Saturnin: a suite of lightweight symmetric algorithms for post-quantum security

Abstract

The cryptographic algorithms needed to ensure the security of our communications have a cost. For devices with little computing power, whose number is expected to grow significantly with the spread of the Internet of Things (IoT), this cost can be a problem. A simple answer to this problem is a compromise on the security level: through a weaker round function or a smaller number of rounds, the security level can be decreased in order to cheapen the implementation of the cipher. At the same time, quantum computers are expected to disrupt the state of the art in cryptography in the near future. For public-key cryptography, the NIST has organized a dedicated process to standardize new algorithms. The impact of quantum computing is harder to assess in the symmetric case but its study is an active research area.In this paper, we specify a new block cipher, Saturnin, and its usage in different modes to provide hashing and authenticated encryption in such a way that we can rigorously argue its security in the post-quantum setting. Its security analysis follows naturally from that of the AES, while our use of components that are easily implemented in a bitsliced fashion ensures a low cost for our primitives. Our aim is to provide a new lightweight suite of algorithms that performs well on small devices, in particular micro-controllers, while providing a high security level even in the presence of quantum computers. Saturnin is a 256-bit block cipher with a 256-bit key and an additional 9-bit parameter for domain separation. Using it, we built two authenticated ciphers and a hash function.• Saturnin-CTR-Cascade is an authenticated cipher using the counter mode and a separate MAC. It requires two passes over the data but its implementation does not require the inverse block cipher.• Saturnin-Short is an authenticated cipher intended for messages with a length strictly smaller than 128 bits which uses only one call to Saturnin to providenconfidentiality and integrity.• Saturnin-Hash is a 256-bit hash function. In this paper, we specify this suite of algorithms and argue about their security in both the classical and the post-quantum setting.
 https://project.inria.fr/saturnin/

Thinking Outside the Superbox

“…The Saturnin [12] block cipher has a 256-bit key and block length. The state has several representations: three-dimensional, two-dimensional, and flat.…”

“…Mixing Layer Spongent has no mixing layer, so there is no cost. Xoodoo-θ requires 2 binary xor operations per bit, while Saturnin's MC can be implemented with 2.25 binary xor operations per bit [12]. The circuit depth for these computations is in both cases 4 xor gates.…”

“…By adopting 4-bit S-boxes instead of 8-bit ones and modern lightweight MDS layers in a smart structure, multiple lightweight ciphers have been constructed. Many lessons were learned and this line of design has culminated in the block cipher of the NIST lightweight competition candidate Saturnin [12], a truly modern version of AES.…”

Energy Analysis of Lightweight AEAD Circuits

“…SATURNIN, designed by Canteaut et al [CDL + 19], is a post-quantum secure mode of operation, again instantiated with a semi-lightweight block cipher SATURNIN-BC. The mode has a rate of 1/2, i.e there are 2 encryption calls per block of plaintext.…”

Quantum Secure Lightweight Cryptography with Quantum Permutation Pad

“…This can be considered as a hybrid quantum secure encryption combining QKD with OTP. In [14], the authors proposed a new lightweight symmetric cryptographic algorithm called Saturnin by introducing two representations of AES 256-bit internal states: the 2-dimensional and 3-dimensional notations. In its 2-dimensional representation, a 256-bit state can be expressed by sixteen 16-bit registers; but in its 3-dimensional representation, it is expressed by a 4x4x4 cube of nibbles.…”