Lightweight Cryptography - vttresearch.com · Modern Block Ciphers (SPN) 6. September 15, 2015...

Lightweight Cryptography:Designing Crypto for Low Energy and Low Power

Miroslav Knežević

NXP Semiconductors

[email protected]

September 12, 2015

WEEE 2015, Espoo, Finland

Cryptography – The Art of Writing Codes

September 15, 20152.

Κρυπτός (kryptós) – “hidden, secret”

Γράφειν (graphein) – “writing”

Secure Communication – Typical Set Up


Caesar Cipher – Julius Caesar (100 BC – 44 BC)


= 4

HELLO WORLD LIPPS ASVPH

Enigma Machine (1925 – 1945)


Modern Block Ciphers (SPN)


K-bit key

N-bit plaintext

32 ≤ N ≤ 128

80 ≤ K ≤ 256

Substitution

Permutation

Network

S-BOX

PERMUTATION

N-bit ciphertext


Conventional Crypto


Lightweight Crypto

Trade-offs in Crypto HW


Security

Performance Silicon area



Security


Designing Crypto for Low Energy and Low Power


Energy Power

Energy


=

Power


=

Passive RFID: Low Power Applications


CONTROL

MEMORY

CRYPTORF

NETWORK

INTERFACE RF

RFID tag

Reader

Anything Battery Powered: Low Energy Applications


Every mW matters!


Total number of mobile devices in 2015 = 9.5 billion*

Average (regular) power consumption of a smartphone = 160 mW**

Total energy spent = €2.8 billion*** a year!

*** average electricity price in 2014 in EU was €0.208 per kWh.

** An Analysis of Power Consumption in a Smartphone, A Carroll, G Heiser, USENIX 2010.

* Mobile Statistics Report 2015-2019, The Radicati Group Inc.

Cisco estimates…


… 50 billion* connected devices by 2020

* http://www.cisco.com/web/solutions/trends/iot/portfolio.html

Intel says…


… 200 billion* smart devices by 2020

* http://www.intel.com/content/www/us/en/internet-of-things/infographics/guide-to-iot.html

Moving Bits vs Moving People & Things


* http://www.tech-pundit.com/wp-content/uploads/2013/07/Cloud_Begins_With_Coal.pdf

World’s ICT Energy Consumption


* http://www.tech-pundit.com/wp-content/uploads/2013/07/Cloud_Begins_With_Coal.pdf

The ICT ecosystem uses about 1500 TWh of electricity annually and

approaches 10% of world electricity generation!

What can Crypto do about it?


Become Lightweight Crypto!

Power Consumption in (Crypto) HW


𝑃𝑡𝑜𝑡 = 𝑃𝑠𝑤𝑖𝑡𝑐ℎ𝑖𝑛𝑔 + 𝑃𝑙𝑒𝑎𝑘𝑎𝑔𝑒

𝑃𝑠𝑤𝑖𝑡𝑐ℎ𝑖𝑛𝑔 ≈ 𝐶𝑒𝑓𝑓 ∙ 𝑉𝐷𝐷2 ∙ 𝑓𝑐𝑙𝑘∙ 𝑠𝑤

𝑃𝑠𝑤𝑖𝑡𝑐ℎ𝑖𝑛𝑔 ≫ 𝑃𝑙𝑒𝑎𝑘𝑎𝑔𝑒

Energy Consumption in (Crypto) HW


𝐸 = 𝑃 ∙ 𝑡 = 𝑃 ∙𝑁

𝑓𝑐𝑙𝑘

𝐸 ≈ 𝐶𝑒𝑓𝑓 ∙ 𝑉𝐷𝐷2 ∙ 𝑁 ∙ 𝑠𝑤

• Reduce circuit area (e.g. serializing): 𝐶𝑒𝑓𝑓 ↓, but 𝑁 ↑

• Reduce switching activity (e.g. clock gating): 𝑠𝑤 ↓

• Move to smaller CMOS technologies: 𝐶𝑒𝑓𝑓 ↓, 𝑉𝐷𝐷 ↓, but 𝑃𝑙𝑒𝑎𝑘𝑎𝑔𝑒 ↑

• Reduce the operating clock frequency: 𝑓𝑐𝑙𝑘 ↓

• Reduce the latency: 𝑁 ↓

Reducing Power and Energy Consumption


𝑃 ≈ 𝐶𝑒𝑓𝑓 ∙ 𝑉𝐷𝐷2 ∙ 𝑠𝑤 ∙ 𝑓𝑐𝑙𝑘

𝐸 ≈ 𝐶𝑒𝑓𝑓 ∙ 𝑉𝐷𝐷2 ∙ 𝑠𝑤 ∙ 𝑁

History of Lightweight Crypto (Area)


0

500

1000

1500

2000

2500

3000

3500

1970 1980 1990 2000 2010 2020

AR

EA

(G

E)

YEAR

Lightweight Block Ciphers

DESAES

PRESENT

KATAN

History of Lightweight Crypto (Latency)


1

10

100

1000

10000

1970 1980 1990 2000 2010 2020

LA

TE

NC

Y (

# C

LO

CK

CY

CLE

S)

YEAR


History of Lightweight Crypto (Energy*)


1

10

100

1000

10000

100000

1000000

10000000

100000000

1970 1980 1990 2000 2010 2020

AR

EA

* L

AT

EN

CY

YEAR




Security


Designing the Smallest Block Cipher


Silicon area

• Smallest logic gate with two inputs.

• GE (gate equivalence) = physical area of a

single NAND gate.


NAND gate

XOR gate


2-3 GE

Modern Lightweight Ciphers


< 1000 GE

AES (128-bit key, ENC only)


2500 GE

Block Cipher – HW Perspective


Memory

Key size ≥ 80 bits

Block size ≥ 32 bits

Round function

+

Key schedule

+

Control logic

Minimize!

KATAN – The Smallest Block Cipher


KATAN32 = 462 GE


KATAN32 = 315 GE + 508 bits of ROM

Only 508 bits of expanded key!

KATAN – The Smallest Block Cipher

KATAN vs Competition


SPECK

IBM130

Synopsys

≥ 580 GE

KLEIN

TSMC180

Synopsys

≥ 1.3 kGE

Piccolo

130nm

Synopsys

≥ 700 GE

LED

180nm

Synopsys

≥ 700 GE

KATAN

NXP90

Synopsys

≥ 460 GEPRESENT

UMC180

IHP250

AMIS350

Synopsys

~1kGE

SIMON

IBM130

Synopsys

≥ 520 GE



Security


Designing the Fastest Block Cipher


Performance

Latency vs Throughput


Latency = 15 s

Throughput = 0.067 beer/s

12

3

6

9Serial

processing



Latency = 15 s


12

3

6

9Parallel

processing!



Latency = 15 s


12

3

6

9Pipelining!



Latency = 5 s


12

3

6

9

bottom-up!

Unrolling!

128 128 8 MDS LIGHT

128 128 4 BINARY NO

64 64 4 MDS LIGHT

64 64, 96, 128 4 BINARY LIGHT

64 80, 128 4BIT

PERMUTATIONLIGHT

64 64, 80, 96 4 MDS LIGHT

64 64, 128 4 MDS NO

Latency of Existing Ciphers – Is Lightweight = “Light + Wait”?


BLOCK-SIZE KEY-SIZE S-BOX P-LAYER K-SCHEDULE

MCRYPTON

AES

NOEKOEN

MINI-AES

PRESENT

KLEIN

LED

Unrolled HW Architectures


17.8

15.3 2

0.3 2

5.3

31.2

46.6

9.8

9.8

9.8

9.9

14.8

15.5

14.8

14.7

20.2

16.4 2

1.4 2

6.4

32.8

48.2

10.8

10.8

11 12

17 17.4

16.4

16.6

LATENCY [NS]

1-cycle 2-cycle

Results – Latency (CMOS 90 nm)


Number of Rounds vs Key Size


366.6

48.2 63.7 79.9

128.7

193.1

41.3

40.4

41.4

40

102.5

49.5 72.3

73.8

191.8

24.9

32.6

41.3 63.5 9

6

20.9

21.1

21

22

49.6

27.1

37.6

37.1

AREA [KGE]

1-cycle 2-cycle

Results – Area (CMOS 90 nm)


• Use small S-boxes (e.g. 5-bit, 4-bit, 3-bit)

• Almost everything follows the normal distribution. So does the S-box!

Low Latency Encryption

S-box


slide credit:

Gregor Leander

choose me!


Number of Rounds


Minimize!

• Not too low complexity.

• Reduce the number of rounds at the cost of (slightly) heavier round.


Round Complexity


• Number of rounds should be independent of the key schedule.

• Use constant addition instead of a key schedule (if possible).


Key Schedule


• Use involution where possible: 𝑓 𝑓 𝑥 = 𝑥.

• Make Encryption and Decryption procedures similar.

• BUT: think application oriented – sometimes it is beneficial to have

asymmetric constructions.


Encryption vs Decryption



Meet PRINCE


𝛼-reflection property:


Meet PRINCE


17.8

15.3

20.3

25.3

31.2

46.6

9.8

9.8

9.8

9.9

14.8

15.5

14.8

14.7

8

LATENCY [NS]


Meet PRINCE


366.6

48.2 63.7 79.9

128.7

193.1

41.3

40.4

41.4

40

102.5

49.5 7

2.3

73.8

17

AREA [KGE]

Future of Lightweight Crypto (Energy*)


1

10

100

1000

10000

100000

1000000

10000000

100000000

1970 1980 1990 2000 2010 2020

AR

EA

* L

AT

EN

CY

YEAR


Future of Lightweight Crypto (Energy*)


1

10

100

1000

10000

100000

1000000

10000000

100000000

1970 1980 1990 2000 2010 2020

AR

EA

* L

AT

EN

CY

YEAR


PRINCE

Futu

re o

f LW

C

THANK YOU!


Thanks to the teams of

KATAN, SPONGENT, PRINCE, FIDES

Lightweight Cryptography - vttresearch.com · Modern Block Ciphers (SPN) 6. September 15, 2015...

Documents

Transcript of Lightweight Cryptography - vttresearch.com · Modern Block Ciphers (SPN) 6. September 15, 2015...