WARP : Revisiting GFN for Lightweight 128-bit Block Cipher
WARP : Revisiting GFN for Lightweight 128-bit Block Cipher
复制标题
DOI：
10.1007/978-3-030-81652-0_21
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
S. Banik;Zhenzhen Bao;Takanori Isobe;Hiroyasu Kubo;F. Liu;Kazuhiko Minematsu;Kosei Sakamoto;Nao Shibata;Maki Shigeri
中科院分区：
文献类型：
--
作者：
S. Banik;Zhenzhen Bao;Takanori Isobe;Hiroyasu Kubo;F. Liu;Kazuhiko Minematsu;Kosei Sakamoto;Nao Shibata;Maki Shigeri
在本文中，我们介绍了warp，它是一个轻量级的128位分组密码，具有128位密钥。它针对128位分组密码领域的小电路，可能实现统一的加解密功能。warpi的总体结构是32-nibble Type-2 Generalized Feistel Network （GFN）的一种变体，通过对nibble的排列来优化安全性和效率。我们进行彻底的安全分析，并报告全面的硬件和软件实施结果。我们的硬件结果表明，对于大多数典型的硬件实现策略，warpi是最小的128位分组密码。warpst的串行电路可以实现大约800个门当量（ge），这比以前轻量级128位密码的最先进实现要小得多（它们需要超过1000个ge）。虽然我们的主要指标是硬件大小，但warp还具有其他几个特性，最显著的是低能耗。这有点令人惊讶，因为GFN通常比替代置换网络（SPN）需要更多的回合，因此GFN在这方面被认为不那么有利。我们展示了warpi的多轮实现是相当低能量的。此外，warp在软件上的表现也很好：对于长输入，我们的SIMD实现与已知的面向硬件的128位轻量级密码相当有竞争力，由于并行块数量少，对于小输入甚至更好。在8位微控制器上，我们的汇编实现结果表明，warpi可以灵活地实现各种性能特征。
In this article, we presentWARP, a lightweight 128-bit block cipher with a 128-bit key. It aims at small-footprint circuit in the field of 128-bit block ciphers, possibly for a unified encryption and decryption functionality. The overall structure ofWARPis a variant of 32-nibble Type-2 Generalized Feistel Network (GFN), with a permutation over nibbles designed to optimize the security and efficiency. We conduct a thorough security analysis and report comprehensive hardware and software implementation results. Our hardware results show thatWARPis the smallest 128-bit block cipher for most of typical hardware implementation strategies. A serialized circuit ofWARPachieves around 800 Gate Equivalents (GEs), which is much smaller than previous state-of-the-art implementations of lightweight 128-bit ciphers (they need more than 1, 000 GEs). While our primary metric is hardware size,WARPalso enjoys several other features, most notably low energy consumption. This is somewhat surprising, since GFN generally needs more rounds than substitution permutation network (SPN), and thus GFN has been considered to be less advantageous in this regard. We show a multi-round implementation ofWARPis quite low-energy. Moreover,WARPalso performs well on software: our SIMD implementation is quite competitive to known hardware-oriented 128-bit lightweight ciphers for long input, and even much better for small inputs due to the small number of parallel blocks. On 8-bit microcontrollers, the results of our assembly implementations show thatWARPis flexible to achieve various performance characteristics.