A Survey on Authenticated Encryption--ASIC Designer’s Perspective

Abstract

Authenticated encryption (AE) has been a vital operation in cryptography due to its ability to provide confidentiality, integrity, and authenticity at the same time. Its use has soared in parallel with widespread use of the internet and has led to several new schemes. There have been studies investigating software performance of various schemes. However, the same is yet to be done for hardware. We present a comprehensive survey of hardware (specifically ASIC) performance of the most commonly used AE schemes in the literature. These schemes include encrypt-then-MAC combination, block-cipher-based AE modes, and the recently introduced permutation-based AE scheme. For completeness, we implemented each scheme with various standardized block ciphers and/or hash algorithms, and their lightweight versions. Our evaluation targets minimizing the time-area product while maximizing the throughput on an ASIC platform. We used 45nm NANGATE Open Cell Library for syntheses. We present area, speed, time-area product, throughput, and power figures for both standard and lightweight versions of each scheme. We also provide an unbiased discussion on the impact of the structure and complexity of each scheme on hardware implementation. Our results reveal 13%--30% performance boost in permutation-based AE compared to conventional schemes, and they can be used as a benchmark in the ongoing AE competition CAESAR.

Authenticated Encryption Schemes: A Systematic Review

“…Past reviews of the area were also identified, such as [36,37,108,283]. However, they are limited in scope and the range of time covered.…”

“…In 2016, Abed et al [36] presented an extensive categorization of AE schemes proposed for the CAESAR competition schemes. Vizár [12] and Zhang et al [37] conducted similar studies on the CAESAR competition schemes. In 2017, Kavun et al [37] provided a hardware implementation benchmark for commonly used AE schemes that excluded a majority of schemes proposed in the CAESAR project.…”

“…Vizár [12] and Zhang et al [37] conducted similar studies on the CAESAR competition schemes. In 2017, Kavun et al [37] provided a hardware implementation benchmark for commonly used AE schemes that excluded a majority of schemes proposed in the CAESAR project. Thus, there is a need for a systematic literature review that explores the status of research in the area to inform researchers, readers, and industry experts of the feature set available in AE schemes for implementation or further research.…”

“…The idea of a tweakable block cipher dates back to the hasty pudding cipher, a candidate in the AES competition [35]. The tweakable block cipher was later formalized by Liskov et al [36,37]. At the time of writing, the tweakable block cipher SKINNY [38] is being included in a new standard called the ISO/IEC18033-7 [39].…”

Authenticated Encryption Based on Chaotic Neural Networks and Duplex Construction

“…The first group is a straightforward class called Encrypt-Then-MAC (ETM), which is designed and implemented by using both a hash function and a block cipher, e.g., the CBC-HMAC scheme [4] that is widespread used in IP security protocol suite IPSec and other applications [5]. The second group is composed of AE schemes based on block cipher, e.g., CCM, GCM, EAX, and OCB [6], and some of these schemes are even standardized or recommended by National Institute of Standards and Technology (NIST). The third group is the AE schemes based permutation [7], which were proposed and implemented with the appearance of Sponge functions, e.g., ASCON [8], PHOTON-Beetle [9], Oribatida [10], etc.…”