4 ms·

What are some other examples of "lightweight" block ciphers? Is AES considered lightweight, or are these far "lighter"?

by jlgreco 13y ago

tptacek 13y ago
TEA is another lightweight cipher. AES isn't lightweight. At the end of the first 1/3rd of this paper there's a chart comparing code size and throughput for ciphers by key/block size; that's what you want to pay attention to. You would tend to use ciphers like these in applications where the time/value of your information wouldn't justify the silicon or code space of a general-purpose cipher. Note also that neither of these ciphers were designed with any thought to the open-key security model, where the adversary knows the key in advance, as is the case with hashes. I don't know what this means to to the security of using, say, SIMON in a construction where the cipher core is also a PRF for a MAC, like CCM.
- JoachimSchipper 13y ago
  I'm confused about the latter half of your comment. CCM is basically CTR mode plus CBC-MAC; certainly the adversary isn't meant to have the key to your MAC? (Your comment about open-key use does make sense; it's just that I'm not sure it applies to CCM.) Also, I'll channel your for a moment: don't build your own crypto! And don't use lightweight block ciphers for data you care about: many are designed to skirt the edges of "too weak", their implementations haven't been side-channel-attacked quite as often as OpenSSL's AES, and they haven't been reviewed to anything like the extent that AES has been and/or have been found wanting (TEA). Yes, experts can put them to good use, but be very careful and don't use them before ruling out the conservative AES-HMAC-SHA2 as well as more modern constructions like Keccak in AEAD mode.
  - tptacek 13y ago
    Yeah, I wasn't thinking straight about that either. :) I think the Xbox TEA hash is another example of a lightweight cipher having problems when used as a hash construction. Certainly I wouldn't ever advise someone to use SIMON or SPECK in production.
pbsd 13y ago
They're a dime a dozen these days. Incomplete list, block ciphers only: HIGHT [1], PRESENT [2], KLEIN [3], PRINTcipher [4], KATAN [5], TWINE [6], LED [7], PRINCE [8], Piccolo [9]. AES is generally known to be doable in around 2500 gates, or gate-equivalents. These lightweight ciphers aim lower, towards the 1000 or so. [1] http://www.iacr.org/cryptodb/archive/2006/CHES/04/04.pdf http://www.iacr.org/cryptodb/archive/2006/CHES/04/04.pdf [2] http://homes.esat.kuleuven.be/~abogdano/papers/present_ches07.pdf http://homes.esat.kuleuven.be/~abogdano/papers/present_ches0... [3] http://doc.utwente.nl/73129/1/The_KLEIN_Block_Cipher.pdf http://doc.utwente.nl/73129/1/The_KLEIN_Block_Cipher.pdf [4] http://www.iacr.org/archive/ches2010/62250016/62250016.pdf http://www.iacr.org/archive/ches2010/62250016/62250016.pdf [5] http://www.cs.technion.ac.il/~orrd/KATAN/CHES2009.pdf http://www.cs.technion.ac.il/~orrd/KATAN/CHES2009.pdf [6] http://www.nec.co.jp/rd/media/code/research/images/twine_LC11.pdf http://www.nec.co.jp/rd/media/code/research/images/twine_LC1... [7] http://eprint.iacr.org/2012/600.pdf http://eprint.iacr.org/2012/600.pdf [8] http://eprint.iacr.org/2012/529.pdf http://eprint.iacr.org/2012/529.pdf [9] http://link.springer.com/chapter/10.1007%2F978-3-642-23951-9_23 http://link.springer.com/chapter/10.1007%2F978-3-642-23951-9...
- tptacek 13y ago
  Do you see anything interesting in the design of SIMON? Apart from how parsimonious it is with mathematical operations.
  - pbsd 13y ago
    The design looks very elegant, and they manage to avoid using sboxes at all, departing from most known lightweight ciphers. It also has decent performance in 64-bit hardware, without having to recur to bitslicing, which is nice. The whole round has algebraic degree 2, like Keccak, which makes things easier to analyze when it comes to differential and linear cryptanalysis. Hard to say much more at this point.
    - e3pi 13y ago
      Elegance and speed optimization is inconsequential for any non-real time, sub-TB? sub-GB file size. Or, what am I missing?
dfc 13y ago
In the youtube video I linked to one of the NSA guys says something like "You may even think of these as ultra lightweight block ciphers." https://www.youtube.com/watch?v=vtyo4nWGBwk https://www.youtube.com/watch?v=vtyo4nWGBwk

What are some other examples of "lightweight" block ciphers? Is AES considered lightweight, or are these far "lighter"?

by jlgreco 13y ago

What are some other examples of "lightweight" block ciphers? Is AES considered lightweight, or are these far "lighter"?

TEA is another lightweight cipher. AES isn't lightweight. At the end of the first 1/3rd of this paper there's a chart comparing code size and throughput for ciphers by key/block size; that's what you want to pay attention to. You would tend to use ciphers like these in applications where the time/value of your information wouldn't justify the silicon or code space of a general-purpose cipher. Note also that neither of these ciphers were designed with any thought to the open-key security model, where the adversary knows the key in advance, as is the case with hashes. I don't know what this means to to the security of using, say, SIMON in a construction where the cipher core is also a PRF for a MAC, like CCM.

JoachimSchipper 13y ago
I'm confused about the latter half of your comment. CCM is basically CTR mode plus CBC-MAC; certainly the adversary isn't meant to have the key to your MAC? (Your comment about open-key use does make sense; it's just that I'm not sure it applies to CCM.) Also, I'll channel your for a moment: don't build your own crypto! And don't use lightweight block ciphers for data you care about: many are designed to skirt the edges of "too weak", their implementations haven't been side-channel-attacked quite as often as OpenSSL's AES, and they haven't been reviewed to anything like the extent that AES has been and/or have been found wanting (TEA). Yes, experts can put them to good use, but be very careful and don't use them before ruling out the conservative AES-HMAC-SHA2 as well as more modern constructions like Keccak in AEAD mode.
- tptacek 13y ago
  Yeah, I wasn't thinking straight about that either. :) I think the Xbox TEA hash is another example of a lightweight cipher having problems when used as a hash construction. Certainly I wouldn't ever advise someone to use SIMON or SPECK in production.

pbsd 13y ago

They're a dime a dozen these days. Incomplete list, block ciphers only: HIGHT [1], PRESENT [2], KLEIN [3], PRINTcipher [4], KATAN [5], TWINE [6], LED [7], PRINCE [8], Piccolo [9]. AES is generally known to be doable in around 2500 gates, or gate-equivalents. These lightweight ciphers aim lower, towards the 1000 or so. [1] http://www.iacr.org/cryptodb/archive/2006/CHES/04/04.pdf http://www.iacr.org/cryptodb/archive/2006/CHES/04/04.pdf [2] http://homes.esat.kuleuven.be/~abogdano/papers/present_ches07.pdf http://homes.esat.kuleuven.be/~abogdano/papers/present_ches0... [3] http://doc.utwente.nl/73129/1/The_KLEIN_Block_Cipher.pdf http://doc.utwente.nl/73129/1/The_KLEIN_Block_Cipher.pdf [4] http://www.iacr.org/archive/ches2010/62250016/62250016.pdf http://www.iacr.org/archive/ches2010/62250016/62250016.pdf [5] http://www.cs.technion.ac.il/~orrd/KATAN/CHES2009.pdf http://www.cs.technion.ac.il/~orrd/KATAN/CHES2009.pdf [6] http://www.nec.co.jp/rd/media/code/research/images/twine_LC11.pdf http://www.nec.co.jp/rd/media/code/research/images/twine_LC1... [7] http://eprint.iacr.org/2012/600.pdf http://eprint.iacr.org/2012/600.pdf [8] http://eprint.iacr.org/2012/529.pdf http://eprint.iacr.org/2012/529.pdf [9] http://link.springer.com/chapter/10.1007%2F978-3-642-23951-9_23 http://link.springer.com/chapter/10.1007%2F978-3-642-23951-9...

tptacek 13y ago
Do you see anything interesting in the design of SIMON? Apart from how parsimonious it is with mathematical operations.
- pbsd 13y ago
  The design looks very elegant, and they manage to avoid using sboxes at all, departing from most known lightweight ciphers. It also has decent performance in 64-bit hardware, without having to recur to bitslicing, which is nice. The whole round has algebraic degree 2, like Keccak, which makes things easier to analyze when it comes to differential and linear cryptanalysis. Hard to say much more at this point.
  - e3pi 13y ago
    Elegance and speed optimization is inconsequential for any non-real time, sub-TB? sub-GB file size. Or, what am I missing?

dfc 13y ago

In the youtube video I linked to one of the NSA guys says something like "You may even think of these as ultra lightweight block ciphers." https://www.youtube.com/watch?v=vtyo4nWGBwk https://www.youtube.com/watch?v=vtyo4nWGBwk