Block Cipher Implementations Research Articles

Enhanced design and hardware implementation of a chaos-based block cipher for image protection

Nowadays chaos-based cryptography systems are widely used to protect sensitive data. A variety of chaos-based cryptosystems with software implementation has been published in the literature. However, due to the rapid growth of connected devices, the development of hardware secure and low-resource cryptographic systems is necessary. In this paper, we enhance the design of one of our software cryptosystems and then we address its FPGA-based implementation. The improvement in the design consists essentially to introduce an Initial Vector (IV) entry to the Chaotic Pseudo Random Number Generator (CPRNG) thus allowing to generate a new dynamic keys for the confusion layer (using a modified 2-D cat map) and diffusion layer (using a logistic map) with each new execution of the system. The CPRNG is formed by XORred a discrete Skew Tent Map (STM) with a discrete Piecewise Linear Chaotic Map (PWLCM). The proposed cryptosystem, which operates in Cipher Block Chaining (CBC) mode, is controlled by a Finite State Machine (FSM) to ensure that both the encryption and decryption are performed by the same reconfigurable architecture. The system is implemented on a Xilinx XC7Z020 ZYNQ FPGA platform. The results obtained in terms of hardware implementation costs (logic resources, throughput, and efficiency) and in terms of security against cryptographic attacks demonstrate the effectiveness of the proposed chaos-based cryptosystem.

Template Attack Assisted Linear Cryptanalysis on Outer Rounds Protected DES Implementations

Abstract In practice, when the security of a block cipher implementation is considered, the leakages related to the outer rounds encryptions can be used by side channel attacks (SCA) to recover the secret key. Therefore, the outer rounds of block cipher implementations should be protected. However, in order to lower the implementation price, the inner rounds of block cipher implementations may be unprotected. In light of this, the security of an outer rounds protected DES implementation is considered. In detail, template attack (TA), which is information theoretically the strongest SCA style, can be used to obtain the inner round output. Then, linear cryptanalysis (LC) can be used to recover the secret key. Finally, the optimal key enumeration algorithm can be used to optimize the efficiency of TA assisted LC. We evaluate the efficiency of TA assisted LC in simulated scenarios where a three outer rounds protected DES implementation is targeted. The evaluation results show that when 800 correct samples are available and the number of key enumeration is $2^{10}$, the efficiency of TA assisted LC can reach 83% of success rate. Overall, an efficient combination attack style that can be used to accurately evaluate the security of an outer rounds protected DES implementation is proposed.

Glitch-less hardware implementation of block ciphers based on an efficient glitch filter

In this paper, we present a glitch-less hardware structure based on a glitch filter for the implementation of the block ciphers. The glitch filter circuit is used to build a glitch-free arbitrary binary signal at full clock speed based on both positive and negative clock edges. In this technique, the desired signal is constructed by combining two signals whose individual frequencies are one-half that of the original signal. From the hardware point of view, the circuit does not employ delay blocks that depend on routing delays. Therefore, this property is suitable for use in both VLSI- and FPGA-based implementations. The glitch filter stops pulses of narrow width while allowing the passage of pulses of larger width. The circuit removes chatter and extraneous noise in hardware structures of the cryptosystem without affecting the output signal. The glitch filter can play both roles of the register for save of data and also glitch remover. In this case, the area overhead for the glitch-less structure is negligible. Therefore, we achieving a good trade-off between glitch-less and area overhead which is essential for an efficient design. The delay and area consumption of the different block ciphers such as PRESENT, HIGHT, and SPECK based on glitch filter circuit are achieved in 180 nm CMOS technology. The results show that the proposed structures have an acceptable area and time complexities compared to the original structures.

Optimized Implementation of SM4 on AVR Microcontrollers, RISC-V Processors, and ARM Processors

At 2003, the SM4 block cipher was introduced that is a Chinese domestic cryptographic. It is mandated in the Chinese National Standard for Wireless LAN Wired Authentication and Privacy Infrastructure (WAPI), because the algorithm was developed for use in wireless sensor networks to provide safety network environment. The SM4 block cipher uses a 128-bit block size and a 32-bit round key. It consists of 32 rounds and one reverse translation R. In this paper, we present the optimized implementation of the SM4 block cipher on 8-bit AVR microcontrollers, which are widely used in wireless sensor devices; the optimized implementation of the SM4 block cipher on 32-bit RISC-V processors, which are open-source-based computer architectures, and the optimized implementation of SM4 on 64-bit ARM processors with parallel computation, which are widely used in smartphones and tablets. In the AVR microcontroller, three versions are implemented for various purposes, including speed-optimization, memory-optimization, and code size-optimization. As a result, the speed-optimization, memory-optimization, and code size-optimization versions achieved 205.2 cycles per byte, 213.3 cycles per byte, and 207.4 cycles per byte, respectively. This is faster than the reference implementation written in C language (1670.7 cycles per byte). The implementation on 32-bit RISC-V processors achieved 128.8 cycles per byte. This is faster than the reference implementation written in C language (345.7 cycles per byte). The implementation on 64-bit ARM processors achieved 8.62 cycles per byte. This is faster than the reference implementation written in C language (120.07 cycles per byte).

Correlation power analysis attack on software implementation of TRIVIUM stream cipher

Power analysis attacks are a category of attacks against cryptographic implementations. In this case, the power consumption of a cryptosystem is analysed to extract its secret values such as secret keys and key streams. This has become a huge threat to modern day cryptosystems. Therefore, identifying cryptographic implementations which are vulnerable to power analysis attacks is very important. Many studies have been carried out on power analysis attacks on block cipher implementations, but relatively less number of studies have been carried out on power analysis attacks on stream cipher implementations. This paper presents a power analysis attack on a software implementation of TRIVIUM stream cipher. In order to analyse the power consumption, correlation power analysis (CPA) is done, and the keystream is successfully recovered.

Optimized Implementation of PIPO Block Cipher on 32-Bit ARM and RISC-V Processors

A lightweight block cipher PIPO-64/128 was presented in ICISC’2020. PIPO of the 8-bit unit using an unbalanced-bridge S-box showed better performance than other lightweight block cipher algorithms on an 8-bit AVR environment. So far, optimization methods for implementing PIPO have been proposed in various environments; however, no optimization research has been conducted for two popular 32-bit based processors: ARM Cortex-M4 and RISC-V. Since RISC-V and ARM Cortex-M series platforms do not support bit-based Single Instruction Multiple Data (SIMD) instructions, several aspects should be considered to apply a forced parallelization strategy. In this article, we discuss the implementation methodology of PIPO for 32-bit RISC-V and ARM Cortex-M4 environments. We optimize the performance of S-Layer via proposed register-scheduling and masking technique while we maintain parallelism to the R-Layer implementation. Moreover, we propose an on-the-fly key scheduling technique for further performance improvement. Finally, compared to the existing reference implementations in RISC-V and ARM Cortex-M4 platforms, when 4 plaintext encrypted simultaneously, our software achieved performance of 229% and 370%, respectively.

Design and Evaluation of Countermeasures Against Fault Injection Attacks and Power Side-Channel Leakage Exploration for AES Block Cipher

Differential Fault Analysis (DFA) and Power Analysis (PA) attacks, have become the main methods for exploiting the vulnerabilities of physical implementations of block ciphers, currently used in a multitude of applications, such as the Advanced Encryption Standard (AES). In order to minimize these types of vulnerabilities, several mechanisms have been proposed to detect fault attacks. However, these mechanisms can have a significant cost, not fully covering the implementations against fault attacks or not taking into account the leakage of the information exploitable by the power analysis attacks. In this paper, four different approaches are proposed with the aim of protecting the AES block cipher against DFA. The proposed solutions are based on Hamming code and parity bits as signature generators for the internal state of the AES cipher. These allow to detect DFA exploitable faults, from bit to byte level. The proposed solutions have been applied to a T-box based AES block cipher implemented on Field Programmable Gate Array (FPGA). Experimental results suggest a fault coverage of 98.5% and 99.99% with an area penalty of 9% and 36% respectively, for the parity bit signature generators and a fault coverage of 100% with an area penalty of 18% and 42% respectively when Hamming code signature generator is used. In addition, none of the proposed countermeasures impose a frequency degradation, in respect to the unprotected cipher. The proposed work goes further in the evaluation of the proposed DFA countermeasures by evaluating the impact of these structures in terms of power side-channel. The obtained results suggest that no extra information leakage is produced that can be exploited by PA. Overall, the proposed DFA countermeasures provide a high fault coverage protection with a low cost in terms of area and power consumption and no PA security degradation.

WBMatrix: An Optimized Matrix Library for White-Box Block Cipher Implementations

White-box block cipher (WBC) has been proposed by Chow \textit{et al.} to prevent the secret key to be extracted from its implementation in an untrusted context. A pivotal technique behind WBC is to convert the iterated round functions into a series of look-up tables (LUTs) with encodings. The construction of encoded LUTs consists of matrix operations, such as multiplication and inversion. The widely-used matrix libraries in applications, such as open-source NTL and M4RI, are primarily designed for large dimensional matrix operations. Therefore, they might not be suitable for WBC implementations which are mainly based on small-scale matrices and vectors. In this paper, we propose a new matrix library named WBMatrix for the optimization of WBC implementations. WBMatrix reduces the operating steps of multiplication and simultaneously generates pairwise invertible matrices as encodings. The performance comparison supports that WBMatrix improves the table construction and encryption phases on Intel x86 and ARMv8 platforms. Moreover, WBMatrix also boosts the initialization and encryption phases of LowMC/LowMC-M block ciphers and enhances the performance for the generation of key-dependent Sbox.

A survey on software implementation of lightweight block ciphers for IoT devices

A survey on software implementation of lightweight block ciphers for IoT devices

GPU accelerated 3DES encryption

AbstractTriple DES (3DES) is a NIST and ISO/IEC standard block cipher that is also used in some web browsers and several electronic payment applications. We propose an optimized bit‐level parallelization of 3DES for GPU accelerated encryption to allow processing high volumes of data. Since the block size of 3DES is 64 bits, our approach considers a kernel block as a 64‐bit 3DES block. Each kernel block performs XOR, permutation, and S‐box operations of this cipher in parallel and memory accesses are optimized by the use of constant and shared memory. Although table based and bitsliced implementations of block ciphers on GPUs outperform naive implementations, their performance vary significantly on different GPU models and architectures. Lack of publicly available source codes prohibit a fair comparison of the performance results for different implementations. In this work, we provide performance results on various GPU models and make our implementation publicly available for reproducibility and further comparisons. When compared against the baseline multi‐threaded CPU implementation, our optimization achieves an average of 15.95 speed‐up when encrypting large files using an RTX 2070 Super GPU. Moreover, when modified into a key search attack, more than 94.4 million 3DES key searches per second can be conducted on an RTX 2070 Super GPU.

Countermeasures against Static Power Attacks

In recent years it has been demonstrated convincingly that the standby power of a CMOS chip reveals information about the internally stored and processed data. Thus, for adversaries who seek to extract secrets from cryptographic devices via side-channel analysis, the static power has become an attractive quantity to obtain. Most works have focused on the destructive side of this subject by demonstrating attacks. In this work, we examine potential solutions to protect circuits from silently leaking sensitive information during idle times. We focus on countermeasures that can be implemented using any common digital standard cell library and do not consider solutions that require full-custom or analog design flow. In particular, we evaluate and compare a set of five distinct standard-cell-based hiding countermeasures, including both, randomization and equalization techniques. We then combine the hiding countermeasures with state-of-the-art hardware masking in order to amplify the noise level and achieve a high resistance against attacks. An important part of our contribution is the proposal and evaluation of the first ever standard-cell-based balancing scheme which achieves perfect data-independence on paper, i.e., in absence of intra-die process variations and aging effects. We call our new countermeasure Exhaustive Logic Balancing (ELB). While this scheme, applied to a threshold implementation, provides the highest level of resistance in our experiments, it may not be the most cost effective option due to the significant resource overhead associated. All evaluated countermeasures and combinations thereof are applied to a serialized hardware implementation of the PRESENT block cipher and realized as cryptographic co-processors on a 28nm CMOS ASIC prototype. Our experimental results are obtained through real-silicon measurements of a fabricated die of the ASIC in a temperature-controlled environment using a source measure unit (SMU). We believe that our elaborate comparison serves as a useful guideline for hardware designers to find a proper tradeoff between security and cost for almost any application.

Design Space Exploration for High-Speed Implementation of the MISTY1 Block Cipher

This paper proposes 2 × unrolled high-speed architectures of the MISTY1 block cipher for wireless applications including sensor networks and image encryption. Design space exploration is carried out for 8-round MISTY1 utilizing dual-edge trigger (DET) and single-edge trigger (SET) pipelines to analyze the tradeoff w.r.t. speed/area. The design is primarily based on the optimized implementation of lookup tables (LUTs) for MISTY1 and its core transformation functions. The LUTs are designed by logically formulating S9/S7 s-boxes and FI and {FO + 32-bit XOR} functions with the fine placement of pipelines. Highly efficient and high-speed MISTY1 architectures are thus obtained and implemented on the field-programmable gate array (FPGA), Virtex-7, XC7VX690T. The high-speed/very high-speed MISTY1 architectures acquire throughput values of 25.2/43 Gbps covering an area of 1331/1509 CLB slices, respectively. The proposed MISTY1 architecture outperforms all previous MISTY1 implementations indicating high speed with low area achieving high efficiency value. The proposed architecture had higher efficiency values than the existing AES and Camellia architectures. This signifies the optimizations made for proposed high-speed MISTY1 architectures.

Power analysis attack resilient block cipher implementation based on 1‐of‐4 data encoding

Side-channel attacks pose an inevitable challenge to the implementation of cryptographic algorithms, and it is important to mitigate them. This work identifies a novel data encoding technique based on 1-of-4 codes to resist differential power analysis attacks, which is the most investigated category of side-channel attacks. The four code words of the 1-of-4 codes, namely (0001, 0010, 1000, and 0100), are split into two sets: set-0 and set-1. Using a select signal, the data processed in hardware is switched between the two encoding sets alternately such that the Hamming weight and Hamming distance are equalized. As a case study, the proposed technique is validated for the NIST standard AES-128 cipher. The proposed technique resists differential power analysis performed using statistical methods, namely correlation, mutual information, difference of means, and Welch's t-test based on the Hamming weight and distance models. The experimental results show that the proposed countermeasure has an area overhead of 2.3× with no performance degradation comparatively.

Design and implementation of Threefish cipher algorithm in PNG file

This paper is presenting design and implementation of Threefish block cipher on grayscale images. Despite the fact that Threefish block cipher is one of the best secure algorithms, most studies concerning Threefish have focused on hardware implementation and have not commonly been applied on image encryption due to huge amount of data. The main contribution here was to reduce the time and the amount of data to be encrypted while maintaining encryption performance. This objective was achieved by encrypting just the most significant bits of image pixels. A 256-bit plain text blocks of the Threefish was constructed from 2n most significant bits of the pixels, where 0<n<3. Furthermore, Threefish block cipher was applied when n=3 to analyze the impact of uninvolving some bits in encryption process on the encryption performance. The results indicated that the encryption achieved good encryption quality when n=1, but it might cause some loss in decryption. In contrast, the encryption achieved high encryption quality when n=2, almost as good as the encryption of the whole pixel bits. Furthermore, the encryption time and the amount of data to be encrypted were decreased 50% as n decreased by 1. It was concluded that encrypting half of the pixel bits reduces both time and data, as well as significantly preserves the encryption quality. Finally, although the proposed method passed the statistical analysis, further work is needed to find a method resistant to the differential analysis.

Efficient Implementation of PRESENT and GIFT on Quantum Computers

Grover search algorithm is the most representative quantum attack method that threatens the security of symmetric key cryptography. If the Grover search algorithm is applied to symmetric key cryptography, the security level of target symmetric key cryptography can be lowered from n-bit to n2-bit. When applying Grover’s search algorithm to the block cipher that is the target of potential quantum attacks, the target block cipher must be implemented as quantum circuits. Starting with the AES block cipher, a number of works have been conducted to optimize and implement target block ciphers into quantum circuits. Recently, many studies have been published to implement lightweight block ciphers as quantum circuits. In this paper, we present optimal quantum circuit designs of symmetric key cryptography, including PRESENT and GIFT block ciphers. The proposed method optimized PRESENT and GIFT block ciphers by minimizing qubits, quantum gates, and circuit depth. We compare proposed PRESENT and GIFT quantum circuits with other results of lightweight block cipher implementations in quantum circuits. Finally, quantum resources of PRESENT and GIFT block ciphers required for the oracle of the Grover search algorithm were estimated.

Secure HIGHT Implementation on ARM Processors

Secure and compact designs of HIGHT block cipher on representative ARM microcontrollers are presented in this paper. We present several optimizations for implementations of the HIGHT block cipher, which exploit different parallel approaches, including task parallelism and data parallelism methods, for high-speed and high-throughput implementations. For the efficient parallel implementation of the HIGHT block cipher, the SIMD instructions of ARM architecture are fully utilized. These instructions support four-way 8-bit operations in the parallel way. The length of primitive operations in the HIGHT block cipher is 8-bit-wise in addition–rotation–exclusive-or operations. In the 32-bit word architecture (i.e., the 32-bit ARM architecture), four 8-bit operations are executed at once with the four-way SIMD instruction. By exploiting the SIMD instruction, three parallel HIGHT implementations are presented, including task-parallel, data-parallel, and task/data-parallel implementations. In terms of the secure implementation, we present a fault injection countermeasure for 32-bit ARM microcontrollers. The implementation ensures the fault detection through the representation of intra-instruction redundancy for the data format. In particular, we proposed two fault detection implementations by using parallel implementations. The two-way task/data-parallel based implementation is secure against fault injection models, including chosen bit pair, random bit, and random byte. The alternative four-way data-parallel-based implementation ensures all security features of the aforementioned secure implementations. Moreover, the instruction skip model is also prevented. The implementation of the HIGHT block cipher is further improved by using the constant value of the counter mode of operation. In particular, the 32-bit nonce value is pre-computed and the intermediate result is directly utilized. Finally, the optimized implementation achieved faster execution timing and security features toward the fault attack than previous works.

Compact Implementation of ARIA on 16-Bit MSP430 and 32-Bit ARM Cortex-M3 Microcontrollers

In this paper, we propose the first ARIA block cipher on both MSP430 and Advanced RISC Machines (ARM) microcontrollers. To achieve the optimized ARIA implementation on target embedded processors, core operations of ARIA, such as substitute and diffusion layers, are carefully re-designed for both MSP430 (Texas Instruments, Dallas, TX, USA) and ARM Cortex-M3 microcontrollers (STMicroelectronics, Geneva, Switzerland). In particular, two bytes of input data in ARIA block cipher are concatenated to re-construct the 16-bit wise word. The 16-bit word-wise operation is executed at once with the 16-bit instruction to improve the performance for the 16-bit MSP430 microcontroller. This approach also optimizes the number of required registers, memory accesses, and operations to half numbers rather than 8-bit word wise implementations. For the ARM Cortex-M3 microcontroller, the 8×32 look-up table based ARIA block cipher implementation is further optimized with the novel memory access. The memory access is finely scheduled to fully utilize the 3-stage pipeline architecture of ARM Cortex-M3 microcontrollers. Furthermore, the counter (CTR) mode of operation is more optimized through pre-computation techniques than the electronic code book (ECB) mode of operation. Finally, proposed ARIA implementations on both low-end target microcontrollers (MSP430 and ARM Cortex-M3) achieved (209 and 96 for 128-bit security level, respectively), (241 and 111 for 192-bit security level, respectively), and (274 and 126 for 256-bit security level, respectively). Compared with previous works, the running timing on low-end target microcontrollers (MSP430 and ARM Cortex-M3) is improved by (92.20% and 10.09% for 128-bit security level, respectively), (92.26% and 10.87% for 192-bit security level, respectively), and (92.28% and 10.62% for 256-bit security level, respectively). The proposed ARIA–CTR implementation improved the performance by 6.6% and 4.0% compared to the proposed ARIA–ECB implementations for MSP430 and ARM Cortex-M3 microcontrollers, respectively.

Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded Processors

A crypto-ransomware has the process to encrypt victim’s files. Afterward, the crypto-ransomware requests a ransom for the password of encrypted files to victims. In this paper, we present a novel approach to prevent crypto-ransomware by detecting block cipher algorithms for Internet of Things (IoT) platforms. We extract the sequence and frequency characteristics from the opcode of binary files for the 8-bit Alf and Vegard’s RISC (AVR) processor microcontroller. In other words, the late fusion method is used to extract two features from one source data, learn through each network, and integrate them. We classify the crypto-ransomware virus or harmless software through the proposed method. The general software from AVR packages and block cipher implementations written in C language from lightweight block cipher library (i.e., Fair Evaluation of Lightweight Cryptographic Systems (FELICS)) are trained through the deep learning network and evaluated. The general software and block cipher algorithms are successfully classified by training functions in binary files. Furthermore, we detect binary codes that encrypt a file using block ciphers. The detection rate is evaluated in terms of F-measure, which is the harmonic mean of precision and recall. The proposed method not only achieved 97% detection success rate for crypto-ransomware but also achieved 80% success rate in classification for each lightweight cryptographic algorithm and benign firmware. In addition, the success rate in classification for Substitution-Permutation-Network (SPN) structure, Addition-Rotation-eXclusive-or structures (ARX) structure, and benign firmware is 95%.

Design, analysis, and implementation of a new lightweight block cipher for protecting IoT smart devices

A modified XXTEA “M-XXTEA” symmetric block cipher that has a simple construction compared to the advanced encryption standard (AES) is proposed. It is efficient for protecting limited-resource devices such as IoT smart devices. The M-XXTEA will be able to achieve confidentiality during transmission of data over the internet. Since the original XXTEA was vulnerable against key-related and chosen-plaintext attacks. Therefore, this paper introduces a new and robust version of the original XXTEA by employing an improved S-box to enhance security to overcome such types of attacks. Besides, the M-XXTEA is coupled with a chaotic key generator system adding a layer of security achieving the idea behind the one-time pad. The cipher keys are dynamically changing for each block of plaintext when encrypted. Thus, it provides a more robust security mechanism than the original XXTEA and the AES. Besides enhancing data security, the M-XXTEA can function with different sizes of text blocks and with different key sizes. Several experiments are implemented to compare the performance of the M-XXTEA with the original XXTEA and with the AES. Results show that the M-XXTEA encryption and decryption time efficiencies outperform AES by 60%. Besides, the M-XXTEA achieves speed efficiency 57% better than the AES. It can be used efficiently for protecting IoT smart devices in the industry, and e-health systems, and smart cities.

Diffusional Side-Channel Leakage From Unrolled Lightweight Block Ciphers: A Case Study of Power Analysis on PRINCE

This study investigates a new side-channel leakage observed in the inner rounds of an unrolled hardware implementation of block ciphers in a chosen-input attack scenario. The side-channel leakage occurs in the first round and it can be observed in the later inner rounds because it arises from path activation bias caused by the difference between two consecutive inputs. Therefore, a new attack that exploits the leakage is possible even for unrolled implementations equipped with countermeasures (masking and/or deglitchers that separate the circuit in terms of glitch propagation) in the round involving the leakage. We validate the existence of such a unique side-channel leakage through a set of experiments with a fully unrolled PRINCE cipher hardware, implemented on a field-programmable gate array (FPGA). In addition, we verify the validity and evaluate the hardware cost of a countermeasure for the unrolled implementation, namely the Threshold Implementation (TI) countermeasure.