Software Benchmarking of the 2 nd round CAESAR Candidates Ralph - PowerPoint PPT Presentation

Software Benchmarking of the 2 nd round CAESAR Candidates Ralph Ankele 1 , Robin Ankele 2 1 Royal Holloway, University of London, UK 2 University of Oxford, UK September 27, 2016 Directions in Authenticated Ciphers - Nagoya, Japan Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 1 /39

Motivation 1 Use Case 1: Lightweight applications (resource constrained environments) Use Case 2: High-performance applications I critical: e ffi ciency on 64-bit CPUs (servers) and/or dedicated hardware I desirable: e ffi ciency on 32-bit CPUs (small smartphones) I desirable: constant time when the message length is constant I message sizes: usually long (more than 1024 bytes), sometimes shorter Use Case 3: Defense in depth 1 CAESAR usecases on CAESAR mailing list (16. July 2016) by Dan J. Bernstein: https://groups.google.com/forum/#!topic/crypto-competitions/DLv193SPSDc Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 2 /39

Overview 1. Classification of the 2 nd round CAESAR Candidates 2. Software Optimizations 3. Benchmarking Framework 4. Results 5. Conclusions Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 3 /39

Classification of the 2 nd round CAESAR Candidates 1. Classification of the 2 nd round CAESAR Candidates 2. Software Optimizations 3. Benchmarking Framework 4. Results 5. Conclusions Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 4 /39

CAESAR competition CAESAR Round 2 candidates ACORN AEGIS AES-COPA AES-JAMBU AES-OTR AEZ Ascon CLOC Deoxys ELmD HS1-SIV ICEPOLE Joltik Ketje Keyak MORUS Minalpher NORX OCB OMD PAEQ POET PRIMATEs SCREAM SHELL SILC STRIBOB Tiaoxin TriviA-ck π -Cipher Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 5 /39

Type Block Cipher 15 1 Compression Function 2 8 4 Permutations Sponge Construction Stream Cipher Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 6 /39

Underlying Primitive AES Others 10 9 1 1 Dedicated Permutation 1 3 1 1 Dedicated Stream Cipher 3 2 3 Dedicated Block Cipher AES Round SHA2 ARX SPN LRX Keccak Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 7 /39

Parallel Encryption/Decryption Fully/Fully 14 1 Fully/No 5 10 Partly/Partly No/No Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 8 /39

Online Encryption/Decryption Fully/Fully 27 3 No/No Encryption of a message block M i only depends on message blocks M 1 . . . M i � 1 . Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 9 /39

Inverse Free Yes 19 10 No Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 10 /39

Security Proof Yes 24 6 No Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 11 /39

Nonce-Missuse Resistance None 16 1 2 Intermediate 7 Max (O ffl ine Ciphers) Longest Common Prefix (Online Ciphers) Longest common prefix: an adversary can observe the longest common prefix of messages for repeated nonces Max: the repetition of nonces only leak the ability to see a repeated message Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 12 /39

Software Optimizations 1. Classification of the 2 nd round CAESAR Candidates 2. Software Optimizations 3. Benchmarking Framework 4. Results 5. Conclusions Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 13 /39

Software Optimizations AES New Instructions Streaming SIMD Extensions 12 9 4 7 4 NEON 6 No Software Optimization Dedicated Processor Optimizations Advanced Vector Instructions Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 14 /39

AES-New Instructions Instructions � 2010 Westmere microarchitecture I Introduced with Intel R I Consists of 6 new instructions that are implemented in hardware I Four instructions for encryption/decryption ( i.e. AESENC , AESENCLAST , AESDEC , AESDECLAST ) I Two instructions for the keyschedule ( i.e. AESKEYGENASSIST , AESIMC ) Performance I 10 times faster for parallel modes ( i.e. CTR) I 2-3 times faster for non-parallel modes ( i.e. CBC) Security I Improved security against side channel attacks [Gue12] Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 15 /39

AES-New Instructions Instructions � 2010 Westmere microarchitecture I Introduced with Intel R I Consists of 6 new instructions that are implemented in hardware I Four instructions for encryption/decryption ( i.e. AESENC , AESENCLAST , AESDEC , AESDECLAST ) I Two instructions for the keyschedule ( i.e. AESKEYGENASSIST , AESIMC ) Performance I 10 times faster for parallel modes ( i.e. CTR) I 2-3 times faster for non-parallel modes ( i.e. CBC) Security I Improved security against side channel attacks [Gue12] Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 15 /39

AES-New Instructions Instructions � 2010 Westmere microarchitecture I Introduced with Intel R I Consists of 6 new instructions that are implemented in hardware I Four instructions for encryption/decryption ( i.e. AESENC , AESENCLAST , AESDEC , AESDECLAST ) I Two instructions for the keyschedule ( i.e. AESKEYGENASSIST , AESIMC ) Performance I 10 times faster for parallel modes ( i.e. CTR) I 2-3 times faster for non-parallel modes ( i.e. CBC) Security I Improved security against side channel attacks [Gue12] Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 15 /39

Streaming SIMD Extensions Instructions I Vector-mode operations that enables parallel execution of one instruction on multible data I 16 · 128-bit registers (xmm0-15) � processor generations to include SSE2, I Expanded over Intel R SSE3/SSE3S and SSE4 Image: https://software.intel.com/sites/default/files/37208.gif Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 16 /39

Advanced Vector Extensions Instructions � SandyBridge microarchitecture I Introduced with Intel R I Extends SSE 128-bit registers with 16 new 256-bit registers (ymm0-15) I Support of three-operand non-destructive operations (two-operand instructions e.g. A = A + B are replaced by three-operand instructions e.g. A = B + C) I AVX2 instructions expand integer vector types and vector shift operations Performance I AVX is 1.8 times faster than fastest SSE4.2 instructions [Len14] I AVX2 is 2.8 times faster than fastest SSE4.2 instructions [Len14] Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 17 /39

Advanced Vector Extensions Instructions � SandyBridge microarchitecture I Introduced with Intel R I Extends SSE 128-bit registers with 16 new 256-bit registers (ymm0-15) I Support of three-operand non-destructive operations (two-operand instructions e.g. A = A + B are replaced by three-operand instructions e.g. A = B + C) I AVX2 instructions expand integer vector types and vector shift operations Performance I AVX is 1.8 times faster than fastest SSE4.2 instructions [Len14] I AVX2 is 2.8 times faster than fastest SSE4.2 instructions [Len14] Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 17 /39

NEON Instructions I Advanced SIMD instructions for ARM processors avaliable since CORTEX-A microarchitecture I 32 · 64-bit registers (dual view 16 · 128-bit registers) Performance I 2-8 times performance boost [neo] Image: http://www.arm.com/assets/images/NEON_ISA.jpg Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 18 /39

NEON Instructions I Advanced SIMD instructions for ARM processors avaliable since CORTEX-A microarchitecture I 32 · 64-bit registers (dual view 16 · 128-bit registers) Performance I 2-8 times performance boost [neo] Image: http://www.arm.com/assets/images/NEON_ISA.jpg Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 18 /39

Benchmarking Framework 1. Classification of the 2 nd round CAESAR Candidates 2. Software Optimizations 3. Benchmarking Framework 4. Results 5. Conclusions Software Benchmarking of the 2nd round CAESAR Candidates Ralph Ankele - Royal Holloway, University of London slide 19 /39