PRESENT: An ultra-lightweight block cipher (2007)

by Andrey Bogdanov, Lars R Knudsen, Gregor Leander, Christof Paar, Axel Poschmann, Matthew J B Robshaw, Yannick Seurin, C Vikkelsoe
Venue:In CHES, volume 4727 of Lecture Notes in Computer Science
Add To MetaCart
Results 1 - 10 of 167

The LED Block Cipher

by Jian Guo, Thomas Peyrin, Axel Poschmann, Matt Robshaw - Cryptographic Hardware and Embedded Systems - CHES 2011, volume 6917 of LNCS , 2011
"... Abstract. We present a new block cipher LED. While dedicated to compact hardware implementation, and offering the smallest silicon footprint among comparable block ciphers, the cipher has been designed to simultaneously tackle three additional goals. First, we explore the role of an ultra-light (in ..."
Abstract - Cited by 71 (7 self) - Add to MetaCart
Abstract. We present a new block cipher LED. While dedicated to compact hardware implementation, and offering the smallest silicon footprint among comparable block ciphers, the cipher has been designed to simultaneously tackle three additional goals. First, we explore the role of an ultra-light (in fact non-existent) key schedule. Second, we consider the resistance of ciphers, and LED in particular, to related-key attacks: we are able to derive simple yet interesting AES-like security proofs for LED regarding related- or single-key attacks. And third, while we provide a block cipher that is very compact in hardware, we aim to maintain a reasonable performance profile for software implementation. Key words: lightweight, block cipher, RFID tag, AES. 1
(Show Context)

KLEIN: A New Family of Lightweight Block Ciphers

by Zheng Gong, Svetla Nikova, Yee Wei Law
"... Resource-efficient cryptographic primitives become fundamental for realizing both security and efficiency in embedded systems like RFID tags and sensor nodes. Among those primitives, lightweight block cipher plays a major role as a building block for security protocols. In this paper, we describe a ..."
Abstract - Cited by 52 (4 self) - Add to MetaCart
Resource-efficient cryptographic primitives become fundamental for realizing both security and efficiency in embedded systems like RFID tags and sensor nodes. Among those primitives, lightweight block cipher plays a major role as a building block for security protocols. In this paper, we describe a new family of lightweight block ciphers named KLEIN, which is designed for resource-constrained devices such as wireless sensors and RFID tags. Compared to the related proposals, KLEIN has ad-vantage in the software performance on legacy sensor platforms, while its hardware implementation can be compact as well.
(Show Context)

Algebraic Techniques in Differential Cryptanalysis

by Martin Albrecht, Carlos Cid - Proceedings of the First International Conference on Symbolic Computation and Cryptography, SCC 2008 , 2008
"... Abstract. In this paper we propose a new cryptanalytic method against block ciphers, which combines both algebraic and statistical techniques. More specifically, we show how to use algebraic relations arising from differential characteristics to speed up and improve key-recovery differential attacks ..."
Abstract - Cited by 34 (7 self) - Add to MetaCart
Abstract. In this paper we propose a new cryptanalytic method against block ciphers, which combines both algebraic and statistical techniques. More specifically, we show how to use algebraic relations arising from differential characteristics to speed up and improve key-recovery differential attacks against block ciphers. To illustrate the new technique, we apply algebraic techniques to mount differential attacks against round reduced variants of Present-128. 1
(Show Context)

Linear Cryptanalysis of Reduced-Round PRESENT

by Joo Yeon Cho
"... Abstract. PRESENT is a hardware-oriented block cipher suitable for resource constrained environment. In this paper we analyze PRESENT by the multidimensional linear cryptanalysis method. We claim that our attack can recover the 80-bit secret key of PRESENT up to 25 rounds out of 31 rounds with aroun ..."
Abstract - Cited by 27 (0 self) - Add to MetaCart
Abstract. PRESENT is a hardware-oriented block cipher suitable for resource constrained environment. In this paper we analyze PRESENT by the multidimensional linear cryptanalysis method. We claim that our attack can recover the 80-bit secret key of PRESENT up to 25 rounds out of 31 rounds with around 2 62.4 data complexity. Furthermore, we showed that the 26-round version of PRESENT can be attacked faster than key exhaustive search with the 2 64 data complexity by an advanced key search technique. Our results are superior to all the previous attacks. We demonstrate our result by performing the linear attacks on reduced variants of PRESENT. Our results exemplify that the performance of the multidimensional linear attack is superior compared to the classical linear attack.

Hb#: Increasing the security and efficiency of hb

by Henri Gilbert, Matthew J. B. Robshaw, Yannick Seurin - of LNCS
"... Abstract. The innovative HB + protocol of Juels and Weis [10] extends device authentication to low-cost RFID tags. However, despite the very simple on-tag computation there remain some practical problems with HB + and despite an elegant proof of security against some limited active attacks, there is ..."
Abstract - Cited by 19 (2 self) - Add to MetaCart
Abstract. The innovative HB + protocol of Juels and Weis [10] extends device authentication to low-cost RFID tags. However, despite the very simple on-tag computation there remain some practical problems with HB + and despite an elegant proof of security against some limited active attacks, there is a simple man-in-the-middle attack due to Gilbert et al. [8]. In this paper we consider improvements to HB + in terms of both security and practicality. We introduce a new protocol that we denote random-HB #. This proposal avoids many practical drawbacks of HB +, remains provably resistant to attacks in the model of Juels and Weis, and at the same time is provably resistant to a broader class of active attacks that includes the attack of [8]. We then describe an enhanced variant called HB # which offers practical advantages over HB +. Key words: HB +, RFID tags, authentication, LPN, Toeplitz matrix. 1
(Show Context)

Cryptanalysis of the SIMON Family of Block Ciphers

by Hoda A. Alkhzaimi, Martin M. Lauridsen
"... Abstract. Recently, the U.S National Security Agency has published the specifications of two families of lightweight block ciphers, SIMON and SPECK, on ePrint [2]. The ciphers are developed with optimization towards both hardware and software in mind. While the specification paper discusses design r ..."
Abstract - Cited by 17 (1 self) - Add to MetaCart
Abstract. Recently, the U.S National Security Agency has published the specifications of two families of lightweight block ciphers, SIMON and SPECK, on ePrint [2]. The ciphers are developed with optimization towards both hardware and software in mind. While the specification paper discusses design requirements and performance of the presented lightweight ciphers thoroughly, no security assessment is given. This paper is a move towards filling that cryptanalysis gap for the SIMON family of ciphers. We present a series of observations on the presented construction that, in some cases, yield attacks, while in other cases may provide basis of further analysis by the cryptographic community. Specifically, we obtain attacks using classical- as well as truncated differentials. In the former case, we show how the smallest version of SIMON, Simon32/64, exhibits a strong differential effect.
(Show Context)

Side-Channel Resistant Crypto for less than

by Axel Poschmann, Amir Moradi, Khoongming Khoo, Chu-wee Lim, Huaxiong Wang, San Ling
"... Abstract. A provably secure countermeasure against first order sidechannel attacks has been proposed by Nikova et al. in 2006. We have implemented the lightweight block cipher PRESENT using the proposed countermeasure. For this purpose we had to decompose the S-box used in PRESENT and split it into ..."
Abstract - Cited by 17 (9 self) - Add to MetaCart
Abstract. A provably secure countermeasure against first order sidechannel attacks has been proposed by Nikova et al. in 2006. We have implemented the lightweight block cipher PRESENT using the proposed countermeasure. For this purpose we had to decompose the S-box used in PRESENT and split it into three shares that fulfill the properties of the scheme presented by Nikova et al. in 2008. Our experimental results on real-world power traces show that this countermeasure provides additional security. Post-synthesis figures for an ASIC implementation require only 2,300 GE, which makes this implementation suitable for low-cost passive RFID-tags. Keywords: Side-channel attacks, countermeasures, secret sharing, lightweight, ASIC
(Show Context)

Block ciphers that are easier to mask: How far can we go?

by Benoît Gérard, Vincent Grosso, María Naya-plasencia, François-Xavier Standaert - PROC. OF CRYPTOGRAPHIC HARDWARE AND EMBEDDED SYSTEMS (CHES , 2013
"... The design and analysis of lightweight block ciphers has been a very active research area over the last couple of years, with many innovative proposals trying to optimize different performance figures. However, since these block ciphers are dedicated to low-cost embedded devices, their implementati ..."
Abstract - Cited by 16 (1 self) - Add to MetaCart
The design and analysis of lightweight block ciphers has been a very active research area over the last couple of years, with many innovative proposals trying to optimize different performance figures. However, since these block ciphers are dedicated to low-cost embedded devices, their implementation is also a typical target for side-channel adversaries. As preventing such attacks with countermeasures usually implies significant performance overheads, a natural open problem is to propose new algorithms for which physical security is considered as an optimization criteria, hence allowing better performances again. We tackle this problem by studying how much we can tweak standard block ciphers such as the AES Rijndael in order to allow efficient masking (that is one of the most frequently considered solutions to improve security against side-channel attacks). For this purpose, we first investigate alternative S-boxes and round structures. We show that both approaches can be used separately in order to limit the total number of non-linear operations in the block cipher, hence allowing more efficient masking. We then combine these ideas into a concrete instance of block cipher called Zorro. We further provide a detailed security analysis of this new cipher taking its design specificities into account, leading us to exploit innovative techniques borrowed from hash function cryptanalysis (that are sometimes of independent interest). Eventually, we conclude the paper by evaluating the efficiency of masked Zorro implementations in an 8-bit microcontroller, and exhibit their interesting performance figures.
(Show Context)

Advances in Ultralightweight Cryptography for Low-cost RFID Tags: Gossamer Protocol

by Pedro Peris-lopez, Julio Cesar Hernandez-Castro, Juan M. E. Tapiador, Arturo Ribagorda
"... The design of ultralightweight authentication protocols that conform to low-cost tag requirements is imperative. This paper analyses the most important proposals (except for those based in hard problems such as the HB [1–3] family) in the area [4–6] and identifies the common weaknesses that have lef ..."
Abstract - Cited by 16 (3 self) - Add to MetaCart
The design of ultralightweight authentication protocols that conform to low-cost tag requirements is imperative. This paper analyses the most important proposals (except for those based in hard problems such as the HB [1–3] family) in the area [4–6] and identifies the common weaknesses that have left all of them open to various attacks [7–11]. Finally, we present Gossamer, a new protocol inspired by the recently published SASI scheme [13], that was lately also the subject of a disclosure attack by Hernandez-Castro et al. [14]. Specifically, this new protocol is designed to avoid the problems of the past, and we examine in some deep its security and performance.

Multiple differential cryptanalysis: Theory and practice

by Céline Blondeau, Benoît Gérard - In Joux [12
"... Abstract. Differential cryptanalysis is a well-known statistical attack on block ciphers. We present here a generalisation of this attack called multiple differential cryptanalysis. We study the data complexity, the time complexity and the success probability of such an attack and we experimentally ..."
Abstract - Cited by 14 (0 self) - Add to MetaCart
Abstract. Differential cryptanalysis is a well-known statistical attack on block ciphers. We present here a generalisation of this attack called multiple differential cryptanalysis. We study the data complexity, the time complexity and the success probability of such an attack and we experimentally validate our formulas on a reduced version of PRESENT. Finally, we propose a multiple differential cryptanalysis on 18-round PRESENT for both 80-bit and 128-bit master keys.
(Show Context)