The Simeck Family of Lightweight Block Ciphers

Transcription

1 The Simeck Family of Lightweight Block Ciphers Gagqiag Yag, Bo Zhu, Valeti Suder, Mark D. Aagaard, ad Guag Gog Departmet of Electrical ad Computer Egieerig, Uiversity of Waterloo Waterloo, Otario, N2L 3G, CANADA Abstract. Two lightweight block cipher families, Simo ad Speck, have bee proposed by researchers from the NSA recetly. I this paper, we itroduce Simeck, a ew family of lightweight block ciphers that combies the good desig compoets from both Simo ad Speck, i order to devise eve more compact ad eciet block ciphers. For Simeck32/64, we ca achieve 505 GEs (before the Place ad Route phase) ad 549 GEs (after the Place ad Route phase), with the power cosumptio of 0.47 µw i CMOS 30m ASIC, ad 454 GEs (before the Place ad Route phase) ad 488 GEs (after the Place ad Route phase), with the power cosumptio of.292 µw i CMOS 65m ASIC. Furthermore, all of the istaces of Simeck are smaller tha the oes of hardware-optimized cipher Simo i terms of area ad power cosumptio i both CMOS 30m ad CMOS 65m techiques. I additio, we also give the security evaluatio of Simeck with respect to may traditioal cryptaalysis methods, icludig dieretial attacks, liear attacks, impossible dieretial attacks, meet-i-the-middle attacks, ad slide attacks. Overall, all of the istaces of Simeck ca satisfy the area, power, ad throughput requiremets i passive RFID tags. Keywords: Lightweight, Block Cipher, ASICs, Passive RFID Itroductio I recet years, low-ed embedded devices have bee deployed i a icreasig umber ad used i various applicatios, such as Radio Frequecy Ideticatio (RFID) tags ad wireless sesor etworks (WSNs). Providig security solutios to these widely used devices has attracted a lot of attetio from cryptography researchers. These kids of devices have very limited power cosumptio, costraied memory ad computig capability, ad thus applyig traditioal security solutios, such as TLS ad IPsec, i these cotexts is ofte impractical. Hece, lightweight cryptography has bee developed i order to provide compact algorithms ad protocols that t i resource-costraied eviromets. Numerous lightweight ciphers have appeared. Amog them are a large umber of block ciphers such as TEA [3], XTEA [26], PRESENT [9], KATAN ad KTANTAN [], LED [6], EPCBC [33], KLEIN [5], LBlock [32], Piccolo [29], Twie [30], ad the more recet Simo ad Speck [3]. There exist also some

2 lightweight stream ciphers such as Trivium [2], Grai [7] ad WG [25], which provide suitable security ad small implemetatios for resource-costraied devices. The recetly proposed lightweight block ciphers, Simo ad Speck [3], have led to papers cocerig their security [7,,0]. This is partially due to the fact that these ciphers are recogized to be the smallest block ciphers i each of the block/key size categories whe used i resource-costraied eviromets. Simo is optimized for hardware implemetatio, while Speck is optimized for software. Ispired by the desigs of Simo ad Speck, we combie their good compoets i order to get a ew desig of block cipher family, called Simeck. We use a slightly modied versio of Simo's roud fuctio, ad reuse it i the key schedule like Speck does. Moreover, we take the beets of usig Liear Feedback Shift Register (LFSR) based costats i the key schedule i order to further reduce hardware implemetatio footprits. The ew family of lightweight block ciphers Simeck aims to have comparable security levels but more eciet hardware implemetatios. Based o the aforemetioed motivatios, we have the detailed desig goals as follows. Hardware. First, we wat to miimize the area ad power cosumptio of the Applicatio Specic Itegrated Circuit (ASIC) implemetatios. We also wat to allow a rage of optios i the area, throughput, ad power cosumptio. Fially, we wat to keep the maximum operatig frequecy as high as possible. Applicatios. Take the applicatio of passive RFID tags for example, Simeck should satisfy the followig requiremets i order to be used i practice: ) The area of Simeck should be less tha 2000 GEs [8,2]. 2) The power cosumptio of Simeck should be very small. 3) The typical passive RFID tag's operatig frequecy is 2 MHz ad the data rate is 64 Kbps [4,34], ad thus the throughput is 64K/2M /32. Therefore, if the tag's operatig frequecy is 00 KHz (for bechmarkig purpose), the throughput of Simeck should at least be 00 K /32 bps 3. Kbps. Security. Although Simo ad Speck were desiged with small, simple roud fuctios, they are iterated a suciet umber of times i order to resist traditioal attacks. We follow the same strategy with Simeck, ad due to its similarity with Simo, we beet from its aalysis carried so far. I this paper, we oer a wide rage of optios betwee area, throughput, ad power cosumptio for the implemetatios of Simeck. All the Simeck's family members ca meet our security, hardware, ad applicatios desig goals. We compare our results to the previous costructios with comparable block sizes ad key sizes as give i Table. Table gives our smallest area results for all the istaces of Simeck from before ad after the Place ad Route (P&R) i CMOS 30m ad CMOS 65m ASICs. I additio, the correspodig throughput ad power cosumptio after the Place ad Route are also provided. I particular, Table presets our hardware implemetatio results of Simo which cost less area tha the origial results i [3]. Moreover, the hardware implemetatios

3 Table. Compariso of Hardware Implemetatios of Lightweight Block Ciphers Size 32/64 48/96 64/28 Area Throughput Power Algorithm Tech Before P&R Source (m) (GEs) (GEs) (Kbps) (µw ) Simo [3] Speck [3] 30 Simo here Simeck here Simo here 65 Simeck here Simo [3] Speck [3] 30 Simo here Simeck here Simo here 65 Simeck here EPCBC [33] Simo [3] Speck [3] 30 Simo here Simeck here Simo here 65 Simeck here LED [6] 80 PRESENT [33] of our Simeck block cipher family are eve smaller tha our implemetatios of Simo i terms of area ad power cosumptio. More specically i Table, we ca achieve a small area of 505 GEs before the Place ad Route with a throughput of 5.6 Kbps ad 0.47 µw power cosumptio for Simeck32/64 i CMOS 30m ASIC. With a fair compariso (before the Place ad Route) i CMOS 30m, Simeck32/64 ca achieve 2.3% smaller tha our implemetatios of Simo32/64, ad 3.4% smaller tha the origial implemetatios of Simo32/64. Correspodigly, we ca get a eve smaller area of 454 GEs before the Place ad Route ad.292 µw power cosumptio i CMOS 65m ASIC. I this case, Simeck32/64 is 2.6% smaller tha our implemetatios of Simo32/64. Similarly, Simeck48/96, 64/28 are 2.5%, 2.%, respectively, smaller tha our implemetatios of Simo48/96, 64/28, ad they are 3.3%, 3.5%, respectively, smaller tha the origial implemetatios of Simo48/96, 64/28 i CMOS 30m. Correspodigly i CMOS 65m, Simeck48/96, 64/28 are 2.4%, 2.0%, respectively, smaller tha our implemetatios of Simo48/96, 64/28. Moreover, with oly a little extra area (GEs) ad power cosumptio, we ca icrease Simeck's throughput a lot.

4 This paper is orgaized as follows. I Sectio 2, we describe the specicatios ad desig ratioales of the Simeck family. Sectio 3 rst presets our metrics ad desig ow i CMOS 30m ad CMOS 65m ASICs. The, we give two dieret hardware architectures of Simeck i order to make a trade-o betwee area, throughput, ad power cosumptio. Later, the hardware evaluatios i CMOS 30m ad CMOS 65m are give with a thorough aalysis. I Sectio 4, we compare our results of Simeck ad Simo with the results i [3]. Before cocludig this paper, we provide a security aalysis of our ew block ciphers i Sectio 5. 2 Desig Specicatios ad Ratioales I this sectio, we give the specicatios, as well as desig ratioales, of our block cipher family Simeck. We use the followig otatios throughout the rest of the paper. x c deotes the cyclic shift of x to the left by c bits. x y is the bitwise AND of x ad y. x y is the exclusive-or (XOR) of x ad y. 2. Specicatios of Simeck Our lightweight block cipher family Simeck is deoted Simeck2/m, where is the word size ad is required to be 6, 24 or 32; while 2 is the block size ad m is the key size. More specically, our Simeck family icludes Simeck32/64, Simeck48/96, ad Simeck64/28. For example, Simeck32/64 refers to perform ecryptios or decryptios o 32-bit message blocks usig a 64-bit key. These three size choices of the ciphers aim to t dieret applicatios of embedded systems icludig RFID systems, ad these sizes are also cotaied i the specicatios of Simo ad Speck families of block ciphers. Simeck is desiged to be extremely small i hardware footprits ad to be compact i software implemetatios as well. The roud fuctio ad the key schedule algorithm follow the Feistel structure. A plaitext to be ecrypted is rst divided ito two words l 0 ad r 0, where l 0 cotais the most sigicat bits, ad r 0 cosists of the least sigicat bits. The these two words are processed by the Simeck roud fuctio for certai umber of rouds, ad ally the two output words l T ad r T are cocateated to form a complete ciphertext, where T deotes the total umber of rouds. Roud Fuctio. We dee the roud fuctio (of the i-th roud) as the followig fuctio, R ki (l i, r i ) = (r i f(l i ) k i, l i ), where l i ad r i are the two words for the iteral state of Simeck, k i is the roud key, ad the fuctio f is deed as f(x) = (x (x 5)) (x ). Figure illustrates the operatios of the roud fuctio R ki.

5 l i r i 5 k i l i+ r i+ Fig.. The Roud Fuctio of Simeck Key Schedule/Expasio. To geerate the roud key k i from a give master key K, the master key K is rst segmeted ito four words ad loaded as the iitial states (t 2, t, t 0, k 0 ) of the feedback shift registers show i Figure 2. The least sigicat bits of K are loaded ito k 0 ; while the most sigicat bits are put ito t 2. To update the registers ad geerate roud keys, we reuse the roud fuctio with a roud costat C (z j ) i actig as the roud key, i.e. R C (zj) i. The updatig operatio ca be expressed as { ki+ = t i, t i+3 = k i f(t i ) C (z j ) i, t i+2 t i+ t i k i R C (zj ) i Fig. 2. The Key Expasio of Simeck, where R C (zj ) i with C (z j) i Actig as the Roud Key is the Simeck Roud Fuctio

6 where 0 i T. The value k i is used as the roud key of the i-th roud. The value of the costat C is deed by C = 2 4, where is the word size. (z j ) i deotes the i-th bit of the sequece z j. Simeck32/64 ad Simeck48/96 use the same sequece z 0, i.e. j = 0, which is a m-sequece with period 3 ad ca be geerated by the primitive polyomial X 5 + X 2 + with the iitial state (,,,, ). Whe the rouds umber is larger tha 3, the sequece repeats itself. Simeck64/28 uses aother m-sequece z with period 63, which is geerated by the primitive polyomial X 6 + X + with the iitial state (,,,,, ). Number of Rouds. The umber of rouds T for Simeck32/64, Simeck48/96, ad Simeck64/28 are 32, 36, ad 44, respectively. 2.2 Desig Ratioales I Simeck, we use a slightly simplied versio of the roud fuctio of Simo. The roud fuctio of Simo ca be expressed as R k i (l i, r i ) = (((l i ) (l i 8)) (l i 2) r i k i, l i ), where l i ad r i are the iput words, ad k i is the roud key. The operatios of the roud fuctio oly cotai bitwise AND, XOR ad cyclic shifts, ad they are very eciet for hardware implemetatios. I particular, for Simeck, we chage these shift umbers from (, 8, 2) to (0, 5, ). We choose our shift umbers i order to realize a acceptable trade-o betwee hardware performace ad security. These modicatios will improve the eciecy of hardware implemetatios, but will have comparable security stregths agaist certai attacks. More discussios will be give i the followig sectios. For the key expasio/schedule algorithm of Simeck, we lear the idea of re-usig the roud fuctio to update the roud-key registers from the desig of Speck. Cocerig the umber of rouds for Simeck, we choose the same umbers as the correspodig block ciphers i the Simo family, i order to have comparable security levels ad fair hardware implemetatio evaluatios. To defeat certai self-similarity attacks such as slide attacks ad rotatioal attacks, we add the roud costats C ad (z j ) i ito the key expasio process. The costat C = 2 4 is also used i the key expasio of Simo. The polyomials for the two m-sequeces z 0 ad z are chose to have miimum umbers of compoets, such that their hardware implemetatios will have small footprits. 3 Hardware Implemetatios We discuss the hardware implemetatios of the Simeck family of block ciphers i this sectio.

7 3. Metrics ad Desig Flow We use the Syopsys Desig Compiler Versio D SP4 to sythesize the RTL of the desigs ito etlist based o the STMicroelectroics CMOS 65m CORE65LPLVT_.20V ad IBM CMOS 30m CMR8SF-LPVT Process SAGE v2.0 stadard cell libraries with both havig a typical.2v voltage, ad 25 C temperature. Cadece SoC Ecouter v09.2-s59_ is used to ish the Place ad Route phase i order to geerate the layout of the desigs. We use Metor Graphics ModelSim SE 0.a to coduct fuctioal simulatio of the desigs ad perform timig simulatio by usig the timig delay iformatio geerated from SoC Ecouter as well. The areas of the desigs after the logic sythesis are provided for comparisos with previous ciphers, ad a more accurate area after the Place ad Route is also provided for usig the ciphers i practical cases. The desities used for the Place ad Route phase for CMOS 30m ad 65m are 0.92 ad 0.93 respectively, i order to make a trade-o betwee area ad maximum operatig frequecy whe the desities are high eough. As usual, the area is measured i gate equivalets (GEs), ad oe GE is equivalet to the physical area required for the two-iput oe-output NAND gate with the lowest drivig stregth of the correspodig techology. We use SoC Ecouter v09.2-s59_ to geerate the accurate power cosumptio based o the activity iformatio geerated from the timig simulatio with a frequecy of 00 KHz, ad a duratio time of 0.s. We do so because the 00 KHz clock frequecy is widely used for bechmarkig purpose i resourcecostraied applicatios ad 0.s is log eough to provide a accurate activity iformatio for all the sigals. Moreover, the critical path is obtaied after the Place ad Route phase, which would be more accurate tha the estimated value obtaied from logic sythesis. Hece, the maximum clock frequecy which ca be operated for a specic desig is obtaied. Table 2. The Areas of Basic Gates i the Libraries IBM30m-8RF (NSA [3]) IBM30m-CMR8SF-LPLVT ST CMOS65m NAND AND OR NOT XOR XNOR MUX DFF bit full adder Sca FF I fact, durig the aalysis of the previous results [3,,24,27,28], the ASIC results for various implemetatios dier ot oly i the basic gate techology

8 but also i the types of ip-ops used. I order to be fair to compare our results with the previous oes, we provide the areas of some basic gates i our specic libraries ad the library used i [3] by the researchers from the NSA for Simo i Table 2. I additio, all the areas of basic gates provided here are the smallest oes i the library. We observe that our IBM 30m library is almost the same as the IBM 30m library used by the researchers from the NSA [3] except the sca ip-ops i terms of the areas of the basic gates. 3.2 Two Dieret Hardware Architectures for Simeck I this sectio, we target low-area implemetatios of Simeck ad make a tradeo betwee area ad throughput. Meawhile, we still keep a very high operatig frequecy. We give two architectures for the implemetatios: oe is parallel architecture, ad aother oe is fully serialized architecture. Moreover, we provide a block diagram of the top-level I/O iterface betwee the cipher ad the outside eviromet i order to provide a bechmark for the future implemetatios ad comparisos with other ciphers. Parallel Architecture The parallel architecture processes oe roud of the message i oe clock cycle, ad oe roud of the key schedule at the same clock cycle, as show i Figure 3. This architecture provides a very high throughput while keepig a compact desig. The roud fuctio i Fig. 3(a) icludes three parts: 2 ip-ops, a -bit width 2-to- multiplexer, a combiatioal circuit (dashed box) to compute the feedback data for the multiplexer. Iside the 2 ip-ops, ip-ops are for the message b, ad the other oes are for the message a. The multiplexer is used to select the iitial plaitext or the feedback data from the combiatioal circuit for the message b. The combiatioal circuit icludes oe -bit AND gate, three -bit XOR gates, ad two shift modules (cyclic shift to the left by 5 bits ad bit). The shift modules cost o extra hardware resources, because they ca be doe by rewirig the correspodig sigals. Whe the cipher rus, the -bit data from the message block b shifts to message block a, ad simultaeously, the message block b loads a ew -bit data from the multiplexer util the cipher stops. The roud key k i i the combiatioal circuit for every roud comes from the key schedule fuctio, which geerates a key for every rouds util the cipher outputs the ciphertext. Dieret from the roud fuctio architecture, the key schedule i Figure 3(b) has four -bit key blocks ad oe iput to the combiatioal circuit (dashed box) is dieret. This -bit iput to the key schedule is a combiatio of a ( )-bit costat ad a -bit sigal geerated from the cotrol circuit. All the ip-ops i the roud fuctio ad key schedule are stadard ip- ops without chip-eable i our architecture. I additio, there are oly two -bit width 2-to- multiplexers i total i our architecture to select the iitial data or feedback data, where oe is for the roud fuctio, ad the other is for the key schedule. Moreover, the latecy for geeratig a ciphertext usig our parallel architecture is T + 4, where T is the total umber of rouds.

9 i mode d i b b 0 a a 0 d out 5 (a) Parallel Datapath for the Roud Fuctio k i i mode key i d d 0 c c 0 b b 0 a a 0 k i (b) Parallel Datapath for the Key Schedule 5 C (z j ) i Fig. 3. Parallel Architecture for Simeck Partially Serialized Architecture I order to make a trade-o betwee area, throughput, ad power cosumptio, we provide a partially serialized architecture. This architecture processes oly several bits i the roud fuctio ad the key schedule durig oe clock cycle. The specic partially serialized size (par_sz) of Simeck are summarized as follows: Simeck32/64 :, 2, 4, 8, Simeck48/96 :, 2, 3, 4, 6, 8, 2, Simeck64/28 :, 2, 4, 8, 6. Besides the roud couter (i i Figures 3 ad 4) i the cotrol circuit, there is aother couter to cotrol the rouds of the specic serialized size i the partially serialized architecture. The rage of this serialized couter (l i Figure 4) is betwee 0 ad /par_sz. I total, the latecy for geeratig a ciphertext is (/par_sz) (T + 4), where T is the total umber of rouds.

10 i mode d i d out b b 5 b 0 a a 5 a 0 ce ce 5 MUX MUX5 (k i ) l (a) Fully Serialized Datapath for the Roud Fuctio i mode key i d d 5 d 0 c c 5 c 0 b b 5 b 0 a (k a 5 a i) l 0 ce ce 5 MUX MUX5 (b) Fully Serialized Datapath for the Key Schedule [C (z j) i] l Fig. 4. Fully Serialized Architecture for Simeck A fully serialized architecture is show i Figure 4. I this architecture, the multiplexer (MUX), ad combiatioal circuit (dashed box) are all -bit width, which save a lot of area. Compared to the parallel architecture, there are two more multiplexers. They are used to select the cyclic shift iputs. The MUX is used for the left shift by bit, ad MUX5 is used for left shift by 5 bits. The MUX selects b as iput whe the serialized couter equals 0, ad chooses a whe the serialized couter is larger tha 0. Similarly, the MUX5 selects b 5 whe the serialized couter is smaller tha or equal to 4, ad chooses a 5 whe the serialized couter is larger tha 4. The partially serialized architecture with par_sz larger tha is similar to the fully serialized architecture, where the multiplexer ad combiatioal circuit are par_sz-bit width ad the selectio sigals for the multiplexers (MUXes selectio circuitry) are dieret for various values of par_sz. The Top-level I/O Iterface for Dieret Architectures As discussed i Sectio 3., the area of the chip depeds o ot oly the area of the basic gates, but also the adopted types of ip-ops. We provide a toplevel I/O iterface betwee the cipher ad the outside eviromet as show i Figure 5. We do ot have a Fiite State Machie (FSM) to cotrol the circuit with the purpose of reducig the etire area as much as possible. I our top-

11 Clk i mode Key[par sz-:0] Cotrol Datapath Key Schedulig Ciphertext[-:0] Plaitext[par sz-:0] Roud Fuctio Fig. 5. The Top-level I/O Iterface betwee the Cipher ad the Outside Eviromet level architecture, the cipher is always ruig ad it is cotrolled by the outside sigal i_mode. Therefore, we oly have two modes i our architecture: loadig phase ad ruig phase. The cipher goes ito loadig phase whe i_mode equals 0, ad it loads the iitial data from the iputs Key ad Plaitext. Later o, the cipher begis ruig phase whe i_mode equals. The user obtais the Ciphertext at the ed of the ruig phase. The, i_mode returs back to 0, aother Plaitext ecryptio begis. As our architecture ever stops, all the ip-ops i the datapath are stadard ip-ops without chip-eable sigals. This property makes our desig ever smaller i terms of area. This architecture presets a bechmark ASIC implemetatio of Simeck ad ca be used to fairly compare with the hardware results of other ciphers. It is worth metioig that the parallel architecture ca be viewed as a special case of the partially serialized case whe par_sz equals. However, the two cases have dieret architectures as depicted i Figure 3 ad Figure 4. Our top-level architecture icludes two parts: the cotrol circuit ad the datapath. The cotrol circuit for the parallel architecture is used to provide the key costat from the LFSR as described i Sectio 2. However, a extra serialized couter i the cotrol circuit is eeded for the partially serialized architecture. The datapath icludes roud fuctio ad key schedulig, ad they are described as above for the parallel architecture ad partially serialized architecture. Recetly, LFSR or NLFSR based couters are used to replace biary couter i the cotrol circuit i hardware implemetatios [20], because they oly cotai ip-ops ad some combiatioal feedback logics without usig a full-adder. Hece, it ca reduce the area to some extet if the LFSR or NLFSR couter does ot icur extra area i the datapath. However, the serialized couter i our partially serialized architecture is used i two aspects: oe is used to cout the serialized rouds i the cotrol circuit ad aother oe is used to select the two multiplexers (MUX ad MUX5) i the datapath. After a theoretical ad practical aalysis of the eects of the LFSR or NLFSR couter i our partially serialized architecture, we discovered that the total area usig biary serialized couter is the smallest oe because the LFSR or NLFSR couter results i more additioal area i the datapath (i.e., the area of the multiplexers selectio circuitry) tha the area saved by replacig the biary couter with LFSR or NLFSR couter i the cotrol circuit. Therefore, the biary serialized couter is used for our partially serialized architecture.

12 3.3 Hardware Evaluatios of Simeck We use three dieret compilatio techiques i the Desig Compiler to perform hardware optimizatios: simple compile, compile ultra ad compile ultra with clock gatig. The simple compile optio ca provide us the hierarchical architectures of the desig, ad the areas of specic sub-modules. The compile ultra optio ca make deeper optimizatios i a way of optimizig the etire module together, thereby reducig the area ad power cosumptio sigicatly [,20]. The clock gatig techique ca further reduce the area ad power cosumptio []. However, we use all stadard ip-ops without chip-eable sigals for the parallel architecture. Oly the LFSR geeratig the key costat i the cotrol circuit uses the ip-ops with chip-eable sigals, which costs 5, 6, ad 6 ip- ops for Simeck32/64, Simeck48/96, ad Simeck64/28 respectively. Therefore, the clock gatig optimizatio aects oly a little of our results i terms of area ad power cosumptio. The ASIC implemetatio results of Simeck ad Simo i CMOS 30m are show i Table 3 ad Table 4, ad the correspodig results of Simeck ad Simo i CMOS 65m are show i Table 7 ad Table 8. It is worth otig that these results are obtaied without usig sca registers. We provide the best area results before ad after the Place ad Route phase usig compile ultra or compile ultra plus clock gatig. These results ca be used for comparig with other ciphers or for practical purpose. The maximum Table 3. Our Implemetatio Results of Simeck32/64, 48/96, 64/28 i 30m Simeck CMOS 30m Partial Area (GEs) Max Throughput Total Power KHz serial Before P&R After P&R (MHz) (Kbps) (µw) -bit bit Simeck32/64 4-bit bit bit bit bit Simeck48/96 3-bit bit bit bit bit bit bit bit Simeck64/28 4-bit bit bit bit * Area obtaied by usig compile ultra oly. Area obtaied by usig compile ultra ad clock gatig.

13 Table 4. Our Implemetatio Results of Simo32/64, 48/96, 64/28 i 30m Simo CMOS 30m Partial Area (GEs) Max Throughput Total Power NSA KHz serial Before P&R After P&R Before P&R (MHz) (Kbps) (µw) -bit bit Simo32/64 4-bit bit bit bit bit Simo48/96 3-bit bit bit bit bit bit bit bit Simo64/28 4-bit bit bit bit * Area obtaied by usig compile ultra oly. Area obtaied by usig compile ultra ad clock gatig. frequecy correspodig with the best optimizatio techique is give ad it is calculated by usig the critical path. The calculated throughput is based o the latecy i our architectures ad it is the same as Simo. The dierece of the total power cosumptio amog the three dieret optimizatios is margial. Therefore, we oly provide a total power cosumptio usig compile ultra at 00 KHz, which is typical for bechmarkig purpose. Sice the operatig frequecy is too small, the static power cosumptio domiates the total power cosumptio. However, the static power cosumptio is larger i CMOS 65m tha i CMOS 30m, which is the reaso why the total power cosumptio is larger i CMOS 65m as show i Table 7 ad Table 8. Besides havig a very small area, our aother observatio is that most part of the area for all the architectures are built of the sequetial logics, especially for the fully serialized architecture. Take Simeck32/64 for example. 86%, 85%, 82%, 76%, ad 70% of the etire area are sequetial logics for the cases that par_sz equals, 2, 4, 8, ad 6 respectively. From the data provided, we ca obtai that the fully serialized architecture is built of about 90% sequetial logics. Similar coclusios ca be obtaied for Simeck48/96 ad Simeck64/28. We provide a rage of optios betwee the area, throughput, ad power cosumptio i our ASIC implemetatios. Takig Simeck32/64 i CMOS 30m for illustratio, we ca achieve a throughput of 5.6 Kbps at the area cost of 505 GEs (before the Place ad Route) ad 549 GEs (after the Place ad Route) with the power cosumptio of 0.47 µw. However, a two-fold throughput (.

14 Kbps) ca be obtaied with oly 5 ad 6 extra GEs (before ad after the Place ad Route respectively), ad 0.04 µw extra power cosumptio. With more extra area ad power cosumptio, we ca get eve higher throughput. 4 Result Comparisos betwee Simeck ad Simo We compare our area results before the Place ad Route of Simeck ad Simo i CMOS 30m with the Simo results of the NSA researchers [3]. This is because the NSA researchers oly provide the area results before the Place ad Route. The compariso is show i Figure 6. We ca observe that our Simo results are all smaller tha that of NSA's results, ad our Simeck results are eve smaller tha Simo for all the cases show i Figure Areas (GEs) Our_Simeck32/ Our_Simo32/64 NSA_Simo32/64 Our_Simeck48/ Our_Simo48/96 NSA_Simo48/ Our_Simeck64/28 Our_Simo64/28 NSA_Simo64/ Partially Serialized Size (par_sz) Fig. 6. Comparisos of Areas (before the Place ad Route) betwee the Implemetatio Results of the NSA Researchers' ad Ours i CMOS 30m From the theoretical poit of view, Simeck is desiged to have a smaller area due to the followig cosideratios: the simplied key schedule, the simplied LFSR to geerate the key costat, ad the decreased shift umbers i the

15 roud fuctio. It is worth otig that the decreased shift umbers do ot aect ay area i the parallel architecture, ad it oly aect the area i the partially serialized architecture. The costructio of the combiatioal circuit i the key schedule of Simo32/64, 48/96, 64/28 ad Simeck32/64, 48/96, 64/28 i the parallel architecture are show as follows: Simo Simeck (2 + ) XOR + ( ) XNOR ( + ) XOR + ( ) XNOR + AND I geeral, oe XOR gate is larger tha oe AND gate. Therefore, the key schedule of Simo is larger tha that of Simeck. The LFSRs used to geerate the key costats for Simo32/64 ad Simo48/96 are deed by the primitive polyomial X 5 + X 4 + X 2 + X +, ad the LFSR for Simo64/28 is deed by X 5 + X 3 + X 2 + X +. They are all 2 XOR gates (4 GEs) bigger tha the oes used i correspodig Simeck, as described i Sectio 2. The decreased shift umbers of the roud fuctio ad key schedule reduce MUX for the iputs to the combiatioal circuits of the roud fuctio ad the key schedule respectively (2 MUXes i total, GEs/MUX = 4.5 GEs), ad also some logics to select the MUXes. Table 5. Breakdow of the Implemetatio Results before the Place ad Route i CMOS 30m Simeck32/64 (30m) Simo32/64 (30m) Parallel Fully Serialized Parallel Fully Serialized Compoets (GEs) (GEs) (GEs) (GEs) Cotrol Roud_combiatioal Circuit Datapath Key_combiatioal Circuit Sequetial + MUXes Compile simple Totals Compile ultra Compile ultra + clock gatig From the practical poit of view, we break dow the area results before the Place ad Route i CMOS 30m for Simeck32/64, ad Simo32/64 i our implemetatios, as show i Table 5. For parallel architectures, the diereces of the cotrol circuits ad the key combiatioal circuits betwee Simeck32/64 ad Simo32/64 are 4 GEs (key costat) ad 6 GEs respectively. The results are almost the same as the theoretical aalysis. For the fully serialized architecture, the cotrol circuit is reduced by 4 GEs (key costat), the key combiatioal circuit (dashed box i Figure 4) is reduced by 3 GEs, ad the 2 MUXes plus the MUXes selectio circuitry are reduced by 9 GEs for Simeck32/64 (i.e., a total savig of 6 GEs), compared to that of Simo32/64. Therefore, the practical results match the theoretical aalysis. Simeck is smaller tha Simo for both parallel architecture ad partially serialized architecture.

16 The mai area cost for Simo comes from the registers storig the message block ad the key. I order to desig a smaller cipher tha Simo, we ca reduce the areas of oly the roud fuctio, key schedule, key costat, ad multiplexers. For fully serialized architecture of Simo32/64 (see Table 5), the combied area of these blocks is 34.5 GEs ( /MUX), which accouts for oly about 6.4% (34.5/533) of the total area. Simeck32/64 reduces this by 6 GEs, a savig of more tha 46%. This reductio leads to 2.3% smaller total area i compariso to our implemetatios of Simo32/64 i CMOS 30m, ad 3.4% smaller i compariso to the origial Simo32/64 results (see Table ). Similarly, the fully serialized architectures of Simeck48/96, 64/28 are 2.5%, 2.%, respectively, smaller tha our implemetatios of Simo48/96, 64/28 ad they are 3.3% ad 3.5%, respectively, smaller tha the origial implemetatio results of Simo48/96, 64/28 i CMOS 30m (see Table ). For the parallel architectures of Simo, these blocks cosume a larger fractio (about 29%) of the total area (see Table 5). Simeck32/64, 48/96, 64/28 achieve the savig of 3.7%, 3.3%, ad 3.7% respectively, compared to the origial results of Simo32/64, 48/96, 64/28 (see Tables 3 ad 4). The choice of the values of the shift umbers plays a sigicat role i the area reductio of the partially serialized architecture. Because the parallel architecture does ot cotai the MUXes for the iputs to the combiatioal circuit (dashed box), the total area reductio is oly slightly greater tha the fully serialized architecture. From Tables 3 ad 4, we ca also observe that the power cosumptio of Simeck is smaller tha Simo for all the cases i CMOS 30m usig the same optimizatios. This is easy to uderstad because the area of Simeck is smaller tha Simo. This coclusio also holds for CMOS 65m i Tables 7 ad 8. I summary, Simeck is smaller tha Simo i terms of area ad power cosumptio i both CMOS 30m ad CMOS 65m techiques. 5 Security Aalysis I this sectio, we give the security aalysis of the Simeck family of block ciphers. Due to its similitude with Simo ad Speck, most of the ext aalysis follow from the best kow attacks agaist the Simo ad Speck families of block ciphers. As we show i the followig, the security level of Simeck is comparable to those of Simo, which is reasoable to be used i practice. Ideed, the umber of rouds chose for Simeck is sucietly high with respect to the best kow attacks o reduced versios. Moreover, it is worth oticig that the ARX (Additio-Rotatio-XOR) desig of Simeck borrowed from Speck, usig the roud fuctio as key-schedule, did ot lead to a weakess so far. I a recet paper [22], Kölbl et al. study the iuece of the shifts i Simo-like ciphers. They provide some set of parameters that are optimal with respect to dieretial ad liear properties, ad diusio. Our parameters seem comparable to theirs because we take also ito accout hardware eciecy ad other types of cryptaalysis (e.g., impossible dieretial cryptaalysis).

17 Dieretial/Liear Attacks [6,23]. Sice the dieretial ad liear behaviors of Simo ad Simeck are very closely related, it makes sese to use the best kow dieretial ad liear attacks of Simo to evaluate the security of Simeck agaist these attacks. This is why we have essetially followed the procedure of [7] to evaluate the security of Simeck agaist dieretial cryptaalysis. It is the possible to perform a attack o 9 rouds of Simeck32/64 with the time ad data complexity 2 34 ad respectively. It is also possible to attack 20 rouds out of 36 of Simeck48/96 with the time ad data complexity 2 75 ad 2 46 as well as a attack of 26 rouds out of 44 of Simeck64/28 with the time ad data complexity 2 2 ad For the best cryptaalytic result usig liear attacks agaist Simo, we refer to []. Because of the similar structure of Simeck, we veried that those results are also coform with respect to Simeck. For Simeck32/64, we ca cover 2 rouds with the data complexity 2 3. For Simeck48/96, we ca cover 5 rouds with the data complexity Fially, it is possible to perform a liear cryptaalysis of Simeck64/28 up to 9 rouds with 2 23 kow plaitexts. All these attacks have a success probability of Sice the best kow dieretial ad liear trails foud o Simeck, ad Simo, oly cover a reduced umber of rouds, we believe that the full-roud Simeck (ay versio) is sucietly secure agaist dieretial ad liear cryptaalysis. Impossible Dieretial Attacks [4]. Impossible dieretial attacks a- gaist Simeck cover few more rouds (depedig o the versio) tha for Simo as it ca be see i Table 6. This is due to the fact that the diusio of oe bit dierece is oe roud slower for Simeck tha for Simo. Nevertheless, this does ot damage the overall security of the Simeck family, sice the full versios have more rouds. Table 6. Compariso of Impossible Dieretial Attacks agaist Simo ad Simeck Algorithm #Rouds Data Time Memory Simo32/64 [0] Simo48/96 [0] Simo64/28 [0] Simeck32/ Simeck48/ Simeck64/ Algebraic Degree [2]. We computed that after 5 rouds, the algebraic degree of Simeck (ay versio) is 3, as the oe of Simo. It is suciet to esure that after few more rouds, o attack ca exploit properties of the algebraic degree, such as algebraic attack or higher-order dieretial attack. Meet-i-the-Middle Attacks [3]. Because of the key schedule algorithm of Simeck, may key bits of the master key are processed quickly i the roud

18 fuctio of Simeck. This should esure a good resistace of Simeck agaist Meeti-the-Middle (MITM) attacks. Moreover, util ow Simo has ot show to be a good cadidate for MITM attacks. As the roud fuctio of Simeck is very similar as the oe of Simo, we believe that Simeck will also be resistat agaist MITM attacks. Slide Attacks ad Rotatioal Attacks [8,9]. The roud costat additio ad the key schedule desig prevet ay eciet slide or rotatioal attacks. Related-key Dieretial Attacks [5]. Although Simo ad Speck have bee extesively studied i the past years, o cocrete attacks i the related-key settig have bee show. Like Speck, Simeck reuses its roud fuctio i the key schedule part. It is reasoable to thik that Simeck has also good cryptographic properties i the related key model. 6 Cocludig Remarks I this paper, we have preseted Simeck, a ew family of lightweight block ciphers. Simeck is very suitable for resource-costraied devices, such as passive RFID tags ad wireless sesor etworks. We have provided a extesive exploratio for dieret hardware architectures i order to make a balace betwee area, throughput, ad power cosumptio for Simo ad Simeck i both CMOS 30m ad CMOS 65m techiques. We have show that it is possible to desig a smaller cipher tha Simo i terms of area ad power cosumptio. Moreover, we have improved the hardware implemetatios of Simo give i the origial paper. I additio, the similarities betwee Simo/Speck ad Simeck allow us to have a idea of the actual security oered by Simeck. Eve if the roud fuctio of Simeck is quite simple, this roud fuctio is iterated a suciet umber of time to provide a adequate security agaist most kow attacks. I coclusio, all of the istaces i the Simeck family ca meet the area, power cosumptio, ad throughput requiremets i the passive RFID tags ad they are promisig cadidates for resource-costraied devices. We have leart ad uderstood may techiques about desigig hardwareorieted ciphers durig the process of completig the desig of Simeck. It is iterestig to see if we ca devise a block cipher with eve smaller hardware footprits tha Simeck. It also iterests us whether we ca desig, from the theoretical poit of view, a smallest block cipher with the miimum umber of compoets. This should be very useful for cryptography researchers to get deep isights ito desigig ad aalyzig ciphers. Ackowledgmets The authors would like to thak the aoymous reviewers for their helpful ad costructive commets that greatly cotributed to improvig the al versio of the paper. This work is supported by NSERC Discovery Grats, Strategic Project Grat, ad Caadia Microelectroics Corporatio.

19 Refereces. J. Alizadeh, H. AlKhzaimi, M. R. Aref, N. Bagheri, P. Gauravaram, A. Kumar, M. M. Lauridse, ad S. K. Saadhya. Cryptaalysis of SIMON Variats with Coectios. I N. Saxea ad A. Sadeghi, editors, Radio Frequecy Ideticatio: Security ad Privacy Issues - 0th Iteratioal Workshop, RFIDSec 204, Oxford, UK, July 2-23, 204, Revised Selected Papers, volume 865 of Lecture Notes i Computer Sciece, pages Spriger, F. Armkecht, M. Hama, ad V. Mikhalev. Lightweight Autheticatio Protocols o Ultra-Costraied RFIDs Myths ad Facts. I Radio Frequecy Ideti- catio: Security ad Privacy Issues, pages 8. Spriger, R. Beaulieu, D. Shors, J. Smith, S. Treatma-Clark, B. Weeks, ad L. Wigers. The SIMON ad SPECK Families of Lightweight Block Ciphers. Cryptology eprit Archive, Report 203/404, E. Biham, A. Biryukov, ad A. Shamir. Cryptaalysis of Skipjack Reduced to 3 Rouds Usig Impossible Dieretials. J. Cryptology, 8(4):293, E. Biham, O. Dukelma, ad N. Keller. A Uied Approach to Related-Key Attacks. I K. Nyberg, editor, Fast Software Ecryptio, 5th Iteratioal Workshop, FSE 2008, Lausae, Switzerlad, February 0-3, 2008, Revised Selected Papers, volume 5086 of Lecture Notes i Computer Sciece, pages Spriger, E. Biham ad A. Shamir. Dieretial Cryptaalysis of DES-like Cryptosystems. J. Cryptology, 4():372, A. Biryukov, A. Roy, ad V. Velichkov. Dieretial Aalysis of Block Ciphers SIMON ad SPECK. I FSE 204, LNCS. Spriger, A. Biryukov ad D. Wager. Slide Attacks. I L. R. Kudse, editor, Fast Software Ecryptio, 6th Iteratioal Workshop, FSE '99, Rome, Italy, March 24-26, 999, Proceedigs, volume 636 of Lecture Notes i Computer Sciece, pages Spriger, A. Bogdaov, L. R. Kudse, G. Leader, C. Paar, A. Poschma, M. J. B. Robshaw, Y. Seuri, ad C. Vikkelsoe. PRESENT: A Ultra-lightweight Block Cipher. I P. Paillier ad I. Verbauwhede, editors, Cryptographic Hardware ad Embedded Systems - CHES 2007, 9th Iteratioal Workshop, Viea, Austria, September 0-3, 2007, Proceedigs, volume 4727 of Lecture Notes i Computer Sciece, pages Spriger, C. Boura, M. Naya-Plasecia, ad V. Suder. Scrutiizig ad Improvig Impossible Dieretial Attacks: Applicatios to CLEFIA, Camellia, LBlock ad Simo. I Advaces i Cryptology - ASIACRYPT th Iteratioal Coferece o the Theory ad Applicatio of Cryptology ad Iformatio Security, Kaoshiug, Taiwa, R.O.C., December 7-, 204. Proceedigs, Part I, pages 7999, C. De Caière, O. Dukelma, ad M. Keºevi. KATAN ad KTANTAN - A Family of Small ad Eciet Hardware-orieted Block Ciphers. 2. C. De Caière ad B. Preeel. Trivium Specicatios, estream, ECRYP- T Stream Cipher Project, Report 2005/ W. Die ad M. E. Hellma. Exhaustive Cryptaalysis of the NBS Data Ecryptio Stadard. Computer, 0(6):7484, Jue EPCglobal. EPC Class Geeratio 2 Stadard. default/files/docs/uhfcg2/uhfcg2_2_0_0_stadard_2030.pdf, Z. Gog, S. Nikova, ad Y. W. Law. KLEIN: A New Family of Lightweight Block Ciphers. I A. Juels ad C. Paar, editors, RFID. Security ad Privacy - 7th

20 Iteratioal Workshop, RFIDSec 20, Amherst, USA, Jue 26-28, 20, Revised Selected Papers, volume 7055 of Lecture Notes i Computer Sciece, pages 8. Spriger, J. Guo, T. Peyri, A. Poschma, ad M. Robshaw. The LED Block Cipher. I Cryptographic Hardware ad Embedded Systems CHES 20, pages Spriger, M. Hell, T. Johasso, ad W. Meier. Grai: A Stream Cipher for Costraied Eviromets. Iteratioal Joural of Wireless ad Mobile Computig, 2():86 93, A. Juels ad S. A. Weis. Autheticatig Pervasive Devices with Huma Protocols. I Advaces i Cryptology CRYPTO 2005, pages Spriger, D. Khovratovich ad I. Nikolic. Rotatioal Cryptaalysis of ARX. I S. Hog ad T. Iwata, editors, Fast Software Ecryptio, 7th Iteratioal Workshop, FSE 200, Seoul, Korea, February 7-0, 200, Revised Selected Papers, volume 647 of Lecture Notes i Computer Sciece, pages Spriger, L. Kudse, G. Leader, A. Poschma, ad M. J. Robshaw. PRINTcipher: A Block Cipher for IC-pritig. I Cryptographic Hardware ad Embedded Systems, CHES 200, pages 632. Spriger, L. R. Kudse. Trucated ad Higher Order Dieretials. I B. Preeel, editor, Fast Software Ecryptio: Secod Iteratioal Workshop. Leuve, Belgium, 4-6 December 994, Proceedigs, volume 008 of Lecture Notes i Computer Sciece, pages 962. Spriger, S. Kölbl, G. Leader, ad T. Tiesse. Observatios o the Simo Block Cipher Family. I CRYPTO 205, LNCS. Spriger, 205. to appear. 23. M. Matsui. Liear Cryptoaalysis Method for DES Cipher. I T. Helleseth, editor, Advaces i Cryptology EUROCRYPT 993, Workshop o the Theory ad Applicatio of Cryptographic Techiques, Lofthus, Norway, May 23-27, 993, Proceedigs, volume 765 of Lecture Notes i Computer Sciece, pages Spriger, A. Moradi, A. Poschma, S. Lig, C. Paar, ad H. Wag. Pushig the Limits: A Very Compact ad a Threshold Implemetatio of AES. I Advaces i Cryptology EUROCRYPT 20, pages Spriger, Y. Nawaz ad G. Gog. WG: A Family of Stream Ciphers with Desiged Radomess Properties. If. Sci., 78(7):90396, R. M. Needham ad D. J. Wheeler. TEA Extesios, October 997. Techical Report, Uiversity of Cambridge. 27. T. Plos, C. Dobrauig, M. Hoger, A. Oprisik, C. Wiesmeier, ad J. Wiesmeier. Compact Hardware Implemetatios of the Block Ciphers mcrypto, NOEKEON, ad SEA. I Progress i Cryptology INDOCRYPT 202, pages Spriger, C. Rolfes, A. Poschma, G. Leader, ad C. Paar. Ultra-lightweight Implemetatios for Smart Devices Security for 000 Gate Equivalets. I Smart Card Research ad Advaced Applicatios, pages Spriger, K. Shibutai, T. Isobe, H. Hiwatari, A. Mitsuda, T. Akishita, ad T. Shirai. Piccolo: A Ultra-lightweight Block Cipher. I Cryptographic Hardware ad Embedded Systems CHES 20, pages Spriger, T. Suzaki, K. Miematsu, S. Morioka, ad E. Kobayashi. Twie: A Lightweight, Versatile Block Cipher. I ECRYPT Workshop o Lightweight Cryptography, pages 4669, 20.

21 3. D. J. Wheeler ad R. M. Needham. TEA: A Tiy Ecryptio Algorithm. I Fast Software Ecryptio: Secod Iteratioal Workshop. Leuve, Belgium, 4-6 December 994, Proceedigs, pages , W. Wu ad L. Zhag. LBlock: A Lightweight Block Cipher. I J. Lopez ad G. Tsudik, editors, Applied Cryptography ad Network Security - 9th Iteratioal Coferece, ACNS 20, Nerja, Spai, Jue 7-0, 20. Proceedigs, volume 675 of Lecture Notes i Computer Sciece, pages , H. Yap, K. Khoo, A. Poschma, ad M. Herickse. EPCBC - A Block Cipher Suitable for Electroic Product Code Ecryptio. I D. Li, G. Tsudik, ad X. Wag, editors, Cryptology ad Network Security - 0th Iteratioal Coferece, CANS 20, Saya, Chia, December 0-2, 20. Proceedigs, volume 7092 of Lecture Notes i Computer Sciece, pages Spriger, D. J. Yeager, A. P. Sample, J. R. Smith, ad J. R. Smith. WISP: A Passively Powered UHF RFID Tag with Sesig ad Computatio. RFID Hadbook: Applicatios, Techology, Security, ad Privacy, pages 26278, Appedix A ASIC Implemetatio Results of Simo ad Simeck i CMOS 65m Tables 7 ad 8 give our results of Simeck ad Simo i CMOS 65m. Table 7. Our Implemetatio Results of Simeck32/64, 48/96, 64/28 i 65m Simeck CMOS 65m Partial Area (GEs) Max Throughput Total Power KHz Serial Before P&R After P&R (MHz) (Kbps) (µw) -bit bit Simeck32/64 4-bit bit bit bit bit Simeck48/96 3-bit bit bit bit bit bit bit bit Simeck64/28 4-bit bit bit bit * Area obtaied by usig compile ultra oly. Area obtaied by usig compile ultra ad clock gatig.

22 Table 8. Our Implemetatio Results of Simo32/64, 48/96, 64/28 i 65m Simo CMOS 65m Partial Area (GEs) Max Throughput Total Power KHz Serial Before P&R After P&R (MHz) (Kbps) (µw) -bit bit Simo32/64 4-bit bit bit bit bit Simo48/96 3-bit bit bit bit bit bit bit bit Simo64/28 4-bit bit bit bit * Area obtaied by usig compile ultra oly. Area obtaied by usig compile ultra ad clock gatig. Appedix B Test Vectors Here we list some test vectors for the Simeck family of block ciphers, i the same format as the oes i [3]. Simeck32/64 Key: Plaitext: Ciphertext: 770d 2c76 Simeck48/96 Key: a a Plaitext: e Ciphertext: f3cf25 e33b36 Simeck64/28 Key: ba b0a Plaitext: 656b696c 20646e75 Ciphertext: 45ce6902 5f7ab7ed