FOAM: Searching for Hardware-Optimal SPN Structures and Components with a Fair Comparison

Abstract

Abstract. In this article, we propose a new comparison metric, the figure of adversarial merit (FOAM), which combines the inherent security provided by cryptographic structures and components with their implementation properties. To the best of our knowledge, this is the first such metric proposed to ensure a fairer comparison of cryptographic designs. We then apply this new metric to meaningful use cases by studying Substitution-Permutation Network permutations that are suited for hardware implementations, and we provide new results on hardware-friendly cryptographic building blocks. For practical reasons, we considered linear and differential attacks and we restricted ourselves to fully serial and round-based implementations. We explore several design strategies, from the geometry of the internal state to the size of the S-box, the field size of the diffusion layer or even the irreducible polynomial defining the finite field. We finally test all possible strategies to provide designers an exhaustive approach in building hardware-friendly cryptographic primitives (according to area or FOAM metrics), also introducing a model for predicting the hardware performance of round-based or serial-based implementations. In particular, we exhibit new diffusion matrices (circulant or serial) that are surprisingly more efficient than the current best known, such as the ones used in AES, LED and PHOTON.

SKINNY-AEAD and SKINNY-Hash

“…While area-optimized implementations are important for some very constrained applications, throughput or throughput-over-area optimized implementations are also very relevant. Actually, looking at recently introduced efficiency measurements (the FOAM value -Figure Of Adversarial Merit [KPPY14]), one can see that our design choices are good for many types of implementations, which is exactly what makes a good general-purpose lightweight encryption scheme.…”

Generating binary diffusion layers with maximum/high branch numbers and low search complexity

“…As an example, one can generate a 32 × 32 involutory binary matrix with a branch number of 12 by using the following 4 × 4 generator matrix and the MDS matrix over defined by the primitive polynomial x 4 + x + 1. Remark M 5 is the same 8 × 8 involutory MDS matrix over given in .…”

Fast modular multiplication using parallel prefix adder

“…The delay is reduced to (N-1) multiple to (log 2 N) is significant improvement in performance over RCA. t ripple = tpg + ( N-1) t AO + txor (1) t ksa = tpg + ( log 2 N) t AO + txor (2) B. Proposed Architecture Application of above structure for Interleaved and Montgomery Multiplier is presented in this sub-section.…”

“…Modular multiplication is the most frequently used operation in these cryptographic applications which requires high area and power. Performance of cryptographic applications are decided by Area-Time complexity [1][2][3]. As a result, an efficient implementation becomes critical.…”