Fixslicing AES-like Ciphers

Abstract

The fixslicing implementation strategy was originally introduced as a new representation for the hardware-oriented GIFT block cipher to achieve very efficient software constant-time implementations. In this article, we show that the fundamental idea underlying the fixslicing technique is not of interest only for GIFT, but can be applied to other ciphers as well. Especially, we study the benefits of fixslicing in the case of AES and show that it allows to reduce by 52% the amount of operations required by the linear layer when compared to the current fastest bitsliced implementation on 32-bit platforms. Overall, we report that fixsliced AES-128 allows to reach 80 and 91 cycles per byte on ARM Cortex-M and E31 RISC-V processors respectively (assuming pre-computed round keys), improving the previous records on those platforms by 21% and 26%. In order to highlight that our work also directly improves masked implementations that rely on bitslicing, we report implementation results when integrating first-order masking that outperform by 12% the fastest results reported in the literature on ARM Cortex-M4. Finally, we demonstrate the genericity of the fixslicing technique for AES-like designs by applying it to the Skinny-128 tweakable block ciphers.

Oil and Vinegar: Modern Parameters and Implementations

“…Expands the 16 byte public seed to the matrices P (1) = {P (1) i } i∈ [m] and P (2) = {P (2) i } i∈ [m] . We first sample the P (1) matrices, and then the P (2) matrices. The m matrices are expanded in an interleaved fashion, in column-major order.…”

“…)O + P (2) i . The S i matrices are relatively expensive to compute, but they are independent of the message we are signing, so we choose to compute them only once during key generation, and store them as part of the secret key.…”

Efficient Private Circuits with Precomputation

“…Remarks. The bitsliced implementations shown above can be significantly improved by, e.g., using the more advanced fixslicing method [AP21]. But, to the best of our knowledge, state-of-the-art higher-order masked implementations of AES are based on the above strategies, and thus we choose them as well for fair comparisons.…”

Bit-Sliced Implementation of SM4 and New Performance Records

“…We are able to use this representation because most AVX2 instructions are strict with the operations crossing lanes freely but can manipulate quadword (64-bit) or doubleword (32-bit) values as individual processing units. The arrangement of one bundle is similar to the barrel shifter design [22] enabling efficient circular rotations with SHUFFLE instruction instead of SHIFT instruction.…”