Lightweight Block Cipher Research Articles

Comparing the Cost of Protecting Selected Lightweight Block Ciphers against Differential Power Analysis in Low-Cost FPGAs

Lightweight block ciphers are an important topic in the Internet of Things (IoT) since they provide moderate security while requiring fewer resources than the Advanced Encryption Standard (AES). Ongoing cryptographic contests and standardization efforts evaluate lightweight block ciphers on their resistance to power analysis side channel attack (SCA), and the ability to apply countermeasures. While some ciphers have been individually evaluated, a large-scale comparison of resistance to side channel attack and the formulation of absolute and relative costs of implementing countermeasures is difficult, since researchers typically use varied architectures, optimization strategies, technologies, and evaluation techniques. In this research, we leverage the Test Vector Leakage Assessment (TVLA) methodology and the FOBOS SCA framework to compare FPGA implementations of AES, SIMON, SPECK, PRESENT, LED, and TWINE, using a choice of architecture targeted to optimize throughput-to-area (TP/A) ratio and suitable for introducing countermeasures to Differential Power Analysis (DPA). We then apply an equivalent level of protection to the above ciphers using 3-share threshold implementations (TI) and verify the improved resistance to DPA. We find that SIMON has the highest absolute TP/A ratio of protected versions, as well as the lowest relative cost of protection in terms of TP/A ratio. Additionally, PRESENT uses the least energy per bit (E/bit) of all protected implementations, while AES has the lowest relative cost of protection in terms of increased E/bit.

Towards practical white-box lightweight block cipher implementations for IoTs

According to the Kerckhoffs’s principle, the security of a system should be only depended on the security of its secret key. To build the trusted computing base, Secure Element (SE) and Trusted Execution Environment (TEE) have been proposed for secure computing and authentication. But users still need to believe that SE and TEE-supported hardware will not be evil or intruded. In order to totally remove the dependence of extra hardware, white-box cryptography was introduced by Chow et al. (2002) which gives a software solution for AES implementations in an extremely hostile environment. After Chow et al.’s seminal paper, many white-box implementations were proposed on different block ciphers. In IoTs applications, SE and TEE might have the practical issues if the implementation costs are constrained. In this paper, we first discuss the practical issues that relate to white-box block cipher implementations from lightweight block ciphers. Furthermore, we give the white-box implementations of KLEIN, Present and LBlock as the typical candidates that represent the Substitution-Permutation Network (SPN) and Feistel structures. Finally the performance and the costs are compared with the white-box AES implementation. The comparison shows that white-box implementations are not only related to block and key lengths, but also the structure of the cipher and its white-box implementation methodology strongly affect the implementation costs.

Hardware implementation of secure and lightweight Simeck32/64 cipher for IEEE 802.15.4 transceiver

With the advent of Internet of Things (IoT), a future scenario of billions of devices communicating with each other is inevitable. Being a low power technology, IEEE 802.15.4 standard garners a lot of attention in IoT applications. However, along with all the advantages, it also brings worrisome and threatening security issues to fore. Design of secure communication system with low power consumption is still a challenging task. In this work, a lightweight block cipher for IEEE 802.15.4 transceiver using Simeck32/64 cipher is introduced. Unlike other transceiver designs, encryption is performed before modulation and data bits are processed in parallel. These modifications allowed the system to operate at a lower frequency and thereby reduce the dynamic power required for encryption by 82.758%. The design is implemented in FPGA and an ASIC prototype is developed to ascertain its area and power requirements. With Simeck32/64, encryption takes 100 μW dynamic power while the transceiver requires 780 μW which is very much less than other transceivers. The proposed transceiver is resistant to differential attacks, statistical attacks, traffic analysis attacks and energy depletion attacks. As the security is provided in physical layer, it lessens computational burden of the higher layers and improves the lifetime of the system.

Reliable and Fault Diagnosis Architectures for Hardware and Software-Efficient Block Cipher KLEIN Benchmarked on FPGA

Security-sensitive usage models, such as implantable and wearable medical devices are prone to algorithmic cryptographic attacks as well as malicious implementation attacks. The cryptographic algorithms in these cryptosystems, such as lightweight block ciphers utilized in constrained applications, face significant tradeoff between the high level of security and the efficiency of their implementation metrics. For thwarting fault analysis attacks, among effective variants of active implementation attacks, and also to detect natural faults, efficient fault diagnosis schemes for these lightweight block ciphers are essential. In this paper, for the first time, we propose error detection schemes for lightweight block cipher, KLEIN, to ameliorate its error resiliency with low hardware complexity. The proposed fault diagnosis architectures are for linear and nonlinear components of this cipher. We also consider the notion of fault space transformation for lightweight cryptography and present its potential complications. The implementation of the proposed schemes through variants of Xilinx field-programmable gate arrays and the error coverage assessed with fault injection simulations show the effectiveness of the proposed schemes with acceptable footprints.

Modified 128-EEA2 Algorithm by Using HISEC Lightweight Block Cipher Algorithm with Improving the Security and Cost Factors

<span>128-EEA2 (Evolved Packet System Encryption Algorithm 2) is a confidentiality algorithm which is used to encrypt and decrypt block of data based on confidentiality key. This confidentiality algorithm 128-EEA2 is based on the AES-128 which is the block cipher algorithm of 128 bit in CTR mode. In this paper, we are going to replace the AES-128 block cipher algorithm by HISEC block cipher algorithm for two reasons such as reducing cost and ameliorate security factor.</span>

Related-key impossible differential cryptanalysis on lightweight cipher TWINE

Lightweight block cipher is usually used in smart environment to protect confidentiality as well as to authentication. TWINE is a lightweight block cipher proposed by Japan scholar in SAC 2012 suits for kinds of platform from software to hardware. The cipher algorithm iterates a generalized Feistel structure with an improved block shuffle each sub-block includes an SP type round function. It with 64-bit block size, supports 80/128-bit key size and has 36 rounds iteration. This paper further investigates the security of TWINE, presents a new related-key impossible differential attack on reduced-round TWINE with 80-bit key (i.e. TWINE-80). By choosing the relations of keys carefully and exploring an equivalent structure of TWINE based on analysis of the encryption process, we show a 17-round related-key differential and then construct a 15-round related-key impossible differential trial. By using this trail, a 24-round related-key impossible differential attack on TWINE-80 is conducted. The result shows that the known impossible differential attack on TWINE-80 can be improved by one round.

Two Stages Statistical Fault Analysis Method for Midori and Its Evaluation

SUMMARYThe risk of an illegal attack against the sensor devices used by the sensor network has been recently reported. Therefore, it is important that a security countermeasure by using an encryption technique. Then, lightweight block ciphers, which can realize low power, small area, and low latency, have been attracted attention as security countermeasures. Midori is a lightweight block cipher designed for the low power. Regarding the hardware security, the threat of fault analysis for a cryptographic circuit is pointed out. It is important that the tamper resistance verification of lightweight block ciphers against the fault analysis for the security of the future sensor devices. However, the fault analysis for lightweight block ciphers has barely been studied. Therefore, this study proposes a new fault analysis method for Midori. The proposed method performs the statistical analysis for the estimation of the key. Moreover, the proposed method performs two stages statistical fault analysis to analyze the all secret keys of Midori. Simulation results demonstrated the validity of the proposed method and the vulnerability of Midori against the proposed method.

Impossible meet-in-the-middle fault analysis on the LED lightweight cipher in VANETs

With the expansion of wireless technology, vehicular ad-hoc networks (VANETs) are emerging as a promising approach for realizing smart cities and addressing many serious traffic problems, such as road safety, convenience, and efficiency. To avoid any possible rancorous attacks, employing lightweight ciphers is most effective for implementing encryption/decryption, message authentication, and digital signatures for the security of the VANETs. Light encryption device (LED) is a lightweight block cipher with two basic keysize variants: LED-64 and LED-128. Since its inception, many fault analysis techniques have focused on provoking faults in the last four rounds to derive the 64-bit and 128-bit secret keys. It is vital to investigate whether injecting faults into a prior round enables breakage of the LED. This study presents a novel impossible meet-in-the-middle fault analysis on a prior round. A detailed analysis of the expected number of faults is used to uniquely determine the secret key. It is based on the propagation of truncated differentials and is surprisingly reminiscent of the computation of the complexity of a rectangle attack. It shows that the impossible meet-in-the-middle fault analysis could successfully break the LED by fault injections.

Super Optimal S-boxes Based on Pure Non-linear 3-quasigroups

In this paper, we present an approach to construct cryptographically strong 44-bit S-boxes with pure non-linear 3-quasigroups. PRESENT is a light weight block cipher included in ISO and IEC. The S-box used in PRESENT is optimal in linearity, differential uniformity, branch number and algebraic degree. Our methodology is based on 3-quasigroup operations and it enables someone to get 44-bit S-boxes optimal in all the above four properties that PRESENT S-box has.

Lightweight Block Ciphers for IoT: Energy Optimization and Survivability Techniques

With extraordinary growth in the Internet of Things (IoT), the amount of data exchanged between IoT devices is growing at an unprecedented scale. Most of the IoT devices are low-resource devices handling sensitive and confidential data. Conventional encryption methods are inappropriate for low-resource devices. Lightweight block ciphers are used to encrypt data on such devices, as it balances security requirements and energy consumption. The objective of this paper is to explore opportunities to improve performance and optimize energy consumption for cipher designs targeted for low-resource IoT devices. This paper also presents an energy management algorithm to improve IoT survivability against Denial-of-service attacks in the form of battery exhaustion. We developed a simple and effective model for lightweight cipher performance metrics. Model results were compared and validated with published application-specific integrated circuit (ASIC) and field-programmable gate array (FPGA) designs. Using the model, we explored opportunities for performance enhancement in future cipher designs. Our analysis indicates that the optimum energy is achieved when block size is between 48-bit and 96-bit. Also, increasing size of overhead logic from one round to two rounds increases encryption energy-per-bit by 3.4%. Further, the optimum energy is attained when the number of algorithm rounds is 16 or less. Optimum throughput is achieved by implementations with large block sizes and large number of implemented rounds. Next, we present a novel algorithm to manage cipher energy consumption. The algorithm allows low-resource IoT devices to encrypt critical messages during low-energy mode while balancing throughput, energy per bit, and device activity.

On the Design Rationale of SIMON Block Cipher: Integral Attacks and Impossible Differential Attacks against SIMON Variants

Simon is a lightweight block cipher designed by NSA in 2013. NSA presented the specification and the implementation efficiency, but they did not provide detailed security analysis nor the design rationale. The original Simon has rotation constants of (1,8,2), and Kölbl et al. regarded the constants as a parameter (a,b,c), and analyzed the security of Simon block cipher variants against differential and linear attacks for all the choices of (a,b,c). This paper complements the result of Kölbl et al. by considering integral and impossible differential attacks. First, we search the number of rounds of integral distinguishers by using a supercomputer. Our search algorithm follows the previous approach by Wang et al., however, we introduce a new choice of the set of plaintexts satisfying the integral property. We show that the new choice indeed extends the number of rounds for several parameters. We also search the number of rounds of impossible differential characteristics based on the miss-in-the-middle approach. Finally, we make a comparison of all parameters from our results and the observations by Kölbl et al. Interesting observations are obtained, for instance we find that the optimal parameters with respect to the resistance against differential attacks are not stronger than the original parameter with respect to integral and impossible differential attacks. Furthermore, we consider the security against differential attacks by considering differentials. From the result, we obtain a parameter that is potential to be better than the original parameter with respect to security against these four attacks.

Differential-linear cryptanalysis of SIMON32/64

Simon is a family of lightweight block ciphers designed by the U.S National Security Agency in 2013. Simon 2n/k is a cipher in this family with k-bit key and 2n-bit block. So far, there have been several cryptanalytic results on this cipher by means of differential cryptanalysis, linear cryptanalysis and impossible differential cryptanalysis. In this paper, we improve the previous linear cryptanalysis by differential-linear cryptanalysis, which is based on the use of a differential-linear distinguisher constructed by concatenating a linear approximation with a differential. The number of attacks is not increased, but the time complexity of attacks on 18-round Simon32 is reduced from 232 to 219. In addition, we present a key recovery attack on 18 and 19 rounds of Simon32 based on differential-linear distinguisher.

Optimizing Implementations of Lightweight Building Blocks

We study the synthesis of small functions used as building blocks in lightweight cryptographic designs in terms of hardware implementations. This phase most notably appears during the ASIC implementation of cryptographic primitives. The quality of this step directly affects the output circuit, and while general tools exist to carry out this task, most of them belong to proprietary software suites and apply heuristics to any size of functions. In this work, we focus on small functions (4- and 8-bit mappings) and look for their optimal implementations on a specific weighted instructions set which allows fine tuning of the technology. We propose a tool named LIGHTER, based on two related algorithms, that produces optimized implementations of small functions. To demonstrate the validity and usefulness of our tool, we applied it to two practical cases: first, linear permutations that define diffusion in most of SPN ciphers; second, non-linear 4-bit permutations that are used in many lightweight block ciphers. For linear permutations, we exhibit several new MDS diffusion matrices lighter than the state-of-the-art, and we also decrease the implementation cost of several already known MDS matrices. As for non-linear permutations, LIGHTER outperforms the area-optimized synthesis of the state-of-the-art academic tool ABC. Smaller circuits can also be reached when ABC and LIGHTER are used jointly.

Improved meet-in-the-middle attacks on reduced-round Piccolo

Piccolo is a lightweight block cipher that adopts a generalized Feistel network structure with 4 branches, each of which is 16 bit long. The key length is 80 or 128 bit, denoted by Piccolo-80 and Piccolo-128, respectively. In this paper, we mounted meet-in-the-middle attacks on 14-round Piccolo-80 without pre- and post-whitening keys and 18-round Piccolo-128 with post-whitening keys by exploiting the properties of the key schedule and Maximum Distance Separable (MDS) matrix. For Piccolo-80, we first constructed a 5-round distinguisher. Then 4 rounds and 5 rounds were appended at the beginning and at the end, respectively. Based on this structure, we mounted an attack on 14-round Piccolo-80 from the 5th round to the 18th round. The data, time, and memory complexities were $2^{52}$ chosen plaintexts, $2^{67.44}$ encryptions, and $2^{64.91}$ blocks, respectively. For Piccolo-128, we built a 7-round distinguisher to attack 18-round Piccolo-128 from the 4th round to the 21st round. The data, time, and memory complexities were $2^{52}$ chosen plaintexts, $2^{126.63}$ encryptions, and $2^{125.29}$ blocks, respectively. If not considering results on biclique cryptanalysis, these are currently the best public results on this reduced version of the Piccolo block cipher.

HeW: AHash Function based on Lightweight Block Cipher FeW

<p class="p1">A new hash function <em>HeW: </em>A hash function based on light weight block cipher <em>FeW </em>is proposed in this paper. The compression function of <em>HeW </em>is based on block cipher <em>FeW</em>. It is believed that key expansion algorithm of block cipher slows down the performance of the overlying hash function. Thereby, block ciphers become a less favourable choice to design a compression function. As a countermeasure, we cut down the key size of <em>FeW </em>from 80-bit to 64-bit and provide a secure and efficient key expansion algorithm for the modified key size. <em>FeW </em>based compression function plays a vital role to enhance the efficiency of <em>HeW</em>. We test the hash output for randomness using the NIST statistical test suite and test the avalanche effect, bit variance and near collision resistance. We also give the security estimates of <em>HeW </em>against differential cryptanalysis, length extension attack, slide attack and rotational distinguisher.<span class="Apple-converted-space"> </span></p>

Experimental performance analysis of lightweight block ciphers and message authentication codes for wireless sensor networks

Wireless sensor networks are widely used in many mission critical applications such as environment monitoring, military monitoring, and healthcare. The highly sensitive nature of collected informat...

Impossible differential attacks on the SKINNY family of block ciphers

SKINNY is a family of lightweight block ciphers proposed at CRYPTO 2016, which follows the TWEAKEY framework and takes a tweakey input. It is shown that SKINNY family not only has good hardware/software performances, but also provides strong security guarantees against differential/linear cryptanalysis. In this study, the authors study the security of SKINNY against the impossible differential attack. First, they get some properties of the subkeys of SKINNY by analysing its key schedule. Then, combining with the early-abort technique and the greedy strategy, they present impossible differential attacks on SKINNY based on an 11-round impossible differential. Let SKINNY-n -k be the SKINNY cipher with n -bit block size and k -bit tweakey size. On the basis of their method, 17-round SKINNY-64-64 (resp. SKINNY-128-128) can be broken in (resp. ) 17-round encryptions, 19-round SKINNY-64-128 (resp. SKINNY-128-256) can be broken in (resp. ) 19-round encryptions and 21-round SKINNY-64-192 (resp. SKINNY-128-384) can be broken in (resp. ) 21-round encryptions. To the best of their knowledge, these results are currently the best results with respect to the attacked rounds.

Security Analysis of Lightweight Block Cipher ESF

Security Analysis of Lightweight Block Cipher ESF

Double‐Rounds–Driven Electromagnetic Analysis Attack for a Lightweight Block Cipher Simeck and its Evaluation

SUMMARYSince Internet of Things (IoT) has been widely used, embedded devices have the risk of illegal attacks. Therefore, lightweight block ciphers, which can be implemented on embedded devices in small area, have attracted attention as the countermeasure. Simeck is a new lightweight block cipher that can be implemented in the smallest area among lightweight block ciphers. Recently, regarding the security of a cryptographic circuit, the risk of electromagnetic analysis attack has been reported. However, no study of electromagnetic analysis attack for Simeck has been reported. Therefore, this study proposes a new electromagnetic analysis attack for a lightweight block cipher Simeck. The proposed method performs the analysis using double rounds. Moreover, the proposed method performs build‐in processing using already known information and realizes the high attack accuracy. To our knowledge, this is the first attack for Simeck. Experiments using an actual device introduce the vulnerability of Simeck and the validity of the proposed method.

An Evaluation of Lightweight Block Ciphers for Resource-Constrained Applications: Area, Performance, and Security

In March 2017, NIST (National Institute of Standards and Technology) has announced to create a portfolio of lightweight algorithms through an open process. The report emphasizes that with emerging applications like automotive systems, sensor networks, healthcare, distributed control systems, the Internet of Things (IoT), cyber-physical systems, and the smart grid, a detailed evaluation of the so called light-weight ciphers helps to recommend algorithms in the context of profiles, which describe physical, performance, and security characteristics. In recent years, a number of lightweight block ciphers have been proposed for encryption/decryption of data which makes such choices complex. Each such cipher offers a unique combination of resistance to classical cryptanalysis and resource-efficient implementations. At the same time, these implementations must be protected against implementation-based attacks such as side-channel analysis. In this paper, we present a holistic comparison study of four lightweight block ciphers, PRESENT, SIMON, SPECK, and KHUDRA, along with the more traditional Advanced Encryption Standard (AES). We present a uniform comparison of the performance and efficiency of these block ciphers in terms of area and power consumption, on ASIC and FPGA-based platforms. Additionally, we also compare the amenability to side-channel secure implementations for these ciphers on ASIC-based platforms. Our study is expected to help designers make suitable choices when securing a given application, across a wide range of implementation platforms.