivation round, memory usage, and energy consumption, providing a thorough assessment of the system’s feasibility in resource-constrained IoT environments.

The execution latency/time per encryption round (T_exec} is calculated based on the number of CPU clock cycles (N_cycles) required by the algorithm and the microcontroller’s clock frequency (f_clk) using the following formula:

where T_exec is expressed in milliseconds (ms), and f_clk represents the microcontroller clock frequency in hertz (cycles per second). This cycle-accurate measurement ensures a fair comparison across heterogeneous microcontroller architectures.

Table 2 summarizes the measured execution latency per encryption round for the DNA-KDF and other conventional lightweight cryptographic algorithms. Figure 1 provides a visual representation of the data summarized in Table 2.

Memory consumption is divided into non-volatile program storage (ROM/Flash) and volatile runtime memory (RAM). The overall memory footprint (M_total) is the sum of these two components:

where M_ROM represents the compiled code size in bytes, and M_RAM accounts for memory allocated dynamically during execution, including variables, stack frames, and buffers. Evaluating these parameters is essential to determine whether a cryptographic algorithm is suitable for IoT devices with limited memory.

Table 3 shows the memory footprint (ROM and RAM usage) in kilobytes (KB) for each cryptographic algorithm across the six microcontroller platforms. This evaluation helps assess the suitability of each algorithm for IoT devices with limited memory resources and highlights the relative memory overhead of DNA-KDF compared to other lightweight ciphers. Figure 2 provides a visual representation of the data from Table 3.

Throughput measures the rate at which a cryptographic algorithm processes data and is calculated as:

where S_data denotes the size of the data block in bytes, and T_exec is thetime required to encrypt the block (in seconds). The resulting throughput, expressed in bytes per second (Bps), provides an important indicator of an algorithm’s ability to handle high-volume or time-sensitive data streams.

Table 4 shows the measured throughput for each algorithm on the six selected microcontroller platforms, reported in kilobytes per second (kB/s). This metric highlights the relative efficiency of each cryptographic scheme in processing data and offers valuable insight into their suitability for real-time, resource-constrained IoT applications. Figure 3 presents a visual chart based on the data from Table 4.

Energy usage for a single encryption operation, denoted as E_enc, is calculated by multiplying the active current I_active, the operating voltage (V), and the encryption execution time (T_exec):

where E_enc is expressed in Joules (J). This method assumes that the current drawn during encryption remains relatively constant, which is a reasonable approximation for assessing microcontroller workloads in active mode.

Table 5 shows the estimated energy consumption for each encryption round, reported in microjoules (μJ), across all target microcontroller platforms. Such energy measurements are essential for assessing the practical deployment of cryptographic algorithms on energy-constrained IoT devices, where minimizing power consumption directly extends operational lifetime. Figure 4 presents a visual representation of the data summarized in Table 5.

The avalanche effect (AE) measures how much a small change in input (e.g., one-bit flip) affects the output. Ideally, flipping a single input bit should change about 50% of output bits [32,33].

If O is the original output and O’ is the output after a one-bit change in input:

Entropy H(X) quantifies the randomness or unpredictability of an output sequence. For a discrete random variable X (e.g., output bits):

where: p(x_i) = probability of symbol x_i; m = number of possible symbols (e.g., 2 for binary).

For a perfectly random binary sequence, H(X) ≈ 1 bit per bit (or 8 bits per byte).

Collision resistance CR measures the probability that two distinct inputs produce the same output. 0 ≤ CR ≤ 1. For a function f:

Empirically, collision resistance can be measured as:

Key Sensitivity (KS) quantifies the extent to which the ciphertext changes in response to minor modifications of the encryption key. For plaintext P and two keys K, K’ differing by one bit:

where: E_K(P) is the encryption of P with key K, and n is the ciphertext length in bits. Ideal KS is close to 50%.

Table 6 summarizes the security metrics of the evaluated algorithms, including avalanche effect, entropy, collision resistance, and key sensitivity, showing that all schemes achieve near-ideal diffusion and randomness properties across the tested microcontroller platforms. The visual chart corresponding to the data in Table 6 is shown in Figure 5.

Table 7 presents the code size overhead and implementation complexity of the evaluated cryptographic algorithms. Metrics include the total lines of code (LoC) or module size in kilobytes, highlighting the memory footprint required for firmware integration. Dependency requirements, such as lookup tables or S-boxes, are reported to indicate auxiliary resources needed. The firmware integration ratio quantifies the proportion of available non-volatile memory occupied by the cryptographic module, whereas initialization cycles represent the computational overhead incurred during algorithm startup. Together, these metrics offer a complete picture of the practical implementation costs and resource demands for each algorithm. Figure 6 presents a visual chart based on the data summarized in Table 7.

Benchmarking against AES-128, a widely used and well-understood symmetric cipher, provides a useful baseline for comparing the performance of DNA-KDF and other lightweight algorithms. Using AES-128 as a reference helps highlight how these algorithms perform in real-world IoT scenarios. The comparative performance with the baseline (AES-128) is shown in Table 8, and Figure 7 presents a visual chart of the data summarized in Table 8.

Table 9 provides the device-level benchmarking context, including the microcontroller specifications, clock frequencies, supply voltages, measured active currents, and available ROM/RAM. These hardware parameters are crucial for understanding the performance and energy metrics of the evaluated cryptographic algorithms. Figure 8 presents a visual chart based on the data from Table 9.

4.1. Execution Latency

Table 2 presents a detailed comparison of execution latency per encryption round (in milliseconds) across six microcontrollers, highlighting the performance of the DNA-KDF algorithm alongside several widely used lightweight block ciphers. The results highlight clear differences among the algorithms.

• SPECK-64 had the lowest latency, ranging from 0.72 ms on the ESP32 to 1.28 ms on the MSP430, making it ideal for latency-sensitive IoT applications.

• SIMON-64/128 also performed well, with latencies between 1.02 ms (ESP32) and 2.08 ms (MSP430). Both SPECK-64 and SIMON-64/128 consistently outperformed the other algorithms across all platforms, demonstrating their computational simplicity and adaptability to constrained microcontrollers.

In contrast, more complex ciphers such as ASCON-128 and LED-64 had higher latency. For example, ASCON-128 took 3.48 ms on the ATmega328P and 3.18 ms on the MSP430, while LED-64 showed comparable latencies of 3.08 ms and 3.38 ms, respectively. These results reflect the performance cost of sponge-based or substitution-permutation network designs, which, while strong cryptographically, involve more computational overhead on constrained hardware.

The proposed DNA-KDF algorithm showed moderate latency across all microcontrollers, ranging from 1.03 ms on the ESP32 to 2.47 ms on the ATmega328P. Notably, DNA-KDF outperformed conventional ciphers such as TWINE-80, HIGHT, SEPAR, and BORON, which incurred higher execution times on low-frequency platforms. For instance, on the MSP430, DNA-KDF took 2.42 ms, compared to 2.88 ms for TWINE-80, 2.98 ms for HIGHT, and 2.92 ms for SEPAR. This suggests that while DNA-KDF involves additional computational steps (e.g., substitution and crossover inspired by biological processes), its execution time remains competitive with established lightweight algorithms.

The data also show the significant impact of microcontroller architecture and clock frequency. High-performance devices like the ESP32 (240 MHz) consistently had the lowest latencies, while devices like the ATmega328P (16 MHz) and MSP430 (16 MHz) showed higher latencies. Despite these differences, the relative performance rankings of the algorithms remained consistent across platforms, indicating that each algorithm's structural complexity outweighs hardware-specific optimizations.

From a practical perspective, these findings highlight two key points:

1. DNA-KDF strikes a good balance between latency and innovation, performing better than several lightweight algorithms but still slower than the most efficient designs like SPECK-64 and SIMON-64/128.

2. Microcontroller choice is crucial for cryptographic performance. Devices with higher clock speeds and optimized instruction pipelines can reduce latency overhead, enabling the use of moderately complex algorithms like DNA-KDF in real-world IoT applications.

In conclusion, although algorithms such as SPECK-64 and SIMON-64/128 remain optimal for ultra-low-latency applications, DNA-KDF demonstrates competitive performance and represents a viable alternative in scenarios where moderate execution times are acceptable, particularly due to its distinctive structure and potential cryptographic robustness.

4.2. Memory Footprint

Memory footprint, which includes both non-volatile program storage (ROM/Flash) and volatile runtime memory (RAM), is a critical factor when deploying cryptographic algorithms on IoT devices. Since many embedded platforms have only a few kilobytes of available memory, finding a balance between strong security and memory efficiency is key for practical adoption [34,35].

Table 3 presents a summary of ROM and RAM usage for the DNA-KDF in comparison with several common lightweight ciphers across six microcontroller platforms. The results reveal clear patterns:

• SPECK-64 and LEA are the most memory-efficient algorithms, requiring just 1.00 KB ROM/0.15 KB RAM and 0.60 KB ROM/0.10 KB RAM, respectively. Their compact design makes them ideal for ultra-constrained IoT environments like legacy sensor nodes and wearable devices.

• SIMON-64/128 and TWINE-80 also maintain low memory footprints, each consuming under 1.20 KB ROM and 0.20 KB RAM, confirming their efficiency for low-end embedded systems.

• In contrast, DNA-KDF has a moderate memory overhead, requiring 2.50 KB ROM/0.32 KB RAM across all platforms. Although this performance is lower than that of certain DNA-based cryptographic methods reported in previous studies, it remains superior to the majority of conventional lightweight ciphers. The additional memory consumption arises from the need to store DNA-inspired transformation rules and intermediate data required for nucleotide-level operations. However, the memory footprint of DNA-KDF is comparable to that of algorithms such as QARMA (2.20 KB/0.28 KB), SEPAR (2.20 KB/0.30 KB), and BORON (2.40 KB/0.32 KB), suggesting that its integration into modern IoT devices with moderate memory capacity is feasible.

• PRESENT-80 (1.50 KB/0.20 KB) and HIGHT (1.40 KB/0.20 KB) are middle-ground options, balancing compactness with robustness.

• At the higher end, ASCON-128 (2.00 KB/0.25 KB) and LED-64 (1.30 KB/0.22 KB) reflect the increased memory demands of more complex cipher designs, but still fall within the acceptable memory limits of most current MCUs.

A key observation from Table 3 is the consistency of memory usage across platforms. In contrast to execution latency, which varies according to the microcontroller’s clock speed and architectural characteristics, the memory footprint remains largely consistent across all six devices. This is because the compiled code size and static data allocation depend mainly on the algorithm’s design rather than the processor’s characteristics. Therefore, memory efficiency is more of an intrinsic property of the algorithm than a hardware-dependent factor.

From a deployment perspective, these findings highlight two key insights:

1. DNA-KDF requires about twice the memory of the most compact lightweight ciphers (e.g., SPECK-64, SIMON-64/128, LEA), which could limit its use on ultra-constrained platforms with strict memory budgets.

2. However, modern IoT edge devices are increasingly equipped with larger memory capacities—ranging from tens to hundreds of kilobytes of ROM and RAM—making the memory overhead of DNA-KDF acceptable, especially when considering its potential to offer diverse cryptographic security against emerging attack models.

4.3. Throughput

Throughput, defined as the volume of data processed per unit time, is a critical performance metric for evaluating the suitability of cryptographic algorithms in real-time IoT applications, including industrial automation, multimedia streaming, and secure telemetry. Table 4 presents the measured throughput across six different microcontroller platforms, comparing the efficiency of DNA-based algorithms with conventional lightweight ciphers in processing high-volume data streams.

As expected, SPECK-64 delivered the highest throughput across all platforms, reaching up to 1200 kB/s on the ESP32, and maintaining high performance even on lower-power devices such as the ATmega328P (550 kB/s) and MSP430 (500 kB/s). This high throughput reflects its simple design and low execution latency, which minimizes overhead when processing data blocks.

Similarly, SIMON-64/128 performed well, with throughput ranging from 500 kB/s on the ATmega328P to 1000 kB/s on the ESP32, making it a solid choice for latency-sensitive applications.

The proposed DNA-KDF algorithm showed competitive throughput, with values like 1000 kB/s on the ESP32, 850 kB/s on the nRF52840, and 650 kB/s on the STM32F0. While it didn’t surpass SPECK-64 or SIMON-64/128, DNA-KDF often outperformed other lightweight ciphers, including TWINE-80, HIGHT, LED-64, and BORON, especially on higher-frequency platforms. For example, on the nRF52840, DNA-KDF achieved 850 kB/s, outperforming TWINE-80 (700 kB/s) and LED-64 (600 kB/s).

This shows that, despite the added complexity of DNA-inspired transformations, DNA-KDF can still handle medium-to-high data rates in IoT applications. More complex ciphers, such as ASCON-128 and PRESENT-80, exhibited intermediate throughput. ASCON-128 reached 1000 kB/s on the ESP32 and 900 kB/s on the nRF52840, similar to DNA-KDF, but performed worse on low-frequency devices like the ATmega328P (350 kB/s). PRESENT-80 showed stable throughput across devices, ranging from 450–900 kB/s, suggesting it strikes a good balance between efficiency and computational overhead.

At the lower end of the spectrum, algorithms like HIGHT, LED-64, SEPAR, and BORON had the lowest throughput, rarely exceeding 800 kB/s even on the ESP32. For example, LED-64 achieved only 700 kB/s on the ESP32 and dropped to 280 kB/s on the MSP430, making it less suitable for high-speed data protection tasks.

These results clearly demonstrate the impact of microcontroller selection on throughput. High-performance platforms, such as the ESP32 (240 MHz) and nRF52840 (64 MHz), achieved the highest throughput, whereas lower-frequency devices, including the MSP430 (16 MHz) and ATmega328P (16 MHz), exhibited more limited performance. However, the relative ranking of algorithm throughput stayed consistent across platforms, indicating that the algorithm’s design plays a bigger role in performance than the hardware.

4.3.1 Key takeaways

1. DNA-KDF provides sufficient throughput for most IoT data protection tasks, outperforming several conventional lightweight algorithms and nearly matching the performance of optimized block ciphers on higher-frequency platforms.

2. While algorithms like SPECK-64 and SIMON-64/128 are still the best in terms of raw efficiency, DNA-KDF demonstrates that biologically inspired cryptographic methods can achieve competitive throughput without being excessively resource-intensive.

4.4. Energy Consumption

Energy consumption per encryption round is a crucial metric for IoT systems, especially when devices are constrained by power sources like coin-cell batteries, supercapacitors, or energy harvesting. As expected, Table 5 shows a clear correlation between execution latency and energy expenditure—algorithms with longer runtimes generally consume more energy, while those with optimized round structures are more energy-efficient.

Among the algorithms tested, ASCON-128 consistently shows the lowest energy consumption, with values as low as 2.6 μJ per encryption round on the nRF52840 and 2.9 μJ on the ESP32. This is due to its efficient design as a permutation-based AEAD cipher, making it ideal for low-power IoT applications. HIGHT and DNA-KDF also performed well, with energy usage ranging from 3.2 μJ to 6.9 μJ, indicating that DNA-KDF operates with reasonable efficiency and could be suitable for applications with moderate energy budgets.

In contrast, PRESENT-80 and SIMON-64/128 exhibited the highest energy consumption, reaching up to 10.1 μJ per round on the MSP430 and 9.5 μJ on the ATmega328P. These higher values suggest that, despite their historical significance, these algorithms are less energy-efficient compared to more recent designs such as ASCON-128 and DNA-KDF. For ultra-low-power IoT devices, such as wireless sensor motes, these higher energy costs may limit their long-term viability.

Furthermore, the choice of hardware platform has a significant impact on energy consumption. High-performance devices like the ESP32 and nRF52840 typically use less than 5 μJ per encryption round, thanks to their efficient architectures and faster execution times. Conversely, legacy microcontrollers like the ATmega328P and MSP430 tend to have higher energy costs due to slower performance, highlighting their limitations for cryptographically intensive tasks.

4.4.1 Key takeaways

1. While DNA-KDF is not as energy-efficient as ASCON-128, it still operates efficiently compared to older ciphers like PRESENT-80 and SIMON-64/128.

2. DNA-KDF is a strong contender for IoT applications where resilience to new cryptographic attacks is important, and moderate energy budgets are acceptable.

3. The results emphasize the importance of a hardware-algorithm co-design approach, where the cryptographic algorithm is selected based on the capabilities of the target hardware to maximize performance and energy efficiency.

4.5. Security Metrics Analysis

Security metrics including the avalanche effect, entropy, collision resistance, and key sensitivity are essential for assessing a cryptographic algorithm’s resistance to differential and statistical cryptanalysis. Table 6 summarizes these metrics for all evaluated algorithms, and the results reveal that most algorithms exhibit strong diffusion and randomness, essential for security.

• Avalanche effect measures the percentage of output bit changes resulting from a single input bit change, indicating the strength of diffusion. Most algorithms performed close to the ideal 50%, with ASCON-128 (50.1%) and DNA-KDF (49.8%) achieving near-perfect results. This indicates strong resistance against linear and differential cryptanalysis. However, LED-64 (47.0%) and PRESENT-80 (47.3%) showed slightly lower diffusion, which could potentially make them more vulnerable to some statistical attacks.

• Entropy quantifies the randomness of the output ciphertext. All tested algorithms achieved values close to the theoretical maximum of 8 bits per byte (ranging from 7.90 to 7.99 bits/byte), indicating that the ciphertext produced by all algorithms is effectively indistinguishable from random noise. ASCON-128 and DNA-KDF performed at the top end of this range (7.98–7.99).

• Collision resistance assesses the likelihood that two different inputs produce the same ciphertext. ASCON-128, DNA-KDF, QARMA, and LEA showed high collision resistance, making them suitable for high-security applications. In contrast, LED-64 had medium-low collision resistance, which may make it more vulnerable to certain collision-finding techniques due to its smaller state size and simpler structure.

• Key sensitivity measures how much the output changes when a single bit in the key is flipped. All algorithms demonstrated strong adherence to the avalanche principle with key variations, exhibiting values around 48–50%. DNA-KDF (50.2%) and ASCON-128 (50.0%) led this metric, highlighting their resilience against related-key and key-differential attacks.

4.5.1 Key insights

1. ASCON-128 and DNA-KDF consistently deliver the best security metrics, achieving nearly ideal values for all properties, making them the most robust choices.

2. QARMA and LEA also show strong performance, balancing high collision resistance with excellent avalanche and entropy properties.

3. Older block ciphers like LED-64 and PRESENT-80 still provide acceptable security but are less effective in modern IoT contexts due to weaker diffusion and collision resistance.

Overall, the results confirm that DNA-based cryptographic designs, along with modern lightweight algorithms such as ASCON-128, provide security properties that meet or surpass those of traditional lightweight ciphers, making them suitable for IoT systems that demand both high efficiency and robust cryptographic resilience.

4.6. Cryptanalytic Considerations and Potential Attack Vectors

To complement the empirical evaluation of DNA-KDF, we now assess its robustness against common cryptanalytic attacks. These attacks typically target weaknesses in cryptographic algorithms, aiming to break their security or recover the secret key. We consider the following key attack vectors:

• Brute-force and key-search attacks.

The combined entropy from device-specific seeds, temporal inputs, and nonce values generates a 128-bit output space, rendering exhaustive search infeasible for any contemporary adversary. The DNA-encoding and substitution layers introduce no algebraic shortcuts that could reduce the effective key space.

• Structural and differential attacks.

Since nucleotide mappings are invertible and blockwise operations are nonlinear with respect to input bit patterns, DNA-KDF does not reveal exploitable structural invariants. Differential propagation across nucleotide substitution and position-permutation stages yields high output sensitivity (Δinput → Δoutput), degrading any attacker’s ability to mount chosen-input differential analysis.

• Correlation and predictability attacks.

The integration of timestamp-derived temporal entropy ensures that even identical device seeds generate orthogonal key outputs across sessions. No deterministic correlation exists between consecutive derivations, and correlation coefficients measured across 10⁶ pairs remain statistically indistinguishable from noise, limiting predictability attacks.

• Replay and seed-recovery attacks.

An adversary cannot reuse or recompute historical keys, as each derivation is strictly time-scoped and non-invertible due to the irreversible compression stage. The DNA-layer encoding provides no leakage that could facilitate seed reconstruction or backtracking.

• DNA-specific attack vectors.

Potential vulnerabilities related to nucleotide substitution bias, codon frequency imbalances, or positional repetition were analyzed and found to be non-exploitable. The encoded sequences show a balanced nucleotide distribution (with (p ≈ 0.25)), and the block-permutation mechanism effectively removes any fixed patterns or structures that could facilitate template-based reconstruction attacks. From a cryptanalytic standpoint, these findings align with the empirical results, confirming that DNA-KDF demonstrates robust resistance against a wide range of attack vectors, including classical cryptanalysis, structural weaknesses, and domain-specific attack strategies.

4.7. Code Size Overhead and Implementation Complexity

The feasibility of deploying cryptographic algorithms in IoT environments is influenced not only by their performance and security but also by their implementation complexity and code size overhead. Table 7 presents a comparison of these factors, highlighting the costs associated with firmware integration, auxiliary resource dependencies, and initialization requirements.

When it comes to code size, most lightweight ciphers—such as PRESENT-80, ASCON-128, SPECK-64, TWINE-80, and SIMON-64/128—require between 400 and 600 lines of code (LoC) and take up around 1.5 KB of memory. This compact footprint aligns with their design goal of enabling efficient integration into memory-constrained IoT devices. On the other hand, the DNA-KDF algorithm needs between 800 and 1000 LoC, with a slightly smaller compiled module size of 1.2 KB. This increase in code size reflects the algorithm’s greater complexity, which involves specialized processes like DNA encoding and sequence-based transformations. The larger codebase underscores the additional programming and maintenance challenges associated with implementing non-traditional cryptographic methods, while dependency requirements further differentiate the algorithms. Most conventional lightweight ciphers have minimal dependencies, often relying on no lookup tables or S-boxes, which simplifies their implementation. However, DNA-KDF requires both lookup tables and DNA encoding rules, which adds to design complexity and increases code size, particularly when accounting for portability and modularity requirements. This reliance on specialized structures can make integration more challenging in ultra-minimal firmware environments, particularly in legacy systems with strict code size constraints.

The firmware integration ratio, which represents the portion of available non-volatile memory used by the cryptographic module, remains fairly modest across all algorithms, generally between 2% and 3%. This suggests that, even in memory-constrained microcontrollers, cryptographic algorithms don’t take up a significant portion of the available memory, leaving enough space for application code. However, DNA-KDF’s relatively larger overhead may be more pronounced in devices with extremely limited flash memory, where even minor increases in code size can affect overall system functionality.

Finally, initialization cycles reflect the computational cost incurred before encryption can begin. Lightweight block ciphers such as SIMON-64/128 and ASCON-128 exhibit the lowest startup costs (120–180 cycles) owing to their simple designs. DNA-KDF, in contrast, has a higher initialization overhead (200–300 cycles), largely due to the setup of DNA encoding tables and transformation rules. While this might be negligible on high-performance platforms, it could introduce latency in time-sensitive IoT applications where quick cryptographic initialization is essential.

In conclusion, traditional lightweight ciphers excel in simplicity and ease of integration, with minimal dependencies, balanced code size, and low initialization costs. Although slightly more complex, DNA-KDF demonstrates that novel cryptographic approaches can remain practical for IoT applications, provided that firmware size, dependencies, and system latency are carefully considered.

4.8. Comparative Performance with Baseline (AES-128)

AES-128 is widely regarded as the standard in symmetric cryptography, thanks to its broad adoption, strong standardization, and thorough security validation. Benchmarking new and lightweight ciphers against AES-128 provides a useful reference for evaluating their performance, efficiency, and security trade-offs, especially in IoT applications where resource constraints are a concern.

Table 8 presents a comparison of speedup, energy savings, and the overall security/performance trade-off index, offering a clear picture of how different algorithms stack up against this established cipher. The results indicate that AES-128 is outperformed by nearly all evaluated lightweight schemes in both execution speed and energy consumption. This is consistent with the goal of lightweight cryptography, which is specifically designed to address the limitations of resource-constrained devices.

For example, PRESENT-80 achieves a 100–200% speedup and up to 70% energy savings compared to AES-128, while still maintaining a strong trade-off index. These improvements highlight its suitability for ultra-constrained devices, where performance and low power consumption are crucial. DNA-KDF also demonstrates competitive performance, achieving a 50% speedup and 25% reduction in energy consumption compared to AES-128, while maintaining a strong trade-off index. However, its performance gains are more modest, reflecting the computational overhead involved in DNA sequence transformations and related operations. Still, DNA-KDF’s ability to outperform AES-128 while offering a novel security approach suggests it is a viable option for specialized IoT scenarios, especially where resistance to classical cryptanalytic techniques is prioritized.

Among the conventional lightweight ciphers, ASCON-128 stands out for its remarkable acceleration—300–500% faster than AES-128—although its energy savings are more moderate (30–50%). This reflects ASCON’s focus on speed and security, especially as a finalist in the NIST Lightweight Cryptography (LWC) competition, rather than on maximizing energy efficiency. Other algorithms, including SPECK-64, TWINE-80, HIGHT, SIMON-64/128, LED-64, LEA, SEPAR, and BORON, achieve 50–100% speedup and 20–40% energy savings, positioning them in the mid-range of the performance–efficiency trade-off spectrum. These ciphers offer solid performance improvements without reaching the extremes seen in PRESENT-80 or ASCON-128.

QARMA also falls in the middle, offering a 100–200% speedup and 30–50% energy savings, while its trade-off index remains within the 'medium' range.". This suggests that while it offers significant improvements over AES-128, its integration complexity or operational overhead may limit its practicality in highly constrained environments.

In summary, the comparative analysis highlights two main points:

1. AES-128, while secure and standardized, is not optimized for use in constrained IoT platforms, and nearly all the lightweight and DNA-based schemes provide noticeable performance and efficiency improvements.

2. DNA-KDF bridges the gap between traditional lightweight ciphers and AES-128, offering a balance of speed, energy efficiency, and novel security features. This makes it an attractive choice for applications where enhanced cryptographic diversity justifies a slightly higher complexity.

Overall, Table 8 demonstrates the value of lightweight and non-traditional cryptographic designs, providing solid evidence that these approaches can not only match but even outperform AES-128 in resource-limited environments, all while offering a range of performance, energy efficiency, and implementation complexity trade-offs.

4.9. Device-Level Benchmarking Context

Table 9 provides an overview of the key hardware characteristics of the six microcontroller platforms used in the benchmarking tests. These specifications provide a critical baseline for interpreting the results related to execution, memory usage, throughput, and energy consumption of the evaluated cryptographic algorithms. Microcontroller features such as clock frequency, supply voltage, active current, and available memory directly influence the performance of cryptographic algorithms and highlight the diverse constraints commonly encountered in real-world IoT devices.

The devices tested range from the highly constrained ATmega328P and MSP430, which run at 16 MHz and have limited ROM (32–64 KB) and RAM (2 KB), to the high-performance ESP32, which boasts a 240 MHz dual-core processor, 448 KB ROM, and 520 KB RAM. This wide range of specifications enables a representative evaluation across both legacies, low-cost IoT devices and modern edge-computing platforms. Not surprisingly, algorithms running on the ESP32 consistently showed the best performance in terms of speed, throughput, and energy efficiency, thanks to its high clock speed and robust memory subsystem. On the other hand, the ATmega328P and MSP430 performed more slowly, highlighting the challenges of running resource-intensive cryptographic algorithms on ultra-low-power platforms.

In addition to computational power, supply voltage and active current consumption offer important context for understanding the energy profiles of these devices. For instance, the MSP430 draws very little current (5 mA at 3.3 V), making it a commonly chosen energy-efficient option despite its modest processing capabilities. On the other hand, the ESP32’s higher active current draw (80 mA) demonstrates the energy-performance trade-off—faster processing requires more power, which can be a concern for battery-powered IoT devices. The STM32F0 and PIC24FJ64GA lie somewhere in between, with moderate clock speeds (32–48 MHz), active current (around 10 mA), and memory resources (32–64 KB ROM, 8 KB RAM). These make them suitable for mid-range IoT applications where both energy efficiency and performance are important. The nRF52840 stands out for its solid balance, offering 1024 KB ROM and 256 KB RAM, a 64 MHz clock, and moderate active current (15 mA). This configuration makes it particularly well-suited for more complex cryptographic tasks in wireless sensor networks and edge computing applications, where larger memory banks are needed for cryptographic operations or to support multiple communication protocols. Overall, the benchmarking results indicate that a device’s hardware characteristics are as critical as the algorithm itself when assessing the feasibility of cryptographic schemes in IoT applications. High-performance platforms like the ESP32 and nRF52840 can handle more demanding algorithms, such as DNA-KDF, due to their larger memory and processing capacity. In contrast, platforms such as the ATmega328P may necessitate algorithmic optimizations or be restricted to lightweight block ciphers like SPECK-64 or PRESENT-80. Consequently, selecting an appropriate algorithm for a given IoT device requires careful consideration of the hardware, underscoring the importance of device-specific benchmarking when evaluating the suitability of cryptographic solutions in real-world IoT environments.

a) Implementation details

The experiments were set up with the following configuration:

• Compiler and flags: The GCC compiler version 12.3.0 was used, with the `-O2` optimization flag for a good balance between performance and code size. For platforms with stricter energy constraints, the `-Os` optimization flag was applied to reduce the code footprint. Additional flags, including`-std=c11`, `-Wall`, and `-Wextra`, were used to ensure compliance with C standards and to enable comprehensive compilation warnings.

• Variable sizes and memory layout: The key materials and seed buffers were explicitly sized to fit the requirements of the experiment: `device_id` (64–128 bits), `timestamp` (32–48 bits), `sensor_hash` (128 bits), and `derived_key` (128 bits). Temporary DNA sequences and intermediate buffers were allocated statically to avoid overhead from dynamic memory allocation, which is important for memory-constrained MCUs.

• Hardware setup: The experiments were carried out on six different MCU platforms, as detailed in Table 9, with measurements taken for clock frequency, supply voltage, and current. The necessary hardware initialization scripts were used to configure timers, ADC sampling, and GPIO interfaces for acquiring sensor data.

• Code availability: The source code used in these experiments is proprietary and not publicly available at the moment. However, the implementation details, including compiler settings, memory allocation strategies, and measurement protocols, are fully described in the manuscript to ensure that the experiments can be independently reproduced.

Additionally, key functions of the DNA-KDF algorithm, such as buffer handling, rotation, substitution, and HKDF calls, are illustrated in Algorithm 1 with optional code snippets or pseudocode.

4.10. Algorithmic Strengths and Suitability for Resource-Constrained IoT Devices

The thorough benchmarking carried out across six representative microcontrollers provides a detailed analysis of the key strengths, limitations, and real-world applicability of both traditional lightweight and DNA-inspired cryptographic algorithms in IoT environments. Table 10 summarizes the primary advantages of each algorithm and their suitability for deployment in resource-constrained or performance-critical devices.

4.11. Strategic Implications and Emerging Directions in IoT Cryptography

The cross-platform benchmarking and comparative analysis conducted in this study offer valuable insights into the design and deployment of cryptographic algorithms within IoT ecosystems. Traditional lightweight ciphers such as SPECK-64, PRESENT-80, and ASCON-128 exhibit low latency, minimal energy consumption, and compact memory requirements, making them well-suited for highly constrained devices like battery-powered sensors, actuators, and edge nodes. Conversely, DNA-based algorithms, including DNA-KDF, introduce innovative security paradigms marked by strong diffusion, high key sensitivity, and resilience against unconventional attack vectors. Although these DNA-based algorithms entail higher computational and memory demands that may restrict their use in ultra-constrained environments, they present promising opportunities as complementary security layers in hybrid IoT systems requiring enhanced cryptographic diversity.

Future research should focus on optimizing DNA-inspired schemes to reduce their latency and memory footprint. This could involve exploring hardware acceleration, specialized instruction sets, and memory-efficient encoding techniques. Furthermore, in-depth cryptanalysis and real-world deployment studies, including power profiling, environmental stress testing, and resilience assessments, are essential for validating the practical feasibility of these algorithms. A hybrid cryptographic approach that combines conventional lightweight algorithms with DNA-based schemes presents a strategic solution for IoT security. This integrated approach can deliver layered defense mechanisms, balancing the high efficiency of traditional ciphers with the innovative security advantages of DNA-based designs. By tailoring encryption strategies to the specific needs of different IoT scenarios, this dual-layer method offers a way to optimize the trade-off between performance, resource constraints, and robust cryptographic security [36].

This study evaluated Temporal DNA-Based Key Derivation (DNA-KDF) alongside a selection of lightweight cryptographic algorithms on six representative IoT microcontrollers: ATmega328P, STM32F0, ESP32, nRF52840, PIC24FJ64GA, and MSP430. These platforms encompass a diverse range of microcontroller architectures, from ultra-low-power 8- and 16-bit MCUs to high-performance 32-bit devices. Benchmarking results indicate that, although SPECK-64 and SIMON-64/128 outperform DNA-KDF in latency and throughput efficiency, the DNA-KDF algorithm still delivers competitive performance with moderate computational costs. Its execution time (ranging from 1.03 to 2.47 ms), throughput (650–1000 kB/s), and energy usage (3.2–6.9 μJ) place it ahead of several other conventional ciphers, such as TWINE-80, HIGHT, SEPAR, and BORON. Although DNA-KDF requires a larger memory footprint (2.50 KB ROM/0.32 KB RAM) and more complex implementation compared to other lightweight ciphers, it offers robust cryptographic properties, including near-ideal avalanche diffusion, entropy close to 8 bits/byte, and high key sensitivity. Compared to AES-128, DNA-KDF demonstrates significant improvements in execution speed and energy efficiency, while introducing a novel biologically inspired design. These findings suggest that DNA-KDF is well-suited for deployment in mid-tier IoT platforms with adequate memory and processing capabilities, particularly as part of hybrid security frameworks that combine lightweight block ciphers with DNA-based cryptographic primitives. Future research should focus on optimizing encoding rules and exploring hardware acceleration to reduce overhead. These advancements would further strengthen the role of DNA-inspired cryptography in emerging IoT ecosystems.

The author confirms sole responsibility for the conception, design, literature review, analysis, interpretation, visualization, manuscript drafting, critical revisions, and final approval of the article. The author has read and agreed to the published version of the manuscript.

The data that support this study are available from the author upon reasonable request.

The author declares no conflicts of interest.

The study did not receive any external funding and was conducted using only institutional resources.

Declared none.

The author confirms that Chat GPT was used to check grammar and enhance the English language of the manuscript. However, the author confirms that no sections of the manuscript text or graphical images were generated using AI tools. Author takes full responsibility for all content and results presented in this work.