Fixslicing - Application to some NIST LWC round 2 candidates Alexandre Adomnicai Thomas Peyrin Nanyang Technological University, Singapore Temasek Laboratories, Singapore Lightweight Cryptography Workshop 2020
What this talk is about B Constant-time software implementations on 32-bit platforms B Application of the fixslicing implementation strategy to some NIST LWC round 2 candidates built upon AES-128, GIFT-128 and Skinny-128 primitives B Benchmarking results on ARM Cortex-M3 for payloads up to 256 bytes Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 2 / 14
B Fixsliced GIFT-128 runs about 7x faster on ARM Cortex-M3 compared to a naive bitsliced implementation B Consists in fixing a slice to never move and adjusting the others for the S-box layer The fixslicing implementation strategy B Initially introduced as a new representation for the GIFT block ciphers [ANP20] Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 3 / 14
B Consists in fixing a slice to never move and adjusting the others for the S-box layer The fixslicing implementation strategy B Initially introduced as a new representation for the GIFT block ciphers [ANP20] B Fixsliced GIFT-128 runs about 7x faster on ARM Cortex-M3 compared to a naive bitsliced implementation Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 3 / 14
The fixslicing implementation strategy B Initially introduced as a new representation for the GIFT block ciphers [ANP20] B Fixsliced GIFT-128 runs about 7x faster on ARM Cortex-M3 compared to a naive bitsliced implementation B Consists in fixing a slice to never move and adjusting the others for the S-box layer Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 3 / 14
Classical representation of GIFT-128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k i S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k i +1 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k i +2 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k i +3 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k i +4 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S
Fixsliced representation of GIFT-128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k ′ i S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k ′ i +1 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k ′ i +2 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k ′ i +3 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S k i +4 S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S
NOPE! B Many ciphers spend cycles to move bits within the slices to achieve better diffusion ⇒ alternative representations might be valuable even for more complex linear layers Genericity of the fixslicing technique Figure: Extract from [ANP20] B So, only of interest for Substitution-bitPermutation Networks (SbPN)? Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 6 / 14
Genericity of the fixslicing technique Figure: Extract from [ANP20] B So, only of interest for Substitution-bitPermutation Networks (SbPN)? NOPE! B Many ciphers spend cycles to move bits within the slices to achieve better diffusion ⇒ alternative representations might be valuable even for more complex linear layers Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 6 / 14
Application to AES-like ciphers SubBytes ShiftRows MixColumns AddRoundKey 2 3 1 1 <<< 1 1 2 3 1 S × 1 1 2 3 <<< 2 3 1 1 2 <<< 3 Figure: AES round function Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 7 / 14
Application to AES-like ciphers ART ShiftRows MixColumns >>> 1 SC AC >>> 2 >>> 3 Figure: Skinny round function Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 7 / 14
Application to AES-like ciphers ART ShiftRows MixColumns >>> 1 SC AC >>> 2 >>> 3 Figure: Skinny round function B Performance improvements for AES and Skinny-128 on ARM Cortex-M and E31 RISC-V processors [AP20] Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 7 / 14
Implementation results on ARM Cortex-M3 300 2 blocks 250 cycles per byte (cpb) 200 160 150 116 100 83 73 50 0 AES-128 GIFTb-128 Skinny-128-384 Skinny-128-384+ Performance for constant-time implementations on ARM Cortex-M3 Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 8 / 14
Implementation results on ARM Cortex-M3 300 1 block 264 2 blocks 250 cycles per byte (cpb) 200 191 167 160 150 116 100 83 73 73 50 0 AES-128 GIFTb-128 Skinny-128-384 Skinny-128-384+ Performance for constant-time implementations on ARM Cortex-M3 Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 8 / 14
Bitslicing a single block for Skinny-128 b 0 b 1 b 2 b 3 b 4 b 5 b 6 b 7 b 2 b 3 b 7 b 4 b 6 b 1 b 0 b 5 Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 9 / 14
Bitslicing a single block for Skinny-128 b 0 b 1 b 2 b 3 b 4 b 5 b 6 b 7 1st layer 2nd layer 3rd layer 4th layer last permutation output b 0 b 4 b 0 b 4 b 7 b 1 b 7 b 1 b 7 b 0 b 2 b 6 b 1 b 5 b 1 b 2 b 4 b 2 b 4 b 5 b 4 b 5 b 3 b 1 b 2 b 6 b 5 b 3 b 5 b 3 b 2 b 6 b 2 b 6 b 7 b 0 b 3 b 7 b 6 b 7 b 6 b 0 b 3 b 0 b 3 b 1 b 4 b 5 b 2 b 3 b 7 b 4 b 6 b 1 b 0 b 5 Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 9 / 14
Speed optimized Skinny tweakey schedule LFSR LFSR P T Extracted round tweakey (a) Single round Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 10 / 14
Speed optimized Skinny tweakey schedule LFSR LFSR P T Extracted round tweakey (a) Single round LFSR LFSR P 2 T LFSR LFSR Extracted Extracted round tweakey round tweakey (b) Double round Figure: Skinny tweakey schedule round function Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 10 / 14
Speed optimized Skinny tweakey schedule LFSR 3 LFSR 3 LFSR 3 LFSR 3 .... LFSR 3 LFSR 3 LFSR 3 LFSR 3 .... LFSR 3 LFSR 3 LFSR 3 LFSR 3 .... LFSR 3 LFSR 3 LFSR 3 LFSR 3 .... TK 3 LFSR 2 LFSR 2 LFSR 2 LFSR 2 .... LFSR 2 LFSR 2 LFSR 2 LFSR 2 .... LFSR 2 LFSR 2 LFSR 2 LFSR 2 .... LFSR 2 LFSR 2 LFSR 2 LFSR 2 .... TK 2 .... .... .... .... TK 1 P 2 P 4 P 14 T T T RTK 0 RTK 1 RTK 2 RTK 3 RTK 4 RTK 13 RTK 14 RTK 15 .... Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 11 / 14
Benchmark results on ARM Cortex-M3 GIFT-COFB SAEAES-128-64-128 1.2 1e5 1.2 1e5 1.0 1.0 0.8 0.8 0.6 0.6 Skinny-AEAD-M1+ 0.4 0.4 1.2 1e5 0.2 0.2 1.0 0.0 0.0 0 32 64 96 128 160 192 224 256 0 32 64 96 128 160 192 224 256 0.8 0.6 Romulus-M Romulus-N 0.4 1.2 1e5 1.2 1e5 0.2 1.0 1.0 0.0 0 32 64 96 128 160 192 224 256 0.8 0.8 0.6 0.6 0.4 0.4 0.2 0.2 0.0 0.0 0 32 64 96 128 160 192 224 256 0 32 64 96 128 160 192 224 256 Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 12 / 14
What about other candidates? B Fixslicing may be valuable for other candidates ! ◦ PHOTON -Beetle? (AES-like primitive) ◦ Elephant? (Spongent is an SbPN) ◦ ... Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 13 / 14
What about other candidates? B Fixslicing may be valuable for other candidates ! ◦ PHOTON -Beetle? (AES-like primitive) ◦ Elephant? (Spongent is an SbPN) ◦ ... B Some primitives are fixsliced by design (e.g. Ascon-p) Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 13 / 14
Thanks for your attention! Questions? Feel free to contact us at firstname.lastname@ntu.edu.sg Fixslicing - Application to some NIST LWC round 2 candidates - LWC Workshop 2020 14 / 14
Recommend
More recommend
