The Simeck Family of Lightweight Block Ciphers Gangqiang Yang , Bo Zhu, Valentin Suder, Mark D. Aagaard, and Guang Gong Electrical and Computer Engineering, University of Waterloo Sept 15, 2015 Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 1 / 25
Outline Simeck’s Design Goals 1 Design Specifications and Rationales 2 Hardware Implementations Results 3 Results Comparison between Simeck and SIMON 4 Security Analysis 5 Conclusions 6 Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 2 / 25
Simeck’s Design Goals Outline Simeck’s Design Goals 1 Design Specifications and Rationales 2 Hardware Implementations Results 3 Results Comparison between Simeck and SIMON 4 Security Analysis 5 Conclusions 6 Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 3 / 25
Simeck’s Design Goals Lightweight Cryptography Lightweight cryptography is devised to provide suitable, secure, and compact ciphers (less than 2000 GEs) that fit into the resource constrained devices, such as passive RFID tags and wireless sensor network nodes. RFID tags Wireless sensor network nodes Block ciphers: TEA, XTEA, PRESENT, KATAN, LED, EPCBC, KLEIN, LBlock, Piccolo, Twine, S IMON , and S PECK . Stream ciphers: Trivium, Grain, WG (WG-5, WG-7, WG-8). Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 4 / 25
Simeck’s Design Goals A Smaller Block Cipher than S IMON S IMON is optimized for hardware and S PECK is optimized for software [Beaulieu et al. , 2013] . message key round key key fun sched const How to design a smaller cipher family than S IMON ? The registers cannot be changed. We can reduce the areas of only the round function, key schedule, and key constant. Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 5 / 25
Simeck’s Design Goals A Smaller Block Cipher than S IMON S IMON is optimized for hardware and S PECK is optimized for software [Beaulieu et al. , 2013] . message key round key key fun sched const How to design a smaller cipher family than S IMON ? The registers cannot be changed. We can reduce the areas of only the round function, key schedule, and key constant. Simeck Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 5 / 25
Simeck’s Design Goals Simeck: A Family of Lightweight Block Ciphers Simeck is designed to have similar security levels as S IMON but with smaller area. Simeck is designed by combining the best features of S IMON and S PECK . Round function. – Use a modified version of S IMON ’s round function. Key schedule. – Use round function for key schedule, similar to S PECK . Key constant. – Use LFSR-based constant for key schedule, similar to S IMON , but simpler. Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 6 / 25
Simeck’s Design Goals Simeck: A Family of Lightweight Block Ciphers Simeck is designed to have similar security levels as S IMON but with smaller area. Simeck is designed by combining the best features of S IMON and S PECK . Round function. – Use a modified version of S IMON ’s round function. Key schedule. – Use round function for key schedule, similar to S PECK . Key constant. – Use LFSR-based constant for key schedule, similar to S IMON , but simpler. Simeck has three instances. Simeck32/64, Simeck48/96, Simeck64/128. The number of rounds for Simeck are identical with the corresponding S IMON . Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 6 / 25
Design Specifications and Rationales Outline Simeck’s Design Goals 1 Design Specifications and Rationales 2 Hardware Implementations Results 3 Results Comparison between Simeck and SIMON 4 Security Analysis 5 Conclusions 6 Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 7 / 25
Design Specifications and Rationales Round Function msg i+1 msg i msg i+1 msg i n n n n 1 8 5 2 1 n n key i key i n n msg i+2 msg i+2 S IMON Simeck n is the word size (16, 24, 32). Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 8 / 25
Design Specifications and Rationales Round Function in the Parallel Architecture d in d in n n n n i mode n i mode n 1 1 n n msg b msg a msg b msg a b n − 1 b 0 a n − 1 a 0 b n − 1 b 0 a n − 1 a 0 d out d out n n 1 n n � � � � 8 5 n n � � 2 1 n n k i k i � � n n S IMON Simeck The parallel architecture processes 1 round per clock cycle and the datapath is n -bit width. Different shift numbers do not affect the area in parallel architecture. Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 9 / 25
Design Specifications and Rationales Round Function in the Fully Serialized Architecture d out d out i mode i mode msg b msg a n msg b msg a n d in 1 d in 1 1 1 1 1 a n − 8 a 0 a n − 5 a 0 b n − 1 b n − 2 b n − 8 a n − 1 a n − 2 b n − 1 b n − 5 b 0 a n − 1 ce 8 1 1 1 1 1 1 1 1 1 MUX8 ce 1 ce 2 ce 1 ce 5 1 1 � � � � MUX1 MUX5 MUX1 MUX2 1 1 � � 1 1 ( k i ) l ( k i ) l � � 1 1 S IMON Simeck The fully serialized architecture processes 1 bit per clock cycle and the datapath is 1-bit width. Different shift numbers affect the area in the partially serialized architecture in hardware. Reduce 1 MUX (multiplexer) for the fully serialized architecure. Simplify logic to select the MUXes. Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 10 / 25
Design Specifications and Rationales Key Schedule in the Parallel Architecture n key in n n i mode 1 key d n key c key b key a b n − 1 a n − 1 d n − 1 d 0 c n − 1 c 0 b 0 a 0 n k i � 3 � 1 � n � ( z j ) i C � n S IMON n n key in n i mode 1 n key c key b key a key d d n − 1 d 0 c n − 1 c 0 b n − 1 b 0 a n − 1 a 0 n k i n � � 5 n � 1 n � ( z j ) i C � n Simeck Similar as the round function, the parallel architecture processes 1 round per clock cycle and the datapath is n -bit width. Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 11 / 25
Design Specifications and Rationales Simplified Key Schedule n � 3 � � � 5 n 1 � � 1 n � ( z j ) i n � ( z j ) i C C � � n n S IMON Simeck The combinational circuit (dashed box in above) in the key schedule of S IMON and Simeck in the parallel architecture are shown as follows: S IMON (2 n + 1) XOR + ( n − 1 ) XNOR Simeck ( n + 1) XOR + ( n − 1 ) XNOR + n AND In general, one XOR gate is larger than one AND gate. Thus, Simeck’s key schedule is smaller than S IMON . Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 12 / 25
Design Specifications and Rationales Simplified Key Constant The primitive polynomials for the LFSRs to generate the key constants for Simeck and S IMON . Simeck S IMON X 5 + X 2 + 1 X 5 + X 4 + X 2 + X + 1 32/64 X 5 + X 2 + 1 X 5 + X 3 + X 2 + X + 1 48/96 X 6 + X + 1 X 5 + X 3 + X 2 + X + 1 64/128 Simeck’s are all 2 XOR gates (4 GEs) less than the ones used in S IMON . Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 13 / 25
Design Specifications and Rationales Key Schedule in the Fully Serialized Architecture i mode key d key c key b key a key in 1 1 1 1 ( k i ) l 1 c n − 1 c n − 5 a n − 1 d n − 1 d n − 5 d 0 c 0 b n − 1 b n − 5 b 0 a n − 5 a 0 1 1 1 1 1 1 ce 1 ce 5 1 MUX1 MUX5 � � 1 � 1 [ C � ( z j ) i ] l � 1 Simeck Similar as the round function, the fully serialized architecture processes 1 bit per clock cycle and the datapath is 1-bit width. Different shift numbers affect the area in the fully serialized architecture, as round function does. Reduce 1 MUX. Simplify logic to select the MUXes. The combinational circuit (dashed box) is also decreased. Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 14 / 25
Hardware Implementations Results Outline Simeck’s Design Goals 1 Design Specifications and Rationales 2 Hardware Implementations Results 3 Results Comparison between Simeck and SIMON 4 Security Analysis 5 Conclusions 6 Yang, Zhu, Suder, Aagaard, Gong Simeck Family (CHES 2015) Sept 15, 2015 15 / 25
Recommend
More recommend
