Bit-Sliding: A Generic Technique for Bit-Serial Implementations of - - PowerPoint PPT Presentation

▶
bit sliding a generic technique for bit serial
SMART_READER_LITE
LIVE PREVIEW

Bit-Sliding: A Generic Technique for Bit-Serial Implementations of - - PowerPoint PPT Presentation

Jun 03, 2023 302 likes •664 views

Bit-Sliding: A Generic Technique for Bit-Serial Implementations of SPN-based Primitives 28. Sep. 2017 Jrmy Jean, Amir Moradi, Thomas Peyrin, Pascal Sasdrich ANSSI Crypto Lab, Paris, France Ruhr University Bochum, Germany Temasek

slide-1
SLIDE 1

Bit-Sliding: A Generic Technique for Bit-Serial Implementations of SPN-based Primitives

  • 28. Sep. 2017

Jérémy Jean, Amir Moradi, Thomas Peyrin, Pascal Sasdrich

ANSSI Crypto Lab, Paris, France Ruhr University Bochum, Germany Temasek Laboratories, Nanyang Technological University, Singapore

slide-2
SLIDE 2

2

Embedded Security Group

Story?

  • motivated by KATAN & Simon bit‐serial implementations

– KATAN: NLFSR/steam‐cipher construction (borrowed from KeeLoq)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-3
SLIDE 3

3

Embedded Security Group

Story?

  • motivated by KATAN & Simon bit‐serial implementations

– KATAN: NLFSR/steam‐cipher construction (borrowed from KeeLoq) – Simon: Feistel

  • allows even a scalable architecture*

* Aysu, Gulcan, Schaumont: SIMON Says: Break Area Records of Block Ciphers on FPGAs. Embedded Systems Letters 2014

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-4
SLIDE 4

4

Embedded Security Group

Story?

  • motivated by KATAN & Simon bit‐serial implementations

– KATAN: NLFSR/steam‐cipher construction (borrowed from KeeLoq) – Simon: Feistel

  • allows even a scalable architecture*
  • How about SPN constructions?

* Aysu, Gulcan, Schaumont: SIMON Says: Break Area Records of Block Ciphers on FPGAs. Embedded Systems Letters 2014

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-5
SLIDE 5

5

Embedded Security Group

SPN & Implementation Trade‐offs

  • fully unrolled … pipeline … round‐based … serial
  • lightweight cryptography (smallest footprint): serial arch.

– s‐bit Sbox and l‐bit linear function

  • s‐bit data path, l a multiple of s (s‐bit serial implementation)

– PRESENT, LED, Klein, …: 4‐bit serial – AES: 8‐bit serial – enables to employ scan flip‐flops

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

latency area

slide-6
SLIDE 6

6

Embedded Security Group

Scan Flip‐flop

  • developed & used in scan chain

for testing purposes

  • operates as (but smaller than)

a MUX + D‐FF

MUX ≈ 2.33 GE GE: Gate Equivalence: area of a NAND gate

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-7
SLIDE 7

7

Embedded Security Group

Smallest Known Serial AES, Atomic AES v2.0

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

Banik, Bogdanov, Regazzoni, ePrint Archive: Report 2016/1005

slide-8
SLIDE 8

8

Embedded Security Group

Atomic AES v2.0

  • supports both ENC & DEC
  • clock gating for each row (due to ShiftRows & ShiftRows‐1)
  • 3  8‐bit scan FF(state) + 8  8‐bit scan FF(key): 88 scan FF
  • MC‐1(x) = MC(MC(MC(x)))
  • Canright Sbox (supporting Sbox‐1)
  • 2060 GE (STM 90nm)

– 246 clock cycles ENC – 326 clock cycles DEC

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-9
SLIDE 9

9

Embedded Security Group

Bit‐Sliding

  • use as many as possible regular FF, use less scan FF
  • almost all register cells always shift (regular FF)

– a few have multiple inputs (scan FF)

  • challenge 1: s‐bit Sbox

– easy for PICCOLO & SKINNY Sboxes – how about AES, PRESENT, …?

  • no way (yet) than using the Sbox in parallel
  • challenge 2: permutation

– ad hoc, easy for AES, hard for PRESENT

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-10
SLIDE 10

10

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-11
SLIDE 11

11

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-12
SLIDE 12

12

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-13
SLIDE 13

13

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-14
SLIDE 14

14

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-15
SLIDE 15

15

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-16
SLIDE 16

16

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-17
SLIDE 17

17

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-18
SLIDE 18

18

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-19
SLIDE 19

19

Embedded Security Group

How Sbox works

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-20
SLIDE 20

20

Embedded Security Group

Bit‐Serial AES‐128, ENC only (state)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

  • 20 scan FF (state)
  • no clock gating, no enable signal
slide-21
SLIDE 21

21

Embedded Security Group

Bit‐Serial AES‐128, ENC only (state)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

  • 128 clock cycles: plaintext & key load
  • 128 clock cycles: AddKey & SubBytes
  • 8 clock cycles: ShiftRows

32 clock cycles: MixColumns 1776 clock cycles

slide-22
SLIDE 22

22

Embedded Security Group

  • 1 scan FF (state)
  • 1 clock gating
  • 7 extra FF (shared with MC)
  • the largest difference compared to state of the art

Bit‐Serial AES‐128, ENC only (key)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-23
SLIDE 23

23

Embedded Security Group

  • 27 scan FF (state) + 1 scan FF (key)
  • no clock gating, no enable signal
  • MC‐1=MC3, SR‐1=SR3 (no extra logic)

Bit‐Serial AES‐128, ENC & DEC (state)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-24
SLIDE 24

24

Embedded Security Group

Results (AES‐128)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

[2] Banik, Bogdanov, Regazzoni: Atomic‐AES: A compact implementation of the AES enc/dec core. INDOCRYPT 2016 [3] Banik, Bogdanov, Regazzoni: Atomic‐AES v2.0. ePrint Archive: Report 2016/1005 [21] Moradi, Poschmann, Ling, Paar, Wang: Pushing the limits: A very compact and a TI of AES. EUROCRYPT 2011

slide-25
SLIDE 25

25

Embedded Security Group

Results (AES‐128)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

[2] Banik, Bogdanov, Regazzoni: Atomic‐AES: A compact implementation of the AES enc/dec core. INDOCRYPT 2016 [3] Banik, Bogdanov, Regazzoni: Atomic‐AES v2.0. ePrint Archive: Report 2016/1005 [21] Moradi, Poschmann, Ling, Paar, Wang: Pushing the limits: A very compact and a TI of AES. EUROCRYPT 2011

slide-26
SLIDE 26

26

Embedded Security Group

Results (AES‐128)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

[2] Banik, Bogdanov, Regazzoni: Atomic‐AES: A compact implementation of the AES enc/dec core. INDOCRYPT 2016 [3] Banik, Bogdanov, Regazzoni: Atomic‐AES v2.0. ePrint Archive: Report 2016/1005 [21] Moradi, Poschmann, Ling, Paar, Wang: Pushing the limits: A very compact and a TI of AES. EUROCRYPT 2011

Visconti, Schiavo, Peralta: Improved upper bounds for the expected circuit complexity of dense systems of linear equations over GF(2). ePrint 2017/194 David Canright: A Very Compact S‐Box for AES. CHES 2005

slide-27
SLIDE 27

27

Embedded Security Group

Results (AES‐128)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

[2] Banik, Bogdanov, Regazzoni: Atomic‐AES: A compact implementation of the AES enc/dec core. INDOCRYPT 2016 [3] Banik, Bogdanov, Regazzoni: Atomic‐AES v2.0. ePrint Archive: Report 2016/1005 [21] Moradi, Poschmann, Ling, Paar, Wang: Pushing the limits: A very compact and a TI of AES. EUROCRYPT 2011

AES as a lightweight cipher?

slide-28
SLIDE 28

28

Embedded Security Group

Bit‐Serial PRESENT

  • the same principle for Sbox
  • the diffusion layer: bit‐permutation network

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-29
SLIDE 29

29

Embedded Security Group

Bit‐Serial PRESENT

  • the same principle for Sbox
  • the diffusion layer: bit‐permutation network

– our approach: two‐level permutation

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

the same independently found by Reis, Aranha, López: PRESENT Runs Fast ‐ Efficient and Secure Implementation in Software. CHES 2017

slide-30
SLIDE 30

30

Embedded Security Group

Results (PRESENT)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

[31] Ya, Khoo, Poschmann, Henricksen: EPCBC ‐ A Block Cipher Suitable for Electronic Product Code

  • Encryption. CANS 2011
slide-31
SLIDE 31

31

Embedded Security Group

Skinny

  • first glance: iterative Sbox construction helps
  • reality: the parallel technique still better

– not fully iterative (last round different) – Sbox itself small – Bit‐serial already slow

  • becomes almost 4 times slower
  • the same for 8‐bit variant

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-32
SLIDE 32

32

Embedded Security Group

Conclusions

  • not anymore monopoly on bit‐serial and scalable

architecture by Simon & Speck

  • iterative Sbox not necessarily helps
  • small Sboxes in lightweight crypto anyways

– see GIFT: A Small PRESENT. CHES 2017

  • diffusion layer more important to enable bit‐serialization

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-33
SLIDE 33

33

Embedded Security Group

Conclusions

  • not anymore monopoly on bit‐serial and scalable

architecture by Simon & Speck

  • iterative Sbox not necessarily helps
  • small Sboxes in lightweight crypto anyways

– see GIFT: A Small PRESENT. CHES 2017

  • diffusion layer more important to enable bit‐serialization

– Skinny < PRESENT < GIFT

  • (for 64‐bit state & 128‐bit key)

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-34
SLIDE 34

34

Embedded Security Group

Conclusions

  • not anymore monopoly on bit‐serial and scalable

architecture by Simon & Speck

  • iterative Sbox not necessarily helps
  • small Sboxes in lightweight crypto anyways

– see GIFT: A Small PRESENT. CHES 2017

  • diffusion layer more important to enable bit‐serialization

– Skinny < PRESENT < GIFT

  • (for 64‐bit state & 128‐bit key)
  • latency high anyway

– high energy consumption, but expected low power consumption

CHES 2017 | Taipei | 28. Sep 2017 Amir Moradi

slide-35
SLIDE 35

Thanks! any questions?

Embedded Security Group, Ruhr University Bochum, Germany

amir.moradi@rub.de