<figure><img src="image_1.png" /></figure>

# Randomness Generation for Secure Hardware Masking – Unrolled Trivium to the Rescue

Gaëtan Cassiers<sup>a, 1</sup> <sup>1 ID</sup>, Loïc Masure<sup>2</sup> <sup>1 ID</sup>, Charles Momin<sup>1</sup>, Thorben Moos<sup>1</sup> <sup>1 ID</sup>, Amir Moradi<sup>3 ID</sup> and François-Xavier Standaert<sup>1 ID</sup>

<sup>1</sup> Crypto Group, ICTEAM Institute, UCLouvain, Louvain-la-Neuve, Belgium

<sup>2</sup> Université de Montpellier, LIRMM, CNRS, Montpellier, France

<sup>3</sup> TU Darmstadt, Darmstadt, Germany

**Abstract.** Masking is a prominent strategy to protect cryptographic implementations against side-channel analysis. Its popularity arises from the exponential security gains that can be achieved for (approximately) quadratic resource utilization. Many variants of the countermeasure tailored for different optimization goals have been proposed. The common denominator among all of them is the implicit demand for robust and high entropy randomness. Simply assuming that uniformly distributed random bits are available, without taking the cost of their generation into account, leads to a poor understanding of the efficiency vs. security tradeoff of masked implementations. This is especially relevant in case of hardware masking schemes which are known to consume large amounts of random bits per cycle due to parallelism. Currently, there seems to be no consensus on how to most efficiently derive many pseudo-random bits per clock cycle from an initial seed and with properties suitable for masked hardware implementations. In this work, we evaluate a number of building blocks for this purpose and find that hardware-oriented stream ciphers like Trivium and its reduced-security variant Bivium B outperform most competitors when implemented in an *unrolled* fashion. Unrolled implementations of these primitives enable the flexible generation of many bits per cycle, which is crucial for satisfying the large randomness demands of state-of-the-art masking schemes. According to our analysis, only Linear Feedback Shift Registers (LFSRs), when also unrolled, are capable of producing long non-repetitive sequences of random-looking bits at a higher rate per cycle for the same or lower cost as Trivium and Bivium B. Yet, these instances do not provide black-box security as they generate only linear outputs. We experimentally demonstrate that using multiple output bits from an LFSR in the same masked implementation can violate probing security and even lead to harmful randomness cancellations. Circumventing these problems, and enabling an independent analysis of randomness generation and masking, requires the use of cryptographically stronger primitives like stream ciphers. As a result of our studies, we provide an evidence-based estimate for the cost of securely generating *n* fresh random bits per cycle. Depending on the desired level of black-box security and operating frequency, this cost can be as low as 20*n* to 30*n* ASIC gate equivalents (GE) or 3*n* to 4*n* FPGA look-up tables (LUTs), where *n* is the number of random bits required. Our results demonstrate that the cost per bit is (sometimes significantly) lower than estimated in previous works, incentivizing parallelism whenever exploitable. This provides further motivation to potentially move low randomness usage from a primary to a secondary design goal in hardware masking research.

<footnote>E-mail: gaetan.cassiers@uclouvain.be (Gaëtan Cassiers), loic.masure@lirmm.fr (Loïc Masure), charles.momin@uclouvain.be (Charles Momin), thorben.moos@uclouvain.be (Thorben Moos), amir.m oradi@tu-darmstadt.de (Amir Moradi), francois-xavier.standaert@uclouvain.be (François-Xavier Standaert)</footnote>

<footnote><sup>a</sup>Work performed in parts during a post-doctoral stay at IAIK, TU Graz, Graz, Austria.</footnote>
# 1 Introduction

Side-channel analysis is known to be a significant threat to implementations of cryptographic algorithms and protocols that must operate under adversarial exposure. If untrusted individuals gain physical access to a cryptographic device, measurable quantities such as power consumption or electromagnetic emanations during the processing of secret material can be monitored to extract sensitive information. This type of attack was first demonstrated by Kocher et al. in 1999 [KJJ99] and has since inspired a great deal of research on the theory and practice of implementation security. Masking (also known as secret sharing) is a well-known countermeasure to protect cryptographic implementations from side-channel analysis adversaries. It was first proposed by Chari et al. in 1999 [CJRR99], and is nowadays widely considered to be the most potent protection mechanism against passive physical adversaries. Its core principle is based on splitting each potentially sensitive intermediate variable into a discrete number of shares, in such a way that only the combination of all shares reveals information about the secrets. Using this technique, adversaries can be forced (implicitly or explicitly) to collect information on all individual shares before combining them to reconstruct the sensitive intermediates. Yet, learning information about the secrets from partial information on their shares is a hard problem. To be precise, if the leakage of the individual shares is sufficiently noisy and independent, masking is capable of providing exponential security in the number of shares against adversaries trying to extract sensitive information from side-channel observations – see [PR13, DDF14, DFS15] for respective formalizations. The implementation overheads of masking are typically estimated to be quadratic in the number of shares due to the known complexity of masked multiplications [ISW03].

Yet, and especially when masking is applied to hardware implementations of crypto-
graphic algorithms, the independence assumption is often invalidated by physical defaults
such as glitches [MPG05], transitions [CGP+12] and couplings [CBG+17]. It has taken
the research community several years to develop generalizable strategies to avoid these
issues at the conceptual level. The first solid approaches toward preventing glitches from
recombining shares in hardware masking schemes came in the form of threshold implemen-
tations [NRR06, NRS08]. A few years later, other masking schemes with a lower number of
shares to achieve a given protection order (compared to threshold implementations) were
proposed [RBN+15, GMK16, GMK17, GM17]. These schemes also targeted higher-order
security for the first time, after it was found that higher-order threshold implementations
suffered from conceptual flaws [BGN+14a, Rep15, RBN+15]. Simultaneously, independent
researchers started investigating the requirements needed to securely compose masked
building blocks into arbitrary cipher implementations, resulting in the security notion of
Strong Non-Interference (SNI) [BBD+16]. Following these advances, the robust probing
model was introduced to allow formal analysis of composability and robustness against
physical defaults jointly [FGP+18]. Subsequently, it was shown at CHES 2019 that many
previously proposed hardware masking schemes suffer from composability flaws under the
robust probing model at higher orders, giving substantial evidence that a formal analysis
is beneficial to properly generalize schemes to arbitrary orders [MMSS19]. Finally, in
2020, a new composability notion called Probe Isolating Non-Interference (PINI) was
introduced to allow trivial composition of masked implementations of linear and non-linear
functions [CS20, CGLS21]. Based on this notion, new masked gadgets have been intro-
duced [CGLS21, KM22b, KM22a] along with tools that allow formal verification of their
properties [KSM20, CGLS21] and automated generation of full masked hardware circuits
based on PINI gadgets [KMMS22].
## 1.1 Motivation

Clearly, the past few years have advanced our collective understanding of how to best capture physical defaults such as transitions, couplings, and glitches through proven design principles. This, in turn, enables fast and efficient masked hardware implementations that can leverage parallelism to simultaneously operate on the individual shares of a secret intermediate without sacrificing security against physical adversaries. In order to achieve this symbiosis between performance and security, hardware masking schemes often consume a notoriously large number of random bits per cycle. Indeed, in the past several years, a strong trend is observable in the community towards constructing masked hardware implementations entirely from circuit gadgets that are provably robust probing secure and composable (e.g., [CS21, KSM22, MCS22, KMMS22]). This is done in order to automatically derive guarantees that the resulting full hardware implementations are provably secure themselves. The gadgets used for this purpose typically consume a certain amount of fresh random bits per clock cycle to satisfy the required properties, e.g., $d(d-1)/2$ bits for one 2-input AND gate with $d$ shares in domain-oriented masking [GMK16] or HPC2 [CGLS21]. Naturally, full ciphers composed of many such gadgets also need many bits of fresh randomness per cycle, especially if those implementations leverage parallelism, are optimized for low latency and if higher-order protection is required. Hence, it is not uncommon for parallel masked hardware implementations of full block ciphers to require hundreds or even thousands of independent, uniformly distributed, and unpredictable random bits per cycle. Recent works presented at CHES 2022 [KMMS22] and CCS 2022 [KM22b] list exemplary cost and performance figures for masked round-based cipher implementations that demand multiple thousands of freshly random bits in each cycle. Even for serialized implementations or single S-boxes it is not uncommon to see requirements in the range of hundreds of bits per cycle. Despite this huge demand, most works on the topic have considered the efficient generation and distribution of these bits to be beyond their scope. In fact, the majority of publications in the masking literature simply assumes the existence of robust and high-entropy randomness sources. We argue that the lack of focus on this topic can have negative consequences, since concurrent randomness generation is a crucial part of masked implementations, especially in hardware. Failing to include this component in the evaluation of masking schemes clearly leads to a poor understanding of the efficiency vs. security tradeoff of secure implementations.

## 1.2 Research Question

Our work aspires to answer the question whether such huge demands for randomness can be satisfied in hardware and at what cost, as this aspect has been neglected in most previous publications. While reducing randomness requirements is an often researched topic (initiated in [BBP+16], with many follow-up works), studies of the actual cost of randomness for masking are surprisingly missing in the literature. For example, the authors of the recent [KM22a] consider quite different approaches in order to provide meaningful comparisons between masking schemes including randomness generation, such as an individual 32/64-bit LFSR for each bit of randomness required per cycle or a Keccak-based PRNG, which both turn out to be rather expensive. Hence, it is our goal to find more efficient solutions while also clarifying the relevant security properties that must be satisfied in the masking context.

Once a reliable estimate of the cost of producing a certain number of random bits per cycle is established, it becomes much easier to decide on crucial trade-offs in masked hardware implementations. Additionally, it will help to answer the question whether schemes that minimize randomness requirements are more worthwhile, or whether it is better to optimize other parameters such as latency or area at the cost of higher randomness usage.
## 1.3 TRNG vs. PRNG

Whenever randomness is required in a design, at least some initial entropy must come from a true randomness/noise source, usually extracted by a True Random Number Generator (TRNG). Yet, as we will confirm in the paper, TRNGs tend to be either fairly slow or resource-hungry, making the cost of generating each truly random bit significant. Thus, it is a common strategy to use Pseudo Random Number Generators (PRNGs), which are generally considered to be much more efficient than TRNGs, to stretch the initial seed (obtained once at power-up) into many pseudo-random bits whenever needed during runtime.

## 1.4 Requirements for Masking Randomness

Many different PRNG constructions have been proposed in the literature for a variety of applications. Of course, depending on the concrete use case, different properties are required from the random numbers. Cryptographically strong PRNGs, as required in many cryptographic protocols for generating keys, nonces or salts, should produce outputs that are indistinguishable from genuine randomness for computationally bounded adversaries. However, the requirements are not always that strong. In the concrete case of masking, adversaries typically cannot directly obtain the output of the PRNG. In fact, there is no output that depends on the generated random bits at all, since these values are only used for internal randomization of intermediate computations, and the final results of the masked operations are unmasked internally before being released to outside observers. Hence, adversaries can only obtain a noisy version of the generated random bits from their side-channel observations (especially noisy in hardware if generated in parallel to the masked cipher implementation), leaving the possibility to perform direct state recovery attacks on the PRNG quite theoretical (see [JD06, BMV07, CMM14, MCB$^{+22}$]). As a result, many previous works have opted for random number generators without cryptographic strength for mask generation, such as Linear Feedback Shift Registers (LFSRs).

LFSRs are arguably the most simple primitive for generating long non-repetitive sequences of random-looking, uniformly distributed bits from an initial seed. However, as mentioned above, LFSRs cannot provide black-box security, and their linear output can be distinguished from true randomness using statistical test suites such as the one proposed by the National Institute of Standards and Technology (NIST) [BRS$^{+10}$]. This raises doubts regarding their suitability to fill the two main requirements for (pseudo-)random numbers in masking contexts, namely 1) uniformity and 2) unpredictability [GSF13]. Without uniformity, most masking schemes cannot keep their security promises. Even a small bias in the sampling of random masks can lead to a reduction of the protection order, despite noise and independence assumptions being fulfilled. Low Entropy Masking Schemes (LEMS) initially attempted to relax such requirements on the quality of random numbers in order to reduce costs while still maintaining the security order. However, these schemes had to make additional assumptions which have been demonstrated to not always hold in practice [GSP13, YE13]. The need for unpredictability of random numbers is even more obvious in masking contexts. If an adversary can predict the random bits and has knowledge of the data being processed (known-plaintext scenario), she can compute all intermediate values that are actually processed inside the cryptographic implementation and perform attacks in the same trivial way as on unprotected circuits. Since all future outputs (at least until the next re-seeding) can be calculated once the internal state of a deterministic PRNG is discovered, state recovery attacks are commonly the most relevant threat to the unpredictability requirement. With respect to LFSRs, once an adversary has obtained a sufficient number of consecutive output bits, state recovery is trivial. More precisely, if the feedback polynomial is known – with $m$ being the LFSR's degree – an attacker only needs to observe $m$ consecutive output bits to know its internal state and
predict all further outputs. When the feedback polynomial is unknown, the attacker
typically requires 2$^m$ consecutive output bits [PP10]. However, as mentioned before, the
attacker model in the context of masking does not allow direct access to the generated
random bits, making the application of such attacks difficult for sufficiently noisy leakages.

1.5 Masking Randomness in Previous Works

In the state-of-the-art hardware masking literature, researchers have used various techniques to generate the random bits required for their experimental analyses. An AES-128 in counter (CTR) mode has been used in [BGN+14b] to provide 44 random bits per clock cycle. Assuming that a round-based AES-128 implementation requires at least 12500 gate equivalents (GE) of area (the smallest value listed in the comparison of [UHM+20]) and produces 128 output bits every 10 clock cycles, the area cost of generating one random bit per cycle can be estimated to be at least 977 GE. Other works like [CRB+16] instantiated reduced-round variants of the low-latency cipher PRINCE [BCG+12] in Output FeedBack (OFB) mode to rapidly generate a high number of random bits per clock cycle. It is not stated how many of the PRINCE rounds were removed, but calculating based on a full PRINCE as unrolled implementation which requires approximately 8000 GE [BCG+12] of area and generates 64 output bits per cycle, the cost of generating one random bit per cycle is about 125 GE. For a round-reduced variant, this cost might be halved at the expense of a reduced security level. In [SBHM20], a sponge-based PRNG [BDPA10] using a variant of Keaccak [BDPA13] is used to generate 976 random bits every clock cycle. The design details provided are insufficient to estimate the cost per bit of the concrete construction used. However, a round-based Keaccak-f[200] permutation requires about 5000 GE of area and runs for 18 clock cycles [KY10]. Using the construction proposed in [BDPA10], either 64 or 96 bits are obtained per call to Keaccak-f[200], resulting in a minimum cost of 938 GE to produce one random bit per cycle. As mentioned earlier, there are also a number of works that use LFSRs to generate random values for masking. For instance, 31-bit LFSRs are employed in [MMW18, Moo19, SM21, KMMS22, KSM22] in such a way that each required random bit is generated by a dedicated LFSR that is randomly seeded on power-up. Following the same principle, the authors of [KM22a] have considered such a 31-bit LFSR, a 64-bit LFSR, and different variants of Keaccak-Sponge-based PRNGs, and have reported the overhead of a hardware masking scheme including the area required for the necessary PRNGs. The cost of generating one random bit per cycle is estimated as 286 GE and 565 GE for the 31-bit and 64-bit LFSRs respectively [KM22a]. Further, it has been explored in [PYR+16] whether evolutionary computation can be beneficial in the design and optimization of lightweight PRNGs for masking applications. The authors have proposed multiple PRNG variants that have passed all tests of the NIST statistical test suite [BRS+10]. The most efficient one, based on Cartesian genetic programming, is said to have a throughput-area ratio of 68.14 Mbps/GE based on the NanGate 45 nm library. While this is significantly more efficient than all other approaches mentioned above, it is entirely unclear whether this primitive provides sufficient resistance against modeling or state-recovery attacks. Indeed, the variants proposed by the authors which are claimed to be prediction resistant are significantly more expensive. Finally, one work on multiplicative masking of the AES has applied an unrolled Trivium instance to generate multiple random bits per cycle for masking [MRB18]. The use of Trivium is only mentioned at the end of the work's Appendix, without any further reasoning or cost analysis. Yet, the concrete properties of this approach are investigated in detail in Section 3.

1.6 Our Contributions

In this work, we focus on the problem of efficiently and securely generating randomness
in hardware with properties suitable for use in masked implementations. As a first step,
we briefly investigate the efficiency of state-of-the-art on-chip TRNGs, focusing mainly
on a high-throughput, low-area TRNG proposed at CHES 2018 [YRG+18]. While this
design appears to offer promising performance compared to its competitors, we discard
the possibility of using only TRNGs for the entire randomness generation due to their sub-
optimal cost-performance trade-off, which stays orders of magnitude behind that of PRNGs.
In consequence, we conclude that PRNGs are indeed preferable in the considered setting,
especially when trying to satisfy the needs of randomness-hungry masked parallel hardware
implementations, as we focus on in this work. Accordingly, we then analyze a number of
efficient cryptographic building blocks based on their throughput-area ratio with potential
for constructing secure PRNGs tailored to efficient mask generation. The considered
building blocks are selected in part based on prior reports comparing the 32 primitives
that survived to Round 2 of NIST's Lightweight Cryptography (LWC) standardization
process [oSN17] and the 8 stream ciphers in Profile 2 (hardware) that reached the final
phase of eSTREAM, the ECRYPT stream cipher project [oEiCE04]. In particular, we
have included in our comparisons:

* The lightweight primitive *Subterranean 2.0* [DMMR20], which offers by far the best throughput-area ratio among NIST LWC Round 2 candidates according to [AZ21].

* The cross-platform permutation *Gimli* [BKL+17], which is among the highest throughput primitives of NIST LWC Round 2 candidates according to [AZ21].

* The ultra low-latency block cipher *SPEEDY* [LMMR21], whose variant *SPEEDY-5-192* is claimed to provide the best throughput-area ratio among low-latency ciphers.

* The stream ciphers *Trivium* [Can06, CP08] (and its variants Bivium B [Rad06] and Kreyvium [CCF+16]), *Grain v1* (both 80- and 128-bit variant) [HJM07, HJMM06] and *MICKEY 2.0* (both 80- and 128-bit variant) [BD08] which are the three primitives most frequently listed as best performers in throughput-area ratio among the eS-TREAM competition's Phase-3 candidates, according to a number of different comparative efforts [GB08, GLB+06, BKSQ07, GSB07, Rog07, HCK+08, KSPS13, LLL20].

Where possible, we also consider reduced-security variants of these primitives, motivated
by the assumption that full cryptographic strength may not be required in our target
setting, i.e., randomness used in masking. For Gimli and SPEEDY this means that we
consider reduced-round versions. For Trivium, we consider its reduced-security variant
Bivium B [Rad06], which has been introduced to study the cryptanalytic properties of
Trivium. For Grain v1, both the 80- and 128-bit variant, we consider reduced versions
where the NLFSR part is removed and only the filtered LFSR part remains, in order to
include a representative of that class of primitives in the comparison. To the best of our
knowledge, such reduced versions have not received any independent cryptanalysis and are
likely insecure, considering that fast correlation attacks targeting the filtered LFSR part
have been used to successfully break all complete Grain v1 versions [TIM+18]. Finally,
despite the fact that LFSRs are lacking any black-box security due to the linear dependency
between their produced output bits (and are thus generally considered a poor choice for
random number generation in cryptographic contexts), we include them in our comparison
and discuss the security implications of employing such primitives for mask generation
experimentally. Hence, we believe that our comparison covers the entire spectrum from
candidates that are trivially insecure in the black-box setting but most efficient, to those
which are cryptographically strong but less efficient, in order to identify the most promising
primitives.

As part of our investigations, we observe that in order to maximize the throughput-area
ratio, different implementation styles are best suited for different designs. For permutations
and block ciphers, round-unrolled pipelined implementations usually lead to good results,
while for stream ciphers and LFSR-based primitives unrolling multiple update/feedback
functions to generate several output bits in a single cycle using a single hardware module
seems most promising (see [GB08, GLB+06, GSB07, Rog07, HCK+08, MS11, LLL20] and
explanations in Section 3). Since the degree or level of unrolling can be chosen arbitrarily
for stream ciphers, these primitives offer a high flexibility to hardware designers. However,
the effectiveness of unrolling a stream cipher implementation to actually maximize its
throughput-area ratio depends heavily on the concrete cipher design. Thanks to the
fact that Trivium's update/feedback function is independent of the last 64 output bits
produced, leading to high efficiency for even large unrolling levels, our throughput-area
ratio comparison leaves no doubt that Trivium is the most efficient cryptographically
strong primitive among our selected candidates, outperforming the other black-box-secure
designs by an impressive margin.

Only LFSRs, when also unrolled to produce multiple bits simultaneously, are able to
outperform Trivium, Bivium B and Kreyvium. Hence, we take a closer look at unrolled
LFSRs from a security perspective in the relevant application setting. In this respect it
is noteworthy that, to the best of our knowledge, no previous work has claimed that the
use of *unrolled* LFSRs to generate randomness for masking is secure or advisable. The
authors of [KM22a] for example discussed the need to use an independent LFSR for each
random bit required per cycle in a masked circuit, and all related previous works have
apparently followed the same strategy. However, according to our comparison, this is not a
cost-effective solution as it proves more costly than multiple of the cryptographically strong
candidates we analyze (i.e., there is little incentive to ever consider those in practice).
Therefore, we focus on the security properties of *unrolled* LFSRs in two case studies, and
find that without great care, this strategy can lead to problems when used in masked
implementations, and may cancel the entire side-channel security. In fact, the demonstrated
problems extend, although in limited form, to the single-LFSR-per-bit scenario which has
more commonly been considered in the past (potentially causing multivariate instead of
univariate leakage though). Besides, we also put forward weaknesses in the original masking
PRNG design of the OpenTitan project. Multiple independent 32-bit filtered LFSRs were
originally instantiated to be used for generating the randomness needed for the masked
AES core. We describe in detail how state recovery of such a PRNG is possible with low
data complexity by enumerating all possible states of the LFSRs separately which allows
to generate all previous and future masks. The OpenTitan design team has acknowledged
and confirmed the vulnerability and is determined to switch to a Bivium/Trivium-based
alternative to increase the security at very low overhead (≈ 1.8% for the total masked
AES core) in the near future.

We insist that it is not our goal to suggest that (unrolled) LFSRs can never be used
securely for mask generation. We are confident that this can be achieved (as long as state
guessing and correlation attacks [Can11b] are not a concern due to insufficient size) when
ensuring that each random bit is used only in positions where it cannot cause problems.
Yet, our case studies provide evidence that when using such linear primitives which lack
black-box security guarantees, the randomness generation and the masking scheme must
be analyzed jointly. Moving to primitives that offer black-box security, such as Trivium,
solves this issue and allows the independent analysis of the masked implementation and
the randomness generator, which is significantly more convenient from the designer's and
evaluator's perspective. In other words, we claim that (unrolled) LFSRs are not sufficient
for masking *in general* and therefore warn against their use, not that they cannot be
used *in specific and carefully crafted case studies*. Yet, in view of the limited overheads
shown by unrolled stream ciphers like Trivium (for high security levels) and Bivium B (for
medium security levels), we recommend them as a good default option for the efficient
generation of randomness for masked hardware implementations. We detail how to use
these primitives, discuss their security against side-channel attacks, and finally estimate the
resulting cost of generating *n* random bits per cycle. For Trivium, the asymptotic cost per random bit updated per clock cycle is about 30 GE on ASIC or 4 LUTs on FPGA. Using Bivium B, the cost can even be reduced to 20 GE or 3 LUTs per random bit. These results show that randomness generation is significantly cheaper than estimated in most previous works, which incentivizes highly parallel (low latency) masked hardware implementations and might motivate researchers to focus on alternative optimization goals than reducing randomness usage in masking schemes. We believe that our conclusions are of positive nature for the physical security community, as implementations using many random bits per cycle are also known to provide superior security levels against more sophisticated adversaries (e.g., so-called horizontal attacks [BCPZ16]) compared to low-randomness approaches.

## 2 Background

In this section, we introduce primitives that are commonly considered to generate randomness for masked implementations. We start with a quick look at TRNGs, then move to LFSRs and PRNGs (including stream ciphers), before discussing the design details of Trivium and Bivium. We conclude by describing how stream cipher implementations can be unrolled.

### 2.1 True Random Number Generators (TRNGs)

Whenever randomness is needed in a digital design, at least some initial entropy has to come from an analog noise source, as deterministic digital computation methods are unable to generate true randomness. Thus, TRNGs exploit noise sources based on physical phenomena with unpredictable behavior. An optimal source of entropy would be radioactive decay, since the timing of events at the atomic level is impossible to predict, even with unbounded memory and computational resources. Yet, it is clearly not realistic to sample radioactive decay in integrated circuits to generate random numbers for cryptographic applications. Instead, noise sources inherent to modern integrated circuits are commonly leveraged. These include clock jitter, metastability, thermal noise in resistors, oscillatory metastability, write collisions in dual-port random access memories and random initialization of bi-stable circuits [FD02, FL14]. A large number of TRNG designs based on these physical phenomena is discussed and compared in [PMB+16, YRG+18]. The raw random numbers extracted from entropy sources are typically subject to statistical defects and need to be tested and post-processed before being used in applications. Obtaining independent random values with high entropy is therefore a laborious process that comes at a significant cost (e.g., in latency or area).

### 2.2 Linear-Feedback Shift Registers (LFSRs)

LFSRs are structures that hold an array of bits shifted one position per step in a certain direction. The bit that gets shifted out of the array is typically the output, and the new bit shifted into the array is determined by a feedback function computing a linear combination of a number of state bits. LFSRs consist of clocked storage elements like flip-flops, and the feedback function is typically described by a polynomial. The number of storage elements is the degree of the LFSR. The maximum period, or sequence length, of an LFSR of degree $m$ is $2^m - 1$. LFSRs with maximum period exist for any degree $m$. Since the LFSR output is determined by a linear combination of the initial state bits only, state recovery attacks are trivial once a sufficient number of consecutive output bits are observed ($2m$ if the feedback polynomial is unknown; $m$ otherwise [PP10]). Due to this lack of black box security, LFSRs are rarely used as standalone PRNG primitives
in cryptographic applications but more commonly as useful ingredients (e.g., for stream ciphers – see next). Yet, they are named frequently for the generation of randomness to be consumed by masked implementations.

## 2.3 Pseudo-Random Number Generators (PRNGs)

Due to the high cost of generating true random values in integrated circuits, it is common practice to use PRNGs to stretch short sequences of true random bits (called seeds) into long sequences of pseudo-random bits. PRNGs are deterministic polynomial time algorithms constructed from an iterated function [BM82]. They generally use a pair of functions $f$ and $g$, where $f: \{0, 1\}^n \rightarrow \{0, 1\}^n$ iteratively updates an $n$-bit state $s_i = f^i(s_0)$, and $g: \{0, 1\}^n \rightarrow \{0, 1\}^m$ generates the output bitstream $g(s_0) \parallel g(s_1) \parallel \dots$. The initial state $s_0$ is derived from the seed, which can be obtained from a TRNG at device power-up. Therefore, all the entropy in the output descends from the initial random seed, and is further limited by the state size of a PRNG. Cryptographically strong PRNGs, required for key or nonce generation in many cryptographic protocols – when properly seeded – should produce output indistinguishable from genuine randomness for all computationally bounded adversaries.

PRNGs are natural candidates to generate randomness for masked implementations since they generally have good security properties in presence of leakage due to the continuous update of their secret state [YSPY10]. Furthermore their initialization, that may lead to stronger side-channel attack vectors if it had to be synchronized with another communication party [SPY$^+$10], is not needed in this context and can be replaced entirely by a truly random seed of sufficient length generated on-chip. As most cryptographic primitives, they can be obtained generically from well-investigated building blocks like (tweakable) block ciphers (as in the previous reference) or permutations [BDPA10] – both possibly coming with similar guarantees in terms leakage-resistance [BBC$^+$20]. They can also be obtained from dedicated constructions, usually introduced as stream ciphers. Such dedicated constructions generally correspond to a slightly more aggressive security (margins) vs. efficiency tradeoff compared to generic constructions. The latter appears appealing for our purposes since expensive randomness generation makes the application of higher-order masking prohibitive and, as already mentioned, the adversarial scenario of this generation is different from the stream cipher one (i.e., the adversary sees only the leakage of the PRNG). Concretely, we will primarily investigate Trivium [oEiCE04, Can06] and its Bivium B variant [Rad06] that we detail next. We will also report performance figures for Subterranean 2.0 [DMMR20], Gimli [BKL$^+$17] and SPEEDY [LMMR21]. The former two are high-throughput candidates from the NIST lightweight cryptography standardization process [oSN17], while the latter is a performance-driven block cipher with few rounds. For completeness, we also include the stream ciphers Grain v1 [HJM07] and MICKEY 2.0 [BD08], as well as Kreyvium which is a variant of Trivium with 128-bit security [CCF$^+$16] in our comparisons.<fnref n="1" />

## 2.4 Trivium & Bivium

Trivium is a stream cipher submitted by De Cannière and Preneel to the eSTREAM competition, a multi-year effort to collect compact stream ciphers suitable for widespread adoption [oEiCE04, Can06]. It was selected to be part of the final portfolio [CP08] and has later been standardized as part of the lightweight stream cipher standard ISO/IEC 29192-3. Trivium is based on a combination of three Non-Linear Feedback Shift Registers (NLFSRs) of degree 93, 84 and 111 (288 bits in total) – see Figure 1 for an illustration. It has two input parameters, an 80-bit key and an 80-bit initialization vector (IV). As

<footnote n="1">¹ We do not provide the details of these additional algorithms due to place constraints.</footnote>
<figure><img src="image_2.png" /><figcaption>**Figure 1:** Schematic of the Trivium stream cipher consisting of 3 NLFSRs.</figcaption></figure>

is common in cryptographic applications, the IV is public, but should take a new value for each encryption session. During the initialization phase, the IV is loaded into the 80 leftmost positions of the upper register, while the key is loaded into the 80 leftmost positions of the middle register. All other bits are set to zero, with the exception of the three rightmost bits of the bottom register, which are set to one. The cipher is then clocked for 1152 steps without producing any keystream, which corresponds to 4 rotations of the state (4 · 288 = 1152), that randomizes the content of the registers. After the initialization phase (also called warm-up) is completed, the online phase begins and the keystream is generated. According to the performance comparisons of phase-3 candidates of the eSTREAM competition presented in [GB08, GLB+06, BKSQ07, GSB07, Rog07, HCK+08], unrolled Trivium offers by far the best throughput-area ratio for hardware implementations.

In an attempt to better understand the security of Trivium, Raddum introduced two reduced variants, called Bivium A and Bivium B [Rad06]. Both of them consist of only two of Trivium's NLFSRs, namely the 93-bit and the 84-bit ones. Bivium B is depicted in Figure 2. In Bivium A, the keystream is generated as the sum of 2 state bits, both from the same register. In Bivium B, the keystream is generated as the sum of 4 state bits, 2 from each NLFSR. While no key recovery attack on Trivium with a complexity below $2^{80}$ is known, there have been effective attacks on both Bivium variants. In 2006, Haddum presented an attack to break Bivium A in about a day [Rad06] by building and solving a system of equations using the output keystream with the initial state bits as the unknowns. He estimated the same attack to require about $2^{56}$ seconds (about $2^{31}$ years) on Bivium B. Later in 2007, Maximov and Biryukov presented an attack on Bivium B with complexity $c \cdot 2^{37}$, where the constant $c$ denotes the time required to solve a system
<figure><img src="image_3.png" /><figcaption>**Figure 2:** Schematic of Bivium B, a reduced security variant of the stream cipher Trivium consisting of 2 NLFSRs.</figcaption></figure>

of equations (estimated to be $c \approx 2^{14}$) [MB07]. In 2011, it was reported in [HL11] that by guessing 35 variables, Bivium B can be solved in $2^{32.81}$ seconds (about 7.9 years) by MFCS, an algorithm for solving Boolean polynomial equations. In 2019, a key-recovery attack on Bivium B based on Boolean equation solving has been reported [SSD19]. The concrete complexity of the attack is unclear due to ambiguous claims in the paper, but the authors state that about 4 terabytes of memory and a parallel search over $2^{39}$ threads is required to recover the initial state and the key. We conclude that Bivium A is trivially insecure and that Bivium B can be broken in practical time complexity on large computation clusters. In the rest of the paper we denote Bivium B as Bivium and use it as an aggressive design that may be secure in the leakage-only setting, to gauge the performance gains that such an optimization offers.

## 2.5 Unrolling Stream Ciphers

While the terminology of *unrolling* a stream cipher may not be widely established (although it has been used in previous works [BMA+18]), the general concept is well known for many years. Sometimes it has only been described using different terms. Stream ciphers like Trivium and Grain have been developed with this implementation trick in mind in the early 2000s already. Similar to the iterated round functions of a block cipher or permutation, the (normally consecutively executed) state update (and output) functions of a stream cipher can be unrolled, which means multiple instances are realized in hardware without any memory elements in between so that the combinatorial logic of multiple steps is evaluated in a single cycle. See Figure 3(a) for an exemplary illustration of unrolling an update function. Here, each instance of the update function is producing 1 output bit or word per cycle (different from the block cipher analogy). While this is obviously a convenient instrument to adjust the tradeoff between latency (in cycles) and critical path (in seconds), there is another big advantage in the case of stream ciphers. Much unlike typical round functions of block ciphers and permutations, the state update functions of stream ciphers (typically) produce only 1 bit/word per cycle and are often chosen to be sparse. Sparsity of the function means that it receives only a few selected bits/words as inputs instead of the entire state. Thus, when choosing the function in a clever way, namely that the next
update function does not receive the current feedback bit as input, it becomes possible
to unroll a certain number of consecutive state updates (i.e., compute them in parallel in
one cycle) without directly increasing the logic depth or critical path of the circuit. See
Figure 3(b) for an example of a 2-bit unrolled Bivium implementation where the gate
depth is not changed compared to the regular design in Figure 2. It turns out stream
ciphers like Trivium and Grain [HJM07, HJMM06] indeed employ well-chosen functions
to allow fast implementations generating multiple output bits and performing multiple
updates per clock cycle. Trivium’s update function ensures that any state bit which has
just been modified is not used for at least the 64 following update steps [CP08]. For Grain
v1 with 80-bit key, modified state bits are not used in the next 16 updates [HJM07] while
for the 128-bit key variant that number is even increased to 32 [HJMM06]. Consequently,
the critical path is only increased in steps of 64, 16 and 32 bits of unrolling, respectively.
The area, however, is increased for each additional copy of the function. Yet, as only
the combinatorial logic needs to be replicated and as the area of stream ciphers like
Trivium and Grain is highly dominated by the state register(s), unrolling these primitives
corresponds to a net gain in throughput-area ratio up to a certain level. Furthermore, even
beyond that level, the bits/cycle metric continues to grow much faster than the critical
path of the implementation.

We acknowledge that our definition of *unrolling* has been mostly been referred to as *parallelization* in previous works on stream cipher implementations [GB08, GSB07, Rog07, LLL20]. We have decided to avoid this term in our work, as it conflicts with the description of multiple unrolled stream ciphers in parallel, which is a concept we need later in Section 5. Less commonly, unrolled stream cipher circuits have also been referred to as *higher-radix* implementations (e.g., radix-64 for 64-bit unrolled Trivium) [GLB<sup>+06</sup>, HCK<sup>+08</sup>]. An FSE 2019 work on the energy efficiency of stream ciphers has used the term unrolling in the same way that we do, and additionally also explored large unrolling factors in order to optimize the implementation properties of stream ciphers for certain settings [BMA<sup>+18</sup>].

3 Cost Efficiency Comparison

In the following we explore the suitability of multiple building blocks to be used as random-
ness generators for masked hardware implementations from the performance viewpoint.

## 3.1 Throughput-Area Ratio

Comparing primitives for cost-efficient randomness generation begs the question which
performance metric is the most relevant to evaluate. Since we aim to satisfy the random-
ness demands of even large, parallel, higher-order masked hardware implementations of
cryptographic algorithms, we argue that the throughput-area ratio (TPA) is one of the most
meaningful metrics to look at. While a small default area and a low power consumption
(as well as combined metrics of them with the throughput) can also be of high importance,
we believe that TPA is the most universally relevant quantity to answer common questions
in the envisioned application setting. Assuming a masked implementation requires up
to 1000 fresh random bits per cycle (not unusual for gadget-based parallel higher-order
implementations, c.f. [KMMS22]) at 100 MHz in 65 nm ASIC technology, the TPA is
arguably the most suitable metric to find the cheapest solution for generating the required
amount of randomness per cycle at the desired clock frequency. For concrete settings, the
throughput-area ratio measured in (bits/cycle)/GE is probably ideal for decision making.
Yet, it is not best suited for general comparisons of multiple candidates due to its strong de-
pendency on the chosen frequency and implementation technology. Indeed, to obtain both
fair and optimized results in the (bits/cycle)/GE metric for any given candidate, a separate
implementation needs to be constructed to best leverage the available critical path budget
<figure><img src="image_4.png" /><figcaption>**Figure 3:** Unrolling a stream cipher like Trivium/Bivium is achieved by implementing multiple consecutive update functions in the same hardware circuit, each producing one output bit/word per cycle. If one update function's inputs are independent of the feedback bits of multiple previous update functions, consecutive steps can be unrolled without increasing the circuit depth (e.g., up to 64 steps for Bivium/Trivium/Kreyvium).</figcaption></figure>

at each considered frequency and for each considered implementation technology. When measuring the throughput-area ratio in (bits/s)/GE instead, the critical path delay is part of the formula and it becomes easier to compare multiple candidates without limiting the analysis to one predefined setting. In fact, the (bits/s)/GE value can be seen as an upper
bound on the TPA in the sense that the optimal value is obtained for a concrete circuit under the assumption that the operating frequency of the device is determined by this implementation, instead of the implementation being tailored to one predefined frequency. As not every candidate will fit into each setting perfectly, flexibility of an implementation is another important factor. In the following we use the throughput-area ratio measured in (bits/s)/GE to compare the selected candidates for concurrent randomness generation. We aim to avoid remaining technology biases by evaluating the metric in multiple standard cell libraries for the PRNG building blocks.

## 3.2 High-Throughput Low-Area TRNG

Since an efficient TRNG implementation is always needed when randomness has to be generated inside an integrated circuit, the first important question to answer is whether this primitive can potentially be used for all randomness generation, which would save the cost of implementing a PRNG in addition. To answer this question, we have selected a suitable representative from the TRNG literature and evaluate its efficiency in the following. At CHES 2018, Yang et al. proposed a high-throughput, low-area TRNG suitable for both ASIC and FPGA implementations [YRG$^{+18}$]. The design is called ES-TRNG, where ES stands for Edge Sampling. The chosen noise source is timing jitter, and the design relies on two techniques that the authors call variable-precision phase encoding and repetitive sampling to increase throughput and reduce area. We implemented this design using a 65 nm low-power CMOS standard cell library and obtained the results listed in Table 1. The throughput is estimated in part based on timing jitter measurements on a test chip manufactured under the same 65 nm technology and in part based on a prototype FPGA implementation whose output has been evaluated positively by statistical test suites. For a 100 MHz system clock the resulting throughput when synthesized in (and parametrized for) 65 nm ASIC technology is 2.2 Mbit/s and thus higher than the 1.15 Mbit/s given in [YRG$^{+18}$]. This is expected when moving from FPGA to ASIC implementation. In fact, higher performances are likely still possible on ASIC platforms. Our concrete implementation is able to produce 7.4 kbit/s of high-entropy random numbers for each gate equivalent (GE) of area (i.e., a TPA of 7.4 (kbit/s)/GE). Please note that a recent improvement of the original ES-TRNG design has been published in [LBS22] under the name Tight-ES-TRNG. The authors performed low-cost optimizations to ensure that the signal edges populate a larger portion of the full distribution of phase jitter to increase the achievable entropy level. In that work, the throughput is increased to 5.6 Mbit/s. Even higher throughput may potentially be achieved with alternative TRNG designs according to the comparisons presented in [PMB$^{+16}$, YRG$^{+18}$], at the cost of a significantly larger area and less freedom in the implementation. In particular, the only TRNG design listed which provides a larger throughput-area ratio compared to the ES-TRNG is a Self-Timed Ring (STR) based TRNG [CFAF13, CFFA13], with an approximately 6 times better efficiency [PMB$^{+16}$, YRG$^{+18}$]. However, this design occupies a 20 to 30 times larger area (high default cost) and requires both manual placement and manual routing. Even when considering such a design, the throughput-area ratio would still fall in the range of tens, maybe hundreds, of kbit/s/GE for a 65 nm ASIC implementation, without yet considering the cost of monitoring the entropy source or continuous internal testing. We demonstrate in the rest of this section that it is possible to implement cryptographically strong PRNGs with a much higher throughput-area ratio than that, providing strong support for the idea that randomness-hungry masked implementations are better served by PRNGs than TRNGs.
<table><caption>**Table 1:** ES-TRNG in a 65 nm low-power CMOS technology @ 100 MHz system clock.</caption><thead><tr><th></th><th>Min. Area</th><th>Min. Latency</th><th>Throughput @ 100 MHz</th></tr></thead><tbody><tr><td>ES-TRNG</td><td>297 GE</td><td>0.135803 ns</td><td>2.2 Mbit/s</td></tr></tbody></table>

## 3.3 Permutations vs. Block Ciphers vs. Stream Ciphers

Having concluded negatively on the suitability of TRNG instances to generate random values for (parallel, higher-order) hardware masking, we now compare a number of potentially cost-efficient cryptographic building blocks based on their throughput-area ratio to be used in PRNG constructions. We rely on prior efficiency comparisons to pre-select such primitives. In more detail, the authors of [AZ21] compared the Round 2 candidates of the NIST lightweight cryptography standardization process [oSN17] based on their ASIC implementation figures. Several different metrics are evaluated, including throughput and throughput-area ratio. The lightweight primitive *Subterranean 2.0*, introduced in [DMMR20], offers by far the best throughput-area ratio, while the cross-platform permutation *Gimli*, proposed in [BKL+17], offers one of the best throughput figures. Both of these primitives are included in our further investigation. According to the comparison of low-latency ciphers given in [LMMR21], the 5-round version of the ultra low-latency cipher *SPEEDY*, called *SPEEDY-5-192* requires a smaller area per output bit and can be clocked at a higher frequency than any other low-latency primitive when implemented fully-unrolled in hardware. Finally, the comparison of all 8 stream ciphers in the hardware profile of the eSTREAM competition that reached the third phase are compared for their cost and efficiency in [GB08]. The stream cipher *Trivium* [Can06, CP08] offers by far the best throughput-area ratio among all its competitors, hence, we include it in our preliminary investigation as well. Other related works reached similar conclusions [GLB+06, BKSQ07, GSB07, Rog07, HCK+08, LLL20]

### 3.3.1 Full-Security Versions

To summarize, in our initial comparison we have selected two of the most cost-efficient building blocks from the NIST lightweight cryptography competition, the supposedly most cost-efficient low-latency cipher and the supposedly most cost-efficient hardware stream cipher from the eSTREAM competition. The corresponding synthesis results are given in Table 2 for 4 different ASIC standard cell libraries, 2 commercial ones and 2 open-source ones. The synthesis tool used is *Synopsys Design Compiler Version O-2018.06-SP4*. Our Subterranean 2.0, *Gimli* and *SPEEDY* hardware implementation results are based on publicly available source code that can be found here:

* Subterranean 2.0: https://github.com/pmassolino/hw-subterranean

* *Gimli*: https://gimli.cr.yp.to/impl.html

* *SPEEDY*: https://github.com/Chair-for-Security-Engineering/SPEEDY

The complete set of individual delay, area, power consumption and throughput figures, in addition to combined metrics such as energy consumption per bit and power-area-time product, are listed for each candidate in Appendix A. It is important to note that we compare the raw primitives in this initial comparison and do not consider any framework that is needed to turn them into usable PRNGs (typically required for the block-oriented primitives, but not for stream ciphers). For the block ciphers and permutations, two different versions are considered: (i) a fully-unrolled single-cycle implementation from combinatorial logic only and (ii) a fully-unrolled round-pipelined implementation (✓). For *Gimli* and *SPEEDY*, 24 and 5 cipher rounds are unrolled respectively. Both versions (i)
and (ii) produce one block of output per clock cycle. Yet, the pipelined versions obviously require a number of cycles equal to the number of rounds before the first usable output is produced. We also acknowledge that efficiently initializing such large pipelines, for example 24·384 = 9216 bits in case of Gimli, while keeping the initial seed small, might become difficult. For Trivium the situation is different, as common stream ciphers are not based on iterative round functions. Instead, they are typically constructed from state update functions that produce a single output bit or word per step while updating the state register. As discussed in Section 2, these update functions can be unrolled in a similar manner as the round functions of a block cipher or permutation, with the additional advantage that state update functions can be sparse and chosen in such a way that a certain degree of unrolling leads to no increase of the gate depth or critical path. In fact, the structure of Trivium allows it to be implemented in a way that neither the depth nor the delay of the hardware circuit are increased for 64 bits of unrolling or below, making Trivium_X64 the most cost efficient primitive in Table 2. Trivium_X48 and Trivium_X64 outperform Trivium_X32, Trivium_72 and any larger (> 72) or lower (< 32) unrolling level. We evaluated Trivium for many degrees of unrolling (arbitrary degrees are possible, see also Section 5), but none of them offered a better throughput-area ratio than Trivium_X64 in (bits/s)/GE. Of course, when integrated into a larger chip design where other components demand a lower operating frequency, larger unrolling factors are still more attractive in order to fully exhaust the critical path budget and generate as many bits per cycle as possible. Since the degree of unrolling can be chosen arbitrarily, the number of output bits produced per cycle is adjustable with single-bit granularity, which also provides a conveniently high flexibility compared to permutations and block ciphers.

Subterranean 2.0 is a hybrid primitive that is hard to put in a category. It uses elements from permutation-based cryptography and resembles a sponge-like construction that behaves like a stream cipher when squeezed, producing 32-bit words per step. Its round/update function can be unrolled to provide even more bits per cycle, but unlike Trivium, unrolling will not improve its TPA in (bits/s)/GE. Instead, the standard variant producing 32 bits per cycle is the most cost-efficient one in this metric and makes it the second most cost-efficient primitive in two of the four considered standard cell libraries in Table 2. Yet, its throughput-area ratio is 4 times lower compared to Trivium_X64, mostly because it occupies a larger area while only producing half the number of bits per cycle (c.f. Table 7). Its power consumption, however, is up to 30 % lower than unrolled Trivium's (c.f. Table 8). Round-pipelined Gimli performs similarly well and places second in the other two cell libraries. Yet, it comes at a much higher default cost (≈ 70-90 kGE compared to Trivium_X64's 4-5 kGE). Round-pipelined SPEEDY is roughly half as cost-efficient as Gimli and Subterranean 2.0 here.

Note that the throughput-area ratio of Trivium_X64 is 77.51 (Mbit/s)/GE in Nan-Gate 45 nm library, more than 13% larger than the 68.14 (Mbit/s)/GE achieved by the PRNG based on evolutionary programming presented in [PYR+16] using the same library. We believe it is a strong result that Trivium, a stream cipher with proven cryptographic strength that has been analyzed for almost 20 years, leads to more cost-efficient implementations in hardware than dedicated PRNGs for mask generation that only achieve sufficient statistical properties to pass common test suites without cryptographic guarantees.

### 3.3.2 Reduced-Security Versions

Yet, as explained in detail in Section 1, full 80-bit or 128-bit security may not always be needed for PRNGs in masking contexts, as adversaries may at most obtain a noisy version of the PRNG's output through side-channel observations. Performing cryptanalytic attacks or solving complex systems of equations based on partially erroneous data is known to be a hard problem. The security of modern lattice-based post-quantum cryptography for instance depends on the hardness of computational problems such as Learning With
<table><caption>**Table 2:** Comparison of the throughput-area ratio of unrolled building blocks, including the stream cipher Trivium, the lightweight primitive Subterranean 2.0, the cross-platform permutation Gimli and the ultra low-latency cipher SPEEDY. Values are obtained when optimizing for maximum frequency (constrained clock period).</caption><thead><tr><th rowspan="3">Primitive</th><th rowspan="3">pip.</th><th rowspan="3">bits/cycle</th><th colspan="4">Throughput/Area [(Mbit/s)/GE]</th></tr><tr><th colspan="2">Commercial Foundry</th><th colspan="2">NanGate OCL</th></tr><tr><th>90 nm LP</th><th>65 nm LP</th><th>45 nm</th><th>15 nm</th></tr></thead><tbody><tr><td>Subterranean2</td><td></td><td>32</td><td>14.272</td><td>17.848</td><td>15.610</td><td>156.644</td></tr><tr><td>Subterranean2_X2</td><td></td><td>64</td><td>9.430</td><td>11.418</td><td>10.461</td><td>92.776</td></tr><tr><td>Subterranean2_X4</td><td></td><td>128</td><td>5.422</td><td>6.786</td><td>6.987</td><td>60.899</td></tr><tr><td>Subterranean2_X8</td><td></td><td>256</td><td>2.910</td><td>3.309</td><td>3.859</td><td>32.578</td></tr><tr><td rowspan="2">Gimli (24 rounds)</td><td rowspan="2">✓</td><td>384</td><td>1.254</td><td>1.540</td><td>1.739</td><td>16.351</td></tr><tr><td>384</td><td>13.518</td><td>15.875</td><td>16.561</td><td>162.556</td></tr><tr><td rowspan="2">SPEEDY-5-192</td><td rowspan="2">✓</td><td>192</td><td>1.354</td><td>1.637</td><td>2.159</td><td>18.442</td></tr><tr><td>192</td><td>7.446</td><td>10.146</td><td>8.857</td><td>75.990</td></tr><tr><td>Trivium</td><td></td><td>1</td><td>2.356</td><td>4.072</td><td>2.189</td><td>22.232</td></tr><tr><td>Trivium_X32</td><td></td><td>32</td><td>51.292</td><td>46.261</td><td>46.827</td><td>412.244</td></tr><tr><td>Trivium_X48</td><td></td><td>48</td><td>48.623</td><td>63.186</td><td>57.639</td><td>607.553</td></tr><tr><td>Trivium_X64</td><td></td><td>64</td><td>58.899</td><td>73.785</td><td>77.514</td><td>752.875</td></tr><tr><td>Trivium_X72</td><td></td><td>72</td><td>42.484</td><td>59.694</td><td>61.534</td><td>530.410</td></tr></tbody></table>

Errors (LWE), which requires solving a system of noisy linear equations. Hence, lower security levels in the black-box model can lead to much higher security levels against adversaries with access to noisy data only [DFH$^{+16}$]. For this reason our concrete setting might tolerate lower security levels if the cost-efficiency can be improved significantly. In this context, the advantage of block ciphers and permutations over stream ciphers is that the number of rounds can be adapted in order to flexibly adjust the security-vs-performance tradeoff. In fact, it is possible for most modern block ciphers and permutations to remove multiple rounds and still maintain a security level beyond enumeration power. For stream ciphers, no such well-understood mechanism exists (shortening the initialization phase reduces security but brings no gains in hardware performance during keystream generation). Luckily, in case of Trivium, the reduced security variant Bivium has been introduced as a study object for cryptanalytic reasoning. Hence, we also compare Bivium to round-reduced versions of the previously analyzed building blocks Gimli and SPEEDY in Table 3. The smallest round-reduced versions (8-round Gimli and 2-round SPEEDY) chosen here can both be practically broken in the black-box setting (distinguishers with complexities below $2^{40}$ exist), but attacks are still expected to require a computational effort that becomes prohibitive when only partial information on inputs and outputs is available. Bivium_X64 clearly outperforms the reduced security primitives in TPA. Here, round-pipelineed 8-round Gimli performs best among the remaining primitives, with approximately half the throughput-area ratio compared to Bivium_X64, while also consuming a 9 times larger area and 10 times more power on average (c.f. Table 7 and Table 8). Reduced-round SPEEDY achieves less than a quarter of the cost efficiency of Bivium_X64. The results in Table 2 and Table 3 show that Trivium and Bivium are the best performing candidates in TPA for full and reduced security.

## 3.4 Other Stream Ciphers

The observation that stream ciphers can outperform block-based encryption algorithms in throughput-area ratio is not new. Stream ciphers are known to require a smaller area
<table><caption>**Table 3:** Comparison of the throughput-area ratio of the reduced-security versions of the primitives from Table 2. Values are obtained when optimizing for maximum frequency (constrained clock period).</caption><thead><tr><th rowspan="3">Primitive</th><th rowspan="3">pip.</th><th rowspan="3">bits/cycle</th><th colspan="4">Throughput/Area [(Mbit/s)/GE]</th></tr><tr><th colspan="2">Commercial Foundry</th><th colspan="2">NanGate OCL</th></tr><tr><th>90 nm LP</th><th>65 nm LP</th><th>45 nm</th><th>15 nm</th></tr></thead><tbody><tr><td rowspan="3">Gimli (8 rounds)</td><td rowspan="3">✓</td><td>384</td><td>8.619</td><td>10.544</td><td>12.839</td><td>108.180</td></tr><tr><td>384</td><td>42.754</td><td>44.256</td><td>49.251</td><td>480.270</td></tr><tr><td>384</td><td>2.484</td><td>2.996</td><td>4.273</td><td>36.684</td></tr><tr><td>Gimli (16 rounds)</td><td>✓</td><td>384</td><td>20.603</td><td>25.763</td><td>23.827</td><td>243.939</td></tr><tr><td rowspan="2">SPEEDY-2-192</td><td rowspan="2">✓</td><td>192</td><td>10.429</td><td>12.539</td><td>15.224</td><td>134.877</td></tr><tr><td>192</td><td>19.734</td><td>25.811</td><td>24.427</td><td>242.620</td></tr><tr><td rowspan="2">SPEEDY-3-192</td><td rowspan="2">✓</td><td>192</td><td>4.155</td><td>4.918</td><td>6.359</td><td>55.208</td></tr><tr><td>192</td><td>12.513</td><td>16.790</td><td>15.249</td><td>134.630</td></tr><tr><td rowspan="2">SPEEDY-4-192</td><td rowspan="2">✓</td><td>192</td><td>2.183</td><td>2.751</td><td>3.425</td><td>29.738</td></tr><tr><td>192</td><td>9.297</td><td>12.971</td><td>11.013</td><td>96.851</td></tr><tr><td>Bivium</td><td></td><td>1</td><td>3.624</td><td>5.364</td><td>3.544</td><td>34.050</td></tr><tr><td>Bivium_X32</td><td></td><td>32</td><td>70.893</td><td>77.847</td><td>71.559</td><td>690.677</td></tr><tr><td>Bivium_X48</td><td></td><td>48</td><td>75.572</td><td>96.861</td><td>107.462</td><td>969.275</td></tr><tr><td>Bivium_X64</td><td></td><td>64</td><td>89.620</td><td>107.543</td><td>109.730</td><td>1212.312</td></tr><tr><td>Bivium_X72</td><td></td><td>72</td><td>66.909</td><td>90.785</td><td>81.547</td><td>809.863</td></tr></tbody></table>

footprint in hardware (on average) compared to block ciphers with similar security levels and have therefore been of primary interest for resource-constrained devices such as smart cards, sensor networks or Radio-Frequency Identification (RFID) tags [BKSQ07]. Since Trivium delivered very promising results in the preliminary analysis, we now investigate whether other stream ciphers can provide similarly impressive performance for randomness generation.

The eSTREAM competition was held from 2004 to 2008 with the goal to identify and collect secure and compact stream cipher proposals suitable for widespread adoption; separately for a hardware and software profile [oEiCE04]. During this time, researchers have compared many of the proposed stream ciphers to each other and also to older standards such as A5/1 [BGW98], RC4 [Sch96] or E0 [E02], resulting in a number of publications containing performance rankings of multiple candidates [GB08, GLB$^{+}$06, BKSQ07, GSB07, Rog07, HCK$^{+}$08]. They all have in common that Trivium is identified as the number one candidate with respect to throughput-area ratio, although among different sets of primitives, most oftenly followed by Grain v1 (either the 80- or 128-bit key variant). Also for the maximum throughput, Trivium places first in all works that have implemented its 64-bit unrolled variant [GB08, GLB$^{+}$06, GSB07, Rog07, HCK$^{+}$08]. The top rank for minimum area is mostly split between Trivium, Grain v1 [HJM07, HJMM06], MICKEY 2.0 [BD08] when considering only eSTREAM candidates - with the insecure A5/1 algorithm (broken in practical time since the year 2000 [BD00]) being consistently smaller. Two further comparisons have been published several years after the eSTREAM competition ended, namely [KSPS13] in 2013 and [LLL20] in 2020, which also include more recent stream cipher proposals. While the work by Kitsos et al. favors MICKEY 2.0 over Trivium or Grain v1 for maximizing the throughput-area ratio, this is mostly due to the fact that only the basic non-unrolled versions of the latter have been implemented [KSPS13]. This is also criticized by Li et al. [LLL20], who provide implementation figures including unrolled Trivium and Grain v1 and report an advantage of Trivium over MICKEY 2.0 in TPA by more than an order of magnitude. In total, all listed publications collectively
include the following set of stream ciphers (or variants of them) implemented in hardware: A5/1 [BGW98], RC4 [Sch96], E0 [E02], SNOW3G [SNO], Phelix [WSLM05], Lex [Bir08], Achterbahn [GGK05], MOSQUITO [DK05], SFINKS [BLM<sup>+</sup>05], VEST [OGL05], ZK-Crypt [GGV05], Trivium [CP08], Grain v1 [HJM07, HJMM06], MICKEY 2.0 [BD08], DECIM [BBC<sup>+</sup>08], Edon80 [GMK08], F-FCSR [ABL08], Moustique [DK08], Pomaranch [JHK08], Salsa20 [Ber08], ZUC [ZUC], Plantlet [MAM16] and Lizard [HKM17]. Among all these primitives, the candidates consistently performing best in maximum throughput, minimum area and maximum throughput-area ratio (without being broken in practical time complexity yet) are Trivium, Grain v1 (80- and 128-bit variant) and MICKEY 2.0 (80- and 128-bit variant). These are, not surprisingly, also the three candidates that have been selected for the hardware portfolio of the eSTREAM competition. Hence, we decided to select these three primitives for a closer look at stream cipher performances for mask generation. While, to the best of our knowledge, no cryptanalytic attacks against full Trivium or full MICKEY 2.0 exist, key recovery attacks against both Grain v1 variants (80- and 128-bit key) with complexities below exhaustive key search are known [TIM<sup>+</sup>18, BCM23]. However, the complexities remain significant enough to not disregard these primitives for our purposes, as the performance of the attacks is still prohibitive for most computationally bounded adversaries even in the noise-free setting (approximately 2<sup>75</sup> and 2<sup>112</sup> respectively). Since we take a look at 80- and 128-bit variants of both Grain and MICKEY, we also consider a 128-bit secure version of Trivium for this exercise, which is called Kreyvium and has been first proposed at FSE 2016 for efficient homomorphic encryption [CCF<sup>+</sup>16]. Unlike the 128-bit versions of Grain and MICKEY, Kreyvium is not a real re-design of its successor based on larger parameters, but mostly relies on keeping original Trivium intact and extending it by two additional registers holding the 128-bit key and 128-bit IV, which are never updated beyond a rotation of the bits. This change, while promising for the purposes intended by the authors, is not exactly optimal to improve the throughput-area ratio.

The full comparison is shown in Table 4; individual delay, area, power consumption and throughput figures in addition to combined metrics (energy consumption per bit, power-area-time product) can be found in Appendix A. As already pointed out in previous stream cipher comparisons, the optimal level of unrolling to maximize the throughput-area ratio differs between the candidates. For Grain v1 with 80-bit key and 128-bit key it is 16 and 32 respectively, for Trivium and Kreyvium it is 64 (because the core design is identical) and for MICKEY 2.0 with 80-bit key and 128-bit key it is actually 1. The MICKEY design is not based on the principle that recently updated state bits are not used in the next X update steps. Hence, unrolling this stream cipher will not lead to any improved results in the (bits/s)/GE metric (doubling the output bits per cycle will also increase both delay and area of the combinational logic approximately by factor 2, resulting in a lower TPA overall). To still have a common denominator between all designs for comparison purposes, we made sure to evaluate a 32-bit unrolled version of each of them. While the small size and power consumption of Grain v1 is attractive (c.f., Table 7; similar to Bivium), its update function has a larger gate depth than Trivium's and the number of consecutive update functions based on independent bits is too small to reach the throughput-area of Trivium. In fact, Subterranean 2.0 and round-pipelined Gimli achieve better TPA than both Grain v1 variants (c.f., Table 2). MICKEY 2.0 is only competitive when no unrolling is considered, making it a poor choice for our purposes. Additionally, it has received the least amount of cryptanalysis among the three eSTREAM candidates considered here and it has been pointed out that its data-dependent irregular clocking may lead to simple, timing-based side-channel attacks [GBC<sup>+</sup>08], which is undesirable in our setting. Finally, we extrapolated the critical path values given in Appendix A Table 6 to estimate how many bits per *cycle* can at most be generated by each of the stream ciphers (i.e., the maximum level of unrolling) in 65 nm ASIC technology at 100MHz operating frequency. The results
show that Bivium, Trivium and Kreyvium may generate over 3000 bits per cycle, while the Grain v1 variants achieve 400 (for the 80-bit key) and 1000 bits (for the 128-bit key) respectively. Both MICKEY 2.0 versions may generate at most 50 bits per cycle. Again, we conclude that Trivium and its variants are the most promising cryptographic algorithms for maximizing the throughput-area ratio and thus great candidates for cost efficient and secure randomness generation in hardware.

<table><caption>**Table 4:** Comparison of the throughput-area ratio of unrolled stream ciphers. Values are obtained when optimizing for maximum frequency (constrained clock period).</caption><thead><tr><th rowspan="2">Primitive</th><th rowspan="2">key length</th><th rowspan="2">bits/cycle</th><th colspan="4">Throughput/Area [(Mbit/s)/GE]</th></tr><tr><th colspan="2">Commercial Foundry</th><th colspan="2">NanGate OCL</th></tr><tr><th></th><th></th><th></th><th>90 nm LP</th><th>65 nm LP</th><th>45 nm</th><th>15 nm</th></tr></thead><tbody><tr><td>GrainV1_80</td><td rowspan="4">80</td><td>1</td><td>1.464</td><td>2.020</td><td>1.580</td><td>14.825</td></tr><tr><td>GrainV1_80_X8</td><td>8</td><td>6.391</td><td>7.849</td><td>7.287</td><td>69.252</td></tr><tr><td>GrainV1_80_X16*</td><td>16</td><td>8.274</td><td>10.861</td><td>9.031</td><td>86.915</td></tr><tr><td>GrainV1_80_X32</td><td>32</td><td>5.817</td><td>7.023</td><td>7.158</td><td>61.417</td></tr><tr><td>GrainV1_128</td><td rowspan="4">128</td><td>1</td><td>1.086</td><td>1.484</td><td>1.093</td><td>9.841</td></tr><tr><td>GrainV1_128_X16</td><td>16</td><td>8.522</td><td>11.465</td><td>9.751</td><td>91.195</td></tr><tr><td>GrainV1_128_X32*</td><td>32</td><td>12.410</td><td>18.556</td><td>13.996</td><td>130.803</td></tr><tr><td>GrainV1_128_X48</td><td>48</td><td>8.907</td><td>11.978</td><td>11.195</td><td>94.795</td></tr><tr><td>MICKEY2_80*</td><td rowspan="4">80</td><td>1</td><td>1.224</td><td>1.807</td><td>1.391</td><td>11.291</td></tr><tr><td>MICKEY2_80_X2</td><td>2</td><td>0.967</td><td>1.440</td><td>1.108</td><td>9.191</td></tr><tr><td>MICKEY2_80_X4</td><td>4</td><td>0.621</td><td>0.835</td><td>0.763</td><td>6.627</td></tr><tr><td>MICKEY2_80_X32</td><td>32</td><td>0.056</td><td>0.077</td><td>0.068</td><td>0.642</td></tr><tr><td>MICKEY2_128*</td><td rowspan="4">128</td><td>1</td><td>0.778</td><td>0.967</td><td>0.885</td><td>6.247</td></tr><tr><td>MICKEY2_128_X2</td><td>2</td><td>0.575</td><td>0.817</td><td>0.652</td><td>5.602</td></tr><tr><td>MICKEY2_128_X4</td><td>4</td><td>0.360</td><td>0.496</td><td>0.443</td><td>3.603</td></tr><tr><td>MICKEY2_128_X32</td><td>32</td><td>0.033</td><td>0.046</td><td>0.039</td><td>0.359</td></tr><tr><td>Trivium</td><td rowspan="4">80</td><td>1</td><td>2.356</td><td>4.072</td><td>2.189</td><td>22.232</td></tr><tr><td>Trivium_X32</td><td>32</td><td>51.292</td><td>46.261</td><td>46.827</td><td>412.244</td></tr><tr><td>Trivium_X48</td><td>48</td><td>48.623</td><td>63.186</td><td>57.639</td><td>607.553</td></tr><tr><td>Trivium_X64*</td><td>64</td><td>58.899</td><td>73.785</td><td>77.514</td><td>752.875</td></tr><tr><td>Trivium_X72</td><td></td><td>72</td><td>42.484</td><td>59.694</td><td>61.534</td><td>530.410</td></tr><tr><td>Kreyvium</td><td rowspan="4">128</td><td>1</td><td>0.982</td><td>1.240</td><td>1.027</td><td>9.218</td></tr><tr><td>Kreyvium_X32</td><td>32</td><td>21.554</td><td>27.449</td><td>23.696</td><td>233.767</td></tr><tr><td>Kreyvium_X48</td><td>48</td><td>29.554</td><td>36.597</td><td>33.600</td><td>325.753</td></tr><tr><td>Kreyvium_X64*</td><td>64</td><td>37.142</td><td>45.264</td><td>37.719</td><td>388.195</td></tr><tr><td>Kreyvium_X72</td><td></td><td>72</td><td>27.773</td><td>38.244</td><td>32.134</td><td>291.893</td></tr></tbody></table>

## 3.5 LFSRs

There exists one well-known primitive for generating long sequences of random-looking bits that has not been discussed yet and which is preferable over Trivium and Bivium from a pure performance standpoint, namely an unrolled LFSR. Indeed, the update function of an LFSR can be unrolled in the same manner as for stream ciphers like Trivium or Grain. Additionally, sparse feedback polynomials which guarantee maximum period are known for (almost) arbitrary register sizes. Of course, a sufficiently large state is required (e.g., > 64 bits) in order to (i) guarantee a long enough non-repetitive output sequence and (ii) keep adversaries from simply guessing all state bits to perform trivial correlation

<footnote>* Optimal level of unrolling to maximize Throughput/Area ratio.</footnote>
attacks. A negative example where this requirement has been neglected is presented in Section 4. However, even when respecting the minimum size of 64 bits, an unrolled LFSR can easily be 3-4 times more cost-efficient than Bivium, which is demonstrated for different levels of unrolling in Table 5. The obvious caveat is that LFSRs provide no black-box security whatsoever, as all output bits depend linearly on the initial state. As mentioned in Section 2, this allows trivial state recovery attacks when sufficiently many consecutive output bits are observed. Another problem may occur when multiple bits with linear dependencies between each other are used as pseudo-randomness in the same masked implementation. Hence, a closer look at the severity of such risks is needed, which we also study in Section 4.

<table><caption>**Table 5:** Throughput-area ratio of an exemplary 64-bit LFSR for different degrees of unrolling, as well as the filtered LFSR parts of the Grain v1 stream cipher. Values are obtained when optimizing for maximum frequency (constrained clock period).</caption><thead><tr><th rowspan="3">Primitive</th><th rowspan="3">bits/cycle</th><th colspan="4">Throughput/Area [(Mbit/s)/GE]</th></tr><tr><th colspan="2">Commercial Foundry</th><th colspan="2">NanGate OCL</th></tr><tr><th>90 nm LP</th><th>65 nm LP</th><th>45 nm</th><th>15 nm</th></tr></thead><tbody><tr><td>LFSR64</td><td>1</td><td>10.805</td><td>12.984</td><td>11.741</td><td>106.251</td></tr><tr><td>LFSR64_X32</td><td>32</td><td>230.191</td><td>265.875</td><td>218.516</td><td>2384.159</td></tr><tr><td>LFSR64_X64</td><td>64</td><td>222.286</td><td>298.575</td><td>308.312</td><td>3058.591</td></tr><tr><td>LFSR64_X96</td><td>96</td><td>294.813</td><td>399.138</td><td>387.573</td><td>3310.856</td></tr><tr><td>LFSR64_X128</td><td>128</td><td>287.444</td><td>373.509</td><td>332.251</td><td>2821.053</td></tr><tr><td>F-LFSR-GrainV1_80</td><td>1</td><td>4.996</td><td>7.047</td><td>5.059</td><td>47.904</td></tr><tr><td>F-LFSR-GrainV1_80_X16</td><td>16</td><td>38.322</td><td>48.469</td><td>45.928</td><td>430.478</td></tr><tr><td>F-LFSR-GrainV1_80_X32</td><td>32</td><td>31.691</td><td>42.772</td><td>38.885</td><td>332.250</td></tr><tr><td>F-LFSR-GrainV1_128</td><td>1</td><td>2.889</td><td>4.113</td><td>3.094</td><td>25.884</td></tr><tr><td>F-LFSR-GrainV1_128_X16</td><td>16</td><td>26.068</td><td>34.051</td><td>32.218</td><td>299.115</td></tr><tr><td>F-LFSR-GrainV1_128_X32</td><td>32</td><td>38.047</td><td>52.866</td><td>48.116</td><td>477.243</td></tr></tbody></table>

## 3.6 Filtered LFSRs

The move from LFSRs to cryptographically strong designs is admittedly gradual and different tweaks can be used in order to add non-linearity to stream ciphers that are based on shift registers. As just described, Trivium uses NLFSRs, but other approaches have been considered in the literature, including filtering one or several LFSRs with a non-linear Boolean function [Can11c, Can11a] or using irregularly clocked generators [Fon11a, Fon11b]. Grain v1 [HJM07, HJMM06] is an example where both an LFSR with a non-linear filter function and an NLFSR are combined (and where the filtered LFSR part eventually became the weak point [TIM$^{+}$18]). Such approaches have been intensively analyzed, culminating with the eSTREAM competition [oEiCE04]. Yet, when cryptographic strength is not the goal, but only the fully linear characteristic of LFSR output needs to be eliminated, then placing a non-linear filter function between the LFSR and the output can be sufficient. In order to include such a representative in the comparison we exemplarily consider only the filtered LFSR part of the Grain v1 variants, denoted by F-LFSR-GrainV1 in Table 5. Such designs are most likely trivially insecure (see [TIM$^{+}$18]), but still unable to outperform Trivium/Bivium in throughput-area ratio. Of course, even more lightweight designs following the same approach can be derived, but, to the best of our knowledge, none of them have been studied in sufficient detail to warrant their inclusion in this comparison or to be recommended as secure and efficient solutions for masking randomness generation.
# 4 Security Analysis: Unrolled LFSRs

In this section, we tackle the question of the (in)security of using LFSRs as the source of masking randomness. At first sight, although LFSRs do not have as strong properties as other cryptographic primitives (i.e., their state can be retrieved by observing the stream it generates), this might not be an issue since masking schemes usually only require that their randomness is uniformly distributed and unpredictable. Since the adversary does not have access to the output of the LFSR, but only a noisy version of it, state recovery might not be easy, and we will optimistically assume that the unpredictability holds true. Regarding the uniformity, a properly seeded LFSR has uniform output bits, but they are not independent. Are these dependencies an issue in practice? We answer this question positively with two simple examples where the masking security is broken due to the linear dependencies in the LFSR output stream, both in theory and in real-world experiments. Finally, we conclude the section by describing a real-world vulnerability caused by the use of LFSRs of insufficient size inside a PRNG used for masking randomness generation.

Let $r_0, r_1, \dots$ be the output stream from an $k$-bit LFSR. Then, using the LFSR Fibonacci representation, there exists coefficients $a_i \in \mathbb{F}_2$ such that $r_{i+k} = \bigoplus_{j=0}^{k-1} a_j r_{i+j}$. Therefore, for any initial seed $(r_0, \dots, r_{k-1})$, the random variables $(r_i, \dots, r_{i+k})$ satisfy the linear relationship $\bigoplus_{j=0}^k a_j r_{i+j} = 0$ (taking $a_k = 1$). Since the LFSR output bits are linear functions of the seed bits, the linear relationship generalizes: for any set of $k+1$ indices $i_0, \dots, i_k$, there exists $a \in \mathbb{F}_2^k$ such that $\bigoplus_{j=0}^k a_j r_{i_j} = 0$ for any seed and $a \neq (0, \dots, 0)$. When a set of $r_{i_j}$ satisfies his property, we call the values it contains *linearly dependent*.

As a simple example of issue caused by linearly dependent random bits in masking, let us consider the masked computation of $s = \bigoplus_{i=1}^m x_i y_i$ with the well-known ISW multiplication [ISW03] and the sharewise XOR gadget. Let $(x_i^0, x_i^1)$ and $(y_i^0, y_i^1)$ be shareings representing $x_i$ and $y_i$ respectively, and let $(z_i^0, z_i^1)$ be the output sharing of the ISW multiplication that computes $x_i y_i$. Then, $z_i^0 = x_i^0 y_i^0 \oplus (x_i^0 y_i^1 \oplus r_i)$ and the first share of $s$ is $s^0 = \bigoplus_{i=1}^m x_i^0 y_i^0 \oplus (x_i^0 y_i^1 \oplus r_i)$. If $r_1, \dots, r_m$ are linearly dependent, the randomness cancels out and we get $s^0 = \bigoplus_{i=1}^m x_i^0 (y_i^0 \oplus y_i^1) = \bigoplus_{i=1}^m x_i^0 y_i$. This value depends on the non-masked values $y_i$, which should not happen in a first-order masked circuit.

Let us now show how this problem happens in concrete cases. Both case studies are based on a circuit masked at the first order using the HPC2 masking scheme [CGLS21] (i.e., we have HPC2 AND gadgets and sharewise XORs), and we ensure that the circuits are secure against glitches and transitions [CS21] when provided with fresh randomness.

The first case-study is a low-latency implementation of Ascon [DEMS20] (the recent winner of NIST's Lightweight Cryptography standardization process [oSN17]) showing that the above problem can appear in real-world circuits and not only in artificial examples. Next, the second case study shows how glitches and transitions interact with the LFSR, providing further insights on how (not) to use an LFSR for generating masking randomness.

## 4.1 Case Study 1

We implemented a first-order masked Ascon permutation with a round-based architecture and with minimal latency (2 clock cycles per round, due to the latency of the HPC2 AND gadgets). The permutation operates on a 320-bit state and it is composed of the layers shown in Figure 4: the substitution layer consists in 64 5-bit S-boxes and the linear diffusion layer operates on 64-bit words. In the implementation, the non-linear part of the S-box (which is the Keccak S-box) is the only sequential logic, and the other layers (S-box output, Ascon diffusion layer, and S-box input) are all linear and implemented with combinational logic. The non-linear S-box layer is implemented as a two-stage pipeline that is fed with the randomness $(r_i)_{0 \le i < 320}$. It outputs the shared state bits $(s_i)_{0 \le i < 320}$ (which are simply forwarded from its input) and the results of the AND gates denoted $(a_i)_{0 \le i < 320}$.
<figure><img src="image_5.png" /><figcaption>Figure 4: Top-level representation of the Ascon permutation.</figcaption></figure>

The other layers combined together form a purely combinational XOR network producing $(s'_i)_{0<i<320}$, the shared inputs of the non-linear layer of the next round.

The structure of the $s'_i$ terms is fairly similar to our simple example from the beginning of this section. Indeed, for some set $\mathcal{I}_i$, we have

$$s'_{i} = \bigoplus_{j \in \mathcal{I}_{i}} s_{j} \oplus \bigoplus_{j \in \mathcal{I}_{i}} s_{j+2\overline{s_{j+1}}}$$

and therefore, its first share is (note that $\overline{s_{j+1}} \oplus s_{j+1}^1 = (s_{j+1}^0 \oplus 1) \oplus s_{j+1}^1 = \overline{s_{j+1}}$)

$$s'_{i}^{0} = \bigoplus_{j \in \mathcal{I}_{i}} s_{j}^{0} \oplus \bigoplus_{j \in \mathcal{I}_{i}} s_{j+2\overline{s_{j+1}}}^{0} \oplus (s_{j+2\overline{s_{j+1}}}^{0} s_{j+1}^{1} + r_{j}).$$

Since all the XOR operations in this computation belong to a single combinational circuit, the exact order in which they are evaluated in a practical implementation cannot be easily controlled by the circuit designer. This lack of control can be caused by design tools (which may exploit associativity of the XOR gate to optimize the circuit), or due to the presence of glitches (i.e., values that appear only ephemerally due to propagation delays, but still produce leakage). In particular glitch leakage is often worked around with worst-case leakage models that assume that any possible glitch occurs [FGP+18]. Following that assumption, we will assume that for some subset of indices $\mathcal{I}'_i \subset \mathcal{I}_i$, the value

$$l = \bigoplus_{j \in \mathcal{I}'_i} s_{j+2\overline{s_{j+1}}}^{0} \oplus (s_{j+2\overline{s_{j+1}}}^{0} s_{j+1}^{1} + r_j)$$

leaks. Let us now consider the randomness generation, and assume that the bits $r_0, \dots, r_{319}$ are the outputs of an LFSR unrolled 320 times. Then, if there is a linear dependency in the LFSR output such that $\bigoplus_{j \in \mathcal{I}'_i} r_j = 0$, then the above leakage becomes

$$l = \bigoplus_{j \in \mathcal{I}'_i} s_{j+2\overline{s_{j+1}}}^{0},$$

which depends on $(s_{j+1})_{j \in \mathcal{I}'_i}$, causing first-order leakage.

Concretely, we analyzed the maximum-length LFSRs proposed in [Alf96]. By symbolically simulating the execution of our Ascon implementation when using these LFSRs as PRNG, we identified that 13 designs (out of 166 possible ones) had linear dependency issues in the randomness that led to possible first-order leakage, as explained above. For
<figure><img src="image_6.png" /><figcaption>**Figure 5:** Case study 1: fixed-vs-fixed t-test results for the first-order masked Ascon experiment (10M traces) using the unrolled 63-bit LFSR as source of fresh randomness.</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>**Figure 6:** Case study 1: fixed-vs-fixed t-test results for the first-order masked Ascon experiment (10M traces) using unrolled Trivium as source of fresh randomness.</figcaption></figure>

example, for the 63-bit LFSR (feedback polynomial $x^{63} + x^{62} + 1$ [Alf96]), 39 indices $i$ had this issue, with, e.g., $\mathcal{I}_{32} = \{2, 27, 30, 31, 32, 45, 46, 155, 156\}$ and $\mathcal{I}'_{32} = \{30, 32, 156\}$.

We conclude our analysis by performing an experimental verification of the discovered issue on a SAKURA-G board using a Spartan-6 FPGA as target. To do so, we performed a power analysis by collecting measurements at 500MS/s using a Picoscope 5224D digital oscilloscope and by measuring the voltage drop across a 1 Ohm shunt resistor, with a vertical resolution of 12bits. The FPGA was fed with an external clock of 2.5MHz synchronized with the clock of the oscilloscope to ensure a proper temporal alignment of the traces. With this configuration, we performed a fixed-vs-fixed statistical t-test using 10M traces to evaluate the statistical security order achieved by our securely first-order masked Ascon implementation. Figure 5 shows that first-order leakage is present and confidently detectable with less than 10M traces. In order to verify that the source of this leakage is indeed the use of the unrolled 63-bit LFSR for fresh mask generation we have repeated the same experiment with an unrolled Trivium instead. The result is depicted in Figure 6, showing a clear absence of first-order leakage (only the expected second-order leakage is present and has a lower amplitude). It confirms that using multiple bits from the same LFSR as random values for a masked implementation can lead to a security degradation in realistic settings.

## 4.2 Case Study 2

As a second example, we consider the case of a network of AND and XOR operations. More precisely, we suppose that the underlying circuit receives two $n$-bit operands $x_1, \dots, x_n$ and $y_1, \dots, y_n$ and generates the output as $z = \bigoplus_{i=1}^n x_i y_i$. Considering an $n$-bit LFSR, we have seen in the first case study what happens when unrolling more than $n$ rounds. In this case study, we demonstrate that even unrolling less than that can cause issues, due
to transitions. More precisely, the observation is that such an *n*-bit LFSR should not be unrolled more than *n*/2 rounds.<fnref n="2" /> Otherwise, the security of the circuit under the robust probing model [FGP<sup>+</sup>18] cannot be guaranteed. This can be justified by the fact that transition-extended probes allow the attacker to observe two consecutive values stored in a register. Without considering transitions, it should be possible to securely use an *n*-bit LFSR with *n* unrolled rounds (again considering 1 execution cycle). In order to show this, we set two examples with *n* = 4 and *n* = 5 (identified as ANDXOR4 and ANDXOR5), while using an unrolled 8-bit LFSR generating 4 (resp., 5) random bits per clock cycle (next referred to as LFSR8_X4 and LFSR8_X5).

**Verification Tool.** To examine the security of these circuits, we conducted two distinct experiments. We first synthesized the circuits for an ASIC platform by Synopsys Design Compiler with NanGate 45 nm digital library and used PROLEAD [MM22] to examine their first-order probing security under the glitch- and transition-extended probing model. As a side note, PROLEAD is a simulation-based leakage assessment software tool developed for evaluation of masked hardware designs following the robust probing security model. We analyzed both circuits by PROLEAD using 100M simulations and allowed first-order probes to be placed on every location of the circuit (including the LFSR) and extended based on glitches as well as transitions. We set PROLEAD to seed the LFSR with a randomly generated 8-bit value for every simulation, and performed a fixed-vs-random statistical test with fixed input $x_1, \dots, x_n$ and $y_1, \dots, y_n$ being all zero. While the tool did not report any leakage for *n* = 4, it revealed a single probe placed on an output share (e.g., $z^0$) able to see significantly different distributions for *n* = 5 using less than 1M simulations. Note that we have similarly examined smaller circuits with *n* < 4 which led to the same result as with *n* = 4. Note also that transition-extended probes play an important role here. Without covering transitional leakages, PROLEAD did not report any first-order leaking probes up to *n* = 8.

**FPGA-Based Experiments.** As in the previous section, we also have carried out FPGA-based experimental analysis on both aforementioned circuits. To this end, we made use of a SAKURA-G board with Spartan-6 FPGAs, and measured dynamic power consumption of the underlying circuit being operated at a low clock frequency of 3 MHz. The power traces have been collected by a digital oscilloscope at a sampling rate of 500 MS/s; corresponding sample power traces can be seen in Figure 7(a) and Figure 8(a). We followed the procedure suggested in [SM15] for collecting the traces suitable for a fixed-vs-random t-test. Similar to the simulation-based analysis explained above, the LFSR was randomly seeded before every measurement. We further made sure that the circuit is enabled once the input is given and the corresponding clock cycles are covered by the collected power traces. For each circuit, we collected 100M traces and performed a first- and second-order t-test, whose results are depicted in Figure 7(b), 7(c) and Figure 8(b), 8(c), respectively. The experimental results are in line with the simulation-based analysis employing PROLEAD, i.e., detectable first-order leakage is seen for *n* = 5 while it is not the case for *n* = 4.

We would like to highlight that these experiments cannot be seen as a proof that unrolling an *n*-bit LFSRs for more than *n*/2 steps will always cause leakage. However, we presented an example (for small *n*) where this is indeed the case and consider the rule of thumb plausible based on the joint occurrence of glitches and transitions in practice.

More generally, we conclude from our two case studies that even in simple settings (i.e., analyzing one clock cycle), LFSRs as PRNGs can cause serious security issues. While it might be possible to work around these issues with thorough analysis, exhaustive verification of combined circuits becomes quickly prohibitive and some countermeasures

<footnote n="2">² If we unroll less than *n*/2, we do not expect to see problem arising when considering only one execution cycle, however there might still be issues when executing the implementation over multiple cycles.</footnote>
to prevent issues from occurring (e.g., not unrolling too much, paying close attention to synthesis details) will add undesirable overheads. We therefore conclude that a simpler solution will be often desirable, such as the use of a proper cryptographically-secure PRNG.

## 4.3 Case Study 3

As a final case study we highlight a vulnerability discovered in a real-world design. The identified problem is caused by the use of a cryptographically weak, filtered LFSR-based, PRNG for masking randomness generation, once again showing that such design choices can easily lead to issues in practice. While the previous two case studies have discussed violations of masking security stemming from the linear dependency between LFSR output bits that either directly, or with the aid of glitches and transitions in hardware, led to side-channel leakage, this last case study highlights an example where the chosen shift registers are too small to prevent guessing attacks. In particular, the PRNG initially used to supply the masked AES core inside the OpenTitan chip design, contained multiple independent filtered 32-bit LFSRs. To attack this design, one may simply enumerate all possible states of each LFSR separately to find the correct seed, as there is no diffusion between the registers, which in turn allows an adversary to generate all previous and future masks.

**Attack description.** The independent 32-bit LFSRs in the PRNG design are expected to leak side channel information, for example through the power consumption, about their initial state (the seed) over the full duration of a leakage trace in a highly multivariate manner. The adversary may simply enumerate all $2^{32}$ potential initial states of one of the LFSRs and predict the $n$ following states that are produced when clocking it. If the guessed initial state is correct, all consecutive state updates are predicted correctly and a horizontal template or correlation attack on the leakage of the $n$ successive state updates that occur over the period captured by the trace will then typically be sufficient to identify the correct seed (leading to the maximum likelihood or correlation). The same procedure can be repeated for each of the independent LFSRs independently using the same leakage trace(s) until the entire PRNG state is recovered. If the PRNG is not (or rarely) reseeded, the initial seed only has to be extracted once. If the seed is fresh for every execution, one seed per trace needs to be extracted. Once all seeds are known, the implementation is essentially unprotected and a standard side-channel analysis attack on the processed intermediates, such as Differential Power Analysis (DPA), is likely to succeed unless the noise level is prohibitively high.

**Disclosure and fix.** After disclosing the issue to the designers, the OpenTitan team has acknowledged and confirmed the described problems and is actively working on integrating a fixed solution. To the best of our knowledge, the plan is to switch to a Bivium- or Trivium-based PRNG with an unrolling factor of 160 (i.e., producing 160 bits per cycle) for the masking randomness generation. According to the designers, the overhead of moving to a Bivium-based solution, including a partial state reseeding interface, associated tracking logic, and lockup detection as well as protection, comes at the cost of additional ≈ 2.22 kGE, which corresponds to ≈ 1.8 % overhead for the full masked AES. This solution even outperforms the alternative of simply stretching each of the 32-bit LFSRs to 64-bit ones and otherwise keeping the original design, while it additionally provides much stronger diffusion over the entire state and hence significantly improved security characteristics.
# 5 Unrolled Trivium/Bivium for Masking Randomness

We finally provide guidelines for the secure use of Trivium and Bivium as PRNGs for masking randomness generation and analyze the efficiency and security of the resulting circuits.

## 5.1 Initialization

Trivium (resp., Bivium) normally expect two input parameters, a key and an Initialization Vector (IV). One simple and efficient option to turn them into PRNGs is to use a randomly chosen fixed 80-bit IV for the device lifetime and at every device power-up obtain 80 true random bits from a TRNG as a seed to supply via the key input. If multiple instances in parallel are required (to generate many bits without increasing the critical path too much), each of them needs a different 80-bit IV, but can be fed with the same seed. Before randomness is produced, at least the initial phase of 1152 (resp., 708) steps needs to be executed. Note that the amount of cycles for this initialization depends on the level of unrolling. Using Trivium_X64 this phase requires only [1152/64] = 18 cycles. Using Trivium_X256 for example only [1152/64] = 5 cycles are needed. These numbers of initialization cycles are in the same range as required for the pipelined block-based primitives discussed in Section 3 (i.e., 5 for full SPEEDY, 24 for full Gimli). Alternatively, in order to skip the initialization phase altogether, the state of each Trivium (resp., Bivium) instance can be completely filled with 288 bits (resp., 177 bits) of TRNG output. In this case, the respective instance's output can be used immediately in the masked implementation without any further delay. Yet, due to the limited efficiency of TRNGs, this approach is often less convenient, especially when multiple Trivium (resp., Bivium) instances in parallel are needed.

## 5.2 Cost and Performance Analysis

Since the unrolling factor may be chosen arbitrarily in both Trivium and Bivium hardware implementations, it is crucial to investigate how the relevant cost and performance metrics scale when increasing the number of bits produced per cycle. Figure 9 illustrates the relationship between the area cost per output bit produced, which predictably decreases with larger levels of unrolling (blue curves), and the critical path delays defining the maximum possible operating frequency of the resulting circuits, which expectedly increase when more bits per cycle are generated (red curves). These results exclude the cost of the register stage that is needed before the generated bits can be used in a masked implementation in order to avoid timing dependencies between generated output bits. The curves are based on synthesis results using a commercial 65nm CMOS ASIC library and have been obtained without placing any timing constraints, i.e., the critical path delays are larger than reported in Appendix A and considered in Section 3, while the area figures are smaller (this choice has been made to reduce the tool runtime for the large unrolling factors). Critical path delays are given in nanoseconds and area is measured in gate equivalents (circuit area divided by 2-input NAND area). The x-axis covers the range from $2^0 = 1$ to $2^{13} = 8192$ bits per cycle. Please note that there are two separate y-axes, where the left y-axis (red) is in linear scale and the right y-axis (blue) is in logarithmic scale. We have chosen this kind of data representation here to highlight that there is a sweet spot (i.e., an effective zone) between $2^6 = 64$ and $2^{10} = 1024$ that combines a high maximum operating frequency (> 100 MHz) with a low average area cost per bit (< 60 GE for Trivium, < 40 GE for Bivium). The concrete values for $2^8 = 256$ output bits per cycle, which is the center of the effective area, are 35.48 GE per bit at a maximum 419 MHz for Trivium, and 22.9 GE per bit at a maximum 436 MHz for Bivium. The asymptotic values
<figure><img src="image_8.png" /><figcaption>**Figure 7:** Case study 2: fixed-vs-random t-test results for the ANDXOR4 experiment (100M traces) with LFSR8_X4 as source of fresh randomness.</figcaption></figure>

<figure><img src="image_9.png" /><figcaption>**Figure 8:** Case study 2: fixed-vs-random t-test results for the ANDXOR5 experiment (100M traces) with LFSR8_X5 as source of fresh randomness.</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>**Figure 9:** Area cost per bit and respective critical path delays for different degrees of unrolling (i.e., number of output bits produced per cycle).</figcaption></figure>
<figure><img src="image_11.png" /><figcaption>**Figure 10:** Number of LUTs per bit instantiated on a Spartan-6 FPGA for different degrees of unrolling (i.e., number of output bits produced per cycle).</figcaption></figure>

for the area per bit decrease even below 31 GE for Trivium and 20 GE for Bivium, but beyond a certain point the critical path delay becomes prohibitive.

In Figure 10 we have repeated the same analysis on an FPGA. Since our experimental results are obtained on Spartan-6 FPGAs we have chosen the same device model for the cost and performance analysis here. In contrast to the ASIC results presented above, the area cost is now measured by the number of six-input look-up tables (LUTs) that are instantiated by the synthesis and implementation tool (ISE Design Suite 14.7) per output bit per cycle. Again, these results exclude the cost of the registers that the finally generated bits need to pass through before being used in a masked implementation. In general, the FPGA results are similar to the ASIC analysis. The *sweet spot* is again between $2^6 = 64$ and $2^{10} = 1024$. The concrete values for $2^8 = 256$ output bits per cycle are 4.82 LUTs per bit at a maximum 140 MHz for Trivium, and 3.65 GE per bit at a maximum 139 MHz for Bivium.

In summary, the cost and performance of unrolled Trivium and Bivium hardware implementations reach their optimal trade-off when a few hundreds, but less than thousands of bits per cycle are required by a masked implementation. In consequence, when more than a thousand bits per cycle are required by a masked implementation and if the unrolled PRNG becomes part of the critical path of the entire design, one may consider instantiating multiple PRNG instances in parallel while reducing the degree of unrolling.

## 5.3 Security against SCA Attacks

In this subsection we discuss the security of the pseudo-random phase of Bivium and Trivium against Side-Channel Analysis (SCA) attacks. Our analysis relies mostly on the state-of-the-art investigations reported by Kumar et al. at CHES 2022 [KDB+22]. To the best of our knowledge, this is the only successful SCA on the pseudo-random phase of Trivium, and no follow-up of this work has been published yet. More precisely, the authors successfully performed a simulated SCA on a software implementation of Trivium embedded on a 32-bit microcontroller. To this end, they assumed that each register over which the state is encoded leaked its Hamming weight. This leakage model has nice algebraic properties that allows one to instantiate a so-called Algebraic SCA [RSV09], by solving equations whose variables are the state bits, and whose constraints are given not only by the output stream bits, but also by the Hamming weights of the state registers. Concretely, Kumar et al. instantiated this approach using the Z3 Satisfiability Modulo Theory (SMT) solver.<fnref n="3" />

<footnote n="3">³ The authors used an SMT solver rather than a SAT solver, in order to deal with potential noise into the SCA measurements, that could prevent from a fully accurate guessing of the Hamming weights.</footnote>
In a nutshell, knowing the Hamming weights of each register at each state update enables the adversary to straightforwardly guess some information about the input/output bits of these registers, provided that their size is less than the size of the three NLFSRs in Trivium. As an example, consider one particular register whose bit-size is small enough to not store the bits $s_0, s_{92}$ or $s_{177}$ — those are the only bits that may not be just shifted from one clock cycle to another. If the adversary observes a sequence $(h, h+1)$ (resp., $(h+1, h)$) of Hamming weights for some value $h$, this means that the bit leaving the register is 0 (resp., 1) while the bit entering the register is 1 (resp., 0). Likewise, if the adversary observes a sequence of two equal Hamming weights, this means that the register input and output bits are equal. Overall, this leaks exactly $\frac{3}{2}$ bits per clock-cycle, and per such register — assuming pseudo-randomness of the input/output bits. Then, letting the state bit shift over a few updates is sufficient to easily recover the whole state. We could even extend Kumar et al.'s attack with the Hamming weight leakage model up to 128-bit registers. There, the bit-size becomes larger than the size of each NLFSR, but the last 31 bits of the third NLFSR need to be stored in a third register, whose bits are just shifted from one update to another.

However, for attacks with larger registers, and in particular for a whole state fitting into one single 288-bit register, the picture becomes different. Hereupon, we did not succeed in extending Kumar et al.'s attack, with 288, 300 or 3000 state updates, within 2 days of computation, even with this noise-free idealized leakage model. Likewise, the results are the same when turning to attacks on a 288-bit register assuming a Hamming distance leakage model. These results were already reported by Kumar et al. [KDB+22, Sec. 5.2.2]. Hereupon, although the authors succeed in recovering the state during the initialization phase using a few hundreds of rounds and a few hundreds of seconds, and assuming to know in advance a dozen of key bits, they could not succeed any attack on the pseudo-random phase within 2 days, unless potentially combined with an enumeration of 140 bits, which is more than the complexity of directly enumerating the 80-bit secret key of Trivium.

To summarize, when assuming a Hamming weight or a Hamming distance leakage model, operating on the whole Trivium state in parallel, as it is done for hardware implementations, seems to be the key ingredient to make side-channel attacks on Trivium prohibitive. Moreover, thanks to their open-source code, we replicated Kumar et al.'s experiment with the Hamming distance leakage model to verify whether considering reduced variants of Trivium, i.e., Bivium A and Bivium B could result in different outcomes, but we were not able to report any success for those variants within 2 days as well. Hence, unless a leakage model is observed in practice which proves to be significantly more informative than noise-free HW/HD on the whole state, attacks on hardware Trivium and Bivium have to be considered hard in our setting. Thus, given the current knowledge, state recovery through SCA attacks is not a primary concern for hardware implementations of stream ciphers with state sizes like Trivium's, meaning that the unpredictability requirement for masking randomness is expected to be fulfilled.

**On the effect of unrolling.** Based on these evaluations, we predict that unrolling a hardware implementation can only be beneficial for the SCA security, as the sequential nature of the leakage should be much less exploitable. To ground this claim, let us consider side-channel analysis against an LFSR. Without considering unrolling, we have been able to successfully apply Kumar et al.'s approach to 64-bit LFSRs within a few seconds and a few rounds, thanks to the sequential nature of the leakages. However, at the extreme case where the adversary is not able to exploit the sequential nature of the Hamming weight/distance leakages due to unrolling — i.e. the adversary assumes that the leakages are independent, whereas they are not — the problem can be seen as an instance of the so-called *hidden multiplier problem*, introduced by Belaïd et al. [BCF+15]. There only exists two known attacks against this problem. The first one leverages the parity of the
least significant bit of the Hamming weight of the leakage, and is therefore highly sensitive to the presence of noise [BFG14]. The second one leverages the most significant bit of the Hamming weight of the leakages, but the attack uses an instance of the LWE problem, for which there is no polynomially efficient algorithm [BCF+15]. Overall this contrasts with attacks against non-unrolled LFSRs, which should be straightforward to break using Kumar et al.'s approach if the noise level is not prohibitive. The same observation also applies to ($\le$ 128-bit) LFSRs with non-linear filter functions when the state is only updated by one or a few bits per cycle. Hence, such tweaked designs are similarly insecure as regular LFSRs in the low-noise setting because the state can be recovered through SCA observations.

# 6 Conclusions

Modern hardware masking schemes based on robust probing secure and composable gadgets are known to consume a large number of random bits per clock cycle, especially in parallel implementations and at higher orders. The required random numbers need to be uniformly distributed and unpredictable to adversaries. However, the secure and efficient generation of these bits has not yet received the attention it deserves from the research community. In this work, we improve upon this state of the art and provide contributions in multiple different directions. First of all, we clarify the relevant security properties that must be satisfied in the context of concurrent randomness generation for hardware masking. Then, after arguing that True Random Number Generators (TRNGs) are not cost-efficient when large quantities of bits are needed per cycle, we compare multiple potential candidates for building cost efficient Pseudo-Random Number Generators (PRNGs) instead, to stretch an initial seed obtained once at power-up (analysis of re-seeding is left to future works) into many pseudo-random bits during runtime. Our comparison includes block ciphers, permutations, stream ciphers and (filtered) LFSRs. We arrive at the conclusion that the stream cipher Trivium and its reduced security variant Bivium B (for more aggressive optimizations) are impressively well-suited for our targeted application scenario when considering their unrolled implementation. Unrolled Trivium is basically a ready-to-use, trivial-to-instantiate, cheap, flexible, cryptographically strong and high-performance PRNG for hardware applications that already survived almost 20 years of cryptanalysis and heuristically inherits some of the properties of leakage-resilient stream ciphers. Hence, we highly recommend its adaptation for concurrent masking randomness generation and provide guidelines for its usage together with parametrizable source code. The only alternatives with even better performance according to our analysis are unrolled LFSRs, which offer no cryptographic strength. For that reason we also studied in detail what the security implications might be when using such a simple linear primitive for mask generation instead of a cryptographically strong PRNG and present three case studies where security degradation occurs in practice. To the best of our knowledge, such concrete results have not been presented in the masking literature so far. In this respect, is always easy to argue that the need for cryptographic strength is obvious for PRNGs in masking contexts. Yet, both the related side-channel literature (see Section 1.5) and concrete real-world examples (see the case study on OpenTitan in Section 4.3) are showing that the opposite assumption is more prevalent: LFSR-based approaches are more the current norm than the exception. Hence, we believe our work is an important cautionary study that still culminates in a positive result, as the secure options we recommend are also more efficient than many of the less secure ones used in previous works (e.g., a separate LFSR for each bit of randomness). Besides, and while it may indeed be possible to instantiate certain LFSRs together with specific masked implementations securely, it at least requires a thorough analysis of the randomness generator and the masked circuit jointly. By contrast, when instantiating a cryptographically strong PRNG like Trivium, the (SCA) security of
randomness generation and masked implementation can be assessed separately, which is a
desirable approach.

Concretely, we demonstrate that securely generating *n* bits of randomness per cycle using our proposed approaches has an asymptotic cost of approximately 30*n* GE (ASIC) or 4*n* LUTs (FPGA) for Trivium (80-bit security), and approximately 20*n* GE (ASIC) and 3*n* LUTs (FPGA) for Bivium. These values are at least one order of magnitude better than what has been used as an estimate for the cost of producing random bits as recently as CHES 2022. For completeness, we also evaluated our solutions using NIST's 800-22 test suite for random and pseudo-random number generators for cryptographic applications. Unsurprisingly, the random values generated by Trivium and Bivium passed all statistical tests, while the unrolled 64-bit LFSR failed all linear complexity tests. This, along with the intrinsic leakage resilience of without constant state, indicates We believe that our results can have a considerable impact on hardware masking research as they help to decide on crucial optimization trade-offs, and can guide future research directions, such as moving low randomness to a secondary design goal for hardware masking in the future.

We provide source code related to this work, including the unrolled stream cipher
implementations, in the following GitHub repository:

https://github.com/uclcrypto/randomness_for_hardware_masking

Acknowledgments

Gaëtan Cassiers and François-Xavier Standaert are respectively post-doctoral researcher and senior research associate of the Belgian Fund for Scientific Research (FNRS-F.R.S.). This work has been funded in parts by European Union through the ERC project SWORD (724725) and the ERC Advanced Grant 101096871 (BRIDGE), the German Research Foundation (DFG) under Germany's Excellence Strategy - EXC 2092 CASA - 390781972, the Walloon Region through the Win2Wal project PIRATE (1910082) and through the FEDER project USERMedia (501907-379156), and by SGS. Views and opinions expressed are those of the authors only and do not necessarily reflect those of the European Union or the European Research Council. Neither the European Union nor the granting authority can be held responsible for them.

References

[ABL08] François Arnault, Thierry P. Berger, and Cédric Lauradoux. F-FCSR stream ciphers. In Matthew J. B. Robshaw and Olivier Billet, editors, *New Stream Cipher Designs - The eSTREAM Finalists*, volume 4986 of *Lecture Notes in Computer Science*, pages 170–178. Springer, 2008. doi:10.1007/978-3-540-68351-3_13.

[Alf96] P Alfke. Efficient shift registers, lfsr counters, and long-pseudo-random generators, 1996.

[AZ21] Mark D. Aagaard and Nusa Zidaric. ASIC benchmarking of round 2 candidates in the NIST lightweight cryptography standardization process: (preliminary results). *IACR Cryptol. ePrint Arch.*, page 49, 2021. URL: https://eprint.iacr.org/2021/049.

[BBC⁺08] Côme Berbain, Olivier Billet, Anne Canteaut, Nicolas T. Courtois, Blandine Debraize, Henri Gilbert, Louis Goubin, Aline Gouget, Louis Granboulan, Cédric Lauradoux, Marine Minier, Thomas Pornin, and Hervé Sibert. Decimv2.
In Matthew J. B. Robshaw and Olivier Billet, editors, *New Stream Cipher Designs - The eSTREAM Finalists*, volume 4986 of *Lecture Notes in Computer Science*, pages 140–151. Springer, 2008. doi:10.1007/978-3-540-68351-3_11.

[BBC<sup>+</sup>20] Davide Bellizia, Olivier Bronchain, Gaëtan Cassiers, Vincent Grosso, Chun Guo, Charles Momin, Olivier Pereira, Thomas Peters, and François-Xavier Standaert. Mode-level vs. implementation-level physical security in symmetric cryptography - A practical guide through the leakage-resistance jungle. In Daniele Micciancio and Thomas Ristenpart, editors, *Advances in Cryptology - CRYPTO 2020 - 40th Annual International Cryptology Conference, CRYPTO 2020, Santa Barbara, CA, USA, August 17-21, 2020, Proceedings, Part I*, volume 12170 of *Lecture Notes in Computer Science*, pages 369–400. Springer, 2020. doi:10.1007/978-3-030-56784-2_13.

[BBD<sup>+</sup>16] Gilles Barthe, Sonia Belaïd, François Dupressoir, Pierre-Alain Fouque, Benjamin Grégoire, Pierre-Yves Strub, and Rébecca Zucchini. Strong non-interference and type-directed higher-order masking. In Edgar R. Weippl, Stefan Katzenbeisser, Christopher Kruegel, Andrew C. Myers, and Shai Halevi, editors, *Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, October 24-28, 2016*, pages 116–129. ACM, 2016. doi:10.1145/2976749.2978427.

[BBP<sup>+</sup>16] Sonia Belaïd, Fabrice Benhamouda, Alain Passelègue, Emmanuel Prouff, Adrian Thillard, and Damien Vergnaud. Randomness complexity of private circuits for multiplication. In Marc Fischlin and Jean-Sébastien Coron, editors, *Advances in Cryptology - EUROCRYPT 2016 - 35th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Vienna, Austria, May 8-12, 2016, Proceedings, Part II*, volume 9666 of *Lecture Notes in Computer Science*, pages 616–648. Springer, 2016. doi:10.1007/978-3-662-49896-5_22.

[BCF<sup>+</sup>15] Sonia Belaïd, Jean-Sébastien Coron, Pierre-Alain Fouque, Benoît Gérard, Jean-Gabriel Kammerer, and Emmanuel Prouff. Improved side-channel analysis of finite-field multiplication. In Tim Güneysu and Helena Handschuh, editors, *Cryptographic Hardware and Embedded Systems - CHES 2015 - 17th International Workshop, Saint-Malo, France, September 13-16, 2015, Proceedings*, volume 9293 of *Lecture Notes in Computer Science*, pages 395–415. Springer, 2015. doi:10.1007/978-3-662-48324-4_20.

[BCG<sup>+</sup>12] Julia Borghoff, Anne Canteaut, Tim Güneysu, Elif Bilge Kavun, Miroslav Knezevic, Lars R. Knudsen, Gregor Leander, Ventzislav Nikov, Christof Paar, Christian Rechberger, Peter Rombouts, Søren S. Thomsen, and Tolga Yalçın. PRINCE - A low-latency block cipher for pervasive computing applications - extended abstract. In Xiaoyun Wang and Kazue Sako, editors, *Advances in Cryptology - ASIACRYPT 2012 - 18th International Conference on the Theory and Application of Cryptology and Information Security, Beijing, China, December 2-6, 2012. Proceedings*, volume 7658 of *Lecture Notes in Computer Science*, pages 208–225. Springer, 2012. doi:10.1007/978-3-642-34961-4_14.

[BCM23] Subhadeep Banik, Daniel Collins, and Willi Meier. Near collision attack against grain V1. In Mehdi Tibouchi and Xiaofeng Wang, editors, *Applied Cryptography and Network Security - 21st International Conference, ACNS 2023, Kyoto, Japan, June 19-22, 2023, Proceedings, Part I*, volume 13905
of *Lecture Notes in Computer Science*, pages 178–207. Springer, 2023. doi: 10.1007/978-3-031-33488-7\_7.

[BCPZ16] Alberto Battistello, Jean-Sébastien Coron, Emmanuel Prouff, and Rina Zeitoun. Horizontal side-channel attacks and countermeasures on the ISW masking scheme. In Benedikt Gierlichs and Axel Y. Poschmann, editors, *Cryptographic Hardware and Embedded Systems - CHES 2016 - 18th International Conference, Santa Barbara, CA, USA, August 17-19, 2016, Proceedings*, volume 9813 of *Lecture Notes in Computer Science*, pages 23–39. Springer, 2016. doi:10.1007/978-3-662-53140-2\_2.

[BD00] Eli Biham and Orr Dunkelman. Cryptanalysis of the A5/1 GSM stream cipher. In Bimal K. Roy and Eiji Okamoto, editors, *Progress in Cryptology - INDOCRYPT 2000, First International Conference in Cryptology in India, Calcutta, India, December 10-13, 2000, Proceedings*, volume 1977 of *Lecture Notes in Computer Science*, pages 43–51. Springer, 2000. doi:10.1007/3-540-68351-3\_15.

[BD08] Steve Babbage and Matthew Dodd. The MICKEY stream ciphers. In Matthew J. B. Robshaw and Olivier Billet, editors, *New Stream Cipher Designs - The eSTREAM Finalists*, volume 4986 of *Lecture Notes in Computer Science*, pages 191–209. Springer, 2008. doi:10.1007/978-3-540-68351-3\_15.

[BDPA10] Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche. Sponge-based pseudo-random number generators. In Stefan Mangard and François-Xavier Standaert, editors, *Cryptographic Hardware and Embedded Systems, CHES 2010, 12th International Workshop, Santa Barbara, CA, USA, August 17-20, 2010. Proceedings*, volume 6225 of *Lecture Notes in Computer Science*, pages 33–47. Springer, 2010. doi:10.1007/978-3-642-15031-9\_3.

[BDPA13] Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche. Ke'acc. In Thomas Johansson and Phong Q. Nguyen, editors, *Advances in Cryptology - EUROCRYPT 2013, 32nd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Athens, Greece, May 26-30, 2013. Proceedings*, volume 7881 of *Lecture Notes in Computer Science*, pages 313–314. Springer, 2013. doi:10.1007/978-3-642-38348-9\_19.

[Ber08] Daniel J. Bernstein. The salsa20 family of stream ciphers. In Matthew J. B. Robshaw and Olivier Billet, editors, *New Stream Cipher Designs - The eSTREAM Finalists*, volume 4986 of *Lecture Notes in Computer Science*, pages 84–97. Springer, 2008. doi:10.1007/978-3-540-68351-3\_8.

[BFG14] Sonia Belaïd, Pierre-Alain Fouque, and Benoît Gérard. Side-channel analysis of multiplications in GF(2128) - application to AES-GCM. In Palash Sarkar and Tetsu Iwata, editors, *Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Kaoshiung, Taiwan, R.O.C., December 7-11, 2014, Proceedings, Part II*, volume 8874 of *Lecture Notes in Computer Science*, pages 306–325. Springer, 2014. doi:10.1007/978-3-662-45608-8\_17.

[BGN+14a] Begül Bilgin, Benedikt Gierlichs, Svetla Nikova, Ventzislav Nikov, and Vincent Rijmen. Higher-order threshold implementations. In Palash Sarkar and Tetsu Iwata, editors, *Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Kaoshiung, Taiwan, R.O.C., December 7-11, 2014*,
*Proceedings, Part II*, volume 8874 of *Lecture Notes in Computer Science*, pages 326–343. Springer, 2014. doi:10.1007/978-3-662-45608-8\_18.

[BGN$^{+14}$b] Begül Bilgin, Benedikt Gierlichs, Svetla Nikova, Ventzislav Nikov, and Vincent Rijmen. A more efficient AES threshold implementation. In David Pointcheval and Damien Vergnaud, editors, *Progress in Cryptology - AFRICACRYPT 2014 - 7th International Conference on Cryptology in Africa, Marrakesh, Morocco, May 28-30, 2014. Proceedings*, volume 8469 of *Lecture Notes in Computer Science*, pages 267–284. Springer, 2014. doi:10.1007/978-3-319-06734-6\_17.

[BGW98] Marc Briceno, Ian Goldberg, and David Wagner. A pedagogical implementa-
tion of a5/1, 1998. URL: https://cryptome.org/jya/a51-pi.htm.

[Bir08] Alex Biryukov. Design of a new stream cipher-lex. In Matthew J. B. Robshaw and Olivier Billet, editors, *New Stream Cipher Designs - The eSTREAM Finalists*, volume 4986 of *Lecture Notes in Computer Science*, pages 48–56. Springer, 2008. doi:10.1007/978-3-540-68351-3\_5.

[BKL$^{+17}$] Daniel J. Bernstein, Stefan Kőlbl, Stefan Lucks, Pedro Maat Costa Mas-
solino, Florian Mendel, Kashif Nawaz, Tobias Schneider, Peter Schwabe, François-Xavier Standaert, Yosuke Todo, and Benoît Viguier. Gimli : A Cross-Platform Permutation. In Wieland Fischer and Naofumi Homma, ed-
itors, *Cryptographic Hardware and Embedded Systems - CHES 2017 - 19th International Conference, Taipei, Taiwan, September 25-28, 2017, Proceedings*, volume 10529 of *Lecture Notes in Computer Science*, pages 299–320. Springer,
2017. doi:10.1007/978-3-319-66787-4\_15.

[BKSQ07] Philippe Bulens, Kassem Kalach, François-Xavier Standaert, and Jean-Jacques Quisquater. Fpga implementations of estream phase-2 focus candidates with hardware profile, 2007. URL: https://www.ecrypt.eu.org/stream/paper sdir/2007/024.pdf.

[BLM$^{+05}$] An Braeken, Joseph Lano, Nele Mentens, Bart Preneel, and Ingrid Ver-
bauwhede. Sfinks: A synchronous stream cipher for restricted hardware
environments, 2005. URL: https://www.ecrypt.eu.org/stream/ciphers
/sfinks/sfinks.ps.

[BM82] Manuel Blum and Silvio Micali. How to generate cryptographically strong sequences of pseudo random bits. In *23rd Annual Symposium on Foundations of Computer Science, Chicago, Illinois, USA, 3-5 November 1982*, pages 112-117. IEEE Computer Society, 1982. doi:10.1109/SFCS.1982.72.

[BMA$^{+18}$] Subhadeep Banik, Vasily Mikhalev, Frederik Armknecht, Takanori Isobe, Willi Meier, Andrey Bogdanov, Yuhei Watanabe, and Francesco Regazzoni. Towards low energy stream ciphers. *IACR Trans. Symmetric Cryptol.*, 2018(2):1–19, 2018. URL: https://doi.org/10.13154/tosc.v2018.i2.1-19, doi: 10.13154/TOSC.V2018.I2.1-19.

[BMV07] Sanjay Burman, Debdeep Mukhopadhyay, and Kamakoti Veezhinathan. LFSR based stream ciphers are vulnerable to power attacks. In K. Sri-nathan, C. Pandu Rangan, and Moti Yung, editors, *Progress in Cryptol-ogy - INDOCRYPT 2007, 8th International Conference on Cryptology in India, Chennai, India, December 9-13, 2007, Proceedings*, volume 4859 of *Lecture Notes in Computer Science*, pages 384–392. Springer, 2007. doi:10.1007/978-3-540-77026-8\_30.
[BRS+10] Lawrence E. Bassham, Andrew L. Rukhin, Juan Soto, James R. Nechvatal, Miles E. Smid, Elaine B. Barker, Stefan D. Leigh, Mark Levenson, Mark Vangel, David L. Banks, Nathanael Alan Heckert, James F. Dray, and San Vo. A statistical test suite for random and pseudorandom number generators for cryptographic applications - rev. 1a. NIST Special Publication (SP) 800-22, 2010. URL: https://www.nist.gov/publications/statistical-testSuite-random-and-pseudorandom-number-generators-cryptographic.

[Can06] Christophe De Cannière. Trivium: A stream cipher construction inspired by block cipher design principles. In Sokratis K. Katsikas, Javier López, Michael Backes, Stefanos Gritzalis, and Bart Preneel, editors, *Information Security, 9th International Conference, ISC 2006, Samos Island, Greece, August 30 - September 2, 2006, Proceedings*, volume 4176 of Lecture Notes in Computer Science, pages 171–186. Springer, 2006. doi:10.1007/11836810\_13.

[Can11a] Anne Canteaut. Combination generator. In Henk C. A. van Tilborg and Sushil Jajodia, editors, *Encyclopedia of Cryptography and Security, 2nd Ed*, pages 222–224. Springer, 2011. doi:10.1007/978-1-4419-5906-5\_338.

[Can11b] Anne Canteaut. Correlation attack for stream ciphers. In Henk C. A. van Tilborg and Sushil Jajodia, editors, *Encyclopedia of Cryptography and Security, 2nd Ed*, pages 261–262. Springer, 2011. doi:10.1007/978-1-4419-5906-5\_339.

[Can11c] Anne Canteaut. Filter generator. In Henk C. A. van Tilborg and Sushil Jajodia, editors, *Encyclopedia of Cryptography and Security, 2nd Ed*, pages 458–460. Springer, 2011. doi:10.1007/978-1-4419-5906-5\_349.

[CBG+17] Thomas De Cnudde, Begül Bilgin, Benedikt Gierlichs, Ventzislav Nikov, Svetla Nikova, and Vincent Rijmen. Does coupling affect the security of masked implementations? In Sylvain Guilley, editor, *Constructive Side-Channel Analysis and Secure Design - 8th International Workshop, COSADE 2017, Paris, France, April 13-14, 2017, Revised Selected Papers*, volume 10348 of Lecture Notes in Computer Science, pages 1–18. Springer, 2017. doi:10.1007/978-3-319-64647-3\_1.

[CCF+16] Anne Canteaut, Sergiu Carpov, Caroline Fontaine, Tancrède Lepoint, María Naya-Plasencia, Pascal Paillier, and Renaud Sirdey. Stream ciphers: A practical solution for efficient homomorphic-ciphertext compression. In Thomas Peyrin, editor, *Fast Software Encryption - 23rd International Conference, FSE 2016, Bochum, Germany, March 20-23, 2016, Revised Selected Papers*, volume 9783 of Lecture Notes in Computer Science, pages 313–333. Springer, 2016. doi:10.1007/978-3-662-52993-5\_16.

[CFAF13] Abdelkarim Cherkaoui, Viktor Fischer, Alain Aubert, and Laurent Fesquet. A self-timed ring based true random number generator. In *19th IEEE International Symposium on Asynchronous Circuits and Systems, ASYNC 2013, Santa Monica, CA, USA, May 19-22, 2013*, pages 99–106. IEEE Computer Society, 2013. doi:10.1109/ASYNC.2013.15.

[CFFA13] Abdelkarim Cherkaoui, Viktor Fischer, Laurent Fesquet, and Alain Aubert. A very high speed true random number generator with entropy assessment. In Guido Bertoni and Jean-Sébastien Coron, editors, *Cryptographic Hardware and Embedded Systems - CHES 2013 - 15th International Workshop, Santa Barbara, CA, USA, August 20-23, 2013. Proceedings*, volume 8086 of Lecture
*Notes in Computer Science*, pages 179–196. Springer, 2013. doi:10.1007/978-3-642-40349-1_11.

[CGLS21] Gaëtan Cassiers, Benjamin Grégoire, Itamar Levi, and François-Xavier Standaert. Hardware Private Circuits: From Trivial Composition to Full Verification. *IEEE Trans. Computers*, 70(10):1677–1690, 2021. doi:10.1109/TC.2020.3022979.

[CGP+12] Jean-Sébastien Coron, Christophe Giraud, Emmanuel Prouff, Soline Renner, Matthieu Rivain, and Praveen Kumar Vadnala. Conversion of security proofs from one leakage model to another: A new issue. In Werner Schindler and Sorin A. Huss, editors, *Constructive Side-Channel Analysis and Secure Design - Third International Workshop, COSADE 2012, Darmstadt, Germany, May 3-4, 2012. Proceedings*, volume 7275 of *Lecture Notes in Computer Science*, pages 69–81. Springer, 2012. doi:10.1007/978-3-642-29912-4_6.

[CJRR99] Suresh Chari, Charanjit S. Jutla, Josyula R. Rao, and Pankaj Rohatgi. Towards sound approaches to counteract power-analysis attacks. In Michael J. Wiener, editor, *Advances in Cryptology - CRYPTO '99, 19th Annual International Cryptology Conference, Santa Barbara, California, USA, August 15-19, 1999, Proceedings*, volume 1666 of *Lecture Notes in Computer Science*, pages 398–412. Springer, 1999. doi:10.1007/3-540-48405-1_26.

[CMM14] Abhishek Chakraborty, Bodhisatwa Mazumdar, and Debdeep Mukhopadhyay. Fibonacci LFSR vs. galois LFSR: which is more vulnerable to power attacks? In Rajat Subhra Chakraborty, Vashek Matyas, and Patrick Schaumont, editors, *Security, Privacy, and Applied Cryptography Engineering - 4th International Conference, SPACE 2014, Pune, India, October 18-22, 2014. Proceedings*, volume 8804 of *Lecture Notes in Computer Science*, pages 14–27. Springer, 2014. doi:10.1007/978-3-319-12060-7_2.

[CP08] Christophe De Cannière and Bart Preneel. Trivium. In Matthew J. B. Robshaw and Olivier Billet, editors, *New Stream Cipher Designs - The eSTREAM Finalists*, volume 4986 of *Lecture Notes in Computer Science*, pages 244–266. Springer, 2008. doi:10.1007/978-3-540-68351-3_18.

[CRB+16] Thomas De Cnudde, Oscar Reparaz, Begül Bilgin, Svetla Nikova, Ventzislav Nikov, and Vincent Rijmen. Masking AES with d+1 shares in hardware. In Benedikt Gierlichs and Axel Y. Poschmann, editors, *Cryptographic Hardware and Embedded Systems - CHES 2016 - 18th International Conference, Santa Barbara, CA, USA, August 17-19, 2016, Proceedings*, volume 9813 of *Lecture Notes in Computer Science*, pages 194–212. Springer, 2016. doi:10.1007/978-3-662-53140-2_10.

[CS20] Gaëtan Cassiers and François-Xavier Standaert. Trivially and efficiently composing masked gadgets with probe isolating non-interference. *IEEE Trans. Inf. Forensics Secur.*, 15:2542–2555, 2020. doi:10.1109/TIFS.2020.2971153.

[CS21] Gaëtan Cassiers and François-Xavier Standaert. Provably secure hardware masking in the transition- and glitch-robust probing model: Better safe than sorry. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2021(2):136–158, 2021. URL: https://doi.org/10.46586/tches.v2021.i2.136-158, doi:10.46586/TCHES.V2021.I2.136-158.

[DDF14] Alexandre Duc, Stefan Dziembowski, and Sebastian Faust. Unifying leakage models: From probing attacks to noisy leakage. In Phong Q. Nguyen and
Elisabeth Oswald, editors, *Advances in Cryptology - EUROCRYPT 2014 - 33rd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Copenhagen, Denmark, May 11-15, 2014. Proceedings*, volume 8441 of *Lecture Notes in Computer Science*, pages 423-440. Springer, 2014. doi:10.1007/978-3-642-55220-5\_24.

[DEMS20] Christoph Dobraunig, Maria Eichlseder, Florian Mendel, and Martin Schläer. Status update on ascon v1. 2. *Submission to the NIST LWC competition*, 2020. URL: https://csrc.nist.gov/CSRC/media/Projects/lightweigh t-cryptography/documents/round-2/status-update-sep2020/ascon_u pdate.pdf.

[DFH+16] Stefan Dziembowski, Sebastian Faust, Gottfried Herold, Anthony Journault, Daniel Masny, and François-Xavier Standaert. Towards sound fresh re-keying with hard (physical) learning problems. In Matthew Robshaw and Jonathan Katz, editors, *Advances in Cryptology - CRYPTO 2016 - 36th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 14-18, 2016, Proceedings, Part II*, volume 9815 of *Lecture Notes in Computer Science*, pages 272-301. Springer, 2016. doi:10.1007/978-3-662-53008-5\_10.

[DFS15] Alexandre Duc, Sebastian Faust, and François-Xavier Standaert. Making masking security proofs concrete - or how to evaluate the security of any leaking device. In Elisabeth Oswald and Marc Fischlin, editors, *Advances in Cryptology - EUROCRYPT 2015 - 34th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Sofia, Bulgaria, April 26-30, 2015, Proceedings, Part I*, volume 9056 of *Lecture Notes in Computer Science*, pages 401-429. Springer, 2015. doi:10.1007/978-3-662-46800-5\_16.

[DK05] Joan Daemen and Paris Kitsos. The self-synchronizing stream cipher mosquito: estream documentation, version 2, 2005. URL: https://www.ecrypt.eu.org/stream/ciphers/mosquito/mosquito.pdf.

[DK08] Joan Daemen and Paris Kitsos. The self-synchronizing stream cipher moustique. In Matthew J. B. Robshaw and Olivier Billet, editors, *New Stream Cipher Designs - The eSTREAM Finalists*, volume 4986 of *Lecture Notes in Computer Science*, pages 210-223. Springer, 2008. doi:10.1007/978-3-540-68351-3\_16.

[DMMR20] Joan Daemen, Pedro Maat Costa Massolino, Alireza Mehrdad, and Yann Rotella. The Subterranean 2.0 Cipher Suite. *IACR Trans. Symmetric Cryptol.*, 2020(S1):262-294, 2020. doi:10.13154/tosc.v2020.iS1.262-294.

[E02] Specification of the bluetooth system - version 1.1. http://www.tscm.com/B aktoothSpec.pdf. Accessed: 2024-01-08.

[FD02] Viktor Fischer and Milos Drutarovský. True random number generator embedded in reconfigurable hardware. In Burton S. Kaliski Jr., Çetin Kaya Koç, and Christof Paar, editors, *Cryptographic Hardware and Embedded Systems - CHES 2002, 4th International Workshop, Redwood Shores, CA, USA, August 13-15, 2002, Revised Papers*, volume 2523 of *Lecture Notes in Computer Science*, pages 415-430. Springer, 2002. doi:10.1007/3-540-36400-5\_30.

[FGP+18] Sebastian Faust, Vincent Grosso, Santos Merino Del Pozo, Clara Paglialonga, and François-Xavier Standaert. Composable masking schemes in the presence of physical defaults & the robust probing model. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2018(3):89-120, 2018. doi:10.13154/tches.v2018.i 3.89-120.
[FL14] Viktor Fischer and David Lubicz. Embedded evaluation of randomness in oscillator based elementary TRNG. In Lejla Batina and Matthew Robshaw, editors, *Cryptographic Hardware and Embedded Systems - CHES 2014 - 16th International Workshop, Busan, South Korea, September 23-26, 2014. Proceedings*, volume 8731 of *Lecture Notes in Computer Science*, pages 527-543. Springer, 2014. doi:10.1007/978-3-662-44709-3\_29.

[Fon11a] Caroline Fontaine. Clock-controlled generator. In Henk C. A. van Tilborg and Sushil Jajodia, editors, *Encyclopedia of Cryptography and Security, 2nd Ed*, pages 211-212. Springer, 2011. doi:10.1007/978-1-4419-5906-5\_337.

[Fon11b] Caroline Fontaine. Shrinking generator. In Henk C. A. van Tilborg and Sushil Jajodia, editors, *Encyclopedia of Cryptography and Security, 2nd Ed*, pages 1197-1198. Springer, 2011. doi:10.1007/978-1-4419-5906-5\_373.

[GB08] Tim Good and Mohammed Benaissa. ASIC hardware performance. In Matthew J. B. Robshaw and Olivier Billet, editors, *New Stream Cipher Designs - The eSTREAM Finalists*, volume 4986 of *Lecture Notes in Computer Science*, pages 267-293. Springer, 2008. doi:10.1007/978-3-540-68351-3\_19.

[GBC+08] Benedikt Gierlichs, Lejla Batina, Christophe Clavier, Thomas Eisenbarth, Aline Gouget, Helena Handschuh, Timo Kasper, Kerstin Lemke-Rust, Stefan Mangard, Amir Moradi, and Elisabeth Oswald. Susceptibility of estream candidates towards side channel analysis, 2008. URL: https://www.esat.kuleuven.be/cosic/publications/article-1030.pdf.

[GGK05] Berndt M. Gammel, Rainer Göttfert, and Oliver Kniffler. The achterbahn stream cipher, 2005. URL: https://www.ecrypt.eu.org/stream/ciphers/achterbahn/achterbahn.pdf.

[GGV05] Carmi Gressel, Ran Granot, and Gabi Vago. Zk-crypt - a compact stream cipher and more, 2005. URL: https://www.ecrypt.eu.org/stream/ciphers/zkcrypt/zkcrypt.zip.

[GLB+06] Frank K. Gürkaynak, Peter Luethi, Nico Bernold, René Blattmann, Victoria M Goode, Marcel Marghitola, Hubert Kaeslin, Norbert Felber, and Wolfgang Fichtner. Hardware evaluation of estream candidates, 2006. URL: https://www.ecrypt.eu.org/stream/papersdir/2006/015.pdf.

[GM17] Hannes Groß and Stefan Mangard. Reconciling d+1 masking in hardware and software. In Wieland Fischer and Naofumi Homma, editors, *Cryptographic Hardware and Embedded Systems - CHES 2017 - 19th International Conference, Taipei, Taiwan, September 25-28, 2017, Proceedings*, volume 10529 of *Lecture Notes in Computer Science*, pages 115-136. Springer, 2017. doi:10.1007/978-3-319-66787-4\_6.

[GMK08] Danilo Gligoroski, Smile Markovski, and Svein J. Knapskog. The stream cipher edon80. In Matthew J. B. Robshaw and Olivier Billet, editors, *New Stream Cipher Designs - The eSTREAM Finalists*, volume 4986 of *Lecture Notes in Computer Science*, pages 152-169. Springer, 2008. doi:10.1007/978-3-540-68351-3\_12.

[GMK16] Hannes Groß, Stefan Mangard, and Thomas Korak. Domain-oriented masking: Compact masked hardware implementations with arbitrary protection order. In Begül Bilgin, Svetla Nikova, and Vincent Rijmen, editors, *Proceedings of the ACM Workshop on Theory of Implementation Security, TIS@CCS 2016*
Vienna, Austria, October, 2016, page 3. ACM, 2016. doi:10.1145/2996366.2996426.

[GMK17] Hannes Groß, Stefan Mangard, and Thomas Korak. An efficient side-channel protected AES implementation with arbitrary protection order. In Helena Handschuh, editor, Topics in Cryptology - CT-RSA 2017 - The Cryptographers' Track at the RSA Conference 2017, San Francisco, CA, USA, February 14-17, 2017, Proceedings, volume 10159 of Lecture Notes in Computer Science, pages 95-112. Springer, 2017. doi:10.1007/978-3-319-52153-4\_6.

[GSB07] Kris Gaj, Gabriel Southern, and Ramakrishna Bachimanchi. Comparison of hardware performance of selected phase ii estream candidates, 2007. URL: https://www.ecrypt.eu.org/stream/papersdir/2007/026.pdf.

[GSF13] Vincent Grosso, François-Xavier Standaert, and Sebastian Faust. Masking vs. multiparty computation: How large is the gap for aes? In Guido Bertoni and Jean-Sébastien Coron, editors, Cryptographic Hardware and Embedded Systems - CHES 2013 - 15th International Workshop, Santa Barbara, CA, USA, August 20-23, 2013. Proceedings, volume 8086 of Lecture Notes in Computer Science, pages 400-416. Springer, 2013. doi:10.1007/978-3-642-40349-1\_23.

[GSP13] Vincent Grosso, François-Xavier Standaert, and Emmanuel Prouff. Low entropy masking schemes, revisited. In Aurélien Francillon and Pankaj Rohatgi, editors, Smart Card Research and Advanced Applications - 12th International Conference, CARDIS 2013, Berlin, Germany, November 27-29, 2013. Revised Selected Papers, volume 8419 of Lecture Notes in Computer Science, pages 33-43. Springer, 2013. doi:10.1007/978-3-319-08302-5\_3.

[HCK+08] David Hwang, Mark Chaney, Shashi Prashanth Karanam, Nick Ton, and Kris Gaj. Comparison of fpga-targeted hardware implementations of estream stream cipher candidates, 2008. URL: http://cryptography.gmu.edu/tea m/download.php?docid=799.

[HJM07] Martin Hell, Thomas Johansson, and Willi Meier. Grain: a stream cipher for constrained environments. Int. J. Wirel. Mob. Comput., 2(1):86-93, 2007. doi:10.1504/IJWMC.2007.013798.

[HJMM06] Martin Hell, Thomas Johansson, Alexander Maximov, and Willi Meier. A stream cipher proposal: Grain-128. In Proceedings 2006 IEEE International Symposium on Information Theory, ISIT 2006, The Westin Seattle, Seattle, Washington, USA, July 9-14, 2006, pages 1614-1618. IEEE, 2006. doi: 10.1109/ISIT.2006.261549.

[HKM17] Matthias Hamann, Matthias Krause, and Willi Meier. LIZARD - A lightweight stream cipher for power-constrained devices. IACR Trans. Symmetric Cryptol., 2017(1):45-79, 2017. doi:10.13154/tosc.v2017.i1.45-79.

[HL11] Zhenyu Huang and Dongdai Lin. Attacking bivium and trivium with the characteristic set method. In Abderrahmane Nitaj and David Pointcheval, editors, Progress in Cryptology - AFRICACRYPT 2011 - 4th International Conference on Cryptology in Africa, Dakar, Senegal, July 5-7, 2011. Proceedings, volume 6737 of Lecture Notes in Computer Science, pages 77-91. Springer, 2011. doi:10.1007/978-3-642-21969-6\_5.

[ISW03] Yuval Ishai, Amit Sahai, and David A. Wagner. Private circuits: Securing hardware against probing attacks. In Dan Boneh, editor, Advances in Cryptology - CRYPTO 2003, 23rd Annual International Cryptology Conference,
Santa Barbara, California, USA, August 17-21, 2003, Proceedings, volume 2729 of Lecture Notes in Computer Science, pages 463-481. Springer, 2003. doi:10.1007/978-3-540-45146-4\_27.

[JD06] Antoine Joux and Pascal Delaunay. Galois lfsr, embedded devices and side channel weaknesses. In Rana Barua and Tanja Lange, editors, Progress in Cryptology - INDOCRYPT 2006, 7th International Conference on Cryptology in India, Kolkata, India, December 11-13, 2006, Proceedings, volume 4329 of Lecture Notes in Computer Science, pages 436-451. Springer, 2006. doi: 10.1007/11941378\_31.

[JHK08] Cees J. A. Jansen, Tor Helleseth, and Alexander Kholosha. Cascade jump controlled sequence generator and pomaranch stream cipher. In Matthew J. B. Robshaw and Olivier Billet, editors, New Stream Cipher Designs - The eSTREAM Finalists, volume 4986 of Lecture Notes in Computer Science, pages 224-243. Springer, 2008. doi:10.1007/978-3-540-68351-3\_17.

[KDB+22] Satyam Kumar, Vishnu Asutosh Dasu, Anubhab Baksi, Santanu Sarkar, Dirmanto Jap, Jakub Breier, and Shivam Bhasin. Side channel attack on stream ciphers: A three-step approach to state/key recovery. IACR Trans. Cryptogr. Hardw. Embed. Syst., 2022(2):166-191, 2022. doi:10.46586/tches.v2022.i2.166-191.

[KJJ99] Paul C. Kocher, Joshua Jaffe, and Benjamin Jun. Differential power analysis. In Michael J. Wiener, editor, Advances in Cryptology - CRYPTO '99, 19th Annual International Cryptology Conference, Santa Barbara, California, USA, August 15-19, 1999, Proceedings, volume 1666 of Lecture Notes in Computer Science, pages 388-397. Springer, 1999. doi:10.1007/3-540-48405-1\_25.

[KM22a] David Knichel and Amir Moradi. Composable Gadgets with Reused Fresh Masks First-Order Probing-Secure Hardware Circuits with only 6 Fresh Masks. IACR Trans. Cryptogr. Hardw. Embed. Syst., 2022(3):114-140, 2022. doi: 10.46586/tches.v2022.i3.114-140.

[KM22b] David Knichel and Amir Moradi. Low-latency hardware private circuits. In Heng Yin, Angelos Stavrou, Cas Cremers, and Elaine Shi, editors, Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, Los Angeles, CA, USA, November 7-11, 2022, pages 1799-1812. ACM, 2022. doi:10.1145/3548606.3559362.

[KMMS22] David Knichel, Amir Moradi, Nicolai Müller, and Pascal Sasdrich. Automated generation of masked hardware. IACR Trans. Cryptogr. Hardw. Embed. Syst., 2022(1):589-629, 2022. doi:10.46586/tches.v2022.i1.589-629.

[KSM20] David Knichel, Pascal Sasdrich, and Amir Moradi. SILVER - statistical independence and leakage verification. In Shiho Moriai and Huaxiong Wang, editors, Advances in Cryptology - ASIACRYPT 2020 - 26th International Conference on the Theory and Application of Cryptology and Information Security, Daejeon, South Korea, December 7-11, 2020, Proceedings, Part I, volume 12491 of Lecture Notes in Computer Science, pages 787-816. Springer, 2020. doi:10.1007/978-3-030-64837-4\_26.

[KSM22] David Knichel, Pascal Sasdrich, and Amir Moradi. Generic hardware private circuits towards automated generation of composable secure gadgets. IACR Trans. Cryptogr. Hardw. Embed. Syst., 2022(1):323-344, 2022. doi:10.46586/tches.v2022.i1.323-344.
[KSPS13] Paris Kitsos, Nicolas Sklavos, George Provelengios, and Athanassios N. Skodras. Fpga-based performance analysis of stream ciphers zuc, snow3g, grain v1, mickey v2, trivium and E0. *Microprocess. Microsystems*, 37(2):235-245, 2013. doi:10.1016/j.micpro.2012.09.007.

[KY10] Elif Bilge Kavun and Tolga Yalçin. A lightweight implementation of kecck hash function for radio-frequency identification applications. In Siddika Berna Örs Yalçin, editor, *Radio Frequency Identification: Security and Privacy Issues - 6th International Workshop, RFIDSec 2010, Istanbul, Turkey, June 8-9, 2010, Revised Selected Papers*, volume 6370 of *Lecture Notes in Computer Science*, pages 258-269. Springer, 2010. doi:10.1007/978-3-642-16822-2\_20.

[LBS22] Itamar Levi, Davide Bellizia, and François-Xavier Standaert. Tight-ES-TRNG: Improved Construction and Robustness Analysis. *SN Comput. Sci.*, 3(4):321, 2022. doi:10.1007/s42979-022-01219-5.

[LLL20] Bohan Li, Meicheng Liu, and Dongdai Lin. FPGA implementations of grain v1, mickey 2.0, trivium, lizard and plantlet. *Microprocess. Microsystems*, 78:103210, 2020. doi:10.1016/j.micpro.2020.103210.

[LMMR21] Gregor Leander, Thorben Moos, Amir Moradi, and Shahram Rasoolzadeh. The SPEEDY Family of Block Ciphers Engineering an Ultra Low-Latency Cipher from Gate Level for Secure Processor Architectures. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2021(4):510-545, 2021. doi:10.46586/tches.v2021.i4.510-545.

[MAM16] Vasily Mikhalev, Frederik Armknecht, and Christian Müller. On ciphers that continuously access the non-volatile key. *IACR Trans. Symmetric Cryptol.*, 2016(2):52-79, 2016. doi:10.13154/tosc.v2016.i2.52-79.

[MB07] Alexander Maximov and Alex Biryukov. Two trivial attacks on trivium. In Carlisle M. Adams, Ali Miri, and Michael J. Wiener, editors, *Selected Areas in Cryptography, 14th International Workshop, SAC 2007, Ottawa, Canada, August 16-17, 2007, Revised Selected Papers*, volume 4876 of *Lecture Notes in Computer Science*, pages 36-55. Springer, 2007. doi:10.1007/978-3-540-7360-3\_3.

[MCB+22] Awaleh Houssein Meraneh, Christophe Clavier, Hélène Le Bouder, Julien Maillard, and Gaël Thomas. Blind side channel on the elephant LFSR. In Sabrina De Capitani di Vimercati and Pierangela Samarati, editors, *Proceedings of the 19th International Conference on Security and Cryptography, SECRYPT 2022, Lisbon, Portugal, July 11-13, 2022*, pages 25-34. SCITEPRESS, 2022. doi:10.5220/0011135300003283.

[MCS22] Charles Momin, Gaëtan Cassiers, and François-Xavier Standaert. Handcrafting: Improving automated masking in hardware with manual optimizations. In Josep Balasch and Colin O'Flynn, editors, *Constructive Side-Channel Analysis and Secure Design - 13th International Workshop, COSADE 2022, Leuven, Belgium, April 11-12, 2022, Proceedings*, volume 13211 of *Lecture Notes in Computer Science*, pages 257-275. Springer, 2022. doi:10.1007/978-3-030-99766-3\_12.

[MM22] Nicolai Müller and Amir Moradi. PROLEAD A probing-based hardware leakage detection tool. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2022(4):311-348, 2022. doi:10.46586/tches.v2022.i4.311-348.
[MMSS19] Thorben Moos, Amir Moradi, Tobias Schneider, and François-Xavier Standaert. Glitch-resistant masking revisited or why proofs in the robust probing model are needed. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2019(2):256-292, 2019. doi:10.13154/tches.v2019.i2.256-292.

[MMW18] Lauren De Meyer, Amir Moradi, and Felix Wegener. Spin me right round rotational symmetry for fpga-specific AES. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2018(3):596-626, 2018. doi:10.13154/tches.v2018.i3.596-626.

[Moo19] Thorben Moos. Static power SCA of sub-100 nm CMOS asics and the insecurity of masking schemes in low-noise environments. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2019(3):202-232, 2019. doi:10.13154/tches.v2019.i3.202-232.

[MPG05] Stefan Mangard, Thomas Popp, and Berndt M. Gammel. Side-channel leakage of masked CMOS gates. In Alfred Menezes, editor, *Topics in Cryptology - CT-RSA 2005, The Cryptographers' Track at the RSA Conference 2005, San Francisco, CA, USA, February 14-18, 2005, Proceedings*, volume 3376 of *Lecture Notes in Computer Science*, pages 351-365. Springer, 2005. doi:10.1007/978-3-540-30574-3\_24.

[MRB18] Lauren De Meyer, Oscar Reparaz, and Begül Bilgin. Multiplicative masking for AES in hardware. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2018(3):431-468, 2018. doi:10.13154/tches.v2018.i3.431-468.

[MS11] Marcel Medwed and François-Xavier Standaert. Extractors against side-channel attacks: weak or strong? *J. Cryptogr. Eng.*, 1(3):231-241, 2011. URL: https://doi.org/10.1007/s13389-011-0014-y, doi:10.1007/S13389-011-0014-Y.

[NRR06] Svetla Nikova, Christian Rechberger, and Vincent Rijmen. Threshold implementations against side-channel attacks and glitches. In Peng Ning, Sihan Qing, and Ninghui Li, editors, *Information and Communications Security, 8th International Conference, ICICS 2006, Raleigh, NC, USA, December 4-7, 2006, Proceedings*, volume 4307 of *Lecture Notes in Computer Science*, pages 529-545. Springer, 2006. doi:10.1007/11935308\_38.

[NRS08] Svetla Nikova, Vincent Rijmen, and Martin Schläffer. Secure hardware implementation of non-linear functions in the presence of glitches. In Pil Joong Lee and Jung Hee Cheon, editors, *Information Security and Cryptology - ICISC 2008, 11th International Conference, Seoul, Korea, December 3-5, 2008, Revised Selected Papers*, volume 5461 of *Lecture Notes in Computer Science*, pages 218-234. Springer, 2008. doi:10.1007/978-3-642-00730-9\_14.

[oEiCE04] European Network of Excellence in Cryptology (ECRYPT). estream: the ecrypt stream cipher project, 2004. URL: https://www.ecrypt.eu.org/stream.

[OGL05] Sean O'Neil, Benjamin Gittins, and Howard Landman. Vest - hardware-dedicated stream ciphers, 2005. URL: https://www.ecrypt.eu.org/stream/ciphers/vest/vest.pdf.

[oSN17] National Institute of Standards and Technology (NIST). Lightweight cryptography, 2017. URL: https://csrc.nist.gov/Projects/lightweight-cryptography.
[PMB+16] Oto Petura, Ugo Mureddu, Nathalie Bochard, Viktor Fischer, and Lilian Bossuet. A survey of AIS-20/31 compliant TRNG cores suitable for FPGA devices. In Paolo Ienne, Walid A. Najjar, Jason Helge Anderson, Philip Brisk, and Walter Stechele, editors, *26th International Conference on Field Programmable Logic and Applications, FPL 2016, Lausanne, Switzerland, August 29 - September 2, 2016*, pages 1-10. IEEE, 2016. doi:10.1109/FPL.2016.7577379.

[PP10] Christof Paar and Jan Pelzl. *Understanding Cryptography - A Textbook for Students and Practitioners*. Springer, 2010. doi:10.1007/978-3-642-04101-3.

[PR13] Emmanuel Prouff and Matthieu Rivain. Masking against side-channel attacks: A formal security proof. In Thomas Johansson and Phong Q. Nguyen, editors, *Advances in Cryptology - EUROCRYPT 2013, 32nd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Athens, Greece, May 26-30, 2013. Proceedings*, volume 7881 of Lecture Notes in Computer Science, pages 142-159. Springer, 2013. doi:10.1007/978-3-642-38348-9_9.

[PYR+16] Stjepan Picek, Bohan Yang, Vladimir Rozic, Jo Vliegen, Jori Winderickx, Thomas De Cnudde, and Nele Mentens. PRNGs for Masking Applications and Their Mapping to Evolvable Hardware. In Kerstin Lemke-Rust and Michael Tunstall, editors, *Smart Card Research and Advanced Applications - 15th International Conference, CARDIS 2016, Cannes, France, November 7-9, 2016, Revised Selected Papers*, volume 10146 of Lecture Notes in Computer Science, pages 209-227. Springer, 2016. doi:10.1007/978-3-319-54669-8_13.

[Rad06] Havard Raddum. Cryptanalytic results on trivium. eSTREAM, ECRYPT Stream Cipher Project, Report 2006/039, 2006. URL: http://www.ecrypt.eu.org/stream/papersdir/2006/039.ps.

[RBN+15] Oscar Reparaz, Begül Bilgin, Svetla Nikova, Benedikt Gierlichs, and Ingrid Verbauwhede. Consolidating masking schemes. In Rosario Gennaro and Matthew Robshaw, editors, *Advances in Cryptology - CRYPTO 2015 - 35th Annual Cryptology Conference, Santa Barbara, CA, USA, August 16-20, 2015, Proceedings, Part I*, volume 9215 of Lecture Notes in Computer Science, pages 764-783. Springer, 2015. doi:10.1007/978-3-662-47989-6_37.

[Rep15] Oscar Reparaz. A note on the security of higher-order threshold implementations. IACR Cryptol. ePrint Arch., page 1, 2015. URL: http://eprint.iacr.org/2015/001.

[Rog07] Marcin Rogawski. Hardware evaluation of estream candidates: Grain, lex, mickey128, salsa20 and trivium, 2007. URL: https://www.ecrypt.eu.org/stream/papersdir/2007/025.pdf.

[RSV09] Mathieu Renauld, François-Xavier Standaert, and Nicolas Veyrat-Charvillon. Algebraic side-channel attacks on the AES: why time also matters in DPA. In Christophe Clavier and Kris Gaj, editors, *Cryptographic Hardware and Embedded Systems - CHES 2009, 11th International Workshop, Lausanne, Switzerland, September 6-9, 2009, Proceedings*, volume 5747 of Lecture Notes in Computer Science, pages 97-111. Springer, 2009. doi:10.1007/978-3-642-404138-9_8.
[SBHM20] Pascal Sasdrich, Begül Bilgin, Michael Hutter, and Mark E. Marson. Low-latency hardware masking with application to AES. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2020(2):300-326, 2020. doi:10.13154/tches.v2020.i2.300-326.

[Sch96] Bruce Schneier. *Applied cryptography - protocols, algorithms, and source code in C, 2nd Edition*. Wiley, 1996. URL: https://www.worldcat.org/oclc/32311687.

[SM15] Tobias Schneider and Amir Moradi. Leakage Assessment Methodology - A Clear Roadmap for Side-Channel Evaluations. In Tim Güneysu and Helena Handschuh, editors, *Cryptographic Hardware and Embedded Systems - CHES 2015 - 17th International Workshop, Saint-Malo, France, September 13-16, 2015, Proceedings*, volume 9293 of *Lecture Notes in Computer Science*, pages 495-513. Springer, 2015. doi:10.1007/978-3-662-48324-4\_25.

[SM21] Aein Rezaei Shahmirzadi and Amir Moradi. Second-order SCA security with almost no fresh randomness. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2021(3):708-755, 2021. doi:10.46586/tches.v2021.i3.708-755.

[SNO] Specification of the 3gpp confidentiality and integrity algorithms uea2 & uia2. document 2: Snow 3g specification. https://www.gsma.com/aboutus/wp-content/uploads/2014/12/snow3gspec.pdf. Accessed: 2024-01-08.

[SPY+10] François-Xavier Standaert, Olivier Pereira, Yu Yu, Jean-Jacques Quisquater, Moti Yung, and Elisabeth Oswald. Leakage resilient cryptography in practice. In Ahmad-Reza Sadeghi and David Naccache, editors, *Towards Hardware-Intrinsic Security - Foundations and Practice*, Information Security and Cryptography, pages 99-134. Springer, 2010. doi:10.1007/978-3-642-14452-3\_5.

[SSD19] Shravani Shahapure, Virendra Sule, and Rohin D. Daruwala. Internal state recovery attack on stream ciphers: Breaking BIVIUM. In Shivam Bhasin, Avi Mendelson, and Mridul Nandi, editors, *Security, Privacy, and Applied Cryptography Engineering - 9th International Conference, SPACE 2019, Gandhinagar, India, December 3-7, 2019, Proceedings*, volume 11947 of *Lecture Notes in Computer Science*, pages 34-49. Springer, 2019. doi:10.1007/978-3-030-35869-3\_5.

[TIM+18] Yosuke Todo, Takanori Isobe, Willi Meier, Kazumaro Aoki, and Bin Zhang. Fast correlation attack revisited - cryptanalysis on full grain-128a, grain-128, and grain-v1. In Hovav Shacham and Alexandra Boldyreva, editors, *Advances in Cryptology - CRYPTO 2018 - 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19-23, 2018, Proceedings, Part II*, volume 10992 of *Lecture Notes in Computer Science*, pages 129-159. Springer, 2018. doi:10.1007/978-3-319-96881-0\_5.

[UHM+20] Rei Ueno, Naofumi Homma, Sumio Morioka, Noriyuki Miura, Kohei Matsuda, Makoto Nagata, Shivam Bhasin, Yves Mathieu, Tarik Graba, and Jean-Luc Danger. High throughput/gate AES hardware architectures based on datapath compression. *IEEE Trans. Computers*, 69(4):534-548, 2020. doi:10.1109/TC.2019.2957355.

[WSLM05] Doug Whiting, Bruce Schneier, Stefan Lucks, and Frederic Muller. Phelix: Fast encryption and authentication in a single cryptographic primitive, 2005. URL: https://www.ecrypt.eu.org/stream/p2ciphers/phelix/phelix_p2.pdf.
[YE13] Xin Ye and Thomas Eisenbarth. On the vulnerability of low entropy masking schemes. In Aurélien Francillon and Pankaj Rohatgi, editors, *Smart Card Research and Advanced Applications - 12th International Conference, CARDIS 2013, Berlin, Germany, November 27-29, 2013. Revised Selected Papers*, volume 8419 of *Lecture Notes in Computer Science*, pages 44–60. Springer, 2013. doi:10.1007/978-3-319-08302-5\_4.

[YRG+18] Bohan Yang, Vladimir Rozic, Milos Grujic, Nele Mentens, and Ingrid Verbauwhede. ES-TRNG: A High-throughput, Low-area True Random Number Generator based on Edge Sampling. *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, 2018(3):267–292, 2018. doi:10.13154/tches.v2018.i3.267-292.

[YSPY10] Yu Yu, François-Xavier Standaert, Olivier Pereira, and Moti Yung. Practical leakage-resilient pseudorandom generators. In Ehab Al-Shaer, Angelos D. Keromytis, and Vitaly Shmatikov, editors, *Proceedings of the 17th ACM Conference on Computer and Communications Security, CCS 2010, Chicago, Illinois, USA, October 4-8, 2010*, pages 141–151. ACM, 2010. doi:10.1145/1866307.1866324.

[ZUC] Specification of the 3gpp confidentiality and integrity algorithms 128-eea3 & 128-eia3. document 2: Zuc specification. https://www.gsma.com/aboutus/w p-content/uploads/2014/12/eea3eia3zucv16.pdf. Accessed: 2024-01-08.
A Extended performance comparison

<table><caption>**Table 6:** Comparison of the critical path delay of relevant building blocks when synthesized for maximum operating frequency.</caption><thead><tr><th rowspan="3">Primitive</th><th rowspan="3">pip.</th><th colspan="4">Critical Path [ns]</th></tr><tr><th colspan="2">Commercial Foundry</th><th colspan="2">NanGate OCL</th></tr><tr><th>90 nm LP</th><th>65 nm LP</th><th>45 nm</th><th>15 nm</th></tr></thead><tbody><tr><td>ES-TRNG</td><td></td><td>0.181586</td><td>0.135803</td><td>0.208436</td><td>0.021313</td></tr><tr><td>LFSR64</td><td></td><td>0.198822</td><td>0.155045</td><td>0.169445</td><td>0.014804</td></tr><tr><td>LFSR64_X32</td><td></td><td>0.195796</td><td>0.157433</td><td>0.197540</td><td>0.017748</td></tr><tr><td>LFSR64_X64</td><td></td><td>0.318669</td><td>0.224628</td><td>0.249999</td><td>0.022856</td></tr><tr><td>LFSR64_X96</td><td></td><td>0.311533</td><td>0.219201</td><td>0.242679</td><td>0.022425</td></tr><tr><td>LFSR64_X128</td><td></td><td>0.346743</td><td>0.265965</td><td>0.329463</td><td>0.028568</td></tr><tr><td>F-LFSR-GrainV1_80</td><td></td><td>0.330864</td><td>0.236224</td><td>0.301292</td><td>0.025280</td></tr><tr><td>F-LFSR-GrainV1_80_X16</td><td></td><td>0.379382</td><td>0.279218</td><td>0.302846</td><td>0.029794</td></tr><tr><td>F-LFSR-GrainV1_80_X32</td><td></td><td>0.579904</td><td>0.456821</td><td>0.499251</td><td>0.049750</td></tr><tr><td>F-LFSR-GrainV1_128</td><td></td><td>0.354693</td><td>0.248964</td><td>0.309799</td><td>0.030301</td></tr><tr><td>F-LFSR-GrainV1_128_X16</td><td></td><td>0.354076</td><td>0.254165</td><td>0.316051</td><td>0.030632</td></tr><tr><td>F-LFSR-GrainV1_128_X32</td><td></td><td>0.403878</td><td>0.244791</td><td>0.337708</td><td>0.029548</td></tr><tr><td>Bivium</td><td></td><td>0.217899</td><td>0.134968</td><td>0.194500</td><td>0.016976</td></tr><tr><td>Bivium_X32</td><td></td><td>0.195342</td><td>0.165267</td><td>0.218067</td><td>0.019418</td></tr><tr><td>Bivium_X48</td><td></td><td>0.242034</td><td>0.168228</td><td>0.192918</td><td>0.019445</td></tr><tr><td>Bivium_X64</td><td></td><td>0.236545</td><td>0.174493</td><td>0.223668</td><td>0.018651</td></tr><tr><td>Bivium_X72</td><td></td><td>0.378802</td><td>0.276818</td><td>0.328879</td><td>0.028219</td></tr><tr><td>Trivium</td><td></td><td>0.217623</td><td>0.118064</td><td>0.194513</td><td>0.016977</td></tr><tr><td>Trivium_X32</td><td></td><td>0.186734</td><td>0.180408</td><td>0.205709</td><td>0.020549</td></tr><tr><td>Trivium_X48</td><td></td><td>0.249180</td><td>0.166565</td><td>0.222982</td><td>0.018831</td></tr><tr><td>Trivium_X64</td><td></td><td>0.243608</td><td>0.173686</td><td>0.205199</td><td>0.018959</td></tr><tr><td>Trivium_X72</td><td></td><td>0.380121</td><td>0.274877</td><td>0.281385</td><td>0.028132</td></tr><tr><td>Kreyvium</td><td></td><td>0.279769</td><td>0.205444</td><td>0.234201</td><td>0.021628</td></tr><tr><td>Kreyvium_X32</td><td></td><td>0.291147</td><td>0.207658</td><td>0.241899</td><td>0.020947</td></tr><tr><td>Kreyvium_X48</td><td></td><td>0.280961</td><td>0.208351</td><td>0.237580</td><td>0.021515</td></tr><tr><td>Kreyvium_X64</td><td></td><td>0.272732</td><td>0.209060</td><td>0.266117</td><td>0.022508</td></tr><tr><td>Kreyvium_X72</td><td></td><td>0.396187</td><td>0.282755</td><td>0.332073</td><td>0.033164</td></tr><tr><td>GrainV1_80</td><td></td><td>0.552327</td><td>0.351267</td><td>0.431476</td><td>0.040580</td></tr><tr><td>GrainV1_80_X8</td><td></td><td>0.518995</td><td>0.406393</td><td>0.495407</td><td>0.044568</td></tr><tr><td>GrainV1_80_X16</td><td></td><td>0.559680</td><td>0.407079</td><td>0.565964</td><td>0.050532</td></tr><tr><td>GrainV1_80_X32</td><td></td><td>0.967295</td><td>0.788402</td><td>0.885287</td><td>0.089198</td></tr><tr><td>GrainV1_128</td><td></td><td>0.475218</td><td>0.322891</td><td>0.419144</td><td>0.039935</td></tr><tr><td>GrainV1_128_X16</td><td></td><td>0.503052</td><td>0.359735</td><td>0.472844</td><td>0.043818</td></tr><tr><td>GrainV1_128_X32</td><td></td><td>0.485202</td><td>0.341568</td><td>0.452880</td><td>0.044034</td></tr><tr><td>GrainV1_128_X48</td><td></td><td>0.769497</td><td>0.549393</td><td>0.705566</td><td>0.071954</td></tr><tr><td>MICKEY2_80</td><td></td><td>0.356980</td><td>0.234147</td><td>0.318378</td><td>0.033913</td></tr><tr><td>MICKEY2_80_X2</td><td></td><td>0.565007</td><td>0.385819</td><td>0.561346</td><td>0.057637</td></tr><tr><td>MICKEY2_80_X4</td><td></td><td>0.994678</td><td>0.747549</td><td>0.967886</td><td>0.096524</td></tr><tr><td>MICKEY2_80_X32</td><td></td><td>9.098467</td><td>6.634537</td><td>9.621321</td><td>0.897338</td></tr><tr><td>MICKEY2_128</td><td></td><td>0.357516</td><td>0.267185</td><td>0.319032</td><td>0.039074</td></tr><tr><td>MICKEY2_128_X2</td><td></td><td>0.630560</td><td>0.451635</td><td>0.605333</td><td>0.060051</td></tr><tr><td>MICKEY2_128_X4</td><td></td><td>1.159020</td><td>0.845300</td><td>1.085925</td><td>0.114799</td></tr><tr><td>MICKEY2_128_X32</td><td></td><td>10.208649</td><td>7.354148</td><td>10.711792</td><td>1.041437</td></tr><tr><td>Gimli-8</td><td>✓</td><td>1.619769</td><td>1.175962</td><td>1.527335</td><td>0.148707</td></tr><tr><td>Gimli-16</td><td>✓</td><td>0.339260</td><td>0.287740</td><td>0.316472</td><td>0.029309</td></tr><tr><td>Gimli-24</td><td>✓</td><td>2.894987</td><td>2.071035</td><td>2.758774</td><td>0.274899</td></tr><tr><td></td><td></td><td>0.356307</td><td>0.264966</td><td>0.337362</td><td>0.029584</td></tr><tr><td></td><td></td><td>4.385863</td><td>3.127366</td><td>4.383278</td><td>0.421443</td></tr><tr><td></td><td></td><td>0.360362</td><td>0.266396</td><td>0.324092</td><td>0.029630</td></tr><tr><td>Subterranean2</td><td></td><td>0.405738</td><td>0.287102</td><td>0.406284</td><td>0.034361</td></tr><tr><td>Subterranean2_X2</td><td></td><td>0.722609</td><td>0.531270</td><td>0.719394</td><td>0.069042</td></tr><tr><td>Subterranean2_X4</td><td></td><td>1.366440</td><td>0.995288</td><td>1.351147</td><td>0.130649</td></tr><tr><td>Subterranean2_X8</td><td></td><td>2.635188</td><td>1.955079</td><td>2.662149</td><td>0.258758</td></tr><tr><td>SPEEDY-2-192</td><td>✓</td><td>1.119609</td><td>0.806595</td><td>1.167997</td><td>0.110700</td></tr><tr><td>SPEEDY-3-192</td><td>✓</td><td>0.729113</td><td>0.521127</td><td>0.725931</td><td>0.066281</td></tr><tr><td>SPEEDY-4-192</td><td>✓</td><td>1.733313</td><td>1.257028</td><td>1.842109</td><td>0.173992</td></tr><tr><td>SPEEDY-5-192</td><td>✓</td><td>0.737364</td><td>0.528380</td><td>0.728356</td><td>0.068753</td></tr><tr><td></td><td></td><td>2.376308</td><td>1.709736</td><td>2.549025</td><td>0.237866</td></tr><tr><td></td><td></td><td>0.737837</td><td>0.521994</td><td>0.742094</td><td>0.069379</td></tr><tr><td></td><td></td><td>2.994643</td><td>2.178075</td><td>3.187368</td><td>0.300466</td></tr><tr><td></td><td></td><td>0.745205</td><td>0.520147</td><td>0.722302</td><td>0.070076</td></tr></tbody></table>
<table><caption>**Table 7:** Comparison of the area consumption of relevant building blocks when synthesized for maximum operating frequency.</caption><thead><tr><th rowspan="3">Primitive</th><th rowspan="3">pip.</th><th colspan="4">Area [GE]</th></tr><tr><th colspan="2">Commercial Foundry</th><th colspan="2">NanGate OCL</th></tr><tr><th>90 nm LP</th><th>65 nm LP</th><th>45 nm</th><th>15 nm</th></tr></thead><tbody><tr><td>ES-TRNG</td><td></td><td>306.25</td><td>297.00</td><td>237.00</td><td>273.00</td></tr><tr><td>LFSR64</td><td></td><td>465.50</td><td>496.75</td><td>502.67</td><td>635.75</td></tr><tr><td>LFSR64_X32</td><td></td><td>710.00</td><td>764.50</td><td>741.33</td><td>756.25</td></tr><tr><td>LFSR64_X64</td><td></td><td>903.50</td><td>954.25</td><td>830.33</td><td>915.50</td></tr><tr><td>LFSR64_X96</td><td></td><td>1045.25</td><td>1097.25</td><td>1020.67</td><td>1293.00</td></tr><tr><td>LFSR64_X128</td><td></td><td>1284.25</td><td>1288.50</td><td>1169.33</td><td>1588.25</td></tr><tr><td>F-LFSR-GrainV1_80</td><td></td><td>605.00</td><td>600.75</td><td>657.33</td><td>825.75</td></tr><tr><td>F-LFSR-GrainV1_80_X16</td><td></td><td>1100.50</td><td>1182.25</td><td>1150.33</td><td>1247.50</td></tr><tr><td>F-LFSR-GrainV1_80_X32</td><td></td><td>1741.25</td><td>1637.75</td><td>1648.33</td><td>1934.50</td></tr><tr><td>F-LFSR-GrainV1_128</td><td></td><td>976.00</td><td>976.50</td><td>1043.33</td><td>1275.00</td></tr><tr><td>F-LFSR-GrainV1_128_X16</td><td></td><td>1733.50</td><td>1848.75</td><td>1571.33</td><td>1746.25</td></tr><tr><td>F-LFSR-GrainV1_128_X32</td><td></td><td>2082.50</td><td>2472.75</td><td>1969.33</td><td>2269.25</td></tr><tr><td>Bivium</td><td></td><td>1266.25</td><td>1381.25</td><td>1450.67</td><td>1730.00</td></tr><tr><td>Bivium_X32</td><td></td><td>2310.75</td><td>2487.25</td><td>2050.67</td><td>2386.00</td></tr><tr><td>Bivium_X48</td><td></td><td>2624.25</td><td>2945.75</td><td>2315.33</td><td>2546.75</td></tr><tr><td>Bivium_X64</td><td></td><td>3019.00</td><td>3410.50</td><td>2607.67</td><td>2830.50</td></tr><tr><td>Bivium_X72</td><td></td><td>2840.75</td><td>2865.00</td><td>2684.67</td><td>3150.50</td></tr><tr><td>Trivium</td><td></td><td>1950.50</td><td>2080.25</td><td>2348.33</td><td>2649.50</td></tr><tr><td>Trivium_X32</td><td></td><td>3341.00</td><td>3834.25</td><td>3322.00</td><td>3777.50</td></tr><tr><td>Trivium_X48</td><td></td><td>3961.75</td><td>4560.75</td><td>3734.67</td><td>4195.50</td></tr><tr><td>Trivium_X64</td><td></td><td>4460.50</td><td>4994.00</td><td>4023.67</td><td>4483.75</td></tr><tr><td>Trivium_X72</td><td></td><td>4458.50</td><td>4388.00</td><td>4158.33</td><td>4825.25</td></tr><tr><td>Kreyvium</td><td></td><td>3641.25</td><td>3924.00</td><td>4193.00</td><td>5016.00</td></tr><tr><td>Kreyvium_X32</td><td></td><td>5099.25</td><td>5614.00</td><td>5582.67</td><td>6535.00</td></tr><tr><td>Kreyvium_X48</td><td></td><td>5780.75</td><td>6295.00</td><td>6013.00</td><td>6848.75</td></tr><tr><td>Kreyvium_X64</td><td></td><td>6318.00</td><td>6763.25</td><td>6376.00</td><td>7324.75</td></tr><tr><td>Kreyvium_X72</td><td></td><td>6543.50</td><td>6658.25</td><td>6747.33</td><td>7437.75</td></tr><tr><td>GrainV1_80</td><td></td><td>1236.75</td><td>1409.25</td><td>1466.67</td><td>1662.25</td></tr><tr><td>GrainV1_80_X8</td><td></td><td>2411.75</td><td>2508.00</td><td>2216.00</td><td>2592.00</td></tr><tr><td>GrainV1_80_X16</td><td></td><td>3455.00</td><td>3618.75</td><td>3130.33</td><td>3643.00</td></tr><tr><td>GrainV1_80_X32</td><td></td><td>5687.50</td><td>5779.00</td><td>5050.00</td><td>5841.25</td></tr><tr><td>GrainV1_128</td><td></td><td>1937.75</td><td>2086.25</td><td>2183.00</td><td>2544.50</td></tr><tr><td>GrainV1_128_X16</td><td></td><td>3732.25</td><td>3879.50</td><td>3470.33</td><td>4004.00</td></tr><tr><td>GrainV1_128_X32</td><td></td><td>5314.25</td><td>5880.50</td><td>5048.67</td><td>5555.753</td></tr><tr><td>GrainV1_128_X48</td><td></td><td>7003.25</td><td>7294.25</td><td>6076.67</td><td>7037.25</td></tr><tr><td>MICKEY2_80</td><td></td><td>2288.00</td><td>2363.25</td><td>2258.33</td><td>2611.50</td></tr><tr><td>MICKEY2_80_X2</td><td></td><td>3660.75</td><td>3600.00</td><td>3214.67</td><td>3775.50</td></tr><tr><td>MICKEY2_80_X4</td><td></td><td>6475.00</td><td>6410.50</td><td>5415.00</td><td>6253.00</td></tr><tr><td>MICKEY2_80_X32</td><td></td><td>62447.25</td><td>62259.50</td><td>48821.67</td><td>55493.00</td></tr><tr><td>MICKEY2_128</td><td></td><td>3594.00</td><td>3872.00</td><td>3542.33</td><td>4097.25</td></tr><tr><td>MICKEY2_128_X2</td><td></td><td>5520.50</td><td>5418.50</td><td>5068.00</td><td>5945.25</td></tr><tr><td>MICKEY2_128_X4</td><td></td><td>9591.25</td><td>9539.75</td><td>8320.67</td><td>9671.25</td></tr><tr><td>MICKEY2_128_X32</td><td></td><td>94555.25</td><td>95573.00</td><td>76321.67</td><td>85654.50</td></tr><tr><td>Gimli-8</td><td>✓</td><td>27505.00</td><td>30970.50</td><td>19582.33</td><td>23870.00</td></tr><tr><td>Gimli-16</td><td>✓</td><td>26474.00</td><td>30086.75</td><td>24636.67</td><td>27280.00</td></tr><tr><td>Gimli-24</td><td>✓</td><td>53388.50</td><td>61880.75</td><td>32578.33</td><td>38078.50</td></tr><tr><td>Subterranean2</td><td></td><td>52309.25</td><td>60988.25</td><td>47771.33</td><td>53210.00</td></tr><tr><td>Subterranean2_X2</td><td></td><td>5526.25</td><td>6244.75</td><td>5045.67</td><td>5945.25</td></tr><tr><td>Subterranean2_X4</td><td></td><td>9391.75</td><td>10550.50</td><td>8504.33</td><td>9991.50</td></tr><tr><td>Subterranean2_X8</td><td></td><td>17274.00</td><td>18951.25</td><td>13559.00</td><td>16087.75</td></tr><tr><td>SPEEDY-2-192</td><td>✓</td><td>16443.00</td><td>18983.25</td><td>10792.67</td><td>12859.25</td></tr><tr><td>SPEEDY-3-192</td><td>✓</td><td>13344.00</td><td>14274.50</td><td>10827.67</td><td>11939.50</td></tr><tr><td>SPEEDY-4-192</td><td>✓</td><td>26658.50</td><td>31058.75</td><td>16391.67</td><td>19988.00</td></tr><tr><td>SPEEDY-5-192</td><td>✓</td><td>20808.25</td><td>21642.00</td><td>17287.33</td><td>20742.75</td></tr></tbody></table>
<table><caption>**Table 8:** Comparison of the power consumption of relevant building blocks when synthesized for maximum operating frequency, estimated for 100 MHz operation.</caption><thead><tr><th rowspan="3">Primitive</th><th rowspan="3">pip.</th><th colspan="4">Power [mW]</th></tr><tr><th colspan="2">Commercial Foundry</th><th colspan="2">NanGate OCL</th></tr><tr><th>90 nm LP</th><th>65 nm LP</th><th>45 nm</th><th>15 nm</th></tr></thead><tbody><tr><td>ES-TRNG</td><td></td><td>0.0382</td><td>0.0219</td><td>0.0220</td><td>0.0074</td></tr><tr><td>LFSR64</td><td></td><td>0.1782</td><td>0.1054</td><td>0.0531</td><td>0.0252</td></tr><tr><td>LFSR64_X32</td><td></td><td>0.2241</td><td>0.1325</td><td>0.0881</td><td>0.0301</td></tr><tr><td>LFSR64_X64</td><td></td><td>0.2564</td><td>0.1556</td><td>0.1058</td><td>0.0360</td></tr><tr><td>LFSR64_X96</td><td></td><td>0.2708</td><td>0.1675</td><td>0.1311</td><td>0.0465</td></tr><tr><td>LFSR64_X128</td><td></td><td>0.3007</td><td>0.1853</td><td>0.1516</td><td>0.0581</td></tr><tr><td>F-LFSR-GrainV1_80</td><td></td><td>0.2260</td><td>0.1120</td><td>0.0703</td><td>0.0329</td></tr><tr><td>F-LFSR-GrainV1_80_X16</td><td></td><td>0.3051</td><td>0.1821</td><td>0.1408</td><td>0.0471</td></tr><tr><td>F-LFSR-GrainV1_80_X32</td><td></td><td>0.4175</td><td>0.2274</td><td>0.2165</td><td>0.0743</td></tr><tr><td>F-LFSR-GrainV1_128</td><td></td><td>0.3602</td><td>0.1953</td><td>0.1125</td><td>0.0508</td></tr><tr><td>F-LFSR-GrainV1_128_X16</td><td></td><td>0.4914</td><td>0.3010</td><td>0.1972</td><td>0.0668</td></tr><tr><td>F-LFSR-GrainV1_128_X32</td><td></td><td>0.5526</td><td>0.3656</td><td>0.2516</td><td>0.0852</td></tr><tr><td>Bivium</td><td></td><td>0.4833</td><td>0.2529</td><td>0.1618</td><td>0.0681</td></tr><tr><td>Bivium_X32</td><td></td><td>0.6458</td><td>0.4078</td><td>0.2550</td><td>0.0902</td></tr><tr><td>Bivium_X48</td><td></td><td>0.7168</td><td>0.4558</td><td>0.2910</td><td>0.0990</td></tr><tr><td>Bivium_X64</td><td></td><td>0.7872</td><td>0.5110</td><td>0.3310</td><td>0.1086</td></tr><tr><td>Bivium_X72</td><td></td><td>0.7304</td><td>0.4166</td><td>0.3406</td><td>0.1193</td></tr><tr><td>Trivium</td><td></td><td>0.7157</td><td>0.3991</td><td>0.2776</td><td>0.0974</td></tr><tr><td>Trivium_X32</td><td></td><td>0.9599</td><td>0.5950</td><td>0.4127</td><td>0.1439</td></tr><tr><td>Trivium_X48</td><td></td><td>1.0750</td><td>0.6864</td><td>0.4704</td><td>0.1583</td></tr><tr><td>Trivium_X64</td><td></td><td>1.1559</td><td>0.7276</td><td>0.5108</td><td>0.1705</td></tr><tr><td>Trivium_X72</td><td></td><td>1.1301</td><td>0.6370</td><td>0.5299</td><td>0.1859</td></tr><tr><td>Kreyvium</td><td></td><td>1.4335</td><td>0.7247</td><td>0.4449</td><td>0.2018</td></tr><tr><td>Kreyvium_X32</td><td></td><td>1.6782</td><td>0.9694</td><td>0.6799</td><td>0.2571</td></tr><tr><td>Kreyvium_X48</td><td></td><td>1.7909</td><td>1.0446</td><td>0.7525</td><td>0.2730</td></tr><tr><td>Kreyvium_X64</td><td></td><td>1.8916</td><td>1.0999</td><td>0.8017</td><td>0.2923</td></tr><tr><td>Kreyvium_X72</td><td></td><td>1.9194</td><td>1.0440</td><td>0.8620</td><td>0.2986</td></tr><tr><td>GrainV1_80</td><td></td><td>0.4479</td><td>0.2424</td><td>0.1742</td><td>0.0661</td></tr><tr><td>GrainV1_80_X8</td><td></td><td>0.6472</td><td>0.3750</td><td>0.2829</td><td>0.0998</td></tr><tr><td>GrainV1_80_X16</td><td></td><td>0.8222</td><td>0.4983</td><td>0.4107</td><td>0.1387</td></tr><tr><td>GrainV1_80_X32</td><td></td><td>1.2170</td><td>0.7298</td><td>0.7144</td><td>0.2369</td></tr><tr><td>GrainV1_128</td><td></td><td>0.7005</td><td>0.3705</td><td>0.2532</td><td>0.1016</td></tr><tr><td>GrainV1_128_X16</td><td></td><td>1.0080</td><td>0.5954</td><td>0.4455</td><td>0.1554</td></tr><tr><td>GrainV1_128_X32</td><td></td><td>1.2855</td><td>0.8108</td><td>0.6683</td><td>0.2167</td></tr><tr><td>GrainV1_128_X48</td><td></td><td>1.5699</td><td>0.9661</td><td>0.8331</td><td>0.2785</td></tr><tr><td>MICKEY2_80</td><td></td><td>0.6057</td><td>0.3425</td><td>0.2700</td><td>0.0942</td></tr><tr><td>MICKEY2_80_X2</td><td></td><td>0.8498</td><td>0.4772</td><td>0.3981</td><td>0.1399</td></tr><tr><td>MICKEY2_80_X4</td><td></td><td>1.3253</td><td>0.7962</td><td>0.7055</td><td>0.2344</td></tr><tr><td>MICKEY2_80_X32</td><td></td><td>18.3180</td><td>11.7230</td><td>11.9660</td><td>3.5713</td></tr><tr><td>MICKEY2_128</td><td></td><td>0.9650</td><td>0.5482</td><td>0.4274</td><td>0.1536</td></tr><tr><td>MICKEY2_128_X2</td><td></td><td>1.2706</td><td>0.7234</td><td>0.6327</td><td>0.2212</td></tr><tr><td>MICKEY2_128_X4</td><td></td><td>1.9906</td><td>1.1607</td><td>1.1222</td><td>0.3654</td></tr><tr><td>MICKEY2_128_X32</td><td></td><td>26.8160</td><td>17.6274</td><td>18.8430</td><td>5.6178</td></tr><tr><td>Gimli-8</td><td>✓</td><td>8.0824</td><td>5.5274</td><td>4.1302</td><td>1.4268</td></tr><tr><td>Gimli-16</td><td>✓</td><td>9.8002</td><td>6.1129</td><td>4.5818</td><td>1.5078</td></tr><tr><td>Gimli-16</td><td>✓</td><td>13.4989</td><td>9.8060</td><td>6.4017</td><td>2.0360</td></tr><tr><td>Gimli-24</td><td>✓</td><td>18.1331</td><td>11.7633</td><td>8.8154</td><td>2.8464</td></tr><tr><td>Gimli-24</td><td>✓</td><td>17.4224</td><td>13.0373</td><td>9.7293</td><td>2.9185</td></tr><tr><td>Gimli-24</td><td>✓</td><td>26.6511</td><td>17.3752</td><td>13.1350</td><td>4.2043</td></tr><tr><td>Subterranean2</td><td></td><td>0.8247</td><td>0.5043</td><td>0.3999</td><td>0.1492</td></tr><tr><td>Subterranean2_X2</td><td></td><td>1.1644</td><td>0.7594</td><td>0.6346</td><td>0.2423</td></tr><tr><td>Subterranean2_X4</td><td></td><td>2.8752</td><td>1.9857</td><td>1.6683</td><td>0.5661</td></tr><tr><td>Subterranean2_X8</td><td></td><td>9.3689</td><td>7.1013</td><td>5.2655</td><td>1.7625</td></tr><tr><td>SPEEDY-2-192</td><td>✓</td><td>4.6353</td><td>3.0388</td><td>1.9893</td><td>0.7162</td></tr><tr><td>SPEEDY-3-192</td><td>✓</td><td>3.8586</td><td>2.3635</td><td>1.9718</td><td>0.5813</td></tr><tr><td>SPEEDY-4-192</td><td>✓</td><td>7.3420</td><td>5.0057</td><td>3.0958</td><td>1.1275</td></tr><tr><td>SPEEDY-4-192</td><td>✓</td><td>5.8516</td><td>3.5152</td><td>3.1976</td><td>1.1105</td></tr><tr><td>SPEEDY-4-192</td><td>✓</td><td>10.1531</td><td>6.6220</td><td>4.1915</td><td>1.5378</td></tr><tr><td>SPEEDY-5-192</td><td>✓</td><td>7.8388</td><td>4.6164</td><td>4.3498</td><td>1.5172</td></tr><tr><td>SPEEDY-5-192</td><td>✓</td><td>12.9344</td><td>8.7471</td><td>5.3422</td><td>1.9655</td></tr><tr><td>SPEEDY-5-192</td><td>✓</td><td>9.6633</td><td>5.8834</td><td>5.5623</td><td>1.9002</td></tr></tbody></table>
<table><caption>**Table 9:** Comparison of the maximum throughput of relevant building blocks when synthesized for maximum operating frequency.</caption><thead><tr><th rowspan="2">Primitive</th><th rowspan="2">pip.</th><th colspan="4">Throughput [Gbit/s]</th></tr><tr><th colspan="2">Commercial Foundry</th><th colspan="2">NanGate OCL</th></tr><tr><th></th><th></th><th>90 nm LP</th><th>65 nm LP</th><th>45 nm</th><th>15 nm</th></tr></thead><tbody><tr><td>ES-TRNG</td><td></td><td>5.5070</td><td>7.3636</td><td>4.7976</td><td>46.9197</td></tr><tr><td>LFSR64</td><td></td><td>5.0296</td><td>6.4497</td><td>5.9016</td><td>67.5493</td></tr><tr><td>LFSR64_X32</td><td></td><td>163.4354</td><td>203.2611</td><td>161.9925</td><td>1803.0201</td></tr><tr><td>LFSR64_X64</td><td></td><td>200.8353</td><td>284.9155</td><td>256.0010</td><td>2800.1400</td></tr><tr><td>LFSR64_X96</td><td></td><td>308.1536</td><td>437.9542</td><td>395.5843</td><td>4280.9365</td></tr><tr><td>LFSR64_X128</td><td></td><td>369.1495</td><td>481.2663</td><td>388.5110</td><td>4480.5377</td></tr><tr><td>F-LFSR-GrainV1_80</td><td></td><td>3.0224</td><td>4.2333</td><td>3.3190</td><td>39.5570</td></tr><tr><td>F-LFSR-GrainV1_80_X16</td><td></td><td>42.1739</td><td>57.3029</td><td>52.8321</td><td>537.0209</td></tr><tr><td>F-LFSR-GrainV1_80_X32</td><td></td><td>55.1815</td><td>70.0493</td><td>64.0960</td><td>643.2161</td></tr><tr><td>F-LFSR-GrainV1_128</td><td></td><td>2.8193</td><td>4.0166</td><td>3.2279</td><td>33.0022</td></tr><tr><td>F-LFSR-GrainV1_128_X16</td><td></td><td>45.1880</td><td>62.9512</td><td>50.6247</td><td>522.3296</td></tr><tr><td>F-LFSR-GrainV1_128_X32</td><td></td><td>79.2318</td><td>130.7238</td><td>94.7564</td><td>1082.9836</td></tr><tr><td>Bivium</td><td></td><td>4.5893</td><td>7.4092</td><td>5.1414</td><td>58.9067</td></tr><tr><td>Bivium_X32</td><td></td><td>163.8153</td><td>193.6261</td><td>146.7439</td><td>1647.9555</td></tr><tr><td>Bivium_X48</td><td></td><td>198.3192</td><td>285.3271</td><td>248.8104</td><td>2468.5009</td></tr><tr><td>Bivium_X64</td><td></td><td>270.5616</td><td>366.7769</td><td>286.1384</td><td>3431.4514</td></tr><tr><td>Bivium_X72</td><td></td><td>190.0729</td><td>260.0987</td><td>218.9255</td><td>2551.4724</td></tr><tr><td>Trivium</td><td></td><td>4.5951</td><td>8.4700</td><td>5.1410</td><td>58.9032</td></tr><tr><td>Trivium_X32</td><td></td><td>171.3668</td><td>177.3757</td><td>155.5596</td><td>1557.2534</td></tr><tr><td>Trivium_X48</td><td></td><td>192.6318</td><td>288.1758</td><td>215.2640</td><td>2548.9884</td></tr><tr><td>Trivium_X64</td><td></td><td>262.7172</td><td>368.4811</td><td>311.8924</td><td>3375.7055</td></tr><tr><td>Trivium_X72</td><td></td><td>189.4134</td><td>261.9353</td><td>255.8772</td><td>2559.3630</td></tr><tr><td>Kreyvium</td><td></td><td>3.5744</td><td>4.8675</td><td>4.2698</td><td>46.2364</td></tr><tr><td>Kreyvium_X32</td><td></td><td>109.9101</td><td>154.0995</td><td>132.2866</td><td>1527.6651</td></tr><tr><td>Kreyvium_X48</td><td></td><td>170.8422</td><td>230.3805</td><td>202.0372</td><td>2231.0016</td></tr><tr><td>Kreyvium_X64</td><td></td><td>234.6626</td><td>306.1322</td><td>240.4957</td><td>2843.4334</td></tr><tr><td>Kreyvium_X72</td><td></td><td>181.7324</td><td>254.6374</td><td>216.8198</td><td>2171.0288</td></tr><tr><td>GrainV1_80</td><td></td><td>1.8105</td><td>2.8468</td><td>2.3176</td><td>24.6427</td></tr><tr><td>GrainV1_80_X8</td><td></td><td>15.4144</td><td>19.6854</td><td>16.1483</td><td>179.5010</td></tr><tr><td>GrainV1_80_X16</td><td></td><td>28.5878</td><td>39.3044</td><td>28.2703</td><td>316.6310</td></tr><tr><td>GrainV1_80_X32</td><td></td><td>33.0819</td><td>40.5884</td><td>36.1465</td><td>358.7524</td></tr><tr><td>GrainV1_128</td><td></td><td>2.1043</td><td>3.0970</td><td>2.3858</td><td>25.0407</td></tr><tr><td>GrainV1_128_X16</td><td></td><td>31.8059</td><td>44.4772</td><td>33.8378</td><td>365.1467</td></tr><tr><td>GrainV1_128_X32</td><td></td><td>65.9519</td><td>93.6856</td><td>70.6589</td><td>726.7112</td></tr><tr><td>GrainV1_128_X48</td><td></td><td>62.3784</td><td>87.3692</td><td>68.0305</td><td>667.0929</td></tr><tr><td>MICKEY2_80</td><td></td><td>2.8013</td><td>4.2708</td><td>3.1409</td><td>29.4872</td></tr><tr><td>MICKEY2_80_X2</td><td></td><td>3.5398</td><td>5.1838</td><td>3.5629</td><td>34.6999</td></tr><tr><td>MICKEY2_80_X4</td><td></td><td>4.0214</td><td>5.3508</td><td>4.1327</td><td>41.4405</td></tr><tr><td>MICKEY2_80_X32</td><td></td><td>3.5171</td><td>4.8232</td><td>3.3259</td><td>35.6610</td></tr><tr><td>MICKEY2_128</td><td></td><td>2.7971</td><td>3.7427</td><td>3.1345</td><td>25.5925</td></tr><tr><td>MICKEY2_128_X2</td><td></td><td>3.1718</td><td>4.4284</td><td>3.3040</td><td>33.3050</td></tr><tr><td>MICKEY2_128_X4</td><td></td><td>3.4512</td><td>4.7320</td><td>3.6835</td><td>34.8435</td></tr><tr><td>MICKEY2_128_X32</td><td></td><td>3.1346</td><td>4.3513</td><td>2.9874</td><td>30.7268</td></tr><tr><td>Gimli-8</td><td>✓</td><td>237.0708</td><td>326.5412</td><td>251.4183</td><td>2582.2591</td></tr><tr><td></td><td></td><td>1131.8753</td><td>1334.5381</td><td>1213.3775</td><td>13101.7776</td></tr><tr><td>Gimli-16</td><td>✓</td><td>132.6433</td><td>185.4145</td><td>139.1923</td><td>1396.8767</td></tr><tr><td></td><td></td><td>1077.7223</td><td>1449.2425</td><td>1138.2432</td><td>12979.9892</td></tr><tr><td>Gimli-24</td><td>✓</td><td>87.5540</td><td>122.7870</td><td>87.6057</td><td>911.1552</td></tr><tr><td></td><td></td><td>1065.5952</td><td>1441.4631</td><td>1184.8487</td><td>12959.8380</td></tr><tr><td>Subterranean2</td><td></td><td>78.8686</td><td>111.4586</td><td>78.7626</td><td>931.2884</td></tr><tr><td>Subterranean2_X2</td><td></td><td>88.5680</td><td>120.4661</td><td>88.9638</td><td>926.9720</td></tr><tr><td>Subterranean2_X4</td><td></td><td>93.6741</td><td>128.6060</td><td>94.7343</td><td>979.7243</td></tr><tr><td>Subterranean2_X8</td><td></td><td>97.1468</td><td>130.9410</td><td>96.1629</td><td>989.3414</td></tr><tr><td>SPEEDY-2-192</td><td>✓</td><td>171.4884</td><td>238.0377</td><td>164.3840</td><td>1734.4173</td></tr><tr><td></td><td></td><td>263.3337</td><td>368.4323</td><td>264.4879</td><td>2896.7577</td></tr><tr><td>SPEEDY-3-192</td><td>✓</td><td>110.7705</td><td>152.7412</td><td>104.2284</td><td>1103.4990</td></tr><tr><td></td><td></td><td>260.3870</td><td>363.3748</td><td>263.6074</td><td>2792.6054</td></tr><tr><td>SPEEDY-4-192</td><td>✓</td><td>80.7976</td><td>112.2980</td><td>75.3229</td><td>807.1772</td></tr><tr><td></td><td></td><td>260.2201</td><td>367.8203</td><td>258.7273</td><td>2767.4080</td></tr><tr><td>SPEEDY-5-192</td><td>✓</td><td>64.1145</td><td>88.1512</td><td>60.2378</td><td>639.0074</td></tr><tr><td></td><td></td><td>257.6472</td><td>369.1264</td><td>265.8168</td><td>2739.8824</td></tr></tbody></table>
<table><caption>**Table 10:** Comparison of the energy consumption per bit of relevant building blocks when synthesized for maximum operating frequency, estimated for 100 MHz operation</caption><thead><tr><th rowspan="3">Primitive</th><th rowspan="3">pip.</th><th colspan="4">Energy per bit [fJ/bit]</th></tr><tr><th colspan="2">Commercial Foundry</th><th colspan="2">NanGate OCL</th></tr><tr><th>90 nm LP</th><th>65 nm LP</th><th>45 nm</th><th>15 nm</th></tr></thead><tbody><tr><td>ES-TRNG</td><td></td><td>382.0000</td><td>219.0000</td><td>220.0000</td><td>74.0000</td></tr><tr><td>LFSR64</td><td></td><td>1782.0000</td><td>1054.0000</td><td>531.0000</td><td>252.0000</td></tr><tr><td>LFSR64_X32</td><td></td><td>70.0312</td><td>41.4062</td><td>27.5312</td><td>9.4062</td></tr><tr><td>LFSR64_X64</td><td></td><td>40.0625</td><td>24.3125</td><td>16.5312</td><td>5.6250</td></tr><tr><td>LFSR64_X96</td><td></td><td>28.2083</td><td>17.4479</td><td>13.6562</td><td>4.8438</td></tr><tr><td>LFSR64_X128</td><td></td><td>23.4922</td><td>14.4766</td><td>11.8438</td><td>4.5391</td></tr><tr><td>F-LFSR-GrainV1_80</td><td></td><td>2260.0000</td><td>1120.0000</td><td>703.0000</td><td>329.0000</td></tr><tr><td>F-LFSR-GrainV1_80_X16</td><td></td><td>190.6875</td><td>113.8125</td><td>88.0000</td><td>29.4375</td></tr><tr><td>F-LFSR-GrainV1_80_X32</td><td></td><td>130.4688</td><td>71.0625</td><td>67.6562</td><td>23.2188</td></tr><tr><td>F-LFSR-GrainV1_128</td><td></td><td>3602.0000</td><td>1953.0000</td><td>1125.0000</td><td>508.0000</td></tr><tr><td>F-LFSR-GrainV1_128_X16</td><td></td><td>307.1250</td><td>188.1250</td><td>123.2500</td><td>41.7500</td></tr><tr><td>F-LFSR-GrainV1_128_X32</td><td></td><td>172.6875</td><td>114.2500</td><td>78.6250</td><td>26.6250</td></tr><tr><td>Bivium</td><td></td><td>4833.0000</td><td>2529.0000</td><td>1618.0000</td><td>681.0000</td></tr><tr><td>Bivium_X32</td><td></td><td>201.8125</td><td>127.4375</td><td>79.6875</td><td>28.1875</td></tr><tr><td>Bivium_X48</td><td></td><td>149.3333</td><td>94.9583</td><td>60.6250</td><td>20.6250</td></tr><tr><td>Bivium_X64</td><td></td><td>123.0000</td><td>79.8438</td><td>51.7188</td><td>16.9688</td></tr><tr><td>Bivium_X72</td><td></td><td>101.4444</td><td>57.8611</td><td>47.3056</td><td>16.5694</td></tr><tr><td>Trivium</td><td></td><td>7157.0000</td><td>3991.0000</td><td>2776.0000</td><td>974.0000</td></tr><tr><td>Trivium_X32</td><td></td><td>299.9688</td><td>185.9375</td><td>128.9688</td><td>44.9688</td></tr><tr><td>Trivium_X48</td><td></td><td>223.9583</td><td>143.0000</td><td>98.0000</td><td>32.9792</td></tr><tr><td>Trivium_X64</td><td></td><td>180.6094</td><td>113.6875</td><td>79.8125</td><td>26.6406</td></tr><tr><td>Trivium_X72</td><td></td><td>156.9583</td><td>88.4722</td><td>73.5972</td><td>25.8194</td></tr><tr><td>Kreyvium</td><td></td><td>14335.0000</td><td>7247.0000</td><td>4449.0000</td><td>2018.0000</td></tr><tr><td>Kreyvium_X32</td><td></td><td>524.4375</td><td>302.9375</td><td>212.4687</td><td>80.3438</td></tr><tr><td>Kreyvium_X48</td><td></td><td>373.1042</td><td>217.6250</td><td>156.7708</td><td>56.8750</td></tr><tr><td>Kreyvium_X64</td><td></td><td>295.5625</td><td>171.8594</td><td>125.2656</td><td>45.6719</td></tr><tr><td>Kreyvium_X72</td><td></td><td>266.5833</td><td>145.0000</td><td>119.7222</td><td>41.4722</td></tr><tr><td>GrainV1_80</td><td></td><td>4479.0000</td><td>2424.0000</td><td>1742.0000</td><td>661.0000</td></tr><tr><td>GrainV1_80_X8</td><td></td><td>809.0000</td><td>468.7500</td><td>353.6250</td><td>124.7500</td></tr><tr><td>GrainV1_80_X16</td><td></td><td>513.8750</td><td>311.4375</td><td>256.6875</td><td>86.6875</td></tr><tr><td>GrainV1_80_X32</td><td></td><td>380.3125</td><td>228.0625</td><td>223.2500</td><td>74.0312</td></tr><tr><td>GrainV1_128</td><td></td><td>7005.0000</td><td>3705.0000</td><td>2532.0000</td><td>1016.0000</td></tr><tr><td>GrainV1_128_X16</td><td></td><td>630.0000</td><td>372.1250</td><td>278.4375</td><td>97.1250</td></tr><tr><td>GrainV1_128_X32</td><td></td><td>401.7188</td><td>253.3750</td><td>208.8438</td><td>67.7188</td></tr><tr><td>GrainV1_128_X48</td><td></td><td>327.0625</td><td>201.2708</td><td>173.5625</td><td>58.0208</td></tr><tr><td>MICKEY2_80</td><td></td><td>6057.0000</td><td>3425.0000</td><td>2700.0000</td><td>942.0000</td></tr><tr><td>MICKEY2_80_X2</td><td></td><td>4249.0000</td><td>2386.0000</td><td>1990.5000</td><td>699.5000</td></tr><tr><td>MICKEY2_80_X4</td><td></td><td>3313.2500</td><td>1990.5000</td><td>1763.7500</td><td>586.0000</td></tr><tr><td>MICKEY2_80_X32</td><td></td><td>5724.3750</td><td>3663.4375</td><td>3739.3750</td><td>1116.0312</td></tr><tr><td>MICKEY2_128</td><td></td><td>9650.0000</td><td>5482.0000</td><td>4274.0000</td><td>1536.0000</td></tr><tr><td>MICKEY2_128_X2</td><td></td><td>6353.0000</td><td>3617.0000</td><td>3163.5000</td><td>1106.0000</td></tr><tr><td>MICKEY2_128_X4</td><td></td><td>4976.5000</td><td>2901.7500</td><td>2805.5000</td><td>913.5000</td></tr><tr><td>MICKEY2_128_X32</td><td></td><td>8380.0000</td><td>5508.5625</td><td>5888.4375</td><td>1755.5625</td></tr><tr><td>Gimli-8</td><td>✓</td><td>210.4792</td><td>143.9427</td><td>107.5573</td><td>37.1563</td></tr><tr><td>Gimli-16</td><td>✓</td><td>255.2135</td><td>159.1901</td><td>119.3177</td><td>39.2656</td></tr><tr><td>Gimli-24</td><td>✓</td><td>351.5339</td><td>255.3646</td><td>166.7109</td><td>53.0208</td></tr><tr><td>Subterranean2</td><td></td><td>472.2161</td><td>306.3359</td><td>229.5677</td><td>74.1250</td></tr><tr><td>Subterranean2_X2</td><td></td><td>453.7083</td><td>339.5130</td><td>253.3672</td><td>76.0026</td></tr><tr><td>Subterranean2_X4</td><td></td><td>694.0391</td><td>452.4792</td><td>342.0573</td><td>109.4870</td></tr><tr><td>Subterranean2_X8</td><td></td><td>257.7188</td><td>157.5938</td><td>124.9688</td><td>46.6250</td></tr><tr><td>SPEEDY-2-192</td><td>✓</td><td>241.4219</td><td>158.2708</td><td>103.6094</td><td>37.3021</td></tr><tr><td>SPEEDY-3-192</td><td>✓</td><td>200.9688</td><td>123.0990</td><td>102.6979</td><td>30.2760</td></tr><tr><td>SPEEDY-4-192</td><td>✓</td><td>382.3958</td><td>260.7135</td><td>161.2396</td><td>58.7240</td></tr><tr><td>SPEEDY-5-192</td><td>✓</td><td>304.7708</td><td>183.0833</td><td>166.5417</td><td>57.8385</td></tr><tr><td>SPEEDY-6-192</td><td>✓</td><td>528.8073</td><td>344.8958</td><td>218.3073</td><td>80.0938</td></tr><tr><td>SPEEDY-7-192</td><td>✓</td><td>408.2708</td><td>240.4375</td><td>226.5521</td><td>79.0208</td></tr><tr><td>SPEEDY-8-192</td><td>✓</td><td>673.6667</td><td>455.5781</td><td>278.2396</td><td>102.3698</td></tr><tr><td>SPEEDY-9-192</td><td>✓</td><td>503.2969</td><td>306.4271</td><td>289.7031</td><td>98.9688</td></tr></tbody></table>