Implementation Of S-box Research Articles

Reliable advanced encryption standard hardware implementation: 32- bit and 64-bit data-paths

Cryptographic primitives are extensively used in today's applications to provide the desired security. Malicious or accidental faults that occur in the hardware implementations of cryptographic primitives, specifically in this paper the Advanced Encryption Standard (AES), can result in an erroneous output of encryption/decryption process and reduce the reliability of the cryptographic hardware. The use of a suitable fault-tolerant scheme for AES, to recover it from failures or attacks and bring it back to an operational state, is crucial for reliability, and consequently for security purposes. In this paper, two novel online fault-tolerant schemes are proposed for AES. In the proposed fault-tolerant architecture, the round path is modified and divided it into two pipeline stages. The proposed fault-tolerant schemes are based on a combination of hardware and time redundancies, where a new hardware redundancy is proposed for the AES round function and a time redundancy for the hardware of the AES key expansion unit. The presented fault-tolerant schemes are valid for all versions of AES and are independent of its S-box implementation manner. Both ASIC and FPGA implementations of the original and the proposed fault-tolerant AES along with Full TMR (Triple Modular Redundancy) and Full TTR (Triple Time Redundancy) structures are reported as traditional fault-tolerant schemes. It is shown that the first proposed fault-tolerant architecture, named TMRrp&TTRke32, outperforms these approaches and the previous report in the literature in terms of area overhead and therefore power consumption. Also, the other approach, named TMRrp&TTRke64, is better than the other approaches in achieving a trade-off between area overhead and throughput overhead.

New Low-Area Designs for the AES Forward, Inverse and Combined S-Boxes

The implementation of AES S-boxes is one of the most extensively studied areas of cryptography. In this paper, we propose three new hardware designs for the AES S-box that can serve in the forward, inverse and combined data paths. Each of these designs represents the smallest AES S-box ever proposed in its respective category. We achieve this goal by using new tower field representation over normal bases and optimizing each and every block inside the three proposed architectures. Our complexity analysis and ASIC synthesis results in the CMOS STM 65 nm, as well as the NanGate 15 nm technologies, show that our designs outperform their counterparts in terms of area and power.

Side-channel attack-resistant AES S-box with hidden subfield inversion and glitch-free masking

A side-channel attack (SCA)-resistant AES S-box implementation is proposed, which is an improvement from the power-aware hiding (PAH) S-box but with higher security and a smaller area. We use the composite field approach and apply the PAH method to the inversion in the nonlinear kernel and a masking method to the other parts. In addition, a delay-matched enable control technique is used to suppress glitches in the masked parts. The evaluation results show that its area is contracted to 63.3% of the full PAH S-box, and its power-delay product is much lower than that of the masking implementation. The leakage assessment using simulation power traces concludes that it has no detectable leakage under t-test and that it at least can thwart the moment-correlation analysis using 665 000 noiseless traces.

Hardware Performance Evaluation of Authenticated Encryption SAEAES with Threshold Implementation

SAEAES is the authenticated encryption algorithm instantiated by combining the SAEB mode of operation with AES, and a candidate of the NIST’s lightweight cryptography competition. Using AES gives the advantage of backward compatibility with the existing accelerators and coprocessors that the industry has invested in so far. Still, the newer lightweight block cipher (e.g., GIFT) outperforms AES in compact implementation, especially with the side-channel attack countermeasure such as threshold implementation. This paper aims to implement the first threshold implementation of SAEAES and evaluate the cost we are trading with the backward compatibility. We design a new circuit architecture using the column-oriented serialization based on the recent 3-share and uniform threshold implementation (TI) of the AES S-box based on the generalized changing of the guards. Our design uses 18,288 GE with AES’s occupation reaching 97% of the total area. Meanwhile, the circuit area is roughly three times the conventional SAEB-GIFT implementation (6229 GE) because of a large memory size needed for the AES’s non-linear key schedule and the extended states for satisfying uniformity in TI.

Improvement of Radio Frequency Identification Security Using New Hybrid Advanced Encryption Standard Substitution Box by Chaotic Maps

Radio Frequency Identification (RFID) technology is widely utilized by businesses, organizations and wireless communication systems. RFID technology is secured using different ways of data encryption, e.g., Advanced Encryption Standard (AES). The Substitution Box (S-Box) is the core of AES. In this paper, a new algorithm is proposed to generate a modified S-Box with new keys, specifically a key and plaintext-dependent S-Box using an improved RC4 encryption algorithm with Logistic Chaotic Maps (LCM). The strength of the proposed S-Box is tested throughout the paper, and compared against the state-of-the-art S-Box implementations, namely, the static S-Box, dynamic S-box, KSA and PRGA S-Box, and RC4 S-Boxes with Henon chaotic maps. The comparison between the state-of-the-art S-Boxes and the proposed S-Box demonstrates that the use of the Logistic Chaotic Map increases the security of the S-Box and makes the differential and linear cryptography more sturdy. In particular, using the strict avalanche test, we demonstrate that the proposed S-Box improves the security by achieving a cipher text bit-flip ratio of 0.4765, which is closer to 0.5 (where half the bits are flipped), while maintaining a minimum elapsed time of 19 milliseconds for encryption and decryption.

S-Box Implementation for Security Algorithms in IOT

Internet of Things (IoT) is dominant technology for real time applications because it is integrated with various sensors, software and hardware. Security is the primary concern for IoT because of many ways of threats from different components. Typical encryption algorithms have less complexity and easy to decrypt thereby requiring highcomplexity security algorithm. The improved security algorithm must be less in size and power hence compatible to IoT based applications. This paper is used an Elliptic Curve Cryptography (ECC) to generate Substitution box (S-box) hence proposing 128-bit block cipher based on feistel network.

Low AND Depth and Efficient Inverses: a Guide on S-boxes for Low-latency Masking

In this work, we perform an extensive investigation and construct a portfolio of S-boxes suitable for secure lightweight implementations, which aligns well with the ongoing NIST Lightweight Cryptography competition. In particular, we target good functional properties on the one hand and efficient implementations in terms of AND depth and AND gate complexity on the other. Moreover, we also consider the implementation of the inverse S-box and the possibility for it to share resources with the forward S-box. We take our exploration beyond the conventional small (and even) S-box sizes. Our investigation is twofold: (1) we note that implementations of existing S-boxes are not optimized for the criteria which define masking complexity (AND depth and AND gate complexity) and improve a tool published at FSE 2016 by Stoffelen in order to fill this gap. (2) We search for new S-box designs which take these implementation properties into account from the start. We perform a systematic search based on the properties of not only the S-box but also its inverse as well as an exploration of larger S-box sizes using length-doubling structures. The result of our investigation is not only a wide selection of very good S-boxes, but we also provide complete descriptions of their circuits, enabling their integration into future work.

Spin Me Right Round Rotational Symmetry for FPGA-Specific AES: Extended Version

The effort in reducing the area of AES implementations has largely been focused on application-specific integrated circuits (ASICs) in which a tower field construction leads to a small design of the AES S-box. In contrast, a naive implementation of the AES S-box has been the status-quo on field-programmable gate arrays (FPGAs). A similar discrepancy holds for masking schemes—a well-known side-channel analysis countermeasure—which are commonly optimized to achieve minimal area in ASICs. In this paper, we demonstrate a representation of the AES S-box exploiting rotational symmetry which leads to a 50% reduction in the area footprint on FPGA devices. We present new AES implementations which improve on the state-of-the-art and explore various trade-offs between area and latency. For instance, at the cost of increasing 4.5 times the latency, one of our design variants requires 25% less look-up tables (LUTs) than the smallest known AES on Xilinx FPGAs by Sasdrich and Güneysu at ASAP 2016. We further explore the protection of such implementations against side-channel attacks. We introduce a generic methodology for masking any n-bit Boolean functions of degree t with protection order d. The methodology is exact for first-order and heuristic for higher orders. Its application to our new construction of the AES S-box allows us to improve previous results and introduce the smallest first-order masked AES implementation on Xilinx FPGAs, to date.

Revisiting AES SBox Composite Field Implementations for FPGAs

Composite fields are used for implementing the advanced encryption standard (AES) SBox when compact and side-channel resistant constructions are required. The prior art has investigated efficient implementations of such SBoxes for application specific integrated circuit (ASIC) platforms. On field programmable gate arrays (FPGAs); however, due to the considerably different structure compared with ASICs, these implementations perform poorly. In this letter, we revisit composite field AES SBox implementations for FPGAs. We show how design choices and optimizations can be made to better suit the granular look-up tables that are present in modern FPGAs. We investigate 2880 SBox constructions and show that about half of them are better than the state-of-the-art composite field implementation. Our best SBox implementation is 18% smaller compared with the state-of-the-art implementation on an FPGA.

PEIGEN – a Platform for Evaluation, Implementation, and Generation of S-boxes

In this paper, a platform named PEIGEN is presented to evaluate security, find efficient software/hardware implementations, and generate cryptographic S-boxes. Continuously developed for decades, S-boxes are constantly evolving in terms of the design criteria for both security requirements and software/hardware performances. PEIGEN is aimed to be a platform covering a comprehensive check-list of design criteria of S-boxes appearing in the literature. To do so, the security requirements are first intensively surveyed, existing tools of S-boxes are then comprehensively compared, and finally our platform PEIGEN is presented. The survey part is aimed to be a systematic reference for the theoretical study of S-boxes. The platform is aimed to be an assistant tool for the experimental study and practical use of S-boxes. PEIGEN not only integrates most of the features in existing tools, but also equips with functionalities to evaluate new security-related properties, improves the efficiency of the search algorithms for optimized implementations in several aspects. With the help of this powerful platform, many interesting observations are made in-between the security notations, as well as on the S-boxes used in the existing symmetrickey cryptographic primitives. PEIGEN will become an open platform and welcomes contributions from all parties to help the community to facilitate the research and use of S-boxes.

3-Share Threshold Implementation of AES S-box without Fresh Randomness

Threshold implementation is studied as a countermeasure against sidechannel attack. There had been no threshold implementation for the AES and Keccak S-boxes that satisfies an important property called uniformity. In the conventional implementations, intermediate values are remasked to compensate for the lack of uniformity. The remasking consumes thousands of fresh random bits and its implementation cost is a serious concern. Daemen recently proposed a 3-share uniform threshold implementation of the Keccak S-box. This is enabled by a new technique called the changing of the guards which can be applied to any invertible functions. Subsequently, Wegener et al. proposed a 4-share threshold implementation of the AES S-box based on the changing of the guards technique. However, a 3-share threshold implementation of AES S-box remains open. The difficulty stays in 2-input multiplication, used in decomposed S-box representations, which is non-invertible because of different input and output sizes. In this study, this problem is addressed by introducing a certain generalization of the changing of the guards technique. The proposed method provides a generic way to construct a uniform sharing for a target function having different input and output sizes. The key idea is to transform a target function into an invertible one by adding additional inputs and outputs. Based on the proposed technique, the first 3-share threshold implementation of AES S-box without fresh randomness is presented. Performance evaluation and simulation-based leakage assessment of the implementation are also presented.

CASCA

Implementing a cryptographic circuit poses challenges not always acknowledged in the backing mathematical theory. One of them is the vulnerability against side-channel attacks . A side-channel attack is a procedure that uses information leaked by the circuit through, for example, its own power consumption or electromagnetic emissions, to derive sensitive data (e.g, the secret key used for encryption). Nowadays, we design circuitry to keep this sensitive information from leaking (i.e., a countermeasure ), but the path from specification down to implementation is far from being fully automatic. As we know, manual refinement steps can be error prone and the sheer potential of these errors can be devastating in a scenario such as the one we are dealing with. In this article, we investigate whether a single embedded domain specific language (EDSL) can, at the same time, help us in specifying and enforcing the functionality of the circuit as well as its protection against side-channel attacks. The EDSL is a fundamental block of an original design flow (named Countermeasure Against Side-Channel Attacks, i.e., CASCA) whose aim is to complement an existing industrial scenario and to provide the necessary guarantee that a secure primitive is not vulnerable up to a first-order attack. As a practical case study, we will show how we applied the proposed tools to ensure both functional and extra-functional correctness of a composite-field Advanced Encryption Standard (AES) S-Box. To ensure the reproducibility of this research, this article is accompanied by an open source release of the EDSL 1 that contains the presented S-Box implementation and an additional 3-Shares threshold implementation of the Keccak χ function [7].

Dynamic S-box implementation in PRESENT Cipher

Dynamic S-box implementation in PRESENT Cipher

Spin Me Right Round Rotational Symmetry for FPGA-Specific AES

The effort in reducing the area of AES implementations has largely been focused on Application-Specific Integrated Circuits (ASICs) in which a tower field construction leads to a small design of the AES S-box. In contrast, a naïve implementation of the AES S-box has been the status-quo on Field-Programmable Gate Arrays (FPGAs). A similar discrepancy holds for masking schemes – a wellknown side-channel analysis countermeasure – which are commonly optimized to achieve minimal area in ASICs.In this paper we demonstrate a representation of the AES S-box exploiting rotational symmetry which leads to a 50% reduction of the area footprint on FPGA devices. We present new AES implementations which improve on the state of the art and explore various trade-offs between area and latency. For instance, at the cost of increasing 4.5 times the latency, one of our design variants requires 25% less look-up tables (LUTs) than the smallest known AES on Xilinx FPGAs by Sasdrich and Güneysu at ASAP 2016. We further explore the protection of such implementations against first-order side-channel analysis attacks. Targeting the small area footprint on FPGAs, we introduce a heuristic-based algorithm to find a masking of a given function with d + 1 shares. Its application to our new construction of the AES S-box allows us to introduce the smallest masked AES implementation on Xilinx FPGAs, to-date.

Smashing the Implementation Records of AES S-box

Canright S-box has been known as the most compact S-box design since its introduction back in CHES’05. Boyar-Peralta proposed logic-minimization heuristics that could reduce the gate count of Canright S-box from 120 gates to 113 gates, however synthesis results did not reflect much improvement. In CHES’15, Ueno et al. proposed an S-box that has a slightly higher area, but significantly faster than the previous designs, hence it was the most efficient (measured by area×delay) S-box implementation to date. In this paper, we propose two new designs for the AES S-box. One design has a smaller implementation area than both Canright and the 113-gate S-boxes. Hence, our first design is the smallest AES S-box to date, breaking the 13 years implementation record of Canright. The second design is faster and smaller than the Ueno S-box. Hence, our second design is both the fastest and the most efficient S-box design to date. While doing so, we also propose new logicminimization heuristics that outperform the previous algorithms of Boyar-Peralta. Finally, we conduct an exhaustive evaluation of each and every block in the S-box circuit, using both structural and behavioral HDL modeling, to reach the optimum synergy between theoretical algorithms and technology-supported optimization tools. We show that involving the technology-supported CAD tools in the analysis results in several counter-intuitive results.

Timing Attack and Countermeasure on NEMS Relay Based Design of Block Ciphers

Scaling down CMOS technology results in excessive power dissipation issues. Nanoelectromechanical System (NEMS) relay technology is an alternative emerging solution that overcomes the power dissipation limitation of CMOS technology. However, despite its zero static leakage, NEMS relay technology suffers from large delay compared to CMOS technology. Binary Decision Diagram (BDD) based implementations of NEMS relay design targets minimizing the total delay. However, this implementation renders the timing delay of the output of a BDD input-dependent, which is a threat to security-critical applications, such as ciphers. In this paper, we analyze the impact of the input-dependent timing variation on the security of NEMS relay based cipher implementations. We present a generalized timing attack methodology, which is applicable to both Substitution Permutation Network (SPN) as well as Feistel block ciphers. We provide case studies on state-of-the-art SPN cipher candidate Advanced Encryption Standard (AES) and Feistel cipher candidates Camellia and DES. Our attack analysis shows that compact designs with single S-box implementation can be compromised, while parallel S-box implementations possess an inherent resistance against timing attacks. We also propose a cost-effective countermeasure which eliminates the input-dependent timing variation and thwarts all such timing attacks on BDD based implementations of NEMS relay design.

Design of Low Power and Secure Implementation of SBox and Inverse-SBox for AES

Design of Low Power and Secure Implementation of SBox and Inverse-SBox for AES

Optimization of Area and Delay for Implementation of the Composite Field Advanced Encryption Standard S-Box

Among different implementations of the Advanced Encryption Standard (AES) S-box, the implementation based on composite field arithmetic (CFA) has the smallest size. In this study, to eliminate the redundant gates in the implementation of CFA-based S-box, a new optimization algorithm named common subexpression elimination (CSE)–shortest critical path constructing (SCPC) algorithm is proposed. The CSE–SCPC algorithm combines an efficient CSE technology with the SCPC method, therefore not only area cost but also the delays are taken into account in the optimization process. For facilitating the search of common subexpressions (CSs), the main operation of CFA-based S-box — the multiplicative inverses (MI) over galois field (GF)((2[Formula: see text] — is divided into six parts and each part is expressed by logical expressions directly. Furthermore, the parts with same input are classified into the same group, as there are CSs among them. Each part of the S-box is optimized by the CSE–SCPC algorithm. For the MI over GF((2[Formula: see text], both the CSs in each part and the CSs among the parts are eliminated by the CSE–SCPC algorithm. Compared to the previous works, our design has not only the minimal area cost but also the shorter critical path in both theoretical computing evaluation and experimental evaluation.

Design and Implementation of Low Power AES SBOX with Error Detection Circuit

Design and Implementation of Low Power AES SBOX with Error Detection Circuit

Mutual Information Analysis for Three-Phase Dynamic Current Mode Logic against Side-Channel Attack

To date, many different kinds of logic styles for hardware countermeasures have been developed; for example, SABL, TDPL, and DyCML. Current mode-based logic styles are useful as they consume less power compared to voltage mode-based logic styles such as SABL and TDPL. Although we developed TPDyCML in 2012 and presented it at the WISA 2012 conference, we have further optimized it in this paper using a binary decision diagram algorithm and confirmed its properties through a practical implementation of the AES S-box. In this paper, we will explain the outcome of HSPICE simulations, which included correlation power attacks, on AES S-boxes configured using a compact NMOS tree constructed from either SABL, CMOS, TDPL, DyCML, or TPDyCML. In addition, to compare the performance of each logic style in greater detail, we will carry out a mutual information analysis (MIA). Our results confirm that our logic style has good properties as a hardware countermeasure and 15% less information leakage than those secure logic styles used in our MIA.