Search

The sponge construction is a popular method for hashing. Quickly after its introduction, the sponge was proven to be tightly indifferentiable from a random oracle up to ≈ 2c/2 queries, where c is the capacity. However, this bound is not tight when the number of message blocks absorbed is restricted to ℓ < ⌈ c / 2(b−c) ⌉ + 1 (but still an arbitrary number of blocks can be squeezed). In this work, we show that this restriction leads to indifferentiability from a random oracle up to ≈ min { 2b/2, max { 2c/2, 2b−ℓ×(b−c) }} queries, where b > c is the permutation size. Depending on the parameters chosen, this result allows to have enhanced security or to absorb at a larger rate for applications that require a fixed-length input hash function.

International audience; Ascon is a sponge-based Authenticated Encryption with Associated Data that was selected as both one of the winners of the CAESAR competition and one of the finalists of the NIST lightweight cryptography standardization effort. As this competition comes to an end, we analyse the security of this algorithm against cube attacks. We present a practical cube attack against the full 6-round encryption in Ascon in the nonce-misuse setting. We note right away that this attack does not violate the security claims made by the designers of Ascon, due to this setting.Our cryptanalysis is a conditional cube attack that is capable of recovering the full capacity in practical time; but for Ascon-128, its extension to a key recovery or a forgery is still an open question. First, a careful analysis of the maximum-degree terms in the algebraic normal form of the Ascon permutation allows us to derive linear equations in half of the capacity bits given enough cube sums of dimension 32. Then, depending on the results of this first phase, we identify smaller-degree cubes that allow us to recover the remaining half of the capacity. Overall, our cryptanalysis has a complexity of about 240 adaptatively chosen plaintexts, and about 240 calls to the permutation. We have implemented the full attack and our experiments confirm our claims.Our results are built on a theoretical framework which allows us to easily identify monomials whose cube-sums provide linear equations in the capacity bits. The coefficients of these monomials have a more general form than those used in the previous attacks against Ascon, and our method enables us to re-frame previous results in a simpler form. Overall, it enables to gain a deeper understanding of the properties of the permutation, and in particular of its S-box, that make such state-recoveries possible.

The NIST LightWeight Cryptography (LWC) selection process aims to standardise cryptographic functionality which is suitable for resource-constrained devices. Since the outcome is likely to have significant, long-lived impact, careful evaluation of each submission with respect to metrics explicitly outlined in the call is imperative. Beyond the robustness of submissions against cryptanalytic attack, metrics related to their implementation (e.g., execution latency and memory footprint) form an important example. Aiming to provide evidence allowing richer evaluation with respect to such metrics, this paper presents the design, implementation, and evaluation of one separate Instruction Set Extension (ISE) for each of the 10 LWC final round submissions, namely Ascon, Elephant, GIFT-COFB, Grain-128AEADv2, ISAP, PHOTON-Beetle, Romulus, Sparkle, TinyJAMBU, and Xoodyak; although we base the work on use of RISC-V, we argue that it provides more general insight.

Automatic tools to search for boomerang distinguishers have seen significant advances over the past few years. However, most previous work has focused on ciphers based on a Substitution Permutation Network (SPN), while analyzing the Feistel structure is of great significance. Boukerrou et al. recently provided a theoretical framework to formulate the boomerang switch over multiple Feistel rounds, but they did not provide an automatic tool to find distinguishers. In this paper, by enhancing the recently proposed method by Hadipour et al., we provide an automatic tool to search for boomerang distinguishers and apply it to block ciphers following the Generalized Feistel Structure (GFS). Applying our tool to a wide range of GFS ciphers, we show that it significantly improves the best previous results on boomerang analysis. In particular, we improve the best previous boomerang distinguishers for 20 and 21 rounds of WARP by a factor of 238.28 and 236.56, respectively. Thanks to he effectiveness of our method, we can extend the boomerang distinguishers of WARP by two rounds and distinguish 23 rounds of this cipher from a random permutation. Applying our method to the internationally-standardized cipher CLEFIA, we achieve a 9-round boomerang distinguisher which improves the best previous boomerang distinguisher by one round. Based on this distinguisher, we build a key-recovery attack on 11 rounds of CLEFIA, which improves the best previous sandwich attack on this cipher by one round. We also apply our method to LBlock, LBlock-s, and TWINE and improve the best previous boomerang distinguisher of these ciphers.

Research motivation. When developing microcontrollers, manufacturers try to include as many different types of peripherals as possible in order to increase the marketing attractiveness of their products. On the one hand, with a large assortment of various peripheral modules, it is very difficult to implement several devices of the same type in the microcontroller: manufacturers are mainly limited to 1-2 instances, in rare cases 4 modules of the same type are included. On the other hand, most software projects do not use all the peripherals of modern microcontrollers and many devices are left unused, while there may be a shortage of other types of modules. Another problem that has become especially noticeable for microcontrollers used in the field of IoT is the cryptographic protection of data that is transmitted through built-in information exchange interfaces. The main efforts of researchers and developers of cryptographic data protection methods were aimed at reducing energy-intensive operations, memory access iterations and speeding up encryption processes while maintaining a high level of cryptographic protection and enabling efficient data distribution within IoT devices networks. Research results. This paper presents an alternative approach to the manufacture of peripheral modules as part of microcontrollers. The authors propose to use a configurable software processor module based on the MIPS architecture with a reduced instruction set and limited capabilities. Conclusions. This approach would make it possible to dynamically change the functionality of peripheral modules in accordance with the requirements of the developed software solution, which in turn will increase the efficiency of the microcontroller chips capabilities utilization. In addition, the transfer of data stream encryption functions to the reconfigurable core of the peripheral module will provide fast and transparent cryptographic protection, as well as allow offloading the microcontroller core and increasing the energy efficiency of chips while reducing their production cost., Мотивація дослідження. При розробці мікроконтролерів виробники намагаються включити якнайбільше різних видів периферійних пристроїв, щоб підвищити маркетингову привабливість своєї продукції. З одного боку, при великому асортименті різних периферійних модулів дуже складно включити до складу мікроконтролера велику кількість пристроїв одного типу: виробники переважно обмежуються 1-2 екземплярами, дуже рідко зустрічаються 4 модулі однакового типу. З іншого боку, більшість програмних проектів не використовують всю периферію сучасних мікроконтролерів і багато пристроїв залишаються незадіяними, тоді як може відчуватися нестача модулів іншого типу. Ще однією проблемою, яка стала особливо відчутною для мікроконтролерів, що застосовуються у сфері ІТ, це криптографічний захист даних, які передаються через вбудовані інтерфейси обміну інформацією. Основні зусилля дослідників та розробників криптографічних методів захисту даних були спрямовані на зниження енерговитратних операцій, звернень до пам'яті та прискорення процесів шифрування за одночасного збереження високого рівня криптографічного захисту та забезпечення можливості ефективного поширення даних у мережах пристроїв ІоТ. Результати дослідження. У роботі подано альтернативний підхід до виготовлення периферійних модулів у складі мікроконтролерів. Пропонується використовувати конфігурований модуль програмного процесора на базі архітектури MIPS з укороченим набором команд та обмеженими можливостями. Висновки. Такий підхід дозволяє динамічно змінювати функціонал периферійних модулів відповідно до вимог програмного рішення, що розробляється, що в свою чергу дозволить підвищити ефективність використання можливостей мікросхем мікроконтролерів. Крім того, перенесення функцій шифрування потоку даних в ядро периферійного модуля, що реконфігурується, дозволить забезпечити швидкий і прозорий криптографічний захист, а також дозволить розвантажити ядро мікроконтролера

International audience; Cryptographic algorithms that can provide both encryption and authentication are increasingly required in modern security architectures and protocols (e.g. TLS v1.3). Many authenticated encryption systems have been proposed in the past few years, which has resulted in several cryptanalysis research work. In this same direction, the National Institute of Standards and Technology (NIST) is coordinating a large effort to find a new standard authenticated encryption algorithm to be used by resource-constrained and limited devices. In this paper, 12 algorithms of the 33 candidates of the Round 2 phase from NIST competition are being benchmarked on a real IoT test-bed. These 33 ciphers implement authenticated encryption with associated data which aims at preserving integrity, privacy and authenticity at the same time. In this work, we ported the 12 algorithms to different hardware platforms (an x86_64 PC, an AVR ATmega128, an MSP430F1611 and the IoT-LAB platform) and make a fair comparison between their performance. We adapted these algorithms to the Contiki operating system to evaluate the latency and efficiency of each algorithm on IoT applications deployed on a national experimental platform which is IoT-LAB. In addition, we used the FELICS-AE benchmark to quantify locally the RAM, execution time and code size of each algorithm. In fact, this work provides practical results of their performance in an IoT scenario which pave the way for further research on other algorithms, platforms or OS.

The object of the study is the processes of building groups of symmetric double-operand operations of cryptographic coding of information. The subject of the study are features of the implementation of a generalized method of synthesis groups of symmetric two-operand operations of cryptographic coding information for "lightweight cryptography". The purpose of this work is to investigate the process of building and implementing a method of synthesis of groups of symmetric multibit double-operand operations of information cryptographic coding to provide automation for finding ways to increase the variability, and stability of lightweight cryptoalgorithms. The following tasks are solved in the article: to determine the mathematical group of single-operand operations, on the basis of which the realization of the method of synthesis of groups of symmetric double-operand operations of cryptographic coding will be presented; to offer the search technology of symmetric double-operand operations; to evaluate power of synthesized groups of operations, and their influence on variability and stability of " lightweight cryptography" algorithms. The following results were obtained: the technology for determining symmetric double-operand operations, which will be the basis for the synthesis of a group of symmetric double-operand operations, was proposed. A method for synthesizing groups of symmetric double-operand cryptographic information coding operations for block encryption systems was proposed and implemented. On the example of module-two addition with correction and the use of three-digit single-operand operations, the practical implementation of this method was shown. Based on the synthesized operations and the given quantitative characteristics of the set of single-operand operations, the power of synthesized groups of operations and their influence on the variability and stability of "lightweight cryptography" algorithms were evaluated. Conclusions: the proposed and implemented method of synthesis of groups of symmetric double-operand operations of cryptographic coding information allows to provide the possibility of increasing the variability of lightweight crypto-algorithms. Synthesis of symmetric cryptographic coding operations belonging to different mathematical groups provides increase of algorithm's crypto stability. Application of synthesized cryptographic coding operations leads to significant increase of variability of cryptoalgorithms and their complexity., Объектом исследования есть процессы построения групп симметричных двухоперандных операций криптографического кодирования информации. Предметом исследования есть особенности реализации обобщенного метода синтеза групп симметричных двухоперандных операций криптографического кодирования информации для «облегченной криптографии». Цель работы – исследовать процесс построения и реализации метода синтеза групп симметричных многоразрядных двухоперандных операций криптографического кодирования информации для обеспечения автоматизации поиска путей увеличения вариативности, и устойчивости облегченных криптоалгоритмов. В статье решаются следующие задачи: определить математическую группу однооперандных операций, на основе которой будет представлена реализация метода синтеза групп симметричных двухоперандных операций криптографического кодирования; предложить технологию поиска симметричных двухоперандных операций; оценить мощность синтезированных групп операций, и их влияние на вариативность и устойчивость алгоритмов "облегченной криптографии". Получены следующие результаты: предложена технология определения симметричных двухоперандных операций, которые будут основой для синтеза группы симметричных двухоперандных операций; предложен и реализован метод синтеза групп симметричных двухоперандных операций криптографического кодирования информации для систем блочного шифрования; на примере поразрядного сложения по модулю два с коррекцией, и использования трехразрядных однооперандных операций показана практическая реализация данного метода; на основе синтезированных операций и приведенных количественных характеристик множества однооперандных операций проведена оценка мощности синтезированных групп операций и их влияние на вариативность и стойкость алгоритмов «облегченной криптографии». Выводы: предложенный и реализованный метод синтеза групп симметричных двухоперандных операций криптографического кодирования информации позволяет обеспечить возможность увеличения вариативности облегченных криптоалгоритмов. Синтез симметричных операций криптографического кодирования, принадлежащих разным математическим группам, обеспечивает повышение криптостойкости алгоритма. Применение синтезированных операций криптографического кодирования приводит к значительному увеличению вариативности криптоалгоритмов и их сложности., Об’єктом дослідження є процеси побудови груп симетричних двохоперандних операцій криптографічного кодування інформації. Предметом дослідження є особливості реалізації узагальненого методу синтезу груп симетричних двохоперандних операцій криптографічного кодування інформації для «полегшеної криптографії». Мета роботи – дослідити процес побудови і реалізації методу синтезу груп симетричних багаторозрядних двооперандних операцій криптографічного кодування інформації для забезпечення автоматизації пошуку шляхів збільшення варіативності і стійкості полегшених криптоалгоритмів. В статті вирішуються наступні завдання: визначити математичну групу однооперандних операцій на основі якої буде представлено реалізацію методу синтезу груп симетричних двохоперандних операцій криптографічного кодування; запропонувати технологію пошуку симетричних двохоперандних операцій; оцінити потужність синтезованих груп операцій та їх вплив на варіативність та стійкість алгоритмів «полегшеної криптографії». Отримано наступні результати: запропоновано технологію визначення симетричних двохоперандних операцій які будуть основою для синтезу групи симетричних двохоперандних операцій; запропоновано та реалізовано метод синтезу груп симетричних двохоперандних операцій криптографічного кодування інформації для систем блокового шифрування; на прикладі порозрядного додавання за модулем два з корекцією та використання трьохрозрядних однооперандних операцій показано практичну реалізацію даного методу; на основі синтезованих операцій та наведених кількісних характеристики множини однооперандних операцій проведено оцінку потужностість синтезованих груп операцій та їх вплив на варіативність та стійкість алгоритмів «полегшеної криптографії». Висновки: запропонований то реалізований метод синтезу груп симетричних двооперандних операцій криптографічного кодування інформації дозволяє забезпечити можливість збільшення варіативності полегшених криптоалгоритмів. Синтез симетричних операцій криптографічного кодування, що належать різним математичним групам, забезпечує підвищення криптостійкість алгоритму. Застосування синтезованих операцій криптографічного кодування, приводить до значного збільшення варіативності криптоалгоритмів та їх складності.

Lightweight cryptography ensures cryptography applications to devices with limited resources. Low-area implementations of linear layers usually play an essential role in lightweight cryptography. The previous works have provided plenty of methods to generate low-area implementations using 2-input xor gates for various linear layers. However, it is still challenging to search for smaller implementations using two or more inputs xor gates. This paper, inspired by Banik et al., proposes a novel approach to construct a quantity of lower area implementations with (n + 1)- input gates based on the given implementations with n-input gates. Based on the novel algorithm, we present the corresponding search algorithms for n = 2 and n = 3, which means that we can efficiently convert an implementation with 2-input xor gates and 3-input xor gates to lower-area implementations with 3-input xor gates and 4-input xor gates, respectively.We improve the previous implementations of linear layers for many block ciphers according to the area with these search algorithms. For example, we achieve a better implementation with 4-input xor gates for AES MixColumns, which only requires 243 GE in the STM 130 nm library, while the previous public result is 258.9 GE. Besides, we obtain better implementations for all 5500 lightweight matrices proposed by Li et al. at FSE 2019, and the area for them is decreased by about 21% on average.

Stream ciphers are vulnerable to generic time-memory-data tradeoff attacks. These attacks reduce the security level to half of the cipher’s internal state size. The conventional way to handle this vulnerability is to design the cipher with an internal state twice as large as the desired security level. In lightweight cryptography and heavily resource constrained devices, a large internal state size is a big drawback for the cipher. This design principle can be found in the eSTREAM portfolio members Grain and Trivium.Recently proposals have been made that reduce the internal state size. These ciphers distinguish between a volatile internal state and a non-volatile internal state. The volatile part would typically be updated during a state update while the non-volatile part remained constant. Cipher proposals like Sprout, Plantlet, Fruit and Atom reuse the secret key as non-volatile part of the cipher. However, when considering indistinguishability none of the ciphers mentioned above provides security beyond the birthday bound with regard to the volatile internal state. Partially this is due to the lack of a proper proof of security.We present a new stream cipher proposal called Draco which implements a construction scheme called CIVK. In contrast to the ciphers mentioned above, CIVK uses the initial value and a key prefix as its non-volatile state. Draco builds upon CIVK and uses a 128-bit key and a 96-bit initial value and requires 23 % less area and 31 % less power than Grain-128a at 10 MHz. Further, we present a proof that CIVK provides full security with regard to the volatile internal state length against distinguishing attacks. This makes Draco a suitable cipher choice for ultra-lightweight devices like RFID tags.

In today’s hyperconnected world, the Internet of Things and Cloud Computing complement each other in several areas. Cloud Computing provides IoT systems with an efficient and flexible environment that supports application requirements such as real-time control/monitoring, scalability, fault tolerance, and numerous security services. Hardware and software limitations of IoT devices can be mitigated using the massive on-demand cloud resources. However, IoT cloud-based solutions pose some security and privacy concerns, specifically when an untrusted cloud is used. This calls for strong encryption schemes that allow operations on data in an encrypted format without compromising the encryption. This paper presents an asymmetric multi-key and partially homomorphic encryption scheme. The scheme provides the addition operation by encrypting each decimal digit of the given integer number separately using a special key. In addition, data integrity processes are performed when an untrusted third party performs homomorphic operations on encrypted data. The proposed work considers the most widely known issues like the encrypted data size, slow operations at the hardware level, and high computing costs at the provider level. The size of generated ciphertext is almost equal to the size of the plaintext, and order-preserving is ensured using an asymmetrical encryption version.

Highly constrained devices that are interconnected and interact to complete a task are being used in a diverse range of new fields. The Internet of Things (IoT), cyber-physical systems, distributed control systems, vehicular systems, wireless sensor networks, tele-medicine, and the smart grid are a few examples of these fields. In any of these contexts, security and privacy might be essential aspects. Research on secure communication in Internet of Things (IoT) networks is a highly contested topic. One method for ensuring secure data transmission is cryptography. Because IoT devices have limited resources, such as power, memory, and batteries, IoT networks have boosted the term “lightweight cryptography”. Algorithms for lightweight cryptography are designed to efficiently protect data while using minimal resources. In this research, we evaluated and benchmarked lightweight symmetric ciphers for resource-constrained devices. The evaluation is performed using two widely used platform: Arduino and Raspberry Pi. In the first part, we implemented 39 block ciphers on an ATMEGA328p microcontroller and analyzed them in the terms of speed, cost, and energy efficiency during encryption and decryption for different block and key sizes. In the second part, the 2nd-round NIST candidates (80 stream and block cipher algorithms) were added to the first-part ciphers in a comprehensive analysis for equivalent block and key sizes in the terms of latency and energy efficiency.

Dissertação de mestrado integrado em Informatics Engineering, Traditional cryptographic standards are designed with a desktop and server environment in mind, so, with the relatively recent proliferation of small, resource constrained devices in the Internet of Things, sensor networks, embedded systems, and more, there has been a call for lightweight cryptographic standards with security, performance and resource requirements tailored for the highly-constrained environments these devices find themselves in. In 2015 the National Institute of Standards and Technology began a Standardization Process in order to select one or more Lightweight Cryptographic algorithms. Out of the original 57 submissions ten finalists remain, with ASCON and Romulus being among the most scrutinized out of them. In this dissertation I will introduce some concepts required for easy understanding of the body of work, do an up-to-date revision on the current situation on the standardization process from a security and performance standpoint, a description of ASCON and Romulus, and new best known analysis, and a comparison of the two, with their advantages, drawbacks, and unique traits., Os padrões criptográficos tradicionais foram elaborados com um ambiente de computador e servidor em mente. Com a proliferação de dispositivos de pequenas dimensões tanto na Internet of Things, redes de sensores e sistemas embutidos, apareceu uma necessidade para se definir padrões para algoritmos de criptografia leve, com prioridades de segurança, performance e gasto de recursos equilibrados para os ambientes altamente limitados em que estes dispositivos operam. Em 2015 o National Institute of Standards and Technology lançou um processo de estandardização com o objectivo de escolher um ou mais algoritmos de criptografia leve. Das cinquenta e sete candidaturas originais sobram apenas dez finalistas, sendo ASCON e Romulus dois desses finalistas mais examinados. Nesta dissertação irei introduzir alguns conceitos necessários para uma fácil compreensão do corpo deste trabalho, assim como uma revisão atualizada da situação atual do processo de estandardização de um ponto de vista tanto de segurança como de performance, uma descrição do ASCON e do Romulus assim como as suas melhores análises recentes e uma comparação entre os dois, frisando as suas vantagens, desvantagens e aspectos únicos.

Internet of Things (IoT) is an auspicious technology that will connect more number of devices through an internet. The huge number of communication expected to transmit high data securely is an important problem in recent days. In this paper, an Enhanced Energy Efficient Lightweight Cryptography Method which utilizes 8 bit manipulation principle (E3LCM) has been proposed. The proposed method has been verified for speech signal using MATLAB. The hardware complexity has been validated using Sparten3E XC3S500E FPGA devices and it has been found that the proposed method consumes 202mW power and 0.9 Kbytes RAM and it outperforms other methods.

International audience; Ephemeral Diffie-Hellman Over COSE (EDHOC) aims at being a very compact and lightweight authenticated Diffie-Hellman key exchange with ephemeral keys. It is expected to provide mutual authentication, forward secrecy, and identity protection, with a 128-bit security level.A formal analysis has already been proposed at SECRYPT ’21, on a former version, leading to some improvements, in the ongoing evaluation process by IETF. Unfortunately, while formal analysis can detect some vulnerabilities in the protocol, it cannot evaluate the actual security level.In this paper, we study the protocol as it appeared in version 15. Without complete breaks, we anyway exhibit attacks in 2^64 operations, which contradict the expected 128-bit security level. We thereafter propose improvements, some of them being at no additional cost, to achieve 128-bit security for all the security properties (i.e. key privacy, mutual authentication, and identity-protection).

Ever since lightweight cryptography emerged as one of the trending topics in symmetric key cryptography, optimizing the implementation cost of MDS matrices has been in the center of attention. In this direction, various metrics like d-XOR, s-XOR and g-XOR have been proposed to mimic the hardware cost. Consequently, efforts also have been made to search for the optimal MDS matrices for dimensions relevant to cryptographic applications according to these metrics. However, finding the optimal MDS matrix in terms of hardware cost still remains an unsolved problem. In this paper, we settle the question of the optimal 4 x 4 MDS matrices over GL(n, F2) under the recently proposed metric sequential XOR count based on words (sw-XOR). We prove that the sw-XOR of such matrices is at least 8n + 3, and the bound is tight as matrices with sw-XOR cost 35 and 67 for the values of n = 4 and 8, respectively, were already known. Moreover, the lower bound for these values of n matches with the known lower bounds according to s-XOR and g-XOR metrics.

The U.S. National Institute of Standards and Technology is currently undertaking a process to evaluate and eventually standardize one or more "lightweight" algorithms for authenticated encryption and hashing that are suitable for resource-restricted devices. In addition to security, this process takes into account the efficiency of the candidate algorithms in various hardware environments (e.g. FPGAs, ASICs) and software platforms (e.g. 8, 16, 32-bit microcontrollers). However, while there exist numerous detailed benchmarking results for 8-bit AVR and 32-bit ARM/RISC-V/ESP32 microcontrollers, relatively little is known about the candidates' efficiency on 16-bit platforms. In order to fill this gap, we present a performance evaluation of the final-round candidates Ascon, Schwaemm, TinyJambu, and Xoodyak on the MSP430 series of ultra-low-power 16-bit microcontrollers from Texas Instruments. All four algorithms were explicitly designed to achieve high performance in software and have further in common that the underlying primitive is a permutation. We discuss how these permutations can be implemented efficiently in Assembly language and analyze how basic design decisions impact their execution time on the MSP430 architecture. Our results show that, overall, Schwaemm is the fastest algorithm across various lengths of data and associated data, respectively. Xoodyak has benefits when a large amount of associated data is to be authenticated, whereas TinyJambu is very efficient for the authentication of short messages.

ASCON is one of the elegant designs of authenticated encryption with associated data (AEAD) that was selected as the first choice for lightweight applications in the CAESAR competition, which also has been submitted to NIST lightweight cryptography standardization. ASCON has been in the literature for a while; however, there has been no successful AEAD which is secure and at the same time lighter than ASCON. In this article, we have overcome the challenge of constructing a permutation that is lighter than the ASCON permutation while ensuring a similar performance, and based on which we achieve a more lightweight AEAD which we call Sycon. Extensive security analysis of Sycon confirms that it provides the same level of security as that of ASCON. Our hardware implementation result shows that the Sycon permutation has 5.35% reduced area, compared to the ASCON permutation. This leads to a remarkable area reduction for Sycon AEAD which is about 14.95% as compared to ASCON AEAD. We regard Sycon as a new milestone as it is the lightest among all the AEADs belonging to the ASCON family.

The Internet of Things (IoT) associated with life is a budding real-time environment paradigm. Smart Users can control and analyze Things through Smart gadgets connected through the network. As gazillions of devices are connected and communicated via a complex, distributed network, the number of potential threats and attacks has grown drastically against protection and privacy. Security must be provided continuously for IoT service. Exploring the issues to be improved in IoT setup includes Information Secrecy, Access Control, Authentication, Integrity, Privacy, and Trust. The paper summarizes the issues with IoT device security and the efficiency of the existing security solutions. This paper analyses the schemes to guard IoT communications and the methods adopted by the researchers while providing security of data in IoT.

Monitoring the farm field data parameters is one of the important criteria for farmers to keep track of the cultivations and its progress. Internet of Things (IoT) powered system can be implemented...

Lightweight cryptography is a new concept for securing data more effectively while using fewer resources and providing greater throughput, conservatism, and low battery consumption. Every fraction second, the Internet of Things (IoT), which connects billions of objects, generates massive amounts of data. As the number of devices grows, so does the amount of data generated, and the security of that data becomes a concern. In IoT architecture, gadgets are essentially smaller and low-powered. Because of their complexity, traditional encryption methods are computationally expensive and take many rounds to encrypt, basically wasting the limited energy of IoT devices. However, a less sophisticated method may jeopardise the intended fidelity. There are various lightweight cryptography techniques available, and we choose one of the symmetric encryption techniques known as Advanced Encryption Standard (AES). The speed of this algorithm is six times that of triple DES.

The great revolution of technology and its fast growth have led to a cyber space increasingly vulnerable to cyber-attacks. For this reason, cyber security becomes paramount to protect our cyber space by presenting and implementing important solutions to protect sensitive data from malicious persons. Thereby various measures of protection have been developed and aim to minimize the risks and damages of attacks. Among them, cryptography plays a vital and crucial role in protecting sensitive transmissions and electronic exchanges through complex networks. Numerous scientific studies have emerged with the advent of the cloud and the Internet of Things (IoT); all of them have expressed a strong need for building secure, efficient and fast cryptosystems targeting confidentiality, integrity and authentication. The last two objectives are essentially built on hash functions which are the main components of many applications and secure networks. The purpose of this paper is to give recent advances of lightweight cryptographic solutions that meet the requirements of constrained systems, and to present a study, in terms of security, energy-consuming and efficiency, of the main hash functions standardized by NIST (National Institute of Standards and Technology). In the end, the paper will give a comparison between the studied hash functions aiming to come up with a recommendation of good lightweight hash functions suitable for implementation in an IoT framework.

Recently, cryptographic literature has seen new block cipher designs such as PRESENT, GIFT or SKINNY that aim to be more lightweight than the current standard, i.e., AES. Even though AES family of block ciphers were designed two decades ago, they still remain as the de facto encryption standard, with AES-128 being the most widely deployed variant. In this work, we revisit the combined one-in-all implementation of the AES family, namely both encryption and decryption of each AES-128/192/256 as a single ASIC circuit. A preliminary version appeared in Africacrypt 2019 by Balli and Banik, where the authors design a byte-serial circuit with such functionality. We improve on their work by reducing the size of the compact circuit to 2268 GE through 1-bit-serial implementation, which achieves 38% reduction in area. We also report stand-alone bit-serial versions of the circuit, targeting only a subset of modes and versions, e.g., AES-192 and AES-256. Our results imply that, in terms of area, AES-192 and AES-256 can easily compete with the larger members of recently designed SKINNY family, e.g., SKINNY-128-256, SKINNY-128-384. Thus, our implementations can be used interchangeably inside authenticated encryption candidates such as SKINNY-AEAD/-HASH, ForkAE or Romulus in place of SKINNY.

In the past decade, the Internet of Things (IoT) has emerged and has been of great importance in the digital world arousing the interest of the scientific community. The requirements of new small intelligent devices brought numerous security and privacy concerns. In order to secure the exchanged data through the IoT, integrity and authentication protocols are required and are usually constructed under hash functions. We notice that the most conventional cryptographic standards are not suitable for multiple platforms hardware/software. The expressed need is to construct lightweight functions and algorithms suitable for constrained environments including small devices. In this context, we propose a review of the research progress on IoT architecture. Further, we present and compare some selected lightweight cryptographic algorithms regarding security, performance, and resource requirements. The main goal of the present paper is to highlight the need to provide security systems for IoT applications through lightweight cryptographic mechanisms.

The Internet of Things (IoT) and the Cloud Computing are among the main technologies influencing the quality and efficiency of our social and economic activities. Their importance is quite notable in several areas such as remote medical care and healthcare monitoring systems. These later face difficulties most of them are the expensive costs for the chronic diseases and the hospitals charges specially during the pandemic time. All these issues have led to the creation of new solutions for enhancing the quality of the healthcare systems. In this paper, we focus on the network architecture security including healthcare monitoring systems based on IoT and Cloud Computing. We present a recent review on the research field and we propose a secure solution based on lightweight cryptography in accordance with the limited resource environments within which health data are exchanged. The proposed solution is guaranteeing data confidentiality and ensuring integrity and authenticity.

This paper introduces an area-optimized and power-efficient implementation of the Cipher Block Chaining (CBC) mode for an ultra-lightweight block cipher, PRESENT, and the Keyed-Hash Message Authentication Code (HMAC)-expanded PHOTON by using a feedback path for a single block in the scheme. The proposed scheme is designed, taped out, and integrated as a System-on-a-Chip (SoC) in a 65-nm CMOS process. An experimental analysis and comparison between a conventional implementation of CBC-PRESENT/HMAC-PHOTON with the proposed feedback basis is performed. The proposed CBC-PRESENT/HMAC-PHOTON has 128-bit plaintext/text and a 128-bit secret key, which have a gate count of 5683/20,698 and low power consumption of 1.03/2.62 mW with a throughput of 182.9/14.9 Mbps at the maximum clock frequency of 100 MHz, respectively. The overall improvement in area and power dissipation is 13/50.34% and 14.87/75.28% when compared to a conventional design.

WARP is a 128-bit block cipher published by Banik et al. at SAC 2020 as a lightweight alternative to AES. It is based on a generalized Feistel network and achieves the smallest area footprint among 128-bit block ciphers in many settings. Previous analysis results include integral key-recovery attacks on 21 out of 41 rounds. In this paper, we propose integral key-recovery attacks on up to 32 rounds by improving both the integral distinguisher and the key-recovery approach substantially. For the distinguisher, we show how to model the monomial prediction technique proposed by Hu et al. at ASIACRYPT 2020 as a SAT problem and thus create a bit-oriented model of WARP taking the key schedule into account. Together with two additional observations on the properties of WARP’s construction, we extend the best previous distinguisher by 2 rounds (as a classical integral distinguisher) or 4 rounds (for a generalized integral distinguisher). For the key recovery, we create a graph-based model of the round function and demonstrate how to manipulate the graph to obtain a cipher representation amenable to FFT-based key recovery.

International audience; The design of efficient and secure cryptographic algorithms is a fundamental problem of cryptography. Due to the tight cost and constrained resources devices such as Radio-Frequency IDentification (RFID), wireless sensors, smart cards, health-care devices, lightweight cryptography has received a great deal of attention. Recent research mainly focused on designing optimized cryptographic algorithms which trade offs between security performance, time consuming, energy consumption and cost. In this paper, we present two chaotic stream ciphers based on chaos and we report the results of a comparative performance evaluation study. Compared to other crypto-systems of the literature, we demonstrate that our designed stream ciphers are suitable for practical secure applications of the Internet of Things (IoT) in a constrained resource environment.

We present Orthros, a 128-bit block pseudorandom function. It is designed with primary focus on latency of fully unrolled circuits. For this purpose, we adopt a parallel structure comprising two keyed permutations. The round function of each permutation is similar to Midori, a low-energy block cipher, however we thoroughly revise it to reduce latency, and introduce different rounds to significantly improve cryptographic strength in a small number of rounds. We provide a comprehensive, dedicated security analysis. For hardware implementation, Orthros achieves the lowest latency among the state-of-the-art low-latency primitives. For example, using the STM 90nm library, Orthros achieves a minimum latency of around 2.4 ns, while other constructions like PRINCE, Midori-128 and QARMA9-128- σ0 achieve 2.56 ns, 4.10 ns, 4.38 ns respectively.

The security of Internet of Things (IoTs) devices in recent years has created interest in developing implementations of lightweight cryptographic algorithms for such systems. Additionally, open-source hardware and field-programable gate arrays (FPGAs) are gaining traction via newly developed tools, frameworks, and HDLs. This enables new methods of creating hardware and systems faster, more simply, and more efficiently. In this paper, the implementation of a system-on-chip (SoC) based on a 32-bit RISC-V processor with lightweight cryptographic accelerator cores in FPGA and an open-source integrating framework is presented. The system consists of a 32-bit VexRiscv processor, written in SpinalHDL, and lightweight cryptographic accelerator cores for the PRINCE block cipher, the PRESENT-80 block cipher, the ChaCha stream cipher, and the SHA3-512 hash function, written in Verilog HDL and optimized for low latency with fewer clock cycles. The primary aim of this work was to develop a customized SoC platform with a register-controlled bus suitable for integrating lightweight cryptographic cores to become compact embedded systems that require encryption functionalities. Additionally, custom firmware was developed to verify the functionality of the SoC with all integrated accelerator cores, and to evaluate the speed of cryptographic processing. The proposed system was successfully implemented in a Xilinx Nexys4 DDR FPGA development board. The resources of the system in the FPGA were low with 11,830 LUTs and 9552 FFs. The proposed system can be applicable to enhancing the security of Internet of Things systems.

Grain-128AEAD is a lightweight authenticated encryption stream cipher and one of the finalists in the National Institute of Standards and Technology (NIST) Lightweight Cryptography (LWC) project. This paper provides an independent third-party analysis of Grain-128AEAD against fault attacks. We investigate the application of three differential fault attack models on Grain-128AEAD. All these attacks can recover the initial state of Grain-128AEAD. First, we demonstrate an attack using a bit-flipping fault that requires access to 27.80 faulty outputs to recover the initial state. Then, we demonstrate an attack with a more relaxed assumption of a random fault with a probabilistic approach. Our probabilistic random fault attack requires access to 211.60 faulty outputs and 210.45 fault injections to recover the initial state with a success rate over 99%. Both of the above two attacks are based on precise control on the fault target. Finally, we apply a random fault attack with a deterministic approach (can conclusively determine the random fault value) and using different precision controls. For the precise control, we use existing approaches that have been applied to other ciphers, such as Tiaoxin-346. We also propose a technique for less stringent precision models, such as moderate control and no control, which are more practical than the precise control. Our result indicates that the deterministic random fault attack with a precise control requires an average of 27.64 fault injections and a data complexity of 28.80. The deterministic random fault attack with moderate control requires a weak assumption on the fault injection and hence, is the best attack presented in this paper; and is expected to require about 29.39 fault injections with a data complexity of about 212.98. All the attacks discussed in this paper are verified experimentally.

Machine learning has recently started to gain the attention of cryptographic researchers, notably in block cipher cryptanalysis. Most of these machine learning-based approaches are black box attacks that are cipher-specific. Thus, more research is required to understand the capabilities and limitations of machine learning when being used to evaluate block cipher security. We contribute to this body of knowledge by investigating the capability of linear and nonlinear machine learning classifiers in evaluating block cipher security. We frame block cipher security evaluation as a classification problem, whereby the machine learning models attempt to classify a given block cipher output as secure or insecure based on the number of active S-boxes. We also train the machine learning models with common block cipher features such as truncated differences, the number of rounds, and permutation pattern. Various experiments were performed on small-scale (4-branch) generalized Feistel ciphers to identify the best performing machine learning model for the given security evaluation problem. Results show that nonlinear machine learning models outperform linear models, achieving a prediction accuracy of up to 93% when evaluating inputs from ciphers that they have seen before during training. When evaluating inputs from other unseen ciphers, nonlinear models again outperformed linear models with an accuracy of up to 71%. We then showcase the feasibility of our approach when used to evaluate a real-world 16-branch generalized Feistel cipher, TWINE. By training the best performing nonlinear classifiers (k-nearest neighbour and decision tree) using data from other similar ciphers, the nonlinear classifiers achieved a 74% accuracy when evaluating differential data generated from TWINE. In addition, the trained classifiers were capable of generalizing to a larger number of rounds than they were trained for. Our findings showcase the feasibility of using simple machine learning classifiers as a security evaluation tool to assess block cipher security.

The Wireless Body Area Network (WBAN) plays a pivotal role in providing ubiquitous computing and has applications in different fields, especially in health monitoring. The advancement in wearable devices has revolutionized the concept of medical services and brought ease to our daily lives. However, the latent threat imposed by attackers has increased concerns related to the security and privacy of patient’s data due to the open nature of the wireless network. The authentication schemes are used to secure patient’s critical data from different types of cyber-attacks. In this paper, we extend our previous work by presenting an anonymous, hybrid authentication scheme that utilized physiological signals in combination with a lightweight cryptographic method to provide robust security against well-known attacks especially key escrow, base station compromise, and untraceability of sessions. The broadly accepted BAN logic is utilized to offer formal proof of mutual authentication and key agreement. The informal verification is performed by the Automated Validation of Internet Security Protocol and Applications (AVISPA) tool. Furthermore, the comparative analysis of the proposed scheme with peer work highlighted that it accomplished better security at low computational, communicational, energy consumption, and storage overheads.

The area of lightweight cryptography for constrained nodes has been quite well researched since the advent of RFID tags. However, the important issue of the integrated design of a secure, ultra-low power, small-footprint IoT transceiver has not received sufficient attention. The objective of this paper is to present such a transceiver and evaluate its data rate and power in the presence of the cryptographic overhead and compare its security with that of prior lightweight cryptographic algorithms. The proposed secure transceiver design is based on two main novel ingredients. The first is the Edge-Coded Signaling (ECS) protocol - a recently introduced technique for single-channel, high-data rate, low-power dynamic signaling that does not require any clock and data recovery. The second ingredient is a novel high-speed symmetric block cipher, HSA5/1, that is based on the well-known $A5/1$ cipher and that generates a full keystream in one clock cycle. Both ingredients are combined to design a lightweight, high-speed, multilayer cipher with a tunable impact on ECS’s power consumption, energy efficiency, and data rate. The multilayer cipher provides additional layers of packet security that make it difficult for an attacker to even receive a legitimate packet, let alone decrypt its data by attacking the HSA5/1 protocol itself. In addition, the multilayer encryption method may be easily configured to modulate the communication security overhead as a function of the number of clock cycles made available to the encryption/decryption stage. The secure ECS transceiver is prototyped and verified on both an embedded and an FPGA platform. It has also been synthesized for an ASIC implementation in $65nm$ CMOS technology that is shown to preserve the low-power operation of ECS, consuming only $27~\mu W$ of power at a clock frequency of $25MHz$ while requiring only one clock cycle for executing 148-bit-key encryption/decryption unit.

Radio Frequency Identification (RFID) systems have bestowed numerous conveniences in a multitude of applications, but the underlying wireless communications architecture makes it vulnerable to several security threats. To mitigate these issues, various authentication protocols have been proposed. The literature accommodates comprehensive proposals and analysis of authentication protocols, but not many of them provide hardware implementations. In addition, there is diverse demand for hardware area and throughput (TP) requirements from RFID system components (tags, readers, database servers), which demand a flexible implementation strategy. This paper proposes a flexible implementation strategy for the lightweight authenticated encryption (AE) and hash function called Gimli, and applies it to a state-of-the-art authentication protocol. This allows the authentication protocol to be implemented efficiently, wherein the area and TP can be adjusted flexibly according to the RFID system requirements. This implementation strategy is generic; it can be used to implement any other AE and hash functions. This strategy can also be applied to other authentication protocols that heavily use AE and hash functions. To provide a detailed analysis, the hardware optimization techniques in each component of the RFID system for a state-of-the-art authentication protocol are analyzed. When implemented with the most area-optimized versions, we achieve TP of 740 Mbps and 420 Mbps for Gimli hash and Gimli AE, respectively, and for throughput-oriented implementation, the results are 3.08 Gbps and 1.43 Gbps, respectively. This shows that the proposed implementation strategies allow us to implement authentication protocols in a flexible manner to meet the differing requirements in TP and area for RFID applications.

Wireless body area networks (WBANs) can enable e-health applications under Internet of Things (IoT) scenarios. However, to use WBAN technologies in practical applications, sensitive data collected by wireless sensors must be protected when transmitted across a network and until accessed by authorized applications or end-users. Specifically, it is necessary to provide confidentiality, integrity, authentication and access control in WBANs. This paper presents a security approach to provide these security services in a layered WBAN system using lightweight cryptography. Layer 1 consists of the communication between the sensor nodes and the base station (data acquisition); Layer 2 involves the communication between the base station and a data repository (data storage); and Layer 3 deals with the communication of end-users to the repository (data access). In the past, security has focused only on Layer 1 and for limited security levels. In this paper, security concerns in the three layers of a WBAN system are studied and addressed. As primary contributions, the design details of a secure WBAN system prototype and the impact of lightweight cryptographic engines on the performance of the primary use cases in the WBAN system are highlighted from data acquisition until data use. We present a novel WBAN system prototype that ensures most of the required security services for standard security levels.

The Internet of Things (IoT) aims to transform everyday physical objects into an interconnected ecosystem with digital data accessible anywhere and anytime. “Things” in IoT are embedded with sensing, processing, and actuating capabilities and cooperate in providing smart and innovative services autonomously. The rapid spread of IoT services arises different security vulnerabilities that need to be carefully addressed. Several emerging and promising technologies and techniques are introduced to improve the security of IoT. This paper aims to provide an up-to-date vision of the current research topics related to IoT security. Initially, we introduce common elements and protocols of IoT to demystify the origins of threats in IoT. Then, we propose a taxonomy of IoT attacks and analyze the security vulnerabilities of IoT at different layers. Subsequently, we provide a comparison of recent security schemes based on emerging solutions including fog computing, edge computing, software-defined networking (SDN), blockchain, lightweight cryptography, homomorphic and searchable encryption, and machine learning. Finally, security challenges are discussed and future directions are highlighted for future interested researchers.

One of the main security requirements for symmetric-key block ciphers is resistance against differential cryptanalysis. This is commonly assessed by counting the number of active substitution boxes (S-boxes) using search algorithms or mathematical solvers that incur high computational costs. These costs increase exponentially with respect to block cipher size and rounds, quickly becoming inhibitive. Conventional S-box enumeration methods also require niche cryptographic knowledge to perform. In this paper, we overcome these problems by proposing a data-driven approach using deep neural networks to predict the number of active S-boxes. Our approach trades off exactness for real-time efficiency as the bulk of computational work is brought over to pre-processing (training). Active S-box prediction is framed as a regression task whereby neural networks are trained using features such as input and output differences, number of rounds, and permutation pattern. We first investigate the feasibility of the proposed approach by applying it on a reduced (4-branch) generalized Feistel structure (GFS) cipher. Apart from optimizing a neural network architecture for the task, we also explore the impact of each feature and its representation on prediction error. We then extend the idea to 64-bit GFS ciphers by first training neural networks using data from five different ciphers before using them to predict the number of active S-boxes for TWINE, a lightweight block cipher. The best performing model achieved the lowest root mean square error of 1.62 and R2 of 0.87, depicting the feasibility of the proposed approach.

Group communication enables Internet of Things (IoT) devices to communicate in an efficient and fast manner. In most instances, a group message needs to be encrypted using a cryptographic key that only devices in the group know. In this paper, we address the problem of establishing such a key using a lattice-based one-way function, which can easily be inverted using a suitably designed lattice trapdoor. Using the notion of a bad/good basis, we present a new method of coupling multiple private keys into a single public key, which is then used for encrypting a group message. The protocol has the apparent advantage of having a conjectured resistance against potential quantum-computer-based attacks. All functions—key establishment, session key update, node addition, encryption, and decryption—are effected in constant time, using simple linear-algebra operations, making the protocol suitable for resource-constrained IoT networks. We show how a cryptographic session group key can be constructed on the fly by a user with legitimate credentials, making node-capture-type attacks impractical. The protocol also incorporates a mechanism for node addition and session-key generation in a forward- and backward-secrecy-preserving manner.

Lightweight cryptography features a small footprint and/or low computational complexity. Low-cost implementations of linear layers usually play an important role in lightweight cryptography. Although it has been shown by Boyar et al. that finding the optimal implementation of a linear layer is a Shortest Linear Program (SLP) problem and NP-hard, there exist a variety of heuristic methods to search for near-optimal solutions. This paper considers the low-latency criteria and focuses on the heuristic search of lightweight implementation for linear layers. Most of the prior approach iteratively combines the inputs (of linear layers) to reach the output, which can be regarded as the forward search. To better adapt the low-latency criteria, we propose a new framework of backward search that attempts to iteratively split every output (into an XORing of two bits) until all inputs appear. By bounding the time of splitting, the new framework can find a sub-optimal solution with a minimized depth of circuits.We apply our new search algorithm to linear layers of block ciphers and find many low-latency candidates for implementations. Notably, for AES Mixcolumns, we provide an implementation with 103 XOR gates with a depth of 3, which is among the best hardware implementations of the AES linear layer. Besides, we obtain better implementations in XOR gates for 54.3% of 4256 Maximum Distance Separable (MDS) matrices proposed by Li et al. at FSE 2019. We also achieve an involutory MDS matrix (in M4(GL(8, F2))) whose implementation uses the lowest number (i.e., 86, saving 2 from the state-of-the-art result) of XORs with the minimum depth.

17 páginas, 6 figuras, 1 tabla, In the past few years, the use of several medical devices is increasing. This paper will pay attention to a device developed to get measures of the temperature of diabetic foot. These wearables usually do not have cryptographic protocols to guarantee data security. This study analyzes the existing security in these devices, and simulate malware propagation taking into account the vulnerabilities and lack of security in these highly-constrained interconnected devices. A simulation of malware spreading in a network made by 10 and 15 individuals with 6 and 34 sensors each one, respectively, is included in this study. To avoid such attacks, a lightweight cryptographic protocol could be a satisfactory solution. Considering the quick development of quantum computers, several current cryptographic protocols have been compromised., This work was supported by the Spanish State Research Agency (AEI) of the Ministry of Science and Innovation (MICINN), project P2QProMeTe (PID2020-112586RB-I00/AEI/10.13039/501100011033), co-funded by the European Regional Development Fund (ERDF, EU)

The backbone of the Internet of things (IoT) platform consists of tiny low-cost devices that are continuously exchanging data. These devices are usually limited in terms of hardware footprint, memory capacity, and processing power. The devices are usually insecure because implementing standard cryptographic algorithms requires the use of a large hardware footprint which leads to an increase in the prices of devices. This study implements a System-on-Chip (SoC) based lightweight cryptographic core that consists of two encryption protocols, four authentication protocols, and a key generation/exchange protocol for ultra-low-cost devices. The hardware architectures use the concept of resource sharing to minimize the hardware area. The lightweight cryptographic SoC is tested by designing a desktop software application to serve as an interface to the hardware. The design is implemented using Verilog HDL and the 130 nm CMOS cell library is used for synthesis, which results in 33 k gate equivalents at a maximum clock frequency of 50 MHz.

Lightweight cryptography is essential for securing resource-limited devices like smart card, RFID (radio-frequency identification)tags, sensor network and embedded system. In this paper, we present...

In this paper, we present Xoodyak, a cryptographic primitive that can be used for hashing, encryption, MAC computation and authenticated encryption. Essentially, it is a duplex object extended with an interface that allows absorbing strings of arbitrary length, their encryption and squeezing output of arbitrary length. It inherently hashes the history of all operations in its state, allowing to derive its resistance against generic attacks from that of the full-state keyed duplex. Internally, it uses the Xoodoo[12] permutation that, with its width of 48 bytes, allows for very compact implementations. The choice of 12 rounds justifies a security claim in the hermetic philosophy: It implies that there are no shortcut attacks with higher success probability than generic attacks. The claimed security strength is 128 bits. We illustrate the versatility of Xoodyak by describing a number of use cases, including the ones requested by NIST in the lightweight competition. For those use cases, we translate the relatively detailed security claim that we make for Xoodyak into simple ones., IACR Transactions on Symmetric Cryptology, Volume 2020, Special Issue 1

Lightweight cryptography has a major role in cybersecurity for smart cities and the Internet of Things. It can be further secure by the development of lightweight encryption algorithms that work in restricted devices and with limited specifications such as wireless network sensors. The restricted devices have a small memory, a simple processor, and limited power. To secure them, need lightweight cryptography algorithms and take into account the limited specifications at the same time. In addition, decreasing memory and power consumption in lightweight encryption algorithms, increasing security is also essential. When the lightweight cryptography algorithm is more secure and less consumes memory and energy, it is better and more efficient. In this article, we have developed a lightweight cryptographic algorithm, and through studies, analysis, and comparison with other lightweight cryptography algorithms show that the proposed algorithm is efficient.

For the industrial Internet of Things (IIoT), public-key encryption with keyword search (PEKS) is a type of applicable and promising encryption technique to maintain the data stored in clouds secure and searchable. To further improve the efficiency of searching, it is popular to introduce edge computing near the IIoT as the substitute for a cloud. However, the straightforward collaboration of the two techniques performs negatively in latency-sensitive applications since the sluggish encryption of PEKS by IIoT devices negates the instant reaction of edges. To meet this challenge, in this article, we exploit the capability of the edge-cloud architecture and propose a lightweight-designed scheme called edge-aided searchable public-key encryption (ESPE). It allows IIoT devices to delegate their costly cryptographic operations to the nearby edge for fast computing and guarantees that all outsourced ciphertexts are semantically secure. Consequently, ESPE accelerates the corresponding ciphertext procedures on edges and saves over 70% encryption cost of an IIoT device.

In this work, we perform an extensive investigation and construct a portfolio of S-boxes suitable for secure lightweight implementations, which aligns well with the ongoing NIST Lightweight Cryptography competition. In particular, we target good functional properties on the one hand and efficient implementations in terms of AND depth and AND gate complexity on the other. Moreover, we also consider the implementation of the inverse S-box and the possibility for it to share resources with the forward S-box. We take our exploration beyond the conventional small (and even) S-box sizes. Our investigation is twofold: (1) we note that implementations of existing S-boxes are not optimized for the criteria which define masking complexity (AND depth and AND gate complexity) and improve a tool published at FSE 2016 by Stoffelen in order to fill this gap. (2) We search for new S-box designs which take these implementation properties into account from the start. We perform a systematic search based on the properties of not only the S-box but also its inverse as well as an exploration of larger S-box sizes using length-doubling structures. The result of our investigation is not only a wide selection of very good S-boxes, but we also provide complete descriptions of their circuits, enabling their integration into future work., IACR Transactions on Symmetric Cryptology, Volume 2020, Issue 1

Since it was invented, Elliptic Curve Cryptography (ECC) is considered an ideal choice for implementing public key cryptography in resource constrained devices, thanks to its small keys. Scalar point multiplication is the central and the complex operation in the cryptographic computations of ECC that requires a lot of optimizations on execution time and energy consumption especially in low computing power devices such as embedded systems. Thus, many scalar point multiplication algorithms are proposed, each using their own computational techniques and mathematical formulas. In this paper, we have combined the computational techniques with some optimized mathematical formulas and we have implemented them on some Elliptic Curves scalar point multiplication algorithms over finite field. The aim of this work is to identify the most efficient algorithm that combine the best computational technique and the mathematical formulas, and consequently offer less-memory requirements and faster field arithmetic operations. The results show that Montgomery ladder algorithm in co-Z addition with update formula gives better results compared to the other algorithms implemented in this paper.

A new conditional cube attack was proposed by Li et al. at ToSC 2019 for cryptanalysis of Keccak keyed modes. In this paper, we find a new property of Li et al.’s method. The conditional cube attack is modified and applied to cryptanalysis of 5-round Ketje Jr, 6-round Xoodoo-AE and Xoodyak, where Ketje Jr is among the third round CAESAR competition candidates and Xoodyak is a Round 2 submission of the ongoing NIST lightweight cryptography project. For the updated conditional cube attack, all our results are shown to be of practical time complexity with negligible memory cost, and test codes are provided. Notably, our results on Xoodyak represent the first third-party cryptanalysis for Xoodyak.