The Simon and Speck Block Ciphers on AVR 8-Bit Microcontrollers

Due to the demand for low-cost cryptosystems from industry, there spring up a lot of lightweight block ciphers which are excellent for some different implementation features. An innovative design is the block cipher PRINCE. To meet the requirement for low-latency and instantaneously encryption, NXP Semiconductors and its academic partners cooperate and design the low-latency block cipher PRINCE. Another good example is the block cipher LED which is very compact in hardware, and whose designers also aim to maintain a reasonable software performance. In this paper, we demonstrate how to achieve high software performance of these two ciphers on the AVR 8-bit microcontrollers using bitslice technique. Our bitsliced implementations speed up the execution of these two ciphers several times with less memory usage than previous work. In addition to these two nibble-oriented ciphers, we also evaluate the software performance of a newly proposed lightweight block cipher RECTANGLE, whose design takes bitslicing into consider. Our results show that RECTANGLE has very high ranks among the existing block ciphers on 8-bit microcontrollers in the real-world usage scenarios.

Nowadays, there is a strong demand for increasing the protection of resource-constrained devices such as Radio frequency identification (RFID) systems. Current cryptographic algorithms are sufficient for high-resource desktop computers. RFID systems are commonly used in high-security applications such as access control systems, transaction banking systems, and payment systems. The attacker attempts to mislead RFIDs for unauthorized access to services without payment or to circumvent security mechanisms by detecting a secret password. The biggest challenge in RFID systems is how to ensure successful protection against such infringements. Lightweight cryptography can provide security assurance for protecting RFID systems. This article presents a new ultra-lightweight cryptography algorithm for RFID systems called SLIM. SLIM is a 32-bit block cipher based on the Feistel structure since block ciphers are the most used cryptographic and provide very tight protection for IoT devices. The key challenge in designing a lightweight block cipher is to cope with performance, cost, and security. SLIM, like all symmetric block cipher, uses the same key for encryption and decryption. The proposed algorithm has an excellent performance in both hardware and software environments, with a limited implementation area, an acceptable cost/security for RFID systems, and an energy-efficient behaviour. SLIM has demonstrated high immunity against the most effective linear and differential cryptanalysis attacks and has a sufficient margin of defence against these attacks.

This chapter provides general requirements to modern block ciphers required for implementation at lightweight cryptographic transformations for critical distributed environment applications with Green IT conformance. It is given an overview of well-known block ciphers and lightweight primitives PRESENT and CLEFIA, defined at ISO/IEC 29192-2. It is given a specification of the lightweight block cipher Cypress that was recently developed and presented in Ukraine. Cypress does not use heavy computation operations, nor require any precomputed tables that allows efficient hardware implementation. The Cypress performance in software is approximately three times higher than AES one on Windows, Linux and Android platforms.

Today's headlines abound with the promised explosion of the Internet of things. Studies claim that there will be the existence of billions of internet connected devices in coming years. The small size and limited processing power of many connected devices could inhibit encryption and other robust security measure. Here cryptography plays a pivotal role. Also most of the devices available in the market today are resource constrained. Hence cryptographic solutions must be easy to implement and have high performance on a wide range of severely constrained devices. The relatively new field of lightweight cryptography provides significant advantages over existing algorithms when addressing security issues for highly constrained devices. In this project a detailed study of LBlock block cipher is done which is a lightweight cipher in both hardware and 8-bit platforms and an IP core is developed. The block size of LBlock is 64-bit and the key size is 80-bit and it can achieve competitive hardware and software performances when compared with other known lightweight block ciphers. The security evaluation shows that LBlock can achieve enough security margin against known attacks such as differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis and related-key attacks etc. LBlock cryptocore is designed, build and characterized for the efficient implementation in low resource devices. It can serve as a benchmark for the hardware design engineers to model devices that utilizes lightweight characteristics. LBlock cipher is implemented on Xilinx Spartan-6 FPGA (XC6LX16-CS324) and its performance metrics were obtained.

Recent lightweight block cipher competition (FELICS Triathlon) evaluates efficient implementations of block ciphers for Internet of things (IoT) environment. In the competition, the implementation of HIGHT block cipher achieved the most efficient lightweight block cipher, in terms of code size (ROM), memory (RAM), and execution time. In this paper, we further investigate lightweight features of HIGHT block cipher and present the optimized implementations of both software and hardware for low-end IoT platforms, including resource-constrained devices (8-bit AVR and 32-bit ARM Cortex-M3) and application-specific integrated circuit (ASIC). By using proposed optimization methods, the implemented HIGHT block cipher shows better performance compared to previous state-of-the-art implementations.

In recent years, many lightweight block ciphers were proposed to provide security for resource‐constrained environments such as Internet of Things (IoT). PIPO, which stands for “plug‐in plug‐out”, is just a lightweight bit‐sliced block cipher offering excellent performance in 8‐bit AVR software implementations. In fact, PIPO owns 64‐bit input and output, 128‐bit secret key. In this article, we consider the differential fault analysis (DFA), a typical side‐channel attack, on the PIPO cipher. More concretely, for the first time, we apply the mixed attack model, which considers the DFA on the encryption state and key schedule simultaneously, to recover PIPO's 128‐bit master key. The theoretical analysis shows that, in average, after injecting 4‐byte faults, the complexity of obtaining the master key reduces from 2128 reduces to 214. In fact, this attack model alleviates the assumption on attacker than the bit‐injection case. It should be noted that our analysis also holds for other bit‐sliced block ciphers. Finally, the simulations show that our proposed DFA on PIPO cipher is rather practical.

PRESENT and MIBS are two lightweight block ciphers that are suitable for low resource devices such as radio‐frequency identification tags. In this paper, we present the first biclique cryptanalysis of MIBS block cipher and a new biclique cryptanalysis of PRESENT block cipher. These attacks are performed on full‐round MIBS‐80 and full‐round PRESENT‐80. Using matching without matrix technique in the attack on MIBS and choosing a sub‐key space of an internal round for key division eventuate to reduce the security of this cipher by 1bit, while the data complexity of attack is 252 chosen plaintext. The attack on PRESENT‐80 has a data complexity of at most 222 chosen plaintext and computational complexity of 279.34 encryption that both complexities are lower than of other cryptanalyses of full‐round PRESENT‐80 so far. Also, in this paper, we use early abort technique to efficiently filter out wrong keys in matching phase of biclique attack of PRESENT‐80. Copyright © 2015 John Wiley & Sons, Ltd.

Differential cryptanalysis is one of the fundamental cryptanalysis techniques to evaluate the security of the block cipher. In many cases, resistance to differential cryptanalysis is proven through the upper bound of the differential characteristic probability, not the differential probability. Since the attacker uses a differential rather than a differential characteristic, resistance based on a differential characteristic tends to overestimate the security level of the block cipher. Such an overestimation is notably observed in lightweight block ciphers SKINNY, Midori, and CRAFT. In this paper, we examine the gap between the differential characteristics and the differential probability of lightweight block ciphers. We present practical methods for computing differential probability using a multistage graph. Using these methods, we count the exact number of maximum differential characteristics with fixed plaintext/ciphertext difference and activity pattern. By the exact number of maximum differential characteristics, we can calculate the probability that is closer to the real differential probability. In addition, by modifying the method, we compute a more accurate differential probability by considering the characteristics of the lower probability. We find differential distinguishers of 9-round Midori64 with probability 2−61.58, 9-round SKINNY64 with 2−58.67 and 14-round CRAFT with 2−60.32. Furthermore, we find a related-tweakey differential distinguisher of 11-round SKINNY64-64 with 2−55.93 and a related-tweak differential distinguisher of 17-round CRAFT with probability 2−63.37. Finally, we explain why these gaps are notable in Midori64, SKINNY64 and CRAFT by relating the S-box differential distribution table.

This chapter aims to provide a comprehensive survey of lightweight block ciphers that have been designed for resource-constrained IoT platforms. The implementations of 10 lightweight block ciphers are compared on 8-bit, 16-bit, and 32-bit microcontrollers by using evaluation metrics such as power and energy consumption, latency, security level, throughput, and efficiency metrics. Furthermore, advantages and disadvantages of these ciphers are discussed. Finally, authentication problems and solutions for IoT devices are discussed in detail.

Algebraic fault analysis (AFA), which combines algebraic cryptanalysis with fault attacks, has represented serious threats to the security of lightweight block ciphers. Inspired by an earlier framework for the analysis of side-channel attacks presented at EUROCRYPT 2009, a new generic framework is proposed to analyze and evaluate algebraic fault attacks on lightweight block ciphers. We interpret AFA at three levels: the target, the adversary, and the evaluator. We describe the capability of an adversary in four parts: the fault injector, the fault model describer, the cipher describer, and the machine solver. A formal fault model is provided to cover most of the current fault attacks. Different strategies of building optimal equation set are also provided to accelerate the solving process. At the evaluator level, we consider the approximate information metric and the actual security metric. These metrics can be used to guide adversaries, cipher designers, and industrial engineers. To verify the feasibility of the proposed framework, we make a comprehensive study of AFA on an ultra-lightweight block cipher called LBlock. Three scenarios are exploited which include injecting a fault to encryption, to key scheduling, or modifying the round number or counter. Our best results show that a single fault injection is enough to recover the master key of LBlock within the affordable complexity in each scenario.

The advances of Internet of Things (IoT) have had a fundamental impact and influence on sharping our rich living experiences. However, since IoT devices are usually resource-constrained, lightweight block ciphers have played a major role in serving as a building block for secure IoT protocols. In CHES 2015, SIMECK, a family of block ciphers, was designed for resource-constrained IoT devices. Since its publication, there have been many analyses on its security. In this paper, under the one bit-flip model, we propose a new efficient fault analysis attack on SIMECK ciphers. Compared to those previously reported attacks, our attack can recover the full master key by injecting faults into only a single round of all SIMECK family members. This property is crucial, as it is infeasible for an attacker to inject faults into different rounds of a SIMECK implementation on IoT devices in the real world. Specifically, our attack is characterized by exercising a deep analysis of differential trail between the correct and faulty immediate ciphertexts. Extensive simulation evaluations are conducted, and the results demonstrate the effectiveness and correctness of our proposed attack.

The paper proposes an improved, modified version of block cipher PRESENT to make it suitable for use in multimedia applications. For encrypting multimedia one of the core requirements is that the scheme should be computationally less expensive so as to sustain the bulkiness attributed to multimedia. Though, PRESENT is a very lightweight block cipher and is found efficient for textual content yet it is not directly suitable for multimedia. This is because of its block-size limitation which limits the diffusion of redundancy within the block of plaintext encrypted. Hence, if the redundancy extends beyond the block size, the same redundancy gets reflected in the cipher and this is a situation which is practically present in all forms of multimedia. Thus, an attempt is made to overcome this limitation by introducing chaos within the operations performed during encryption. And along with this, focus is kept that the overall computational expense of the improved scheme is not increased much.

Lightweight block ciphers are proposed for Internet of Things (IoT) edge devices to ensure secure data transmission with limited resources. However, past research has been designed on ideal channel models, disregarding the possibility of ciphertext errors caused by channel interference during actual transmission. This omission poses difficulties in ensuring the reliability of the ciphertext, especially in the Internet of Medical Things (IoMT) where resources are limited and data accuracy requirements are high. Designing a highly secure and reliable lightweight block cipher for such situations is one of the most challenging tasks. Hence, we propose a lightweight block cipher ECLBC with error detection and correction mechanisms. For security, ECLBC not only achieves a certain security level in fewer rounds but also achieves a mode transition within AND-Rotation-XOR (AND-RX) lightweight block ciphers. This transition involves a shift from the Feistel to the Substitution-Permutation Network (SPN) and from half-round key XOR to full-round key XOR. For reliability, ECLBC supports detecting and correcting erroneous ciphertext due to channel interference. Given the resource-constrained nature of IoMT devices, we implement the detection and correction mechanism of ECLBC based on the linear block code. Finally, various classical cryptography methods are employed to analyze the performance and security of the ECLBC.

Lightweight block ciphers are designed so as to fit into very constrained environments, but usually not really with software performance in mind. For classical lightweight applications where many constrained devices communicate with a server, it is also crucial that the cipher has good software performance on the server side. Recent work has shown that bitslice implementations applied to Piccolo and PRESENT led to very good software speeds, thus making lightweight ciphers interesting for cloud applications. However, we remark that bitslice implementations might not be interesting for some situations, where the amount of data to be enciphered at a time is usually small, and very little work has been done on non-bitslice implementations. In this article, we explore general software implementations of lightweight ciphers on x86 architectures, with a special focus on LED , Piccolo and PRESENT . First, we analyze table-based implementations, and we provide a theoretical model to predict the behavior of various possible trade-offs depending on the processor cache latency profile. We obtain the fastest table-based implementations for our lightweight ciphers, which is of interest for legacy processors. Secondly, we apply to our portfolio of primitives the vperm implementation trick for $$4$$ -bit Sboxes, which gives good performance, extra side-channels protection, and is quite fit for many lightweight primitives. Finally, we investigate bitslice implementations, analyzing various costs which are usually neglected bitsliced form unpacking, key schedule, etc., but that must be taken in account for many lightweight applications. We finally discuss which type of implementation seems to be the best suited depending on the applications profile.

The integration of wireless sensor nodes (WSNs) in the Internet of things (IoT) may generate new security challenges for establishing secure channels between low-power sensor nodes and Internet hosts. It includes a bunch of challenges right from redefining the existing ones from scratch of legacy codes to the current trend of proposing and designing new key establishment and authentication protocols. This paper is the successful attempt in resource constraint environment like wireless sensor network (WSN) to integrate cipher authentication and lightweight key management solutions in one bundle so that it can be deployed in IoT domains WSN is also a part of IoT. The cipher should be authenticated, lightweight, and should be flexible to use in the cryptanalysis. The cipher gives the better authentication techniques and performance but limited to the flexibility. Lightweight block cipher (LBC) uses less computation and secures the data with low computational cost and it is used for many purposes like radio-frequency identification (RFID) tags and sensor network nodes. Advanced Encryption Standard is applied in many devices for the encryption, but it cannot be applied to the smaller embedded devices like wearable devices, etc. LBC works for the many devices with low resources, and research on the LBC has been increased. In this research, Data Encryption Standard (DES) and analyzed algorithm are used to increase the efficiency in terms of solving time and Improved Fault Analysis (IAFA) is used to increases the security of the LBC in wireless sensor node for IoT.