Swap and Rotate: Lightweight Linear Layers for SPN-based Blockciphers

Abstract

In CHES 2017, Jean et al. presented a paper on “Bit-Sliding” in which the authors proposed lightweight constructions for SPN based block ciphers like AES, PRESENT and SKINNY. The main idea behind these constructions was to reduce the length of the datapath to 1 bit and to reformulate the linear layer for these ciphers so that they require fewer scan flip-flops (which have built-in multiplexer functionality and so larger in area as compared to a simple flip-flop). In this paper, we develop their idea even further in few separate directions.First, we prove that given an arbitrary linear transformation, it is always possible to construct the linear layer using merely 2 scan flip-flops. This points to an optimistic venue to follow to gain further GE reductions, yet the straightforward application of the techniques in our proof to PRESENT and GIFT leads to inefficient implementations of the linear layer, as reducing ourselves to 2 scan flip-flops setting requires thousands of clock cycles and leads to very high latency.Equipped with the well-established formalism on permutation groups, we explore whether we can reduce the number of clock cycles to a practical level, i.e. few hundreds, by adding few more pairs of scan flip flops. For PRESENT, we show that 4 (resp. 8, 12) scan flip-flops are sufficient to complete the permutation layer in 384 (resp. 256, 128) clock cycles. For GIFT, we show that 4 (resp. 8, 10) scan flip flops correspond to 320 (resp. 192, 128) clock cycles. Finally, in order to provide the best of the two worlds (i.e. circuit area and latency), we push our scan flip-flop choices even further to completely eliminate the latency incurred by the permutation layer, without compromising our stringent GE budget. We show that not only 12 scan flip flops are sufficient to execute PRESENT permutation in 64 clock cycles, but also the same scan flip flops can be used readily in a combined encryption decryption circuit. Our final design of PRESENT and GIFT beat the record of Jean et al. and Banik et al. in both latency and in circuit-size metric. We believe that the techniques presented in our work can also be used at choosing bit-sliding-friendly linear layer permutations for the future SPN-based designs.

Six shades lighter: a bit-serial implementation of the AES family

“…Depending on the AES variant, let r denote the number of rounds, l denote the number of key derivation rounds, and b denote the number of bytes of the initial key. Thus, each AES variant (or member) is associated with a tuple (r, l, b) with values (10,10,16), (12,8,24) and (14,7,32) for AES-128, AES-192 and AES-256, respectively. We use d 0 , d 1 , .…”

“…One can add many such swap operations to the pipeline. This idea was introduced by Banik et al [16], and we extend the use of Swaps particularly for all AES versions to perform ShiftRows operation and column rotation required during the key expansion. -Overwriting is an operation primitive that allows to load a different result to a set of registers during a particular cycle.…”

“…During clock cycles count key ∈ [0, 7], we use the swap-32 to temporarily relocate the byte k 96:103 into FF 248:255 so that S-box can get its input from FF 248:255 . This repositioning is reverted at clock cycle count key ∈ [16,23] using yet another swap-32. Both swaps are represented in Fig.…”

Energy Analysis of Lightweight AEAD Circuits

“…This justifies why the literature has seen a large number of new block ciphers such as PRESENT [BKL + 07], KATAN [CDK09], SIMON [BSS + 13], SKINNY [BJK + 16], and GIFT [BPP + 17], to name only a few. There are even some attempts to discover new techniques to improve lightweightness of these new block ciphers [JMPS17,BBRV19]. As block ciphers alone are not ready-to-use primitives but rather need to be wrapped in a mode of operation, a group of candidates in NIST LWC utilize these lightweight block ciphers to attain an authenticated encryption (AE) primitive, i.e.…”