Evaluating the Energy Costs of SHA-256 and SHA-3 (KangarooTwelve) in Resource-Constrained IoT Devices

The rapid expansion of Internet of Things (IoT) devices has heightened the demand for lightweight and secure cryptographic mechanisms suitable for resource-constrained environments. While SHA-256 remains a widely used standard, the emergence of SHA-3 particularly the KangarooTwelve variant offers potential benefits in flexibility and post-quantum resilience for lightweight resource-constrained devices. This paper presents a comparative evaluation of the energy costs associated with SHA-256 and SHA-3 hashing in Contiki 3.0, using three generationally distinct IoT platforms: Sky Mote, Z1 Mote, and Wismote. Unlike previous studies that rely on hardware acceleration or limited scope, our work conducts a uniform, software-only analysis across all motes, employing consistent radio duty cycling, ContikiMAC (a low-power Medium Access Control protocol) and isolating the cryptographic workload from network overhead. The empirical results from the Cooja simulator reveal that while SHA-3 provides advanced security features, it incurs significantly higher CPU and, in some cases, radio energy costs particularly on legacy hardware. However, modern platforms like Wismote demonstrate a more balanced trade-off, making SHA-3 viable in higher-capability deployments. These findings offer actionable guidance for designers of secure IoT systems, highlighting the practical implications of cryptographic selection in energy-sensitive environments.