The Simeck Family of Lightweight Block Ciphers

Transcription

1 The Simeck Family of Lightweight Block Ciphers Gagqiag Yag, Bo Zhu, Valeti Suder, Mark D. Aagaard, ad Guag Gog Electrical ad Computer Egieerig, Uiversity of Waterloo Sept 5, 205 Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, 205 / 25

2 Outlie Simeck s Desig Goals 2 Desig Specificatios ad Ratioales 3 Hardware Implemetatios Results 4 Results Compariso betwee Simeck ad SIMON 5 Security Aalysis 6 Coclusios Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

3 Simeck s Desig Goals Outlie Simeck s Desig Goals 2 Desig Specificatios ad Ratioales 3 Hardware Implemetatios Results 4 Results Compariso betwee Simeck ad SIMON 5 Security Aalysis 6 Coclusios Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

4 Lightweight Cryptography Simeck s Desig Goals Lightweight cryptography is devised to provide suitable, secure, ad compact ciphers (less tha 2000 GEs) that fit ito the resource costraied devices, such as passive RFID tags ad wireless sesor etwork odes. RFID tags Wireless sesor etwork odes Block ciphers: TEA, XTEA, PRESENT, KATAN, LED, EPCBC, KLEIN, LBlock, Piccolo, Twie, SIMON, ad SPECK. Stream ciphers: Trivium, Grai, WG (WG-5, WG-7, WG-8). Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

5 Simeck s Desig Goals A Smaller Block Cipher tha SIMON SIMON is optimized for hardware ad SPECK is optimized for software [Beaulieu et al., 203]. message key roud fu key sched key cost How to desig a smaller cipher family tha SIMON? The registers caot be chaged. We ca reduce the areas of oly the roud fuctio, key schedule, ad key costat. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

6 Simeck s Desig Goals A Smaller Block Cipher tha SIMON SIMON is optimized for hardware ad SPECK is optimized for software [Beaulieu et al., 203]. message key roud fu key sched key cost How to desig a smaller cipher family tha SIMON? The registers caot be chaged. We ca reduce the areas of oly the roud fuctio, key schedule, ad key costat. Simeck Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

7 Simeck s Desig Goals Simeck: A Family of Lightweight Block Ciphers Simeck is desiged to have similar security levels as SIMON but with smaller area. Simeck is desiged by combiig the best features of SIMON ad SPECK. Roud fuctio. Use a modified versio of SIMON s roud fuctio. Key schedule. Use roud fuctio for key schedule, similar to SPECK. Key costat. Use LFSR-based costat for key schedule, similar to SIMON, but simpler. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

8 Simeck s Desig Goals Simeck: A Family of Lightweight Block Ciphers Simeck is desiged to have similar security levels as SIMON but with smaller area. Simeck is desiged by combiig the best features of SIMON ad SPECK. Roud fuctio. Use a modified versio of SIMON s roud fuctio. Key schedule. Use roud fuctio for key schedule, similar to SPECK. Key costat. Use LFSR-based costat for key schedule, similar to SIMON, but simpler. Simeck has three istaces. Simeck32/64, Simeck48/96, Simeck64/28. The umber of rouds for Simeck are idetical with the correspodig SIMON. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

9 Desig Specificatios ad Ratioales Outlie Simeck s Desig Goals 2 Desig Specificatios ad Ratioales 3 Hardware Implemetatios Results 4 Results Compariso betwee Simeck ad SIMON 5 Security Aalysis 6 Coclusios Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

10 Desig Specificatios ad Ratioales Roud Fuctio msg i+ msg i msg i+ msg i key i key i SIMON msg i+2 Simeck msg i+2 is the word size (6, 24, 32). Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

11 Desig Specificatios ad Ratioales Roud Fuctio i the Parallel Architecture i mode msg b d i msg a i mode msg b d i msg a b b 0 a a 0 b b 0 a a 0 d out d out 8 2 k i 5 k i SIMON Simeck The parallel architecture processes roud per clock cycle ad the datapath is -bit width. Differet shift umbers do ot affect the area i parallel architecture. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

12 Desig Specificatios ad Ratioales Roud Fuctio i the Fully Serialized Architecture i mode d i d out msg b msg a b b 2 b 8 a a 2 a 8 a0 i mode d i b msg b d out msg a b 5 b0 a a 5 a0 ce ce 2 MUX MUX2 ce 8 MUX8 ce ce 5 MUX MUX5 SIMON (ki)l Simeck (ki)l The fully serialized architecture processes bit per clock cycle ad the datapath is -bit width. Differet shift umbers affect the area i the partially serialized architecture i hardware. Reduce MUX (multiplexer) for the fully serialized architecure. Simplify logic to select the MUXes. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

13 Desig Specificatios ad Ratioales Key Schedule i the Parallel Architecture key i i mode keyd keyc keyb keya d d0 c c0 b b0 a a0 ki 3 C (zj)i SIMON key i i mode keyd keyc keyb keya d d0 c c0 b b0 a a0 ki Simeck 5 C (zj)i Similar as the roud fuctio, the parallel architecture processes roud per clock cycle ad the datapath is -bit width. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, 205 / 25

14 i mode b b 0 a d a 0 d 0 Simplified Key Schedule c 0 Desig Specificatios ad Ratioales c c 0 k i b b 0 a a 0 k i 3 C (z j ) i 5 C (z j ) i SIMON Simeck The combiatioal circuit (dashed box i above) i the key schedule of SIMON ad Simeck i the parallel architecture are show as follows: SIMON Simeck (2 + ) XOR + ( ) XNOR ( + ) XOR + ( ) XNOR + AND I geeral, oe XOR gate is larger tha oe AND gate. Thus, Simeck s key schedule is smaller tha SIMON. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

15 Simplified Key Costat Desig Specificatios ad Ratioales The primitive polyomials for the LFSRs to geerate the key costats for Simeck ad SIMON. Simeck SIMON 32/64 X 5 + X 2 + X 5 + X 4 + X 2 + X + 48/96 X 5 + X 2 + X 5 + X 3 + X 2 + X + 64/28 X 6 + X + X 5 + X 3 + X 2 + X + Simeck s are all 2 XOR gates (4 GEs) less tha the oes used i SIMON. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

16 Desig Specificatios ad Ratioales Key Schedule i the Fully Serialized Architecture i mode key i key d key c key b key a b b 5 b 0 a (k d a 5 a i) l d 5 d 0 c c 5 c 0 0 ce ce 5 MUX MUX5 [C (z j) i] l Simeck Similar as the roud fuctio, the fully serialized architecture processes bit per clock cycle ad the datapath is -bit width. Differet shift umbers affect the area i the fully serialized architecture, as roud fuctio does. Reduce MUX. Simplify logic to select the MUXes. The combiatioal circuit (dashed box) is also decreased. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

17 Hardware Implemetatios Results Outlie Simeck s Desig Goals 2 Desig Specificatios ad Ratioales 3 Hardware Implemetatios Results 4 Results Compariso betwee Simeck ad SIMON 5 Security Aalysis 6 Coclusios Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

18 Hardware Implemetatios Results Our Implemetatio Results of Simeck32/64, 48/96, 64/28 i 30m Simeck Simeck32/64 Simeck48/96 CMOS 30m Partial Area (GEs) Max Throughput Total Power Total Power MHz serial Before P&R After P&R (MHz) (Kbps) (µw) (µw) -bit bit bit bit bit bit bit bit bit bit bit bit bit bit bit Simeck64/28 4-bit bit bit bit * Area obtaied by usig sythesis optio compile ultra oly. Area obtaied by usig sythesis optio compile ultra ad clock gatig. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

19 Hardware Implemetatios Results Our Implemetatio Results of SIMON32/64, 48/96, 64/28 i 30m SIMON SIMON32/64 SIMON48/96 CMOS 30m Partial Area (GEs) Max Throughput Total Power Total Power NSA MHz serial Before P&R After P&R Before P&R (MHz) (Kbps) (µw) (µw) -bit bit bit bit bit bit bit bit bit bit bit bit bit bit bit SIMON64/28 4-bit bit bit bit * Area obtaied by usig sythesis optio compile ultra oly. Area obtaied by usig sythesis optio compile ultra ad clock gatig. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

20 Results Compariso betwee Simeck ad SIMON Outlie Simeck s Desig Goals 2 Desig Specificatios ad Ratioales 3 Hardware Implemetatios Results 4 Results Compariso betwee Simeck ad SIMON 5 Security Aalysis 6 Coclusios Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

21 Results Compariso betwee Simeck ad SIMON Area (before the Place ad Route) Comparisos i CMOS 30m /28 Areas (GEs) / /64 NSA_SIMON Our_SIMON Our_Simeck Partial Serialized Size (par_sz) Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

22 Results Compariso betwee Simeck ad SIMON Area Comparisos betwee Simeck32/64 ad SIMON32/64 Breakdow of the Results (before the Place ad Route) i CMOS 30m Compoets Parallel (GEs) Fully Serialized (GEs) Simeck SIMON Differece Simeck SIMON Differece Cotrol Roud (comb) Datapath Key (comb) Regs + MUXes Totals Compile simple Compile ultra Compile ultra + clock gatig * Our ow SIMON results. Sythesis optios. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

23 Results Summary Results Compariso betwee Simeck ad SIMON Fully serialized architecture. The roud fuctio, key schedule ad key costat modules of SIMON32/64 accout for oly 6.4% of the total area. Simeck32/64 reduces this by 46%, which leads to 2.3% smaller total area i compariso to our implemetatios of SIMON32/64 ad 3.4% smaller tha the origial results i 30m. Similarly, Simeck48/96, Simeck64/28 are 3.3%, 3.5% smaller tha the origial results i 30m. Parallel architecture. Simeck32/64, 48/96, 64/28 are 3.7%, 3.3%, 3.7% respectively smaller tha the origial results i 30m. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

24 Security Aalysis Outlie Simeck s Desig Goals 2 Desig Specificatios ad Ratioales 3 Hardware Implemetatios Results 4 Results Compariso betwee Simeck ad SIMON 5 Security Aalysis 6 Coclusios Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

25 Security Aalysis Security Aalysis Chagig the shift umbers of the roud fuctio iflueces the security [Kölbl et al., CRYPTO 5]. Liear ad differetial diffusio. We made a trade-off betwee security ad area for Simeck. Simeck beefits from SIMON/SPECK s security aalysis due to the similarity betwee SIMON/SPECK ad Simeck [Kölbl ad Roy, eprit 205/706], [Bagheri, eprit 205/76]. Security aalysis summary. Cipher SIMON attacked rouds/total rouds Simeck attacked rouds/total rouds 32/64 23/32 72% (liear hull) 20/ % (impossible differetial) 48/96 25/36 69% (liear hull) 26/36 72% (differetial) 64/28 3/44 70% (liear hull) 33/44 75% (differetial) * [Beaulieu et al., eprit 205/585]. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

26 Coclusios Outlie Simeck s Desig Goals 2 Desig Specificatios ad Ratioales 3 Hardware Implemetatios Results 4 Results Compariso betwee Simeck ad SIMON 5 Security Aalysis 6 Coclusios Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

27 Coclusios Coclusios We have preseted Simeck: a ew family of lightweight block ciphers. We have provided a extesive exploratio for differet hardware architectures i order to make a balace betwee area, throughput, ad power cosumptio for SIMON ad Simeck i both CMOS 30m ad 65m ASICs. We have show that it is possible to desig a smaller cipher tha SIMON i terms of area ad power cosumptio. Simeck is slightly more vulerable tha SIMON to reduced roud attacks, but still has sufficiet margi for real-world applicatios. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

28 Appedix I: Our Implemetatio Results of Simeck32/64, 48/96, 64/28 i 65m Simeck Simeck32/64 Simeck48/96 CMOS 65m Partial Area (GEs) Max Throughput Total Power Total Power MHz Serial Before P&R After P&R (MHz) (Kbps) (µw) (µw) -bit bit bit bit bit bit bit bit bit bit bit bit bit bit bit Simeck64/28 4-bit bit bit bit * Area obtaied by usig sythesis optio compile ultra oly. Area obtaied by usig sythesis optio compile ultra ad clock gatig. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

29 Appedix II: Our Implemetatio Results of SIMON32/64, 48/96, 64/28 i 65m SIMON SIMON32/64 SIMON48/96 CMOS 65m Partial Area (GEs) Max Throughput Total Power Total Power MHz Serial Before P&R After P&R (MHz) (Kbps) (µw) (µw) -bit bit bit bit bit bit bit bit bit bit bit bit bit bit bit SIMON64/28 4-bit bit bit bit * Area obtaied by usig sythesis optio compile ultra oly. Area obtaied by usig sythesis optio compile ultra ad clock gatig. Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25

30 Area (before the Place ad Route) Comparisos i CMOS 65m /28 Areas (GEs) / /64 Our_SIMON Our_Simeck Partial Serialized Size (par_sz) Yag, Zhu, Suder, Aagaard, Gog Simeck Family (CHES 205) Sept 5, / 25