Efficient (Masked) Hardware Implementation of Grain-128AEADv2

Abstract

We consider the efficient hardware implementation of Grain-128AEADv2, which is the second version of Grain-128AEAD (one of the lightweight cryptography finalist candidates). In order to counteract side-channel attacks, the efficient masked hardware implementation of Grain-128AEADv2 is also considered under the idea of domain-oriented masking. In detail, the so-called pipeline-like pre-computation technique is applied to increase the throughput-area ratio of the (masked) hardware implementation of Grain-128AEADv2. The performance of the (masked) hardware implementation of Grain-128AEADv2 is evaluated on ASIC and FPGA. For the unmasked version, the highest throughput-area ratio can be 2.14 M b p s / G E on ASIC and 9.34 M b p s / S l i c e on FPGA. For the masked version, the highest throughput-area ratio can be 0.37 M b p s / G E on ASIC and 1.72 M b p s / S l i c e on FPGA. Then, the security of the masked hardware implementation of Grain-128AEADv2 is verified with the simulated T-Test. To the best of our knowledge, this is the first published work about the (masked) hardware implementation of Grain-128AEADv2. In light of this, this contribution may help researchers and practitioners to accurately compare the efficiency and the security of the hardware implementation of Grain-128AEADv2 with those of other lightweight cryptography algorithms.