Towards Green Cryptography: a Comparison of Lightweight Ciphers from - PowerPoint PPT Presentation

Towards Green Cryptography: a Comparison of Lightweight Ciphers from the Energy Viewpoint St´ ephanie Kerckhof, Fran¸ cois Durvaux, C´ edric Hoquet, David Bol, Fran¸ cois-Xavier Standaert CHES 2012 – September 2012 UCL Crypto Group Towards Green Cryptography - September 2012 1 Microelectronics Laboratory

Context ◮ More lightweight devices in more applications UCL Crypto Group Towards Green Cryptography - September 2012 2 Microelectronics Laboratory

Outline 1 Motivations 2 This Work 3 Observations 4 Conclusion UCL Crypto Group Towards Green Cryptography - September 2012 3 Microelectronics Laboratory

Lightweight Ciphers AES 2002 2004 2006 2008 2010 2012 UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

Lightweight Ciphers AES 2002 2004 2006 2008 2010 2012 TEA NOEKEON UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

Lightweight Ciphers AES ICEBERG 2002 2004 2006 2008 2010 2012 TEA NOEKEON UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

Lightweight Ciphers HIGHT mCrypton AES ICEBERG SEA 2002 2004 2006 2008 2010 2012 TEA NOEKEON UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

Lightweight Ciphers HIGHT mCrypton AES ICEBERG SEA 2002 2004 2006 2008 2010 2012 TEA PRESENT NOEKEON UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

Lightweight Ciphers KATAN HIGHT TWIS mCrypton MIBS AES ICEBERG SEA 2002 2004 2006 2008 2010 2012 TEA PRESENT NOEKEON UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

Lightweight Ciphers KATAN HIGHT TWIS mCrypton MIBS AES ICEBERG SEA 2002 2004 2006 2008 2010 2012 TEA Piccolo PRESENT NOEKEON LBlock UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

Lightweight Ciphers KATAN HIGHT TWIS mCrypton MIBS KLEIN AES ICEBERG SEA 2002 2004 2006 2008 2010 2012 TEA Piccolo PRESENT NOEKEON LBlock UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

Lightweight Ciphers KATAN HIGHT TWIS mCrypton MIBS KLEIN AES ICEBERG SEA 2002 2004 2006 2008 2010 2012 TEA Piccolo PRESENT NOEKEON LBlock ◮ Many lightweight ciphers UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

Lightweight Ciphers KATAN HIGHT TWIS mCrypton MIBS KLEIN AES ICEBERG SEA 2002 2004 2006 2008 2010 2012 TEA Piccolo PRESENT NOEKEON LBlock ◮ Many lightweight ciphers ◮ Few comparative studies → Lack of standardization? ◮ Existing implementations → Different technologies → Focused on gate count UCL Crypto Group Towards Green Cryptography - September 2012 4 Microelectronics Laboratory

What is Lightweight? UCL Crypto Group Towards Green Cryptography - September 2012 5 Microelectronics Laboratory

What is Lightweight? I’m lightweight UCL Crypto Group Towards Green Cryptography - September 2012 5 Microelectronics Laboratory

What is Lightweight? I’m lightweight UCL Crypto Group Towards Green Cryptography - September 2012 5 Microelectronics Laboratory

What is Lightweight? I’m lightweight UCL Crypto Group Towards Green Cryptography - September 2012 5 Microelectronics Laboratory

What is Lightweight? I’m lightweight UCL Crypto Group Towards Green Cryptography - September 2012 5 Microelectronics Laboratory

What is Lightweight? ◮ Which criteria? → Low area? → Low power? → Low energy? → Still fast? ◮ Limitation: Relativity of metrics → Possibility to optimize one criteria at the expense of another one I’m lightweight UCL Crypto Group Towards Green Cryptography - September 2012 6 Microelectronics Laboratory

How Relevant is Lightweight Cryptography? ◮ Changing algorithm is expensive ◮ How much do we gain compared to ◮ Hardware design choices (e.g. architecture) ◮ Implementation choices (e.g. frequency/voltage scaling) UCL Crypto Group Towards Green Cryptography - September 2012 7 Microelectronics Laboratory

Outline 1 Motivations 2 This Work 3 Observations 4 Conclusion UCL Crypto Group Towards Green Cryptography - September 2012 8 Microelectronics Laboratory

This Work Algorithms choice ◮ Block and key sizes ◮ Different types of key scheduling ◮ Different combinations of encryption/decryption Block Key Ciphers 128 128 aes noekeon 64 128 hight iceberg 64 80 katan present UCL Crypto Group Towards Green Cryptography - September 2012 9 Microelectronics Laboratory

This Work Flexible architecture ◮ 3 core options (Enc, Dec, Enc/Dec) ◮ Unrolling parameter Nr UCL Crypto Group Towards Green Cryptography - September 2012 10 Microelectronics Laboratory

This Work Technology: Low-power 65 nm CMOS Comparative study ◮ At fixed frequency f 100 ◮ At maximum frequency f max (max. area penalty = 10%) ◮ For all metrics Area Frequency Power Throughput Energy Frequency/Voltage scaling E op = 1 2 N sw C L V 2 dd + E leak UCL Crypto Group Towards Green Cryptography - September 2012 11 Microelectronics Laboratory

Outline 1 Motivations 2 This Work 3 Observations Interpretation of Synthesis Results Impact of Algorithmic Design Choices 4 Conclusion UCL Crypto Group Towards Green Cryptography - September 2012 12 Microelectronics Laboratory

Critical Path Expectation: Number of rounds x 2 ⇒ Critical path x 2 NOEKEON 8 HIGHT Critical path [ns] 4 2 1 0.5 1 2 4 8 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 13 Microelectronics Laboratory

Critical Path Expectation: Number of rounds x 2 ⇒ Critical path x 2 NOEKEON 8 HIGHT Critical path [ns] 4 2 1 0.5 1 2 4 8 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 13 Microelectronics Laboratory

Critical Path Expectation: Number of rounds x 2 ⇒ Critical path x 2 Observation: Critical path not always in the round logic NOEKEON 8 HIGHT Critical path [ns] 4 2 1 0.5 1 2 4 8 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 13 Microelectronics Laboratory

Area Naive expectation: Number of rounds x 2 ⇒ Area x 2 2 16 PRESENT 2 15 KATAN 2 14 Area [GE] 2 13 2 12 2 11 2 10 2 9 2 8 1 2 4 8 16 32 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 14 Microelectronics Laboratory

Area Naive expectation: Number of rounds x 2 ⇒ Area x 2 2 16 PRESENT 2 15 KATAN 2 14 Area [GE] 2 13 2 12 2 11 2 10 2 9 2 8 1 2 4 8 16 32 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 14 Microelectronics Laboratory

Area Naive expectation: Number of rounds x 2 ⇒ Area x 2 Observation: Main component of area = state register 2 16 PRESENT 2 15 KATAN 2 14 Area [GE] 2 13 2 12 2 11 2 10 2 9 2 8 1 2 4 8 16 32 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 14 Microelectronics Laboratory

Throughput Expectation: Round unrolling should not make sense at f max 400 KATAN Throughput [Mbits/s] ICEBERG 300 200 100 0 1 2 4 8 16 32 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 15 Microelectronics Laboratory

Throughput Expectation: Round unrolling should not make sense at f max 400 KATAN Throughput [Mbits/s] ICEBERG 300 200 100 0 1 2 4 8 16 32 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 15 Microelectronics Laboratory

Throughput Expectation: Round unrolling should not make sense at f max Observation: And for extremely simple rounds 400 KATAN Throughput [Mbits/s] ICEBERG 300 200 100 0 1 2 4 8 16 32 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 15 Microelectronics Laboratory

Energy Expectation: Energy stable with number of rounds 16 KATAN ICEBERG HIGHT PRESENT Energy per bit [pJ] NOEKEON 8 4 2 1 1 2 4 8 16 32 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 16 Microelectronics Laboratory

Energy Expectation: Energy stable with number of rounds Observation: Energy more or less stable 16 KATAN ICEBERG HIGHT PRESENT Energy per bit [pJ] NOEKEON 8 4 2 1 1 2 4 8 16 32 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 16 Microelectronics Laboratory

Energy Expectation: Energy stable with number of rounds Observation: Trend observed later for KATAN 16 KATAN ICEBERG HIGHT PRESENT Energy per bit [pJ] NOEKEON 8 4 2 1 1 2 4 8 16 32 Number of rounds UCL Crypto Group Towards Green Cryptography - September 2012 16 Microelectronics Laboratory

Outline 1 Motivations 2 This Work 3 Observations Interpretation of Synthesis Results Impact of Algorithmic Design Choices 4 Conclusion UCL Crypto Group Towards Green Cryptography - September 2012 17 Microelectronics Laboratory