In this chapter, we study the hardware implementation of SPNs and the CB3 TBCbased mode. The contents of this chapter have been published in the International Conference on Cryptology in India (Indocrypt) 2017 [1].In order to design a good lightweight TBC-based AEAD scheme, first we need to understand the drawbacks of the state-of-the-art schemes. At the time of writing, the state-of-the-art TBC-based AEAD mode is CB3, proposed by Ted Krovetz and Phillip Rogaway in 2011 [2]. It is a generalization of the OCB BC-based AEAD mode by the same authors. It was proposed as way of analyzing OCB3 using a TBC design based on an underlying BC, e.g. AES. Due to its attractive features, some designers suggested using the CB3 mode as black-box design, using an ad-hoc TBC, such as in [3]. In 2014, Jean, Nikolić and Peyrin published Deoxys, a family of AEAD algorithms submitted to the CAESAR competition [4]. Deoxys consisted of two sub-families, Deoxys-I and Deoxys-II. The former is an instantiation of the CB3 mode with a new underlying black-box TBC: Deoxys-BC. It can also be seen as an instantiation of the Tweakable Authenticated Encryption (TAE) mode intoduced in [5]. Beside the fact that it uses an ad-hoc TBC, Deoxys-I is attractive in two other regards:1. It is fully parallelisable. 2. It is an online rate-1 mode. I needs only 1 block cipher call to process each block of the message. An online mode can generate the ciphertext on-the-fly without preprocessing all the plaintext.Due to these features, we study the hardware implementation of Deoxys-I, and parallelisability in hardware in general. In the original proposal [2], the associated data is first processed using the PMAC [6] structure shown in Figure 1.18. Second, the message is encrypted using the structure in Figure 1.17, computing the message checksum in parallel. Finally, the message checksum in encrypted and XOR-ed to the associated data tag to produce the final tag. In both parts of the algorithm, the
