Embed Size (px)
Citation preview
Miroslav Knežević, Ventzislav Nikov, Peter Rombouts
- Is “Lightweight = Light + Wait?” -
PAGE: 1 of 21
Low-Latency Encryption
CHES 2012, Leuven, Belgium, September 10-12, 2012
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 2 of 21
Digital Continuum
Slide credit: Ingrid Verbauwhede
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 2 of 21
Digital Continuum
Slide credit: Ingrid Verbauwhede
~kb/s, μW
~Gb/s, MW
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 2 of 21
Digital Continuum
Slide credit: Ingrid Verbauwhede
~kb/s, μW
~Gb/s, MW
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
Latency = 15 sThroughput = 0.067 beer/s
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
Ad Fundum
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
Latency = 5 sThroughput = 0.2 beer/s
Ad Fundum
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
Latency = 15 sThroughput = 0.2 beer/s
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
Latency = 15 sThroughput = 0.2 beer/s
Parallel Processing
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 3 of 21
Latency vs Throughput
Latency = 15 sThroughput = 0.2 beer/s
Pipelining
CHES 2012, Leuven, Belgium, September 10-12, 2012
Typical Trade-offs in Crypto Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 4 of 21
CHES 2012, Leuven, Belgium, September 10-12, 2012
Typical Trade-offs in Crypto Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 4 of 21
CHES 2012, Leuven, Belgium, September 10-12, 2012
Typical Trade-offs in Crypto Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 4 of 21
AES
Keccak
Groestl
Blake NOEKEON
Skein
SHA-256JHIDEA
Serpent
Two!sh
Square 3DES
CHES 2012, Leuven, Belgium, September 10-12, 2012
Typical Trade-offs in Crypto Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 4 of 21
AES
Keccak
Groestl
Blake NOEKEON
PRESENT
LED
KLEINMINI-AESMCRYPTON
Photon
KATAN Piccolo
SPONGENT
TEA SEA
PRINTcipher
Quark
Skein
SHA-256JH
TRIVIUM
Grain
IDEA
Serpent
Two!sh
Square 3DES
CHES 2012, Leuven, Belgium, September 10-12, 2012
Typical Trade-offs in Crypto Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 4 of 21
AES
Keccak
Groestl
Blake NOEKEON
PRESENT
LED
KLEINMINI-AESMCRYPTON
Photon
KATAN Piccolo
SPONGENT
TEA SEA
PRINTcipher
Quark
?
Skein
SHA-256JH
TRIVIUM
Grain
IDEA
Serpent
Two!sh
Square 3DES
CHES 2012, Leuven, Belgium, September 10-12, 2012
Typical Trade-offs in Crypto Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 4 of 21
AES
Keccak
Groestl
Blake NOEKEON
PRESENT
LED
KLEINMINI-AESMCRYPTON
Photon
KATAN Piccolo
SPONGENT
TEA SEA
PRINTcipher
Quark
?
Skein
SHA-256JH
TRIVIUM
Grain
IDEA
Serpent
Two!sh
Square 3DES
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 5 of 21
AES
Keccak
Groestl
BlakeNOEKEON
PRESENT
LED
KLEIN
MINI-AES
MCRYPTON
Photon
KATAN
PiccoloSPONGENT
TEASEA
cipher
QuarkSkein
SHA-256JH
TRIVIUM GrainIDEA
Serpent
Two!sh
Square
3DES
A kid in a Toy store
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 5 of 21
AES
Keccak
Groestl
BlakeNOEKEON
PRESENT
LED
KLEIN
MINI-AES
MCRYPTON
Photon
KATAN
PiccoloSPONGENT
TEASEA
cipher
QuarkSkein
SHA-256JH
IDEA
Serpent
Two!sh
Square
3DES
A kid in a Toy store
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 5 of 21
AES
NOEKEON
PRESENT
LED
KLEIN
MINI-AES
MCRYPTON
KATAN
Piccolo
TEASEA
cipher
IDEA
Serpent
Two!sh
Square
3DES
A kid in a Toy store
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 5 of 21
AES
NOEKEON
PRESENT
LED
KLEIN
MINI-AES
MCRYPTON
KATAN
Piccolo
TEASEA
cipher
A kid in a Toy store
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 5 of 21
AES
NOEKEON
PRESENT
LED
KLEIN
MINI-AES
MCRYPTON
cipher
A kid in a Toy store
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 5 of 21
AES
NOEKEON
PRESENT
LED
KLEIN
MINI-AES
MCRYPTON
A kid in a Toy store
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 5 of 21
AES
NOEKEON
PRESENT
LED
KLEIN
MINI-AES
MCRYPTON
A kid in a Toy store
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 6 of 21
AES
NOEKEON
PRESENT
LED
KLEIN
MINI-AES
MCRYPTON
Variety of Choices
128 128 8 MDS LIGHT
128 128 4 BINARY NO
64 64 4 MDS LIGHT
64 64, 96, 128 4 BINARY LIGHT
64 80, 128 4 BITPERMUTATION LIGHT
64 64, 80, 96 4 MDS LIGHT
64 64, 128 4 MDS NO
BLOCK-SIZE KEY-SIZE S-BOX P-LAYER KEY SCHEDULE
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 7 of 21
Number of Rounds
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 8 of 21
Six Architectures
R1
R2
Rn
…
R1
Rn/2
…
R1
R2
Rn
…
Rn
Rn -1
R1
…
-1
-1
-1
R1
Rn/2
…
Rn/2
R1
…
-1
-1
R1/Rn
…
…
-1
R2/Rn -1 -1
Rn /R1 -1
R1/Rn/2 -1
Rn /2/R1 -1
(a) (b) (c) (d) (e) (f)
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 9 of 21
Results - Latency
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 9 of 21
Results - Latency
0
12,5
25
37,5
50
17,8
15,3
20,3
25,3
31,2
46,6
9,8 9,8 9,8 9,9
14,8 15,514,8
14,7
20,2
16,4
21,4
26,4
32,8
48,2
10,8 10,8 11 12
17 17,416,4 16,6
1-cycle 2-cycle
AES-1
28
KLEIN
-64
KLEIN
-96
KLEIN
-128
LED-6
4
LED-1
28
MCRYPT
ON-6
4
MCRYPT
ON-9
6
MCRYPT
ON-1
28
MINI-A
ES-6
4
NOEK
EON-1
28
NOEK
EONs-1
28
PRES
ENT-8
0
PRES
ENT-1
28
*ENC/DEC; Max Time-Constrained
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 10 of 21
Results - Area1-cycle 2-cycle
*ENC/DEC; Max Time-Constrained
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 10 of 21
Results - Area
0
100
200
300
400366,6
48,2 63,7 79,9
128,7
193,1
41,3 40,4 41,440
102,5
49,572,3 73,8
191,8
24,9 32,6 41,363,5
96
20,9 21,1 21 2249,6
27,1 37,637,1
1-cycle 2-cycle
AES-1
28
KLEIN
-64
KLEIN
-96
KLEIN
-128
LED-6
4
LED-1
28
MCRYPT
ON-6
4
MCRYPT
ON-9
6
MCRYPT
ON-1
28
MINI-A
ES-6
4
NOEK
EON-1
28
NOEK
EONs-1
28
PRES
ENT-8
0
PRES
ENT-1
28
*ENC/DEC; Max Time-Constrained
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 11 of 21
Results - Average Latency per Round
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 11 of 21
Results - Average Latency per Round
0
0,5
1
1,5
21,78
1,28 1,27 1,27
0,98 0,97
0,82 0,82 0,82
0,990,93 0,97
0,480,47
1,48
0,93 0,93 0,92 0,97 0,96
0,81 0,81 0,81 0,86 0,93
0,46 0,46
ENC/DEC ENC
AES-1
28
KLEIN
-64
KLEIN
-96
KLEIN
-128
LED-6
4
LED-1
28
MCRYPT
ON-6
4
MCRYPT
ON-9
6
MCRYPT
ON-1
28
MINI-A
ES-6
4
NOEK
EON-1
28
NOEK
EONs-1
28
PRES
ENT-8
0
PRES
ENT-1
28
*1-cycle Architecture; Max Time-Constrained
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 12 of 21
Results - Area per Round DistributionPRESENT-80, ENC only
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 13 of 21
Hardware Recommendations
We provide hardware recommendations for designing low-latency primitives.
Evaluated ciphers are designed with low-area and low-power in mind and not to satisfy new low-latency requirements.
Still, we can learn quite a lot from their constructions.
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 14 of 21
Hardware Recommendations-Sbox-
Use small Sboxes (4-bit or even 3-bit ones).
Even among them there are significant differences in latency and area [24].
These differences are library dependent.
G. Leander and A. Poschmann, On the Classification of 4-bit Sboxes, in Arithmetic of Finite Fields, First International Workshop - WAIFI 2007, volume 4547 of Lecture Notes in Computer Science, pages 159-176, 2007.
[24]
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 15 of 21
Hardware Recommendations-Number of Rounds-
Minimize!
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 16 of 21
Hardware Recommendations-Round Complexity-
Not too low complexity.
Reduce the number of rounds at the cost of (slightly) heavier round.
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 17 of 21
Hardware Recommendations-Key Schedule-
Number of rounds should be independent of the key schedule.
Use constant addition instead of a key schedule (if possible).
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 18 of 21
Hardware Recommendations-Heterogeneous Constructions-
Last few rounds of the cipher are smaller than the middle ones.
Make those few rounds more computationally complex.
Not very good for compact implementations.
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 19 of 21
Hardware Recommendations-Encryption vs Decryption-
Use involution: f(f(x)) = x.
Make Encryption and Decryption procedures similar.
BUT: Think “application oriented” - sometimes is beneficial to have “asymmetric” constructions.
CHES 2012, Leuven, Belgium, September 10-12, 2012
Is “Lightweight = Light + Wait?”
Low-Latency Encryption
PAGE: 20 of 21
Conclusionsmeet PRINCE
AESAES
PRESENT PRESENT
PRINCEPRINCE
Latency [ns]Area [kGE]
J. Borghoff, A. Canteaut, T. Guneysu, E. B. Kavun, M. Knezevic, L. R. Knudsen, G. Leander, V. Nikov, C. Paar, C. Rechberger, P. Rombouts, S. Thomsen, T. Yalcin, PRINCE - A Low-latency Block Cipher for Pervasive Computing Applications, to appear in ASIACRYPT 2012.
CHES 2012, Leuven, Belgium, September 10-12, 2012PAGE: 21 of 21
Thank you!
