Energy Analysis of Lightweight AEAD Circuits

Caforio, Andrea; Balli, Fatih; Banik, Subhadeep

doi:10.1007/978-3-030-65411-5_2

Cited by 10 publications

(9 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Meanwhile, there is a TI of SAEB instantiated with the GIFT lightweight block cipher [13,20]. Caforio et al evaluated a number of NIST LWC candidates with TI [10].…”

Section: Hardware Implementations Of Saeaesmentioning

confidence: 99%

“…By considering the design choices in software/hardware codesign, and following the common practice of letting hardware do regular operations for improving the efficiency, we choose the coprocessor interface aiming at accelerating the main time-consuming part of AD processing, encryption, and decryption. Meanwhile, the design relies on an external processor for handling exceptional cases such as padding following the previous works [10,[13][14][15]28]. Meanwhile, there is another approach of including the padding circuit inside the design, which is more suitable for a high-speed design with a direct memory access [33].…”

Section: Design Policymentioning

confidence: 99%

“…Table 7 also shows the performances of the other authenticated encryptions: (i) the Arribas et al KETJE-JR implementation based on the changing of the guards sharing [9] and (ii) the Caforio et al implementations of several NIST LWC candidates based on GIFT-128 [10], which have the similar circuit sizes compared to that of SAEAES. These implementations are larger because they traded the circuit area with speed: they finish a round function each cycle by using multiple S-box circuits (cf.…”

Section: Other Aeadsmentioning

confidence: 99%

“…TI is popular for hardware implementations because it can provide the security in the presence of glitches, i.e., transient signal propagation through a combinatorial circuit, which is inevitable in common hardware design. Consequently, there are an increasing number of papers reporting authenticated encryptions with TI [8][9][10]. Researchers are even optimizing the algorithms for TI: the TI-friendly S-boxes [11,12] and the TI-friendly modes of operation [13,14].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Hardware Performance Evaluation of Authenticated Encryption SAEAES with Threshold Implementation

Sugawara

2020

Cryptography

View full text Add to dashboard Cite

SAEAES is the authenticated encryption algorithm instantiated by combining the SAEB mode of operation with AES, and a candidate of the NIST’s lightweight cryptography competition. Using AES gives the advantage of backward compatibility with the existing accelerators and coprocessors that the industry has invested in so far. Still, the newer lightweight block cipher (e.g., GIFT) outperforms AES in compact implementation, especially with the side-channel attack countermeasure such as threshold implementation. This paper aims to implement the first threshold implementation of SAEAES and evaluate the cost we are trading with the backward compatibility. We design a new circuit architecture using the column-oriented serialization based on the recent 3-share and uniform threshold implementation (TI) of the AES S-box based on the generalized changing of the guards. Our design uses 18,288 GE with AES’s occupation reaching 97% of the total area. Meanwhile, the circuit area is roughly three times the conventional SAEB-GIFT implementation (6229 GE) because of a large memory size needed for the AES’s non-linear key schedule and the extended states for satisfying uniformity in TI.

show abstract

“…Meanwhile, there is a TI of SAEB instantiated with the GIFT lightweight block cipher [13,20]. Caforio et al evaluated a number of NIST LWC candidates with TI [10].…”

Section: Hardware Implementations Of Saeaesmentioning

confidence: 99%

Section: Design Policymentioning

confidence: 99%

Section: Other Aeadsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Hardware Performance Evaluation of Authenticated Encryption SAEAES with Threshold Implementation

Sugawara

2020

Cryptography

View full text Add to dashboard Cite

show abstract

“…Indeed, any construction optimized with respect to energy has wide applications, especially in constrained environments running on a tight power/energy budget. Over the years there have been a lot of papers that study energy as an optimizable metric in block/stream cipher based protocols [1]- [5]. However, in all these papers energy is computed by calculating the average power consumption after the design is synthesized by a circuit compiler.…”

Section: Introductionmentioning

confidence: 99%

A Deeper Look at the Energy Consumption of Lightweight Block Ciphers

Caforio

Balli

Banik

et al. 2021

2021 Design, Automation &Amp; Test in Europe Conference &Amp; Exhibition (DATE)

View full text Add to dashboard Cite

In the last few years, the field of lightweight cryptography has seen an influx in the number of block ciphers and hash functions being proposed. In the past there have been numerous papers that have looked at circuit level implementation of block ciphers with respect to lightweight metrics like area power and energy. In the paper by Banik et al. (SAC'15), for example, by studying the energy consumption model of a CMOS gate, it was shown that the energy consumed per cycle during the encryption operation of an r-round unrolled architecture of any block cipher is a quadratic function in r.However, most of these explorative works were at a gate level, in which a circuit synthesizer would construct a circuit using gates from a standard cell library, and the area power and energy would be estimated by estimating the switching statistics of the nodes in the circuit. Since only a part of the EDA design flow was done, it did not account for issues that might arise when the circuit is finally mapped into silicon post route. Metrics like area, power and energy would need to be re-estimated due to the effect of the parasitics introduced in the circuit by the connecting wires, nodes and interconnects. In this paper, we look to plug this very gap in literature by re-examining the designs of lightweight block ciphers with respect to their performances after completing the placement and routing process. This is a timely exercise to do since three of the block ciphers we analyze in the paper are used in around 13 of the 32 candidates in the second round of the NIST lightweight competition being conducted currently.

show abstract

Revisiting the Security of COMET Authenticated Encryption Scheme

Gueron

Jha

Nandi

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Threshold Implementations have become a popular generic technique to construct circuits resilient against power analysis attacks. In this paper, we look to devise efficient threshold circuits for the lightweight block cipher family SKINNY. The only threshold circuits for this family are those proposed by its designers who decomposed the 8-bit S-box into four quadratic S-boxes, and constructed a 3-share byte-serial threshold circuit that executes the substitution layer over four cycles. In particular, we revisit the algebraic structure of the S-box and prove that it is possible to decompose it into (a) three quadratic S-boxes and (b) two cubic S-boxes. Such decompositions allow us to construct threshold circuits that require three shares and executes each round function in three cycles instead of four, and similarly circuits that use four shares requiring two cycles per round. Our constructions significantly reduce latency and energy consumption per encryption operation. Notably, to validate our designs, we synthesize our circuits on standard CMOS cell libraries to evaluate performance, and we conduct leakage detection via statistical tests on power traces on FPGA platforms to assess security. 1

show abstract

Energy Analysis of Lightweight AEAD Circuits

Cited by 10 publications

References 27 publications

Hardware Performance Evaluation of Authenticated Encryption SAEAES with Threshold Implementation

Hardware Performance Evaluation of Authenticated Encryption SAEAES with Threshold Implementation

A Deeper Look at the Energy Consumption of Lightweight Block Ciphers

Revisiting the Security of COMET Authenticated Encryption Scheme

Contact Info

Product

Resources

About