Final report

EE260 Final Project P a g e | 1 Spring 2015
Lightweight Cryptography by Simplification of Hardware – A
comparison study
Jagbir Kalirai
Iswarya Muthu Kumar
RFID SYSTEMS
EE 260, Spring 2015
May 18, 2015

ABSTRACT
Radio-frequency identification (RFID) system plays an important role for many applications.
Security comes into picture for a better system. As technology gets universal, the smart devices
are deployed in a huge spectrum of different fields, such as engineering structures, complex
organizations, handy and wearable purposes. The aspiration in such devices is openly analogous
to the tight budget and intrinsic in huge distributions, has partial sources for things like memory,
computing complexity, and power supply. The techniques for Lightweight Cryptography allow
us to deliver adequate security for the RFID tags while restricting the volume of essential sources
with the idea of Hardware Simplification. We studied methodologies to explore the lightweight
cryptographic techniques for block ciphers like DES, AES, Symmetric ciphers.
LIGHTWEIGHT CRYPTOGRAPHY
BACKGROUND
With the amount of resources limited on the tag, we must use algorithms which utilize fewer
resources, yet still provide sufficient security. Lightweight Security techniques enable us to
provide sufficient security for the tags while limiting the amount of required resources. The term
‘Lightweight’ does not imply ‘weak’, instead it is a term used for low-cost (in terms of on-tag
resources). And Lightweight Cryptography is designed specifically for use on constrained
platforms (such as an NFC or RFID tag). One way to implement Lightweight cryptography
within NFC or RFID tags is to use an existing standard that has been modified. In order to
understand the modification, we first must understand how the standard works.
Data Encryption Standard (DES)
We choose to look into Data Encryption Standard (DES) because of its’ ease to implement
within the hardware and that it’s a well-known standard that is used globally. DES was originally
published in 1977, and utilizes a 56 bit key and maps a 64-bit input block onto a 64-bit output
block. The key actually looks like 64-bits, but in each of its’ eight strings of 8 bit values; it uses
the 8th
bit as an odd parity bit. This leaves the key to be 56 bits. DES is efficient to implement in
hardware but performs slow when implemented in software.
The first step in DES encryption is to permutation the initial 64 bit data (shuffling input bits).
The 56 bit key is used to generate sixteen 48 bit keys. DES relies on shuffling the data for sixteen
rounds while using each of the sixteen 48 bit keys (one 48 bit key per round). The output after
the first round becomes the input for the second round, and so on. After the 16th
round, the first
32 bits of data are swapped with the last 32 bits, and the data is once again permutated. For
example, the 8th
bit in the initial permutation (numerical value ‘2’) implies the 2nd
bit holds a
numerical value of ‘8’ in the final permutation (IP-1
).

During each round, the Mangler Function is used. The Mangler Function takes the 32 bit data
(Rn) and the 48 bit Kn and produces a 32 bit output which is XOR’d with the first half of the 64
bit data (Ln). Figure 2 shown below shows this procedure.
The Mangler Function takes the 32 bit data (Rn) and expands it to 48 bits. The original 32 bit
input is broken into eight blocks that are 4 bits each. The expansion is achieved by taking the last
bit of the first block of the 4 bit sequence and the first bit of the next 4 bit block and overlapping
those values as part of the 48 bit output. The new 48 bit sequence is then broken into eight 6 bit
blocks.
Now that the input data is expanded to 48 bits, it matches the 48 bit key. These values are then
XOR’d 6 bits at a time, and the S-Box outputs a 4 bit value for every 6 bits inputted. After the
process is completed, a 32 bit value is outputted which is them XOR’d with the first half of the
64 bit input.
In order to decrypt the data, we would simply reverse the process. As we can see, the process is
extensive and would require quite a bit of power to implement. Since the NFC and RFID tags we
are focusing on are passive, meaning they only get power when they are in the interrogation zone
of a reader, the DES algorithm would not be a suitable choice.
Lightweight DES (DESL)
There is a variation of DES that further reduce the amount of resources (DESL), it stems from
the original DES that is efficiently implemented and slightly modified. Efficiently implementing
DES can be used in a way that reduces the complexity of the gates, and makes the DES
algorithm lightweight as it reduces the amount of gates by 35% compared to the best AES
implementation that is known. (3) However, there is a drawback to this approach in that it has
uses less area at the cost of throughput.
In order to reduce the amount of gates we can modify the original DES implementation, this
makes the process lightweight. However, since the key will still be 56 bits, the amount of
security remains constant. There are two areas of the original DES flow where we can focus our
attention to begin reducing the amount of gates.
The first approach to making DES lightweight is to look at the initial and final permutations (IP
and IP-1
). These permutations are not needed as they do nothing for us in terms to encrypting the
data. Permutations simply shuffle the data that is already existent. Furthermore, the permutations
require additional wiring components when implemented through hardware.
The second method we can implement is to reduce the number of S-Boxes. If you recall, the
original DES approach was to expand the input data from 32 to 48 bits to match it with the key.
This data was then broken into eight blocks (6 bits each) and XOR’d to each of the eight S-
boxes. Eliminating the use of eight S-Boxes and using a single S-Box will reduce the gate
complexity.

The following figure shown below highlights the architecture of the lightweight DES (DESL)
scheme. We can see the initial and final permutations have been eliminated as well as the
simplification of the S-Box (boxed in red).
Figure 1: Block diagram representation of one round within Lightweight DES (DESL)
It’s important to realize the security has not changed; DESL still utilizes the same 56-bit key as
DES. Brute force attacks have been reported to take a just a few months, and only a matter of
days when using specialized computers. DES or DESL should only be used for short term basis,
otherwise it too can be susceptible to security attacks.
Implementing DESL
A test was done by T. Eisenbarth, S. Kumar, C. Paar, A. Poschmann, and L. Uhsadel, where they
implemented DES and DESL into hardware to see what how many gates would be saved and
how it affects the efficiency. An ATMEL ATMega128 8-bit microcontroller was used to
demonstrate this. From Table 1 shown below Shows that a ~20% reduction of gates is possible,
while maintaining throughput and efficiency. This method also reduces the current required.
Table 1: Implementation of DES and DESL in hardware operating at 100 MHz

Advanced Encryption Standard (AES)
The Advanced Encryption Standard (AES) also called as Rijndael is grounded on a design
called substitution-permutation network, as the name suggests, a blend of substitution and
permutation. The speed observed is both in software and hardware. It succeeds the above
mentioned design, Data Encryption Standard (DES). The Advanced Encryption Standard (AES)
postulates an appropriate Federal Information Processing Standard (FIPS) algorithm, which
involves cryptographic standards, which can be used to guard electronic data. In other words, it
can also be termed as an algorithm that employs a symmetric block cipher that can encipher and
decipher data. Encryption translates information to an incomprehensible procedure known as
cipher text; decoding the ciphered text translates the information to its original form, called plain
text. The algorithm is best suited for cryptographic keys of 128, 192, and 256 bits to encipher
and decipher information (data) into symmetric blocks of 128 bits.
As mentioned above, the size of the key for an AES code mentions the repetitions numbers of
alteration series that change the given input (plaintext) to the absolute output (cipher text)are as
follows: repetition in 10 cycles for 128-bit keys, repetition in 12 cycles for 192-bit keys,
repetition in 14 cycles for 256-bit keys.
The procedure for AES is described as follows. Every step contains many processing cycles.
Every cycle contains four or at most four alike but altered states, counting the one which hangs
on the encryption key. A group of converse rounds are employed to convert the cipher text back
into the unique plaintext with the original encryption key. These stages include Key Expansions,
Initial Round (Add Round Key), Rounds (Sub Bytes, Shift Rows, Mix Columns, and Add Round
Key), Final Round (Sub Bytes, Shift Rows, and Add Round Key).
Add Round Key – the stage in which every byte of the state is exlcusive-or’ed with a block of
the round key using bitwise exor. Sub Bytes – this stage is a non-linear substitution in which
every byte is substituted with another byte with the help of a lookup table. Shift Row – this stage
is where a reversal step in which the final three rows of the state are moved intermittently in a
definite number of steps. Mix Column – this stage is where integration process that functions on
the columns of the state, joining the four bytes in every column.
Cipher
The process of Ciphering is described as follows. Initially, the input is replicated to the state
array. After the Add Round Key, the state array is altered by applying a round function 10, 12, or
14 times, varying on the considered key length, with the last round varying somewhat from the
initial Nr -1 rounds. The last state is then replicated to the output. The round function is limited
using a key schedule that contains a 1-D array of four byte words resulted by the use of Key
Expansion. The Cipher is shown in the following code. The single alterations, that are

SubBytes(), ShiftRows(), MixColumns(), and AddRoundKey() functions, process the given
State. The array described below w[ ] comprises of the key schedule. All Nr rounds are alike
with the exclusion of the last and final round, which does not contain the MixColumns()
transformation function.
Figure 2: The Pseudo Code for Cipher
Authenticated Lightweight Encryption (ALE)
A lightweight cryptography technique based on Advance Encryption Standard (AES) known as
Authenticated Lightweight Encryption (ALE) which is proficient in both hardware and software
implementations. The basic functioning of ALE is the AES round transformation with the
implementation of 128-bit key AES schedule. ALE is a single pass algorithm with authenticated
encryption. The operation is to accept a128 key K, a message m, associated data α and a 128
nonce ν, that is not equal to zero. A corresponding of at the most of 248 bits is permissible to be
authentication or sometimes simultaneously authentication and encryption with the help of
similar 128-bit master key. The process of either encryption or authentication yields the cipher
text γ of accurately the exact length as the message m and the verification tag τ of the length of
128 bits for the message m as well as the associated data α. The process of either decryption or
verification procedure consents the five important components, which are key K, cipher text γ,
associated data α, nonce ν and verification tag τ. Once the procedure is successful, it outputs the
decrypted message m if tag is correct. The encryption is performed in five steps that are Padding,
Initialization, Processing associated data, Processing message, Finalization.

Ultra-Light Weight Block Cipher – PRESENT
PRESENT is an ultra-light weight block cipher algorithm developed university of Denmark in
2007. It is prominent for its compact size. When compared to AES, it is 2.5 times smaller. The
specifications of the PRESENT are the block size that is 64 bits in length and the key size can
either be 80 bit or 128 bit in size. It is example of a substitution-permutation network. It has a
non-linear layer which is based on a single 4-bit S-box that was aimed for hardware
simplification. The design was projected for low power and high efficiency results and was
achieved. Security is passable for applications that run on low-security requirement in tag-
centered utilizations.
Figure 3: Pseudo code for cipher with top level algorithm
The functioning of the PRESENT Algorithm is described as follows. It involves of 31 cycles.
Every cycle of the 31 cycles involves of an exclusive-or function to bring together a round key
Ki in the range 1 ≤ i ≤ 32. The key K32 is used for post whitening operation. Post whitening
operation comprises of a linear bitwise permutation and a nonlinear substitution layer. The non-
linear layer uses a single 4-bit S-box S which is applied 16 times in parallel in each round. The
cipher code is described in pseudo-code in figure above. The design is based in such a way that
the bits are numbered from zero and the bit zero is placed to the right most corner of the block
and the numbering goes by.
The above pseudo code comprises of the following functions. addRoundKey. The block size is of
64 bits in length with 31 rounds. Given round key Ki = Ki63 to Ki0 0 for 1 ≤ i ≤ 32 and existent
state b63 to b0, addRoundKey contains the operation for 0 ≤ j ≤ 63, bj → bj ⊕ K i j , performing
an exclusive-or operation.
sBoxlayer. The S-box employed in PRESENT is a 4 bit to 4 bit S-box. The action of this box in
hexadecimal representation is shown below.

CONCLUSION
As NFC and RFID tags grow strength in popularity, the security threats within the tags continues
to grow. These contact less tags are used in an expanding markets related to defense,
entertainment, manufacturing, and retail. Security is a big topic within all of these areas.
The issue with implementing security within these tags is the amount of limited resources
available within them. Typically a tag will have between 1,000 to 10,000 gates while only ~20%
are reserved for security purposes. Simplification of Hardware is to be observed in order to
extend the security.
We decided to implement the DES, AES, PRESENT algorithms and see how we can begin to
make it lightweight – use fewer resources. DES was chosen because of the ease and efficiency of
implementing it within hardware. The DES flow was described and we found a few areas where
the process could be improved by reducing the wires and resources required to implement it.
AES implementation was chosen as it uses 2400 GE and is observed to do well, in terms of
speed, in both software and hardware. It is employed as a point of reference for upcoming
ciphers. Performance factors include high speed and low RAM, which benefits the overall
design. This helps in AES performance on a wide range of hardware.
PRESENT is an example of stream or state ciphers. It was considered as it is applied for ultra-
lightweight cryptography method. It is few of the primary ciphers that proposed a low level gate
count for constrained devices, which wasn’t the instance with AES. The ultra-light weight design
presents a scene of security with qualifications of a 64-bit block size and an 80-bit key.
Comparison table for Lightweight Cryptography Implementations
Algorithm Number of
Gates
Block
size
Key size Implementation Network Security
DESL
1,850 GE 64 bits 56 bits
(8 bits of
parity)
Fast on HW, Slow on
SW
Balanced Feistel
network
Low
Security
AES
2500 GE 128 bits 128, 192 or
256 bits
Fast on both HW and
SW
Substitution
Permutation
Network
Average to
Mid High
Security
PRESENT
1000 – 1500
GE
64 bits 80 or128
bits
Fast on HW Substitution
Permutation
Network
Adequate
Security
Table 2: Comparison table

REFERENCES
1. Kaufman, Charlie, Radia Perlman, and Mike Speciner. Network Security PRIVATE
Communication in a Public World. 2nd ed. Upper Saddle River, N.J: Prentice Hall
PTR, 2002. pp. 62–74.
2. Poschmann, "Lightweight Cryptography—Cryptographic Engineering for a Pervasive
World," doctoral dissertation, Faculty of Electrical Eng. and Information Technology,
Ruhr-Universität Bochum, 2009; www.emsec.rub.de/media/crypto/attachments/
files/2010/04thesis_poschmann.pdf.
3. 2Bluemner, Adam. "7 Unexpected and Awesome Uses of RFID Tags." RFID Arena.
RFID Arena, 4 Mar. 2014. Web. 10 May 2015.
<http%3A%2F%2Fwww.rfidarena.com%2F2014%2F3%2F4%2F7-unexpected-and-
awesome-uses-of-rfid-tags.aspx>.
4. Rfid Report (RFID Forecasts, Players and Opportunities 2011-2021: IDTechEx)
http://www.idtechex.com/research/reports/rfid_forecasts_players_and_opportunities_20
11_2021_000250.asp
5. Juels and S. A. Weis. Authenticating pervasive devices with human protocols. In V.
Shoup, editor, Advances in Cryptology — CRYPTO 2005, volume 3126 of Lecture
Notes in Computer Science, pages 293–198. Springer-Verlag, 2005.
6. M. Feldhofer, S. Dominikus, and J. Wolkerstorfer. Strong Authentication for RFID
Systems Using the AES algorithm. In M. Joye and J.-J. Quisquater, editor,
Cryptographic Hardware and Embedded Systems — CHES 2004, volume 3156 of
Lecture Notes in Computer Science, pages 357–370. Springer-Verlag, 2004.
7. T. Eisenbarth, S. Kumar, C. Paar, A. Poschmann, and L. Uhsadel. A Survey of
Lightweight Cryptography Implementations. IEEE Design & Test of Computers –
Special Issue on Secure ICs for Secure Embedded Computing, 24(6):522 – 533,
November/December 2007.
8. Juels and S.A. Weis, "Defining Strong Privacy for RFID," Proc. 5th Ann. IEEE Int'l
Conf. Pervasive Computing and Communications Workshops,IEEE Press, 2007, pp.
342–347; http://eprint.iacr.org/2006137.
9. Thomas Eisenbarth, Christof Paar and Axel Poschmann, Sandeep Kumar, Leif Uhsadel.
A Survey of LightweightCryptography Implementations.
www.emsec.rub.de/media/crypto/attachments/ files/
2010/04/lwc_survey_ieee_dtco2007.pdf

10. Advanced Encryption Standard (AES). Section 5131 of the Information Technology
Management Reform Act of 1996 (Public Law 104-106) and the Computer Security
Act of 1987 (Public Law 100-235). http://csrc.nist.gov/publications/fips/fips197/fips-
197.pdf
11. A. Bogdanov, L.R. Knudsen, G. Leander. PRESENT: An Ultra-Lightweight Block
Cipher www.emsec.rub.de/ media/crypto/ attachments/files/ 2010/04/present_ches
2007.pdf
12. Andrey Bogdanov, Florian Mendel, Francesco Regazzoni, Vincent Rijmen, Elmar
Tischhauser : “ALE: AES-Based Lightweight Authenticated Encryption”
13. Masanobu Katagi, Shiho Moriai . Lightweight Cryptography for the Internet of Things.
www.iab.org/wp-content/IAB-uploads/2011/03/Kaftan.pdf

Final report

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (19)

Similar to Final report

Similar to Final report (20)

Final report