Attacks and parameter choices in HIMMO Oscar Garc´ ıa-Morch´ on 1 , Ronald Rietman 1 , Ludo Tolhuizen 1 , Jose-Luis Torre-Arce 1 , Moon Sung Lee 2 , Domingo G´ omez-P´ erez 3 , Jaime Guti´ errez 3 , and Berry Schoenmakers 4 1 Philips Research, Eindhoven, The Netherlands 2 University of Luxembourg 3 University of Cantabria, Santander, Spain 4 TU Eindhoven, The Netherlands Abstract. The HIMMO scheme has been introduced as a lightweight collusion-resistant key pre-distribution scheme, with excellent efficiency in terms of bandwidth, energy consumption and computation time. As its cryptanalysis relies on lattice techniques, HIMMO is also an interesting quantum-safe candidate. Unlike the schemes by Blom, by Matsumoto and Imai, and by Blundo et al, which break down once the number of colluding nodes exceeds a given threshold, it aims at tolerating any number of colluding nodes. In 2015, a contest for the verification of the scheme was held. During the contest, a method was developed to guess a key by finding an approxi- mate solution of one of the problems underlying the scheme. This attack involves finding a short vector in a lattice of dimension linear in a system parameter α and allowed key recovery for several challenges. Thwarting this attack by increasing α would lead to a significant performance degra- dation, as CPU and memory requirements for the implementation of the scheme scale quadratically in α. This paper describes a generalization of HIMMO parameters that allows configuring the scheme such that both its performance and the dimension of the lattice involved in the attack grow linearly in α. Two attacks in- spired by the one developed in the contest are described, and the impact of those attacks for different parameter choices is discussed. Parameters choices are described that thwart existing attacks while enabling high performance implementations of the scheme. Keywords: Key predistribution scheme, collusion attack, identity, lattice anal- ysis 1 Introduction Background More and more devices are getting connected to the Internet form- ing the so called Internet of Things (IoT). Strong security is fundamental for the IoT to be deployed in critical applications like healthcare, smart cities and smart