Cipher Implementations Research Articles

Side-Channel Linearization Attack on Unrolled Trivium Hardware

This paper presents a new side-channel attack (SCA) on unrolled implementations of stream ciphers, with a particular focus on Trivium. Most conventional SCAs predominantly concentrate on leakage of some first rounds prior to the sufficient diffusion of the secret key and initial vector (IV). However, recently, unrolled hardware implementation has become common and practical, which achieves higher throughput and energy efficiency compared to a round-based hardware. The applicability of conventional SCAs to such unrolled hardware is unclear because the leakage of the first rounds from unrolled hardware is hardly observed. In this paper, focusing on Trivium, we propose a novel SCA on unrolled stream cipher hardware, which can exploit leakage of rounds latter than 80, while existing SCAs exploited intermediate values earlier than 80 rounds. We first analyze the algebraic equations representing the intermediate values of these rounds and present the recursive restricted linear decomposition (RRLD) strategy. This approach uses correlation power analysis (CPA) to estimate the intermediate values of latter rounds. Furthermore, we present a chosen-IV strategy for a successful key recovery through linearization. We experimentally demonstrate that the proposed SCA achieves the key recovery of a 288-round unrolled Trivium hardware implementation using 360,000 traces. Finally, we evaluate the performance of unrolled Trivium hardware implementations to clarify the trade-off between performance and SCA (in)security. The proposed SCA requires 34.5 M traces for a key recovery of 384-round unrolled Trivium implementation and is not applicable to 576-round unrolled hardware.

An efficient quantum circuit implementation of ZUC-128 cipher with low T-depth

An efficient quantum circuit implementation of ZUC-128 cipher with low T-depth

Analog In-memory Circuit Design of Polynomial Multiplication for Lattice Cipher Acceleration Application

As the core operation of lattice cipher, large-scale polynomial multiplication is the biggest computational bottleneck in its realization process. How to quickly calculate polynomial multiplication under resource constraints has become an urgent problem to be solved in the hardware implementation of lattice ciphers. Therefore, an analog in-memory circuit for fast polynomial multiplication calculation is proposed. First, an in-memory computing circuit for Discrete Fourier Transform and Inverse Discrete Fourier Transform based on memristor array is designed. On this basis, a fully analog circuit that can realize polynomial multiplication in one step is designed. Compared with traditional hardware implementation, the in-memory calculation method used in this article decreases the calculation time of polynomial multiplication to the microsecond level, which greatly improves the speed of lattice cipher encryption and decryption. For the specific examples in this article, PSPICE simulation shows that the average accuracy of the calculation result is above 99.90%.

Cipher key instructions in early modern Europe: analysis and text edition

We present an overview of instructions for the use of European historical cipher keys in early modern times. We describe the structure of instructions and the content presented to the key users. We exemplify various key instruction types and give a text edition of typical examples in various languages. The study is based on the analysis of more than 1,600 cipher keys collected from archives and libraries in ten European countries. We examine the practical implementation of cipher keys to the extent that instructions offer insights into everyday cryptographic practices. We focus on the typical rules scribes were expected to adhere to and the common errors they were instructed to avoid. We aim to reconstruct the apprehensions and considerations of the authors of cipher keys: They sought to offer assistance to users while likely harboring concerns regarding the potential misuse of their intellectual product. Given the secretive nature of cryptology, the documentation of knowledge transfer is scarce. In addition to the detailed manuals authored by well-known cryptologists, anonymous cipher key instructions offer valuable insights into this knowledge transfer process. By studying these instructions, historians gain direct access to a realm of knowledge that would otherwise remain hidden from their view.

Design, Implementation and Analysis of HIBRI Cipher on IoT Platforms

Design, Implementation and Analysis of HIBRI Cipher on IoT Platforms

Semi-Permanent Stuck-At Fault injection attacks on Elephant and GIFT lightweight ciphers

Fault attacks pose a potent threat to modern cryptographic implementations, particularly those used in physically approachable embedded devices in IoT environments. Information security in such resource-constrained devices is ensured using lightweight ciphers, where combinational circuit implementations of SBox are preferable over look-up tables (LUT) as they are more efficient regarding area, power, and memory requirements. Most existing fault analysis techniques focus on fault injection in memory cells and registers. Recently, a novel fault model and analysis technique, namely Semi-Permanent Stuck-At (SPSA) fault analysis, has been proposed to evaluate the security of ciphers with combinational circuit implementation of Substitution layer elements, SBox. In this work, we propose optimized techniques to recover the key in a minimum number of ciphertexts in such implementations of lightweight ciphers. Based on the proposed techniques, a key recovery attack on the NIST lightweight cryptography (NIST-LWC) standardization process finalist, Elephant AEAD, has been proposed. The proposed key recovery attack is validated on two versions of Elephant cipher. The proposed fault analysis approach recovered the secret key within 85 − 240 ciphertexts, calculated over 1000 attack instances. To the best of our knowledge, this is the first work on fault analysis attacks on the Elephant scheme. Furthermore, an optimized combinational circuit implementation of Spongent SBox (SBox used in Elephant cipher) is proposed, having a smaller gate count than the optimized implementation reported in the literature. The proposed fault analysis techniques are validated on primary and optimized versions of Spongent SBox through Verilog simulations. Further, we pinpoint SPSA hotspots in the lightweight GIFT cipher SBox architecture. We observe that GIFT SBox exhibits resilience towards the proposed SPSA fault analysis technique under the single fault adversarial model. However, eight SPSA fault patterns reduce the nonlinearity of the SBox to zero, rendering it vulnerable to linear cryptanalysis. Conclusively, SPSA faults may adversely affect the cryptographic properties of an SBox, thereby leading to trivial key recovery. The GIFT cipher is used as an example to focus on two aspects: i) its SBox construction is resilient to the proposed SPSA analysis and therefore characterizing such constructions for SPSA resilience and, ii) an SBox even though resilient to the proposed SPSA analysis, may exhibit vulnerabilities towards other classical analysis techniques when subjected to SPSA faults. Our work reports new vulnerabilities in fault analysis in the combinational circuit implementations of cryptographic protocols.

Securing IoT devices with fast and energy efficient implementation of PRIDE and PRESENT ciphers

The rise of low-power, cost-efficient internet-connected devices has led to a need for lightweight cryptography. The lightweight block cipher PRIDE, designed by Martin R. Albrecht, is one of the most efficient ciphers designed for IoT-constrained environments. It is useful for connected devices, requires fewer resources to implement, and has high performance. PRIDE is a software-oriented lightweight cipher optimized for microcontrollers. This paper focuses on the FPGA implementation of the PRIDE cipher by keeping throughput, energy, and power consumption metrics focused. The paper also presents a novel and simpler diagrammatical view of a Matrix Layer implementation of the PRIDE cipher. We also implemented the PRESENT cipher using the same metrics. We analyzed different design metrics on Field Programmable Gate Arrays (FPGAs) and compared the metrics of the PRIDE implementation with the well-known cipher PRESENT. This gives us an insight into the efficiency and reliability of PRIDE in IoT-constrained environments. We also proposed different architectures of the PRIDE cipher for 16-bit and 32-bit datapaths.

Power Attack Vulnerability Assessment of Circuit-Level PRESENT Encryption IP Using Artificial Intelligence Mechanisms

Artificial Intelligence (AI) schemes eliminate the need for intellectual human knowledge of crypto algorithms to facilitate side-channel attacks on security implementations. Side channel attack analysis for circuit-level hardware (VLSI) implementations of symmetric-key block ciphers through artificial machine models are yet to be addressed. The proposed design of block cipher architecture, which is the implementation under attack features, secure adiabatic logic style the Charge Balancing Symmetric Pre-resolve Adiabatic Logic (CBSPAL). This style exhibits uniform power consumption through its inherent circuit arrangement, which makes it robust toward side-channel power attacks. This paper considers several Multilayer Perceptron (MLP) architectures to mount non-profiled side-channel attacks on round 1- PRESENT circuit-level implementation. Supervised learning of the MLP models through training with power waveforms employs binary LSB labeling. An attack on the custom dataset with 50,000 supply power traces collected from the CBSPAL implementation fails to retrieve secret information in any of the 8 bytes. The traditional Correlation Power Attack (CPA) was also not thriving with the proposed implementation. Comparison is made through a similar attack approach on benchmark AES (ASCAD dataset), which distinguishes the secret information throughout all the parameters of interest: normalized accuracy, normalized NMM accuracy and rank plots on byte 3.

FortiFix : A Fault Attack Aware Compiler Framework for Crypto Implementations

Fault attacks are one of the most powerful forms of cryptanalytic attack on embedded systems, that can corrupt cipher’s operations leading to a breach of confidentiality and integrity. A single precisely injected fault during the execution of a cipher can be exploited to retrieve the secret key in a few milliseconds. Naïve countermeasures introduced into implementation can lead to huge overheads, making them unusable in resource-constraint environments. On the other hand, optimized countermeasures requires significant knowledge, not just about the attack, but also on the (a) the cryptographic properties of the cipher, (b) the program structure, and (c) the underlying hardware architecture. This makes the protection against fault attacks tedious and error-prone. In this paper, we introduce the first automated compiler framework named FortiFix that can detect and patch fault exploitable regions in a block cipher implementation. The framework has two phases. The pre-compilation phase identifies regions in the source code of a block cipher that are vulnerable to fault attacks. The second phase is incorporated as transformation passes in the LLVM compiler to find exploitable instructions, quantify the impact of a fault on these instructions, and finally insert appropriate countermeasures based on user defined security requirements. As a proof of concept, we have evaluated two block cipher implementations AES-128 and CLEFIA-128 on three different hardware platforms such as MSP430 (16-bit), ARM (32-bit) and RISCV (32-bit).

NLU-V: A Family of Instruction Set Extensions for Efficient Symmetric Cryptography on RISC-V

Cryptographic primitives nowadays are not only implemented in high-performance systems but also in small-scale systems, which are increasingly powered by open-source processors, such as RISC-V. In this work, we leverage RISC-V’s modular base instruction set and architecture to propose a generic instruction set extension (ISE) for symmetric cryptography. We adapt the work from Engels et al. in ARITH’13, the non-linear/linear instruction set extension (NLU), which presents a generic hardware/software co-design solution for efficient symmetric crypto implementations through a hardware unit extending the 8-bit AVR instruction set. These new instructions realize non-linear and linear layers, which are widely used to implement the block ciphers in symmetric cryptography. Our proposal modifies and extends the NLU instructions to a 32-bit RISC-V architecture; hence, we call the proposed ISE ‘NLU-V’. The proposed architecture is integrated into the open-source RISC-V implementation ‘Icicle’ and synthesized on a Xilinx Kintex-7 XC7K160T FPGA. The area overhead for the proposed NLU-V ISE is 1088 slice registers and 4520 LUTs. As case studies, the PRESENT and AES block ciphers are implemented using the new ISE on RISC-V in assembly. Our evaluation metric to showcase the performance gain, Z ‘time-area-product (TAP)’ (the execution time in clock cycles times code memory consumption), reflects the impact of the proposed family of instructions on the performance of the cipher implementations. The simulations show that the NLU-V achieves 89% gain for PRESENT and 68% gain for AES. Further, the NLU-V requires 44% less lines of code for the PRESENT and 23% less for the AES implementation.

An Improved Implementation of Rip van Winkle Cipher Using Satellite TV Broadcast Transmissions

An Improved Implementation of Rip van Winkle Cipher Using Satellite TV Broadcast Transmissions

Efficient Design for a Hardware Implementation of the LED Block Cipher

Efficient Design for a Hardware Implementation of the LED Block Cipher

On the dynamic reconfigurable implementations of MISTY1 and KASUMI block ciphers.

Novel hardware architectures for dynamic reconfigurable implementation of 64-bit MISTY1 and KASUMI block ciphers are proposed to enhance the performance of cryptographic chips for secure IoT applications. The SRL32 primitive (Reconfigurable Look up Tables-RLUTs) and DPR (Dynamic Partial Reconfiguration) are employed to reconfigure single round MISTY1 / KASUMI algorithms on the run-time. The RLUT based architecture attains dynamic logic functionality without extra hardware resources by internally modifying the LUT contents. The proposed adaptive reconfiguration can be adopted as a productive countermeasure against malicious attacks with the added advantage of less reconfiguration time (RT). On the other hand, the block architecture reconfigures the core hardware by externally uploading the partial bit stream and has significant advantages in terms of low area implementation and power reduction. Implementation was carried out on FPGA, Xilinx Virtex 7. The results showed remarkable results with very low area of 668 / 514 CLB slices consuming 460 / 354 mW for RLUT and DPR architectures respectively. Moreover, the throughput obtained for RLUT architecture was found as 364 Mbps with very less RT of 445 nsec while DPR architecture achieved speed of 176 Mbps with RT of 1.1 msec. The novel architectures outperform the stand-alone existing hardware designs of MISTY1 and KASUMI implementations by adding the dynamic reconfigurability while at the same achieving high performance in terms of area and throughput. Design details of proposed unified architectures and comprehensive analysis is described.

HDLBC: A lightweight block cipher with high diffusion

Both the diffusion property and the area consumption are two important evaluation criteria in the design and implementation of symmetric encryption algorithms. Many AND-Rotation-XOR (AND-RX) block ciphers are usually designed by reducing the diffusion property to minimize the area consumption. On the other hand, these AND-RX block ciphers use multiple round function operations to achieve the enough diffusion property, which always induce more area consumption in their hardware implementation. How to trade off the diffusion property and the area consumption appears to be an interesting task in the design of block cipher. In this paper, HDLBC as a new family of lightweight block cipher (with 64-bit plaintext and 64-bit/128-bit key) for the Internet of Things (IoT) is proposed. More specifically, the HDLBC is designed by using only two F-functions (RA1 and RA2), where the non-linear layer of the F-functions is constructed by the NAND operation that consumes the least area among the non-linear logic operations. To the best of our knowledge, HDLBC cipher requires the minimum number of F-functions to provide the diffusion property, where the F-functions require fewer implementation resources than the F-functions of existing similar encryption algorithms. It illustrates the hardware implementation of HDLBC cipher on SMIC 0.18μm requires only 1248 Gate Equivalents (GEs), its throughput rate is 256 Kbps at 100 KHz. Compared with other encryption algorithms, the implementation performance of HDLBC cipher achieves well-balanced in both the area consumption and diffusion property. Moreover, the security analysis shows that HDLBC cipher has enough security margin against various known attacks, such as differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero correlation cryptanalysis, etc.

Revisiting the Software-Efficient Stream Ciphers RCR-64 and RCR-32

Abstract The synchronous stream ciphers RCR-64 and RCR-32 designed by Sekar, Paul and Preneel are strengthened variants of the ciphers TPy and TPypy (designed by Biham and Seberry), respectively. The RCR ciphers have remained unbroken since they were published in 2007. In this paper, we present arguments that not only support the designers’ security claims but suggest, in general, that the ciphers are secure against several classes of cryptanalytic attacks. We find that the ciphers are best used with 256-bit keys and 384-bit IVs. We also suggest ways to protect software implementations of the RCR ciphers against (cache-)timing and processor flag attacks. Our performance evaluation suggests that the protected implementation of the RCR-64 encrypts long messages at speeds comparable to some of the fastest stream ciphers available today. Consequently, we find that the RCR ciphers may be well suited for PC-based applications in general and streaming audio / video applications in particular. This is the first paper to present a detailed study on the security and performance of the RCR ciphers.

New Second-order Threshold Implementation of Sm4 Block Cipher

New Second-order Threshold Implementation of Sm4 Block Cipher

Cryptanalysis of ARX-based White-box Implementations

At CRYPTO’22, Ranea, Vandersmissen, and Preneel proposed a new way to design white-box implementations of ARX-based ciphers using so-called implicit functions and quadratic-affine encodings. They suggest the Speck block-cipher as an example target.In this work, we describe practical attacks on the construction. For the implementation without one of the external encodings, we describe a simple algebraic key recovery attack. If both external encodings are used (the main scenario suggested by the authors), we propose optimization and inversion attacks, followed by our main result - a multiple-step round decomposition attack and a decomposition-based key recovery attack.Our attacks only use the white-box round functions as oracles and do not rely on their description. We implemented and verified experimentally attacks on white-box instances of Speck-32/64 and Speck-64/128. We conclude that a single ARX-round is too weak to be used as a white-box round.

Hardware Optimizations of Fruit-80 Stream Cipher: Smaller than Grain

Fruit-80, which emerged as an ultra-lightweight stream cipher with 80-bit secret key, is oriented toward resource-constrained devices in the Internet of Things. In this article, we propose area and speed optimization architectures of Fruit-80 on FPGAs. Our implementations include both serial and parallel structure and optimize area, power, speed, and throughput, respectively. The area optimization architecture aims to achieve the most suitable ratio of look-up-tables and flip-flops to fully utilize the reconfigurable unit. It also reuses NFSR and LFSR feedback functions to save resources for high throughput. The speed optimization architecture adopts a hybrid approach for parallelization and reduces the latency of long data paths by pre-generating primary feedback and inserting flip-flops. Besides, we recommend using the round key function to optimize serial or parallel implementations for Fruit-80 and using indexing and shifting methods for different throughput. In conclusion, our results show that the area optimization architecture occupies up to 35 slices on Xilinx Spartan-3 FPGA and 18 slices on Xilinx 7 series FPGA, smaller than that of Grain and other common stream ciphers. The optimal throughput/area ratio of the speed optimization architecture is 7.74 Mbps/slice, better than that of Grain v1, which is 5.98 Mbps/slice. The serial implementation of Fruit-80 with round key function occupies only 75 slices on Spartan-3 FPGA. To the best of our knowledge, the result sets a new record of the minimum area in lightweight cipher implementation on FPGA.

SAND-2: An optimized implementation of lightweight block cipher

The development of ARX-based lightweight block ciphers has been plagued by the difficulty of theoretical security analysis. SAND solves this problem better by obtaining an equivalent representation based on a synthetic S-box. This paper analyzed SAND in terms of diffusivity and found that it can be optimized. SAND has the issue of slow diffusion after the initial plaintext and key are all 0. On the other hand, it takes at least 11 rounds for SAND to reach full diffusion without AddRoundKey. Thus, this paper proposes a high-diffusion architecture SAND-2 to address the above issues. Firstly, issue 1 is solved by replacing the AND operation with a NAND operation and calling the round function dynamically. Then, in order to solve issue 2, P1 and P2 permutations are introduced into G0 and G1, respectively. The full diffusion speed of SAND-2 is 63.7% increased compared to SAND. In addition, the comparison results of hardware indicators show that the hardware resources of SAND-2 are slightly lower, and the throughput is 10% higher than SAND. Finally, the security analysis shows that SAND-2 reaches the upper bound of the resisting differential analysis in fewer rounds.

FaultMeter: Quantitative Fault Attack Assessment of Block Cipher Software

Fault attacks are a potent class of physical attacks that exploit a fault njected during device operation to steal secret keys from a cryptographic device. The success of a fault attack depends intricately on (a) the cryptographic properties of the cipher, (b) the program structure, and (c) the underlying hardware architecture. While there are several tools that automate the process of fault attack evaluation, none of them consider all three influencing aspects.This paper proposes a framework called FaultMeter that builds on the state-of-art by not just identifying fault vulnerable locations in a block cipher software, but also providing a quantification for each vulnerable location. The quantification provides a probability that an injected fault can be successfully exploited. It takes into consideration the cryptographic properties of the cipher, structure of the implementation, and the underlying Instruction Set Architecture’s (ISA) susceptibility to faults. We demonstrate an application of FaultMeter to automatically insert optimal amounts of countermeasures in a program to meet the user’s security requirements while minimizing overheads. We demonstrate the versatility of the FaultMeter framework by evaluating five cipher implementations on multiple hardware platforms, namely, ARM (32 and 64 bit), RISC-V (32 and 64 bit), TI MSP-430 (16-bit) and Intel x86 (64-bit).