Hardware Performance Evaluation of Authenticated Encryption SAEAES with Threshold Implementation

Takeshi Sugawara

doi:10.3390/cryptography4030023

Abstract

SAEAES is the authenticated encryption algorithm instantiated by combining the SAEB mode of operation with AES, and a candidate of the NIST’s lightweight cryptography competition. Using AES gives the advantage of backward compatibility with the existing accelerators and coprocessors that the industry has invested in so far. Still, the newer lightweight block cipher (e.g., GIFT) outperforms AES in compact implementation, especially with the side-channel attack countermeasure such as threshold implementation. This paper aims to implement the first threshold implementation of SAEAES and evaluate the cost we are trading with the backward compatibility. We design a new circuit architecture using the column-oriented serialization based on the recent 3-share and uniform threshold implementation (TI) of the AES S-box based on the generalized changing of the guards. Our design uses 18,288 GE with AES’s occupation reaching 97% of the total area. Meanwhile, the circuit area is roughly three times the conventional SAEB-GIFT implementation (6229 GE) because of a large memory size needed for the AES’s non-linear key schedule and the extended states for satisfying uniformity in TI.

Highlights

There is an increasing demand for secure data communication between embedded devices in many areas, including automotive, industrial, and smart-home applications
Lightweight cryptography emerged from block cipher design [1], which covers a larger area in cryptography, including authenticated encryption (AE)
We describe the design at the register-transfer level (RTL); we use no netlist-level optimization, including the direct standard-cell instantiation of SFFs, so that the design will not bound to a specific library

Summary

Introduction

There is an increasing demand for secure data communication between embedded devices in many areas, including automotive, industrial, and smart-home applications. To enable cryptography in resource-constrained devices, researchers have studied lightweight cryptography that has a good performance in implementation by design. Lightweight cryptography emerged from block cipher design [1], which covers a larger area in cryptography, including authenticated encryption (AE). Side-channel attack (SCA) [3,4] is a considerable security risk in lightweight cryptography’s main targets: embedded devices under a hostile environment in which a device owner attacks the device with physical possession. NIST LWC considers the grey-box security model with side-channel leakage [5]. The cost of implementing SCA countermeasures in resource-constrained devices is a big issue because SCA countermeasures multiply the cost

Objectives

Methods

Results

Conclusion