Optimizing Implementations of Lightweight Building Blocks

Abstract

We study the synthesis of small functions used as building blocks in lightweight cryptographic designs in terms of hardware implementations. This phase most notably appears during the ASIC implementation of cryptographic primitives. The quality of this step directly affects the output circuit, and while general tools exist to carry out this task, most of them belong to proprietary software suites and apply heuristics to any size of functions. In this work, we focus on small functions (4- and 8-bit mappings) and look for their optimal implementations on a specific weighted instructions set which allows fine tuning of the technology. We propose a tool named LIGHTER, based on two related algorithms, that produces optimized implementations of small functions. To demonstrate the validity and usefulness of our tool, we applied it to two practical cases: first, linear permutations that define diffusion in most of SPN ciphers; second, non-linear 4-bit permutations that are used in many lightweight block ciphers. For linear permutations, we exhibit several new MDS diffusion matrices lighter than the state-of-the-art, and we also decrease the implementation cost of several already known MDS matrices. As for non-linear permutations, LIGHTER outperforms the area-optimized synthesis of the state-of-the-art academic tool ABC. Smaller circuits can also be reached when ABC and LIGHTER are used jointly.

On the Lower Bound of Cost of MDS Matrices

“…Definition 4. [JPST17] [Sequential XOR count (s-XOR)] Given a non-singular matrix M ∈ GL(n, F 2 ) of order n over F 2 , the sequential XOR count or s-XOR of M , denoted by C s (M ), is the smallest integer t such that the matrix M can be decomposed as…”

“…It was also shown that the optimal implementation of an MDS matrix depends upon the minimum number of additive elementary matrices (known as Type III) that appear in its decomposition. It was then reformulated in [JPST17,BKL16] as sequential XOR or s-XOR to estimate the implementation cost. Also, a graph-based meet-in-the-middle (MITM) search algorithm to find efficient implementation of MDS matrices called LIGHTER was developed in [JPST17].…”

“…It was then reformulated in [JPST17,BKL16] as sequential XOR or s-XOR to estimate the implementation cost. Also, a graph-based meet-in-the-middle (MITM) search algorithm to find efficient implementation of MDS matrices called LIGHTER was developed in [JPST17]. However, the problem with these graph-theoretical tools is that they do not scale well.…”

Efficient Implementation of PRESENT and GIFT on Quantum Computers

“…In [13], authors presented the 4-bit Sbox implementation generator for quantum computers, namely LIGHTER-R. LIGHTER-R is an extension of LIGHTER developed for classical computers, targeting quantum computers [16]. The LIGHTER uses the Meet In The Middle approach to design the compact result of 4-bit Sbox for classical computers.…”

On the automorphisms and isomorphisms of MDS matrices and their efficient implementations

“…In addition to construction methods described for MDS matrices, recently, MDS construction methods have evolved to find MDS matrices with minimal XOR counts [21], which is a metric used in the estimation of hardware implementation cost. In the literature, some studies focusing on generating MDS matrices with low/minimum XOR counts are given in [20,[22][23][24].…”