Pushing the limits further: Sub-atomic AES

Abstract

The recent trend to connect a plethora of sensors, embedded and ubiquitous systems with low computing power, in short the rise of the Internet of Things, has created a great demand for compact, lightweight and cheap to produce implementations of cryptographic primitives. One approach to meet this demand is the development and standardisation of new tailored primitives, most prominently PRESENT. Yet, the wide proliferation of the Advanced Encryption Standard and the trust it earned through its long history of withstanding cryptanalysis spurred anew the search for small, lightweight implementations of AES. Among the smallest published architectures is the AtomicAES design by Banik et al. , who reported a design size of just over 2000 GE.Here we present a new 8-bit serial architecture that has been designed from careful observation of the minimum required connections between storage elements to support all dataflows required for execution of the algorithm. While we reach similar conclusions to previous publications, the new architecture enables us to push the area requirement for a fully featured AES primitive further down by more than 8% from the area requirement of AtomicAES while offering more functionality. Along the way we also answer in the affirmative the open question whether the AES reverse keyschedule can be implemented with negligible hardware overhead based on the forward keyschedule. Our design sets a new record for an 8-bit serial architecture with full functionality for encryption and decryption including the keyschedule, as well as for a sole encryption architecture. Furthermore our design is flexible enough to allow scaling the S-Box architecture from single-cycle to multi-stage pipelined approaches as are required for high operation frequencies or for protection against side-channel attacks. We demonstrate this by instantiating the design with a serial version of the S-Box to reduce the area requirement even further.

Spin Me Right Round Rotational Symmetry for FPGA-Specific AES: Extended Version

“…Another line of work in this area [63,64,69] exploits a property of inversion-based S-boxes that any inversion in GF(2 n ) can be implemented by a linear feedback shift register (LFSR). The ASIC-based smallest such construction [63] needs on average 127 clock cycles, i.e.…”

The Security Evaluation of an Efficient Lightweight AES Accelerator

“…Several lightweight AES implementations have been proposed with the objective of minimizing both the area and power consumption. The objective of these accelerators is to enhance the efficiency of the conventional 128-bit data path by reducing it to 8 bits, as demonstrated in various research studies, such as Lu et al [8], Dhanuskodi et al [9], Wamser and Sauer [10], and Banik et al [11]. The aforementioned reduction leads to a decrease in the number of SBOXes from 16 to 1, thereby resulting in a more condensed hardware design and reduced power consumption.…”

Pushing the Limits Further: Sub-Atomic AES

“…Here we discuss in detail the 8-bit serial hardware architecture for encryption and decryption first presented in [27] that is significantly smaller than previously published architectures at the cost of an increase in latency. We show that by carefully designing the datapath we can construct a smaller architecture than by simply extending the architecture of [21] to accommodate decryption as in [4].…”