Towards Green Cryptography: a Comparison of Lightweight Ciphers from - - PowerPoint PPT Presentation

▶
towards green cryptography a comparison of lightweight
SMART_READER_LITE
LIVE PREVIEW

Towards Green Cryptography: a Comparison of Lightweight Ciphers from - - PowerPoint PPT Presentation

Dec 22, 2022 427 likes •934 views

Towards Green Cryptography: a Comparison of Lightweight Ciphers from the Energy Viewpoint St ephanie Kerckhof, Fran cois Durvaux, C edric Hoquet, David Bol, Fran cois-Xavier Standaert CHES 2012 September 2012 UCL Crypto Group

slide-1
SLIDE 1

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 1

Towards Green Cryptography: a Comparison of Lightweight Ciphers from the Energy Viewpoint

St´ ephanie Kerckhof, Fran¸ cois Durvaux, C´ edric Hoquet, David Bol, Fran¸ cois-Xavier Standaert CHES 2012 – September 2012

slide-2
SLIDE 2

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 2

Context

◮ More lightweight devices in more applications

slide-3
SLIDE 3

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 3

Outline

1 Motivations 2 This Work 3 Observations 4 Conclusion

slide-4
SLIDE 4

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES

slide-5
SLIDE 5

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES TEA NOEKEON

slide-6
SLIDE 6

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES TEA NOEKEON ICEBERG

slide-7
SLIDE 7

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES TEA NOEKEON ICEBERG HIGHT mCrypton SEA

slide-8
SLIDE 8

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES TEA NOEKEON ICEBERG HIGHT mCrypton SEA PRESENT

slide-9
SLIDE 9

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES TEA NOEKEON ICEBERG HIGHT mCrypton SEA PRESENT KATAN TWIS MIBS

slide-10
SLIDE 10

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES TEA NOEKEON ICEBERG HIGHT mCrypton SEA PRESENT KATAN TWIS MIBS Piccolo LBlock

slide-11
SLIDE 11

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES TEA NOEKEON ICEBERG HIGHT mCrypton SEA PRESENT KATAN TWIS MIBS Piccolo LBlock KLEIN

slide-12
SLIDE 12

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES TEA NOEKEON ICEBERG HIGHT mCrypton SEA PRESENT KATAN TWIS MIBS Piccolo LBlock KLEIN

◮ Many lightweight ciphers

slide-13
SLIDE 13

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 4

Lightweight Ciphers

2002 2004 2006 2008 2010 2012 AES TEA NOEKEON ICEBERG HIGHT mCrypton SEA PRESENT KATAN TWIS MIBS Piccolo LBlock KLEIN

◮ Many lightweight ciphers ◮ Few comparative studies → Lack of standardization? ◮ Existing implementations → Different technologies

→ Focused on gate count

slide-14
SLIDE 14

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 5

What is Lightweight?

slide-15
SLIDE 15

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 5

What is Lightweight?

I’m lightweight

slide-16
SLIDE 16

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 5

What is Lightweight?

I’m lightweight

slide-17
SLIDE 17

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 5

What is Lightweight?

I’m lightweight

slide-18
SLIDE 18

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 5

What is Lightweight?

I’m lightweight

slide-19
SLIDE 19

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 6

What is Lightweight?

◮ Which criteria?

→ Low area? → Low power? → Low energy? → Still fast?

◮ Limitation: Relativity of metrics

→ Possibility to optimize one criteria at the expense

  • f another one

I’m lightweight

slide-20
SLIDE 20

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 7

How Relevant is Lightweight Cryptography?

◮ Changing algorithm is expensive ◮ How much do we gain compared to ◮ Hardware design choices (e.g. architecture) ◮ Implementation choices (e.g. frequency/voltage scaling)

slide-21
SLIDE 21

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 8

Outline

1 Motivations 2 This Work 3 Observations 4 Conclusion

slide-22
SLIDE 22

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 9

This Work

Algorithms choice

◮ Block and key sizes ◮ Different types of key scheduling ◮ Different combinations of encryption/decryption

Block Key Ciphers 128 128 aes noekeon 64 128 hight iceberg 64 80 katan present

slide-23
SLIDE 23

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 10

This Work

Flexible architecture

◮ 3 core options (Enc, Dec, Enc/Dec) ◮ Unrolling parameter Nr

slide-24
SLIDE 24

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 11

This Work

Technology: Low-power 65 nm CMOS Comparative study

◮ At fixed frequency f100 ◮ At maximum frequency fmax (max. area penalty = 10%) ◮ For all metrics

Area Frequency Power Energy Throughput Frequency/Voltage scaling Eop = 1

2NswCLV2 dd + Eleak

slide-25
SLIDE 25

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 12

Outline

1 Motivations 2 This Work 3 Observations Interpretation of Synthesis Results Impact of Algorithmic Design Choices 4 Conclusion

slide-26
SLIDE 26

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 13

Critical Path

Expectation: Number of rounds x 2 ⇒ Critical path x 2

0.5 1 2 4 8 1 2 4 8 Number of rounds Critical path [ns]

NOEKEON HIGHT

slide-27
SLIDE 27

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 13

Critical Path

Expectation: Number of rounds x 2 ⇒ Critical path x 2

0.5 1 2 4 8 1 2 4 8 Number of rounds Critical path [ns]

NOEKEON HIGHT

slide-28
SLIDE 28

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 13

Critical Path

Expectation: Number of rounds x 2 ⇒ Critical path x 2 Observation: Critical path not always in the round logic

0.5 1 2 4 8 1 2 4 8 Number of rounds Critical path [ns]

NOEKEON HIGHT

slide-29
SLIDE 29

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 14

Area

Naive expectation: Number of rounds x 2 ⇒ Area x 2

Number of rounds Area [GE] 28 29 210 211 212 213 214 215 216 1 2 4 8 16 32

PRESENT KATAN

slide-30
SLIDE 30

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 14

Area

Naive expectation: Number of rounds x 2 ⇒ Area x 2

Number of rounds Area [GE] 28 29 210 211 212 213 214 215 216 1 2 4 8 16 32

PRESENT KATAN

slide-31
SLIDE 31

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 14

Area

Naive expectation: Number of rounds x 2 ⇒ Area x 2 Observation: Main component of area = state register

Number of rounds Area [GE] 28 29 210 211 212 213 214 215 216 1 2 4 8 16 32

PRESENT KATAN

slide-32
SLIDE 32

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 15

Throughput

Expectation: Round unrolling should not make sense at fmax

Number of rounds Throughput [Mbits/s] 100 200 300 400 1 2 4 8

16 32

ICEBERG KATAN

slide-33
SLIDE 33

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 15

Throughput

Expectation: Round unrolling should not make sense at fmax

Number of rounds Throughput [Mbits/s] 100 200 300 400 1 2 4 8

16 32

ICEBERG KATAN

slide-34
SLIDE 34

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 15

Throughput

Expectation: Round unrolling should not make sense at fmax Observation: And for extremely simple rounds

Number of rounds Throughput [Mbits/s] 100 200 300 400 1 2 4 8

16 32

ICEBERG KATAN

slide-35
SLIDE 35

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 16

Energy

Expectation: Energy stable with number of rounds

Number of rounds Energy per bit [pJ]

NOEKEON PRESENT HIGHT KATAN ICEBERG

1 2 4 8 16 1 2 4 8 16 32

slide-36
SLIDE 36

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 16

Energy

Expectation: Energy stable with number of rounds Observation: Energy more or less stable

Number of rounds Energy per bit [pJ]

NOEKEON PRESENT HIGHT KATAN ICEBERG

1 2 4 8 16 1 2 4 8 16 32

slide-37
SLIDE 37

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 16

Energy

Expectation: Energy stable with number of rounds Observation: Trend observed later for KATAN

Number of rounds Energy per bit [pJ]

NOEKEON PRESENT HIGHT KATAN ICEBERG

1 2 4 8 16 1 2 4 8 16 32

slide-38
SLIDE 38

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 17

Outline

1 Motivations 2 This Work 3 Observations Interpretation of Synthesis Results Impact of Algorithmic Design Choices 4 Conclusion

slide-39
SLIDE 39

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 18

Encryption Only

Energy per bit [pJ]

1 2 4 8 16 1 2−2 2−4

Throughput/Area [Mbits/sµm2]

1 2 4 8 16 1 2−2 2−4

ICEBERG AES HIGHT KATAN PRESENT NOEKEON

slide-40
SLIDE 40

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 18

Impact of Key Scheduling

Energy per bit [pJ]

1 2 4 8 16 1 2−2 2−4

Throughput/Area [Mbits/sµm2]

1 2 4 8 16 1 2−2 2−4

ICEBERG AES HIGHT KATAN PRESENT NOEKEON

slide-41
SLIDE 41

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 18

Encryption/Decryption

Energy per bit [pJ]

1 2 4 8 16 1 2−2 2−4

Throughput/Area [Mbits/sµm2]

1 2 4 8 16 1 2−2 2−4

ICEBERG AES HIGHT KATAN PRESENT NOEKEON

slide-42
SLIDE 42

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 18

”On the Fly” Key Scheduling

Energy per bit [pJ]

1 2 4 8 16 1 2−2 2−4

Throughput/Area [Mbits/sµm2]

1 2 4 8 16 1 2−2 2−4

ICEBERG AES HIGHT KATAN PRESENT NOEKEON

slide-43
SLIDE 43

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 18

  • vs. not ”On the Fly” Key Scheduling

Energy per bit [pJ]

1 2 4 8 16 1 2−2 2−4

Throughput/Area [Mbits/sµm2]

1 2 4 8 16 1 2−2 2−4

ICEBERG AES HIGHT KATAN PRESENT NOEKEON

slide-44
SLIDE 44

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 19

Efficiency

Throughput/(Energy x Area) 0.1 0.2 0.3 0.4 0.5 0.6 NOEKEON KATAN PRESENT

NOEKEON KATAN PRESENT

slide-45
SLIDE 45

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 19

Efficiency

Observation: Definition of round is arbitrary

Throughput/(Energy x Area) 0.1 0.2 0.3 0.4 0.5 0.6 NOEKEON KATAN PRESENT 18 cycles/enc. 17 cycles/enc. 17 cycles/enc.

NOEKEON KATAN PRESENT

slide-46
SLIDE 46

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 20

Frequency/Voltage Scaling

Observation: Better energy gain with frequency/voltage scaling

Energy per bit [pJ] Algorithm choice

1 2 3 4

Vdd [V]

1 2 3 4 1.2 1 0.8 0.6 0.5 0.4

NOEKEON PRESENT HIGHT KATAN ICEBERG AES

slide-47
SLIDE 47

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 21

Outline

1 Motivations 2 This Work 3 Observations 4 Conclusion

slide-48
SLIDE 48

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 22

Conclusion

Comparative studies are usefull Energy: Interesting efficiency metric Algorithm design

◮ Definition of round is arbitrary ◮ Impact of key scheduling ◮ Efficient combination of encryption and decryption

AES is a low energy cipher Voltage scaling: If allowed, has strong impact on energy

slide-49
SLIDE 49

UCL Crypto Group

Microelectronics Laboratory

Towards Green Cryptography - September 2012 23

Thank you!