Pushing the Limits Further: Sub-Atomic AES

Abstract

The recent trend to connect a plethora of sensors, embedded and ubiquitous systems with low computing power, in short the rise of the Internet of Things, has created a great demand for compact, lightweight and cheap to produce implementations of cryptographic primitives. One approach to meet this demand is the development and standardisation of new tailored primitives, most prominently PRESENT. Yet, the wide proliferation of the Advanced Encryption Standard and the trust it earned through its long history of withstanding cryptanalysis spurred anew the search for small, lightweight implementations of AES. Among the smallest published architectures is the AtomicAES design by Banik et al. , who reported a design size of just over 2000 GE.Here we present a new 8-bit serial architecture that has been designed from careful observation of the minimum required connections between storage elements to support all dataflows required for execution of the algorithm. While we reach similar conclusions to previous publications, the new architecture enables us to push the area requirement for a fully featured AES primitive further down by more than 8% from the area requirement of AtomicAES while offering more functionality. Along the way we also answer in the affirmative the open question whether the AES reverse keyschedule can be implemented with negligible hardware overhead based on the forward keyschedule. Our design sets a new record for an 8-bit serial architecture with full functionality for encryption and decryption including the keyschedule, as well as for a sole encryption architecture. Furthermore our design is flexible enough to allow scaling the S-Box architecture from single-cycle to multi-stage pipelined approaches as are required for high operation frequencies or for protection against side-channel attacks. We demonstrate this by instantiating the design with a serial version of the S-Box to reduce the area requirement even further.

Charge Based Power Side-Channel Attack Methodology for an Adiabatic Cipher

“…All of the key bits were successfully retrieved for both implementations. The correlation coefficient vs. number of current traces for static CMOS based SIMON for the key bits with the maximum MTD (that were the hardest to retrieve), K 3 8 , K 3 14 , K 3 15 , K 4 0 is illustrated in Figure 9b. The black curve shows the correlation coefficient for the correct key hypotheses 4'b 1000 and the grey curves are the correlation for the other key guesses.…”

“…The robust general-purpose encryption algorithms such as the AES are not considered as suitable candidates for lightweight applications because of their high hardware cost. Consequently, research on compact realizations of AES with area less than 2000 GE is gaining attention [3,4]. There is also a growing interest in lightweight cryptographic algorithms that are specifically designed for resource-constrained applications.…”