Search

The NIST LightWeight Cryptography (LWC) selection process aims to standardise cryptographic functionality which is suitable for resource-constrained devices. Since the outcome is likely to have significant, long-lived impact, careful evaluation of each submission with respect to metrics explicitly outlined in the call is imperative. Beyond the robustness of submissions against cryptanalytic attack, metrics related to their implementation (e.g., execution latency and memory footprint) form an important example. Aiming to provide evidence allowing richer evaluation with respect to such metrics, this paper presents the design, implementation, and evaluation of one separate Instruction Set Extension (ISE) for each of the 10 LWC final round submissions, namely Ascon, Elephant, GIFT-COFB, Grain-128AEADv2, ISAP, PHOTON-Beetle, Romulus, Sparkle, TinyJAMBU, and Xoodyak; although we base the work on use of RISC-V, we argue that it provides more general insight.

Automatic tools to search for boomerang distinguishers have seen significant advances over the past few years. However, most previous work has focused on ciphers based on a Substitution Permutation Network (SPN), while analyzing the Feistel structure is of great significance. Boukerrou et al. recently provided a theoretical framework to formulate the boomerang switch over multiple Feistel rounds, but they did not provide an automatic tool to find distinguishers. In this paper, by enhancing the recently proposed method by Hadipour et al., we provide an automatic tool to search for boomerang distinguishers and apply it to block ciphers following the Generalized Feistel Structure (GFS). Applying our tool to a wide range of GFS ciphers, we show that it significantly improves the best previous results on boomerang analysis. In particular, we improve the best previous boomerang distinguishers for 20 and 21 rounds of WARP by a factor of 238.28 and 236.56, respectively. Thanks to he effectiveness of our method, we can extend the boomerang distinguishers of WARP by two rounds and distinguish 23 rounds of this cipher from a random permutation. Applying our method to the internationally-standardized cipher CLEFIA, we achieve a 9-round boomerang distinguisher which improves the best previous boomerang distinguisher by one round. Based on this distinguisher, we build a key-recovery attack on 11 rounds of CLEFIA, which improves the best previous sandwich attack on this cipher by one round. We also apply our method to LBlock, LBlock-s, and TWINE and improve the best previous boomerang distinguisher of these ciphers.

Recent lightweight hardware-based stream cipher designs keep an external non-volatile internal state that is not part of the cipher’s hardware module. The purpose of these so-called small-state ciphers is to keep the size of the hardware and the power consumption low. We propose a random oracle model for stream ciphers. This will allow us to analyse the recent small-state stream cipher designs’ resistance against generic attacks and, in particular, time-memory-data tradeoff attacks. We analyse the conventional construction underlying stream ciphers like Grain and Trivium, constructions continuously using the external non-volatile secret key during keystream generation like Sprout, Plantlet, Fruit, and Atom, constructions continuously using the external non-volatile IV, and constructions using a combination of the IV and the key like DRACO. We show the tightness of all bounds by first presenting the time-memory-data tradeoff attacks on the respective constructions, establishing the upper bound on security, and then presenting the proof of security to establish the lower bound on security. In this work, we extend the theoretical work done by Hamann et al. who introduced the DRACO stream cipher at FSE 2023. We use the same random oracle model as the aforementioned work and apply it to the earlier work by Hamann et al. presented at SAC 2019, which showed security for two of the four constructions we consider in this work. Our model is equivalent but allows for a much simpler proof of security. Furthermore, we provide a proof of security for stream ciphers continuously using the secret key during keystream generation, giving upper and lower bounds for all four generic stream cipher constructions proposed so far.

Lightweight cryptography is essential for securing resource-limited devices like smart card, RFID (radio-frequency identification)tags, sensor network and embedded system. In this paper, we present a survey of lightweight block ciphers from both software and hardware perspectives. This paper show the analysis of lightweight block ciphers on the basis of block size, key size, number of rounds, area in gate equivalent, speed, logic process as metrics for comparison purpose. Also, this comprehensive survey highlights the strengths and some of the security related issues in terms of key length and attacks in lightweight cryptography. [ABSTRACT FROM AUTHOR]

This paper introduces an area-optimized and power-efficient implementation of the Cipher Block Chaining (CBC) mode for an ultra-lightweight block cipher, PRESENT, and the Keyed-Hash Message Authentication Code (HMAC)-expanded PHOTON by using a feedback path for a single block in the scheme. The proposed scheme is designed, taped out, and integrated as a System-on-a-Chip (SoC) in a 65-nm CMOS process. An experimental analysis and comparison between a conventional implementation of CBC-PRESENT/HMAC-PHOTON with the proposed feedback basis is performed. The proposed CBC-PRESENT/HMAC-PHOTON has 128-bit plaintext/text and a 128-bit secret key, which have a gate count of 5683/20,698 and low power consumption of 1.03/2.62 mW with a throughput of 182.9/14.9 Mbps at the maximum clock frequency of 100 MHz, respectively. The overall improvement in area and power dissipation is 13/50.34% and 14.87/75.28% when compared to a conventional design. [ABSTRACT FROM AUTHOR]

The IoT technology is currently used in many areas and marked by growing popularity. On the one hand, the IoT makes our lives easier, on the other hand, it presents challenges in terms of security and privacy protection. An IoT infrastructure is characterized by a high level of threats due to, inter alia, numerous technical barriers that make it difficult to use conventional methods to protect information. The aim of this paper is to present a symmetric coding algorithm based on algebraic groups generated by specific trigonometric curves. The algorithm is dedicated to short data sequences transmitted by devices with limited computing power. [ABSTRACT FROM AUTHOR]

Group communication enables Internet of Things (IoT) devices to communicate in an efficient and fast manner. In most instances, a group message needs to be encrypted using a cryptographic key that only devices in the group know. In this paper, we address the problem of establishing such a key using a lattice-based one-way function, which can easily be inverted using a suitably designed lattice trapdoor. Using the notion of a bad/good basis, we present a new method of coupling multiple private keys into a single public key, which is then used for encrypting a group message. The protocol has the apparent advantage of having a conjectured resistance against potential quantum-computer-based attacks. All functions—key establishment, session key update, node addition, encryption, and decryption—are effected in constant time, using simple linear-algebra operations, making the protocol suitable for resource-constrained IoT networks. We show how a cryptographic session group key can be constructed on the fly by a user with legitimate credentials, making node-capture-type attacks impractical. The protocol also incorporates a mechanism for node addition and session-key generation in a forward- and backward-secrecy-preserving manner. [ABSTRACT FROM AUTHOR]

The advances of Internet of Things (IoT) have had a fundamental impact and influence on sharping our rich living experiences. However, since IoT devices are usually resource-constrained, lightweight block ciphers have played a major role in serving as a building block for secure IoT protocols. In CHES 2015, SIMECK, a family of block ciphers, was designed for resource-constrained IoT devices. Since its publication, there have been many analyses on its security. In this paper, under the one bit-flip model, we propose a new efficient fault analysis attack on SIMECK ciphers. Compared to those previously reported attacks, our attack can recover the full master key by injecting faults into only a single round of all SIMECK family members. This property is crucial, as it is infeasible for an attacker to inject faults into different rounds of a SIMECK implementation on IoT devices in the real world. Specifically, our attack is characterized by exercising a deep analysis of differential trail between the correct and faulty immediate ciphertexts. Extensive simulation evaluations are conducted, and the results demonstrate the effectiveness and correctness of our proposed attack. [ABSTRACT FROM AUTHOR]

Nowadays the number of embedded devices communicating over a network is increasing. Thus, the need for security appeared. Considering various constraints for the limited resources devices is very important. These constraints include power, memory, area and latency. A perfect environment for satisfying requirements of security in limited resources devices is lightweight cryptography. A recent lightweight algorithm that has a low area and high throughput which is the ANU-II block cipher. Many technologies like the internet of things (IoT) needed lightweight hardware architectures to provide security for it. In IoT issues like the size of memory, power consumption and smaller gate counts need to take care of by using lightweight cryptography. This paper presents hardware lightweight data path implementation for the ANU-II algorithm using field programmable gate array (FPGA). This paper presents a hardware implementation of a 64-bit ANU-II block cipher. Also, this research presents comparisons based on various design metrics among our data path for the ANU-II cipher and other existing data path designs. The result of the proposed design shows a high throughput of 1502.31, 1951.86, and 2696.47 Mbps. Also, it shows the high efficiency of 7.0201, 31.9977, and 10.6579 Mbps/slice as compared to other ciphers in this paper. [ABSTRACT FROM AUTHOR]

In this paper we present our solution to the CHES Challenge 2020, the task of which it was to break masked hardware respective software implementations of the lightweight cipher Clyde by means of side-channel analysis. We target the secret cipher state after processing of the first S-box layer. Using the provided trace data we obtain a strongly biased posterior distribution for the secret-shared cipher state at the targeted point; this enables us to see exploitable biases even before the secret sharing based masking. These biases on the unshared state can be evaluated one S-box at a time and combined across traces, which enables us to recover likely key hypotheses S-box by S-box. In order to see the shared cipher state, we employ a deep neural network similar to the one used by Gohr, Jacob and Schindler to solve the CHES 2018 AES challenge. We modify their architecture to predict the exact bit sequence of the secret-shared cipher state. We find that convergence of training on this task is unsatisfying with the standard encoding of the shared cipher state and therefore introduce a different encoding of the prediction target, which we call the scattershot encoding. In order to further investigate how exactly the scattershot encoding helps to solve the task at hand, we construct a simple synthetic task where convergence problems very similar to those we observed in our side-channel task appear with the naive target data encoding but disappear with the scattershot encoding. We complete our analysis by showing results that we obtained with a “classical” method (as opposed to an AI-based method), namely the stochastic approach, that we generalize for this purpose first to the setting of shared keys. We show that the neural network draws on a much broader set of features, which may partially explain why the neural-network based approach massively outperforms the stochastic approach. On the other hand, the stochastic approach provides insights into properties of the implementation, in particular the observation that the S-boxes behave very different regarding the easiness respective hardness of their prediction.

The object of the study is the processes of building groups of symmetric double-operand operations of cryptographic coding of information. The subject of the study are features of the implementation of a generalized method of synthesis groups of symmetric two-operand operations of cryptographic coding information for "lightweight cryptography". The purpose of this work is to investigate the process of building and implementing a method of synthesis of groups of symmetric multibit double-operand operations of information cryptographic coding to provide automation for finding ways to increase the variability, and stability of lightweight cryptoalgorithms. The following tasks are solved in the article: to determine the mathematical group of single-operand operations, on the basis of which the realization of the method of synthesis of groups of symmetric double-operand operations of cryptographic coding will be presented; to offer the search technology of symmetric double-operand operations; to evaluate power of synthesized groups of operations, and their influence on variability and stability of " lightweight cryptography" algorithms. The following results were obtained: the technology for determining symmetric double-operand operations, which will be the basis for the synthesis of a group of symmetric double-operand operations, was proposed. A method for synthesizing groups of symmetric double-operand cryptographic information coding operations for block encryption systems was proposed and implemented. On the example of module-two addition with correction and the use of three-digit single-operand operations, the practical implementation of this method was shown. Based on the synthesized operations and the given quantitative characteristics of the set of single-operand operations, the power of synthesized groups of operations and their influence on the variability and stability of "lightweight cryptography" algorithms were evaluated. Conclusions: the proposed and implemented method of synthesis of groups of symmetric double-operand operations of cryptographic coding information allows to provide the possibility of increasing the variability of lightweight crypto-algorithms. Synthesis of symmetric cryptographic coding operations belonging to different mathematical groups provides increase of algorithm's crypto stability. Application of synthesized cryptographic coding operations leads to significant increase of variability of cryptoalgorithms and their complexity.

Lightweight cryptography ensures cryptography applications to devices with limited resources. Low-area implementations of linear layers usually play an essential role in lightweight cryptography. The previous works have provided plenty of methods to generate low-area implementations using 2-input xor gates for various linear layers. However, it is still challenging to search for smaller implementations using two or more inputs xor gates. This paper, inspired by Banik et al., proposes a novel approach to construct a quantity of lower area implementations with (n + 1)- input gates based on the given implementations with n-input gates. Based on the novel algorithm, we present the corresponding search algorithms for n = 2 and n = 3, which means that we can efficiently convert an implementation with 2-input xor gates and 3-input xor gates to lower-area implementations with 3-input xor gates and 4-input xor gates, respectively. We improve the previous implementations of linear layers for many block ciphers according to the area with these search algorithms. For example, we achieve a better implementation with 4-input xor gates for AES MixColumns, which only requires 243 GE in the STM 130 nm library, while the previous public result is 258.9 GE. Besides, we obtain better implementations for all 5500 lightweight matrices proposed by Li et al. at FSE 2019, and the area for them is decreased by about 21% on average.

Stream ciphers are vulnerable to generic time-memory-data tradeoff attacks. These attacks reduce the security level to half of the cipher’s internal state size. The conventional way to handle this vulnerability is to design the cipher with an internal state twice as large as the desired security level. In lightweight cryptography and heavily resource constrained devices, a large internal state size is a big drawback for the cipher. This design principle can be found in the eSTREAM portfolio members Grain and Trivium. Recently proposals have been made that reduce the internal state size. These ciphers distinguish between a volatile internal state and a non-volatile internal state. The volatile part would typically be updated during a state update while the non-volatile part remained constant. Cipher proposals like Sprout, Plantlet, Fruit and Atom reuse the secret key as non-volatile part of the cipher. However, when considering indistinguishability none of the ciphers mentioned above provides security beyond the birthday bound with regard to the volatile internal state. Partially this is due to the lack of a proper proof of security. We present a new stream cipher proposal called Draco which implements a construction scheme called CIVK. In contrast to the ciphers mentioned above, CIVK uses the initial value and a key prefix as its non-volatile state. Draco builds upon CIVK and uses a 128-bit key and a 96-bit initial value and requires 23 % less area and 31 % less power than Grain-128a at 10 MHz. Further, we present a proof that CIVK provides full security with regard to the volatile internal state length against distinguishing attacks. This makes Draco a suitable cipher choice for ultra-lightweight devices like RFID tags.

WARP is a 128-bit block cipher published by Banik et al. at SAC 2020 as a lightweight alternative to AES. It is based on a generalized Feistel network and achieves the smallest area footprint among 128-bit block ciphers in many settings. Previous analysis results include integral key-recovery attacks on 21 out of 41 rounds. In this paper, we propose integral key-recovery attacks on up to 32 rounds by improving both the integral distinguisher and the key-recovery approach substantially. For the distinguisher, we show how to model the monomial prediction technique proposed by Hu et al. at ASIACRYPT 2020 as a SAT problem and thus create a bit-oriented model of WARP taking the key schedule into account. Together with two additional observations on the properties of WARP’s construction, we extend the best previous distinguisher by 2 rounds (as a classical integral distinguisher) or 4 rounds (for a generalized integral distinguisher). For the key recovery, we create a graph-based model of the round function and demonstrate how to manipulate the graph to obtain a cipher representation amenable to FFT-based key recovery.

The security of Internet of Things (IoTs) devices in recent years has created interest in developing implementations of lightweight cryptographic algorithms for such systems. Additionally, open-source hardware and field-programable gate arrays (FPGAs) are gaining traction via newly developed tools, frameworks, and HDLs. This enables new methods of creating hardware and systems faster, more simply, and more efficiently. In this paper, the implementation of a system-on-chip (SoC) based on a 32-bit RISC-V processor with lightweight cryptographic accelerator cores in FPGA and an open-source integrating framework is presented. The system consists of a 32-bit VexRiscv processor, written in SpinalHDL, and lightweight cryptographic accelerator cores for the PRINCE block cipher, the PRESENT-80 block cipher, the ChaCha stream cipher, and the SHA3-512 hash function, written in Verilog HDL and optimized for low latency with fewer clock cycles. The primary aim of this work was to develop a customized SoC platform with a register-controlled bus suitable for integrating lightweight cryptographic cores to become compact embedded systems that require encryption functionalities. Additionally, custom firmware was developed to verify the functionality of the SoC with all integrated accelerator cores, and to evaluate the speed of cryptographic processing. The proposed system was successfully implemented in a Xilinx Nexys4 DDR FPGA development board. The resources of the system in the FPGA were low with 11,830 LUTs and 9552 FFs. The proposed system can be applicable to enhancing the security of Internet of Things systems.

In today’s hyperconnected world, the Internet of Things and Cloud Computing complement each other in several areas. Cloud Computing provides IoT systems with an efficient and flexible environment that supports application requirements such as real-time control/monitoring, scalability, fault tolerance, and numerous security services. Hardware and software limitations of IoT devices can be mitigated using the massive on-demand cloud resources. However, IoT cloud-based solutions pose some security and privacy concerns, specifically when an untrusted cloud is used. This calls for strong encryption schemes that allow operations on data in an encrypted format without compromising the encryption. This paper presents an asymmetric multi-key and partially homomorphic encryption scheme. The scheme provides the addition operation by encrypting each decimal digit of the given integer number separately using a special key. In addition, data integrity processes are performed when an untrusted third party performs homomorphic operations on encrypted data. The proposed work considers the most widely known issues like the encrypted data size, slow operations at the hardware level, and high computing costs at the provider level. The size of generated ciphertext is almost equal to the size of the plaintext, and order-preserving is ensured using an asymmetrical encryption version.

The DryGASCON scheme was one of authenticated encryption (AE) algorithms submitted to the ongoing NIST Lightweight Cryptography Standardization Process. Such a competition aims to standardize lightweight cryptographic algorithms and determine lightweight AE schemes that are suitable for use in constrained environments suitable for several emerging areas in which highly-constrained devices are interconnected. This article deals with DryGASCON and aims to evaluate its security. The reasons for this choice are twofold. The first reason is related to its unique design. The second one is that no forgery cryptanalysis has been performed on it in the literature to the best of our knowledge. Specifically, this paper presents practical forgery attacks on DryGASCON by exploiting internal collisions of the underlying permutation. During our cryptanalysis, we investigate collisions and discuss how to find them. Next, we mounted forgery attacks on DryGASCON128 with an optimal probability 2− 13 for a class of weak keys and with certainty (optimal probability 1) for pairs of related keys. We show that the number of elements from the weak-key class depends on the size of the secret keys. In addition, we also find forgeries of DryGASCON256 in the related-key scenario. Forgery attacks succeeded without the reuse of nonce. Our results threaten the authenticity and robustness of DryGASCON. However, thanks to our analysis, we shed light on the causes of its weaknesses, and we manage to draw constructive conclusions and recommendations for future AE designs schemes, notably similar to DryGASCON. [ABSTRACT FROM AUTHOR]

The substitution box (S-box) is an important nonlinear component in most symmetric cryptosystems and thus should have good properties. Its difference distribution table (DDT) and linear approximation table (LAT) affect the security of the cipher against differential and linear cryptanalysis. In most previous work, differential uniformity and linearity of an S-box are two primary cryptographic properties to impact the resistance against differential and linear attacks. In some cases, the branch number and fixed point are also be considered. However, other important cryptographic properties such as the frequency of differential uniformity (resp. linearity) and the number of Bad Input and Bad Output (BIBO) patterns in DDT (resp. LAT) are often ignored. These properties substantially affect lightweight cryptography based on substitution bit permutation networks (SbPN) such as PRESENT, GIFT and RECTANGLE. This paper introduces a new method to search for S-boxes satisfying all above criteria simultaneously. In our strategy, we transform the process of searching for S-boxes under certain constraints on cryptographic properties into a satisfiability (SAT) problem. As applications, we use our new approach to search out 4-bit and 5-bit S-boxes with the same or better cryptographic properties compared with the S-boxes from well-known ciphers. Finally, we also utilize our method to verify a conjecture proposed by Boura et al. in the case of all 3-bit and 4-bit S-boxes. We propose a proposition and two corollaries to reduce the search space in this verification. [ABSTRACT FROM AUTHOR]

The backbone of the Internet of things (IoT) platform consists of tiny low-cost devices that are continuously exchanging data. These devices are usually limited in terms of hardware footprint, memory capacity, and processing power. The devices are usually insecure because implementing standard cryptographic algorithms requires the use of a large hardware footprint which leads to an increase in the prices of devices. This study implements a System-on-Chip (SoC) based lightweight cryptographic core that consists of two encryption protocols, four authentication protocols, and a key generation/exchange protocol for ultra-low-cost devices. The hardware architectures use the concept of resource sharing to minimize the hardware area. The lightweight cryptographic SoC is tested by designing a desktop software application to serve as an interface to the hardware. The design is implemented using Verilog HDL and the 130 nm CMOS cell library is used for synthesis, which results in 33 k gate equivalents at a maximum clock frequency of 50 MHz. [ABSTRACT FROM AUTHOR]

Essentially all forms of online communication involve the use of cryptography to ensure that only the intended recipient of a message can read it. Nearly every protocol includes message encryption as a part of its standard. Whether it is https, sh, or S[MIME, the most common types of connections have encryption enabled by default. Most computers can encrypt and decrypt information without any perceivable difference to the user. Processors found in home computers are fairly powerful, but home computers are not the only devices people have. There are an increasing number of smart devices in your average person's home. These smart IoT devices do not have as powerful hardware as the average PC. To maintain the expected instant transmission of data while providing security, lightweight crypto algorithms are needed for these devices. [ABSTRACT FROM AUTHOR]

In the past few years, the use of several medical devices is increasing. This paper will pay attention to a device developed to get measures of the temperature of diabetic foot. These wearables usually do not have cryptographic protocols to guarantee data security. This study analyzes the existing security in these devices, and simulate malware propagation taking into account the vulnerabilities and lack of security in these highly-constrained interconnected devices. A simulation of malware spreading in a network made by 10 and 15 individuals with 6 and 34 sensors each one, respectively, is included in this study. To avoid such attacks, a lightweight cryptographic protocol could be a satisfactory solution. Considering the quick development of quantum computers, several current cryptographic protocols have been compromised. [ABSTRACT FROM AUTHOR]

Devices in the Internet of Things (IoT) have resource constraints in terms of energy, computing power, and memory that make them vulnerable to some security attacks. Due to the increasing volume of multimedia content, lightweight encryption algorithms have been developed to allow IoT nodes to communicate securely with the least computational complexity and bandwidth usage. To adapt the low data rate of IoT devices, a lightweight data compression algorithm for image encryption is proposed in this paper which utilizes scan-based block compression and selective pixel encryption approach to encrypt the image data in only one round, resulting in low computational complexity and reduced data volume. The results of the implementing the proposed approach in IoT testbed show that, on average, the power consumption of the devices and packet rate is decreased by 15% and 26%, respectively, compared to the existing algorithms. [ABSTRACT FROM AUTHOR]

Geospatial data is very sensitive data. The GIS data model should provide make sensitive dataset available to authorized users only and preserve the access for insensitive data from same database to general users. To secure sensitive data from any unauthorized modifications and maintain its confidentiality, a strong encryption method with limited resources should be developed. Available encryption techniques for GIS data security are dealing with encryption technologies for GIS data based on watermarking, symmetric key cryptography techniques, and chaotic maps etc. which are useful for copyright protections. Geospatial data is used widely for many data sensitive applications like defence management, power grids, business decision making, tracking of events and activities using IoT devices etc. These systems are all vulnerable to various cyber-attacks, intrusions. It leads to incorrect information and affects business decisions. [ABSTRACT FROM AUTHOR]

Internet-of-Things (IoT) is an advanced intelligent infrastructure, which is formed by using multiple self-organizing devices. Here, the devices are utilized to examine the network and transfers the important information over internet. In this huge network, the unknown devices can create various attacks, thus the security and privacy of data is the major concerns. The major limitation in the IoT network is the devices are battery powered, so they can store low inbuilt resources. Thus, it is necessary to identify more resource optimized and security related solutions to address the problems generated in the network. In addition, the resources of the devices are consuming in higher speed due to the complex cryptography algorithms to maintain. Further, it is necessary to identify the suitable cryptography procedure for an automated IoT network along with data integrity. Therefore, this article aims to introduce the detailed survey on various cryptographic methods with their operational behavior such as asymmetric key cryptography (AKC) and symmetric key cryptography (SKC). This survey mainly focused on the cryptographic methods with respect to various attacks such as forgery and chosen-cipher text, denial of service; replay man-in-the middle, key reset, device capture and brute force attacks. Hence, the lightweight cryptography (LWC) is the prominent solution to mitigate all these attacks by using the deep learning methods and can maintain the higher security standards with the lower resource utilization in IoT environment. [ABSTRACT FROM AUTHOR]