The Area-Latency Symbiosis: Towards Improved Serial Encryption Circuits

Abstract

The bit-sliding paper of Jean et al. (CHES 2017) showed that the smallest-size circuit for SPN based block ciphers such as AES, SKINNY and PRESENT can be achieved via bit-serial implementations. Their technique decreases the bit size of the datapath and naturally leads to a significant loss in latency (as well as the maximum throughput). Their designs complete a single round of the encryption in 168 (resp. 68) clock cycles for 128 (resp. 64) bit blocks. A follow-up work by Banik et al. (FSE 2020) introduced the swap-and-rotate technique that both eliminates this loss in latency and achieves even smaller footprints.In this paper, we extend these results on bit-serial implementations all the way to four authenticated encryption schemes from NIST LWC. Our first focus is to decrease latency and improve throughput with the use of the swap-and-rotate technique. Our block cipher implementations have the most efficient round operations in the sense that a round function of an n-bit block cipher is computed in exactly n clock cycles. This leads to implementations that are similar in size to the state of the art, but have much lower latency (savings up to 20 percent). We then extend our technique to 4- and 8-bit implementations. Although these results are promising, block ciphers themselves are not end-user primitives, as they need to be used in conjunction with a mode of operation. Hence, in the second part of the paper, we use our serial block ciphers to bootstrap four active NIST authenticated encryption candidates: SUNDAE-GIFT, Romulus, SAEAES and SKINNY-AEAD. In the wake of this effort, we provide the smallest block-cipher-based authenticated encryption circuits known in the literature so far.

A Small GIFT-COFB: Lightweight Bit-Serial Architectures

“…Swap-and-rotate is a natural progression of the bit-sliding technique with a particular focus on reducing the latency of an encryption round such that the number of required cycles is equal to the bit-length of the internal state. This technique was first successfully demonstrated on PRESENT and GIFT-64 by Banik et al [4] and refined for other block ciphers in a follow-up work [3]. The core idea behind the technique lies in the reliance on a small number of flip-flop pairs that swap two bits in-place at specific points in time during the round function computation while the state bits are rotating through the register pipeline one position per clock cycle.…”

“…This fact was then exploited in [3] to compute each sub-permutation while the corresponding bits are advancing through FF i for 96 ≤ i ≤ 127. More specifically, the plaintext is loaded into FF 0 throughout cycles 0-127.…”

“…Unlike the bit-serial AEAD implementations proposed in [3], GIFT-COFB involves finite field arithmetic for which there is no straightforward mapping into a bit-serial setting that is both circuit area and latency efficient. In this paper, we fill this gap by proposing three bit-serial circuits that stand as the to-date most area-efficient GIFT-COFB implementations known in the literature.…”

“…The circuit for PRESENT was further compacted in [4] with a technique that made it possible to execute one round in exactly 64 clock cycles which is equal to the block size. This endeavour of computing a round function in the same number cycles as there are bits in the internal state was successfully extended to other ciphers including AES-128, SKINNY and GIFT-128 [3]. This was achieved by not treating the round as a monolithic entity by deferring some operations to the time allotted to operations of the next round.…”

Atom: A Stream Cipher with Double Key Filter

“…There are numerous hardware implementations of AES presented in literature: from fully unrolled which performs encryption in one clock cycle, to round based which takes 10 clock cycles per encryption to various serialized circuits which although smaller in hardware size, utilize much more clock cycles for the same purpose. We choose the byte-serial AES implementation presented in [BCB20] which takes around 176 clock cycles to encrypt one plaintext and so when used in counter mode, this circuit can encrypt 128 bits every 176 clock cycles (this is better than the 216/246 cycle implementations of [BBR16,BBR19]). This is close to the 1 bit/cycle implementations of the other stream ciphers we have listed in Table 3.…”