• KIPS Transactions on Computer and Communication Systems
• /
• v.11 no.6
• /
• pp.167-174
• /
• 2022

PIPO lightweight block ciphers were announced in ICISC'20. In this paper, a single-block optimization implementation and parallel optimization implementation of PIPO lightweight block cipher ECB, CBC, and CTR operation modes are performed on a 32-bit RISC-V processor. A single block implementation proposes an efficient 8-bit unit of Rlayer function implementation on a 32-bit register. In a parallel implementation, internal alignment of registers for parallel implementation is performed, and a method for four different blocks to perform Rlayer function operations on one register is described. In addition, since it is difficult to apply the parallel implementation technique to the encryption process in the parallel implementation of the CBC operation mode, it is proposed to apply the parallel implementation technique in the decryption process. In parallel implementation of the CTR operation mode, an extended initialization vector is used to propose a register internal alignment omission technique. This paper shows that the parallel implementation technique is applicable to several block cipher operation modes. As a result, it is confirmed that the performance improvement is 1.7 times in a single-block implementation and 1.89 times in a parallel implementation compared to the performance of the existing research implementation that includes the key schedule process in the ECB operation mode.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.15 no.2
• /
• pp.600-616
• /
• 2021

SIMON and SPECK are two families of lightweight block ciphers that have excellent performance on hardware and software platforms. At CRYPTO 2019, Gohr first introduces the differential cryptanalysis based deep learning on round-reduced SPECK32/64, and finally reduces the remaining security of 11-round SPECK32/64 to roughly 38 bits. In this paper, we are committed to evaluating the safety of SIMON cipher under the neural differential cryptanalysis. We firstly prove theoretically that SIMON is a non-Markov cipher, which means that the results based on conventional differential cryptanalysis may be inaccurate. Then we train a residual neural network to get the 7-, 8-, 9-round neural distinguishers for SIMON32/64. To prove the effectiveness for our distinguishers, we perform the distinguishing attack and key-recovery attack against 15-round SIMON32/64. The results show that the real ciphertexts can be distinguished from random ciphertexts with a probability close to 1 only by 2^8.7 chosen-plaintext pairs. For the key-recovery attack, the correct key was recovered with a success rate of 23%, and the data complexity and computation complexity are as low as 2⁸ and 2^20.1 respectively. All the results are better than the existing literature. Furthermore, we briefly discussed the effect of different residual network structures on the training results of neural distinguishers. It is hoped that our findings will provide some reference for future research.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.3
• /
• pp.545-550
• /
• 2018

Ultra-lightweight block cipher CHAM, consisting of simple addition, rotation, and eXclusive-or operations, enables the efficient implementations over both low-end and high-end Internet of Things (IoT) platforms. In particular, the CHAM block cipher targets the enhanced computational performance for the low-end IoT platforms. In this paper, we introduce the efficient implementation techniques to minimize the memory consumption and optimize the execution timing over 8-bit AVR IoT platforms. To achieve the higher performance, we exploit the partly iterated expression and arrange the memory alignment. Furthermore, we exploit the optimal number of register and data update. Finally, we achieve the high RANK parameters including 29.9, 18.0, and 13.4 for CHAM 64/128, 128/128, and 128/256, respectively. These are the best implementation results in existing block ciphers.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.9
• /
• pp.4727-4741
• /
• 2019

The lightweight block cipher Piccolo adopts Generalized Feistel Network structure with 64 bits of block size. Its key supports 80 bits or 128 bits, expressed by Piccolo-80 or Piccolo-128, respectively. In this paper, we exploit the security of reduced version of Piccolo from the first round with the pre-whitening layer, which shows the vulnerability of original Piccolo. As a matter of fact, we first study some linear relations among the round subkeys and the properties of linear layer. Based on them, we evaluate the security of Piccolo-80/128 against the meet-in-the-middle attack. Finally, we attack 13 rounds of Piccolo-80 by applying a 5-round distinguisher, which requires $2^{44}$ chosen plaintexts, $2^{67.39}$ encryptions and $2^{64.91}$ blocks, respectively. Moreover, we also attack 17 rounds of Piccolo-128 by using a 7-round distinguisher, which requires $2^{44}$ chosen plaintexts, $2^{126}$ encryptions and $2^{125.49}$ blocks, respectively. Compared with the previous cryptanalytic results, our results are the currently best ones if considering Piccolo from the first round with the pre-whitening layer.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.3
• /
• pp.391-399
• /
• 2023

In this paper, we presents for the first time an implementation using T-table for PIPO-64/128, 256 which are lightweight block ciphers. While our proposed implementation requires 16 T-tables, we show that the two types of T-tables are circulant and obtain variants implementations that require a smaller number of T-tables. We then discuss trade-off between the number of required T-tables (code size) and throughput by evaluating the throughput of the variant implementations on an Intel Core i7-9700K processor. The throughput-optimized versions for PIPO-64/128, 256 provide better throughput than TLU(Table-Look-Up) reference implementation by factors of 3.11 and 2.76, respectively, and bit-slice reference implementation by factors of 3.11 and 2.76, respectively.

• Annual Conference of KIPS
• /
• 2012.04a
• /
• pp.749-752
• /
• 2012

유비쿼터스 환경에서 보다 안전하고 편리하게 정보를 교환하기 위해서 암호 기술은 필수적인 요소이다. 유비쿼터스 컴퓨팅 및 네트워크 환경에서 사용되는 장치들은 기존의 장치보다 저사양이기 때문에 기존의 암호 기술을 그대로 적용하기는 어렵다. 이를 위해서 최근 경량 암호에 대한 연구가 활발히 진행되고 있다. 본 논문에서는 RFID/USN 등과 같이 자원이 제한적인 유비쿼터스 컴퓨팅 환경에 적합한 경량 블록 암호의 개발 동향을 분석한다. 기 제안된 경량 블록 암호의 구조와 특징을 분석하여 경량블록 암호 개발 시 고려해야 할 사항들을 살펴본다.

• Journal of KIISE
• /
• v.43 no.11
• /
• pp.1245-1258
• /
• 2016

Cryptographic technologies providing confidentiality and integrity such as encryption algorithms and message authentication codes (MACs) are necessary for preventing security threats in the Internet of Things (IoT) where various kinds of devices are interconnected. As a number of encryption schemes that have passed security verification are not necessarily suitable for low-power and low-performance IoT devices, various lightweight cryptographic schemes have been proposed. However, a study of lightweight MACs is not sufficient in comparison to that of lightweight block ciphers. Therefore, in this paper, we reviewed various kinds of MACs for their classification and analysis and then, we presented a new way for future MAC development. We also implemented major MAC algorithms and performed experiments to investigate their performance degradation on low-end micro-controllers.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.2
• /
• pp.253-260
• /
• 2015

The side-channel attack is widely known as an attack on implementations of cryptographic algorithms using additional side-channel information such as power traces, electromagnetic waves and sounds. As a countermeasure of side channel attack, the masking method is usually used, however full-round masking makes the efficiency of ciphers dramatically decreased. In order to avoid such a loss of efficiency, one can use reduced-round masking. In this paper, we describe a side channel attack on the lightweight block cipher LEA with the first one~six rounds masked. Our attack is based on differentials and power traces which provide knowledge of Hamming weight for the intermediate data computed during the enciphering of plaintexts. According to our experimental result, it is possible to recover 25 bits of the first round key in LEA-128.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.2
• /
• pp.165-173
• /
• 2023

In this paper, we propose an optimal implementation of lightweight block ciphers, SIMECK and SIMON counter operation mode, on a 32-bit RISC-V processor. Utilizing the characteristics of the CTR operating mode, we propose round function optimization that precomputes some values, single plaintext optimization and two plaintext parallel optimization. Since there are no previous research results on SIMECK and SIMON on RISC-V, we compared the performance of implementations with and without precomputation techniques for single plaintext optimization and two plaintext parallel optimization implementations. As a result, the implementations to which the precomputation technique was applied showed a performance improvement of 1% compared to the implementations to which precomputation was not applied.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.4
• /
• pp.588-594
• /
• 2021

SIMON, a lightweight block cipher developed by the US National Security Agency, is a family of block ciphers optimized for hardware implementation. It supports many kinds of standards to operate in various environments. The counter mode of operation is one of the operational modes. It provides to encrypt plaintext which is longer than the original size. The counter mode uses a constant(Nonce) and Counter value as an input value. Since Nonce is the identical for all blocks, so it always has same result when operates with other constant values. With this feature, it is possible to skip some instructions of round function by pre-computation. In general, the input value of SIMON is affected by the counter. However in an 8-bit environment, it is calculated in 8-bit units, so there is a part that can be pre-computed. In this paper, we focus the part that can be pre-calculated, and compare with previous works.