SILC: SImple Lightweight CFB
Tetsu Iwata, Nagoya University
Kazuhiko Minematsu, NEC Corporation
Jian Guo, Nanyang Technological University
Sumio Morioka, NEC Europe Ltd.
Eita Kobayashi, NEC Corporation
DIAC 2014
August 23, 2014, Santa Barbara, USA1

Outline• Authenticated Encryption with Associated Data (AEAD)• SILC, SImple Lightweight CFB, pronounced as “silk”

http://pixabay.com/en/silk‐yarn‐thread‐spool‐thread‐196539/

2

SILC Design Goal
• Provably secure AEAD that is based on a blockcipher– Standard security notions for privacy and authenticity• To improve previous schemes, CCM, EAX, and EAX‐prime– optimizing the design to achieve a small gate size on HW
implementations• HW oriented version of CLOC [IMGM14]– CLOC is for embedded SW implementations[IMGM14] Iwata, Minematsu, Guo, Morioka, CLOC: Compact Low‐Overhead CFB,
Submission to the CAESAR competition
3

Design Strategy• CLOC optimizes the number of blockcipher calls by making
various cases– if the input is empty, a multiple of block size, or otherwise– this contributes to the efficiency for short input, and well
suits for embedded SW implementations– requires non‐negligible number of logic gates• SILC avoids making cases– at the cost of the constant number of increase ofblockcipher calls– data blocks are processed consistently– reduces the logic gates needed to implement the cases
4

SILC Overview••••

SILC is built upon CLOC
It follows the Encrypt‐then‐PRF paradigm
HASH, PRF: variants of CBC MAC
ENC: a variant of CFB

5

Parameters• EK: blockcipher with an n‐bit block• lN: nonce length in bits
1 ≦ lN ≦ n−1• tau: tag length in bits
1 ≦ tau ≦ n6

V <‐ HASHK(N,A)• variant of CBC MAC• N: nonce, fixed length, 1 ≦ |N| ≦ n−1• A: associated data, at most 2n/2‐1 bytes

7

V <‐ HASHK(N,A)• variant of CBC MAC• N: nonce, fixed length, 1 ≦ |N| ≦ n−1• A: associated data, at most 2n/2‐1 bytes
zero prepending function
zpp(N) = 0…0 || N8

V <‐ HASHK(N,A)• variant of CBC MAC• N: nonce,
fixedlength, 0<|N|<nzeroappending
functionzap(X)|| 0…0• A: associateddata,=atX most2n/2‐1 bytes(possibly none)9V <‐ HASHK(N,A)• variant of CBC MAC• N: nonce, fixed length, 0<|N|<nLen(A) =data,lengthof A in2n/2bytes‐1 bytes• A: associatedat most10

V <‐ HASHK(N,A)• variant of CBC MAC• N: nonce, fixed length, 0<|N|<ntweakfunction• A: associateddata,
at most 2n/2‐1 bytes
broken into bytes

11

V <‐ HASHK(N,A)• variant of CBC MAC• N: nonce, fixed length, 1 ≦ |N| ≦ n−1• A: associated data, at most 2n/2‐1 bytes

12

C <‐ ENCK(V,M)• variant of CFB mode
• M: plaintext, at most 2n/2‐1 bytes13

C <‐ ENCK(V,M)
bit fixing function• variant of CFB mode
fix the most significant bit by one• M: plaintext, at most 2n/2‐1 bytes
fix1(X) = X OR 10…0

14

C <‐ ENCK(V,M)• variant of CFB mode
• M: plaintext, at most 2n/2‐1 bytes

15

T <‐ PRFK(V,C)• variant of CBC MAC

16

Works with Two State Blocks

17

SILC Properties• Nonce‐based AEAD
• uses only the encryption of the blockcipher both forencryption and decryption• It makes |N|n + |A|n + 2|M|n + 2 blockcipher calls for a nonce
N, associated data A, and a plaintext M– where |X|n is the length of X in n‐bit blocks– 1 ≦ |N| ≦ n−1, so |N|n = 1– blockcipher key scheduling can be precomputed– No precomputation beyond that (blockcipher calls,generation of key dependent tables, . . . ) is needed18Limitations• Static associated data cannot be handled efficiently– nonce is processed before associated data• For long plaintexts, it needs 2 blockcipher calls per one block• HASH, ENC, and PRF are all sequential– blockcipher calls in ENC and PRF are parallelizable

19

Security• Privacy:
Indistinguishability of ciphertexts from random bits against
nonce‐respecting adversaries in a chosen plaintext attacksetting••

20

Security• Authenticity:
Unforgeability against nonce‐reusing adversaries in a chosenciphertext attack setting••21

Security• Authenticity:
Unforgeability against nonce‐reusing adversaries in a chosenciphertext attack setting••• Standard birthday bounds, proofs are similar to those of CLOC
22

Recommended Parameter Sets
• EK: blockcipher with an n‐bit block– n: 64 or 128– AES‐128 for n = 128, and PRESENT‐80 or LED‐80 for n = 64
• lN: nonce length in bits
– 96 or 64 for n = 128, and 48 for n = 64
• tau: tag length in bits
– 64 for n = 128, and 32 for n = 64

23

Recommended Parameter Sets
• EK: blockcipher with an n‐bit block– n: 64 or 128– AES‐128 for n = 128, and PRESENT‐80 or LED‐80 for n = 64
• lN: nonce length in bits
– 96 or 64 for n = 128, and 48 for n = 64
• tau: tag length in bits
– 64 for n = 128, and 32 for n = 64
• 64‐bit blockciphers are not for general purpose applications– for applications that can ensure the total amount of dataprocessed with one key
24– low data transmission rate, limited battery lifetime

HW Implementation• We evaluated AES‐SILC for ASIC using a 90 nm standard celllibrary• HW reference implementation AES‐SILC– to see the basic performance• Compared it with AES‐CLOC, AES‐OTR, and AES‐EAX– Unit = Gate Equivalent (GE)– AES is round‐based, where S‐box uses the composite‐fieldexpression– single AES core25

HW Implementation• Scenario 1– Frequency is fixed to 100 MHzAES
Gates (GE)Ratio (AES)
Throughput(Mbit/sec)

SILC

CLOC

OTR

EAX

10207.75 15675.5 17137.75 21862.5 28662.25
1

1.54

1163.63 764.12

1.68

2.14

2.81685.71 1134.18

794.48• SILC is the smallest (x 1.54 of AES size)• no significant change if the freq. ~= 20 MHz• Throughput is an estimation
26

HW Implementation• Scenario 2– The same RTL (Register Transfer Level) as Scenario 1– find the maximum frequency
SILC

CLOCOTRMax freq. (MHz)

344.8

333.3

277.8

Gates (GE)23135 25287.25 29080.75

35305

Ratio (AES)
Throughput(Mbit/sec)

1.57

312.5

EAX

2.01

2.07

3.16

2634.88 2142.85 3780.21 2207.07• Ratio: compared with AES of the corresponding freq.
• SILC is again the smallest (x 1.57 of AES size)• Throughput is an estimation27

SW Implementation• Not the main focus of SILC
• General purpose CPU– Intel(R) Core(TM) i5‐3427U CPU, 1.80GHz (Ivy Bridge)– with a long plaintext (more than 220 blocks) and empty
associated data, and with parallelism P
AES‐SILCPRESENT‐SILC LED‐SILC
Speed (cpb)
4.94240Remarks
AES‐NI, P=1 bit‐sliced, P=16 bit‐sliced, P=32
• In AES‐SILC, EK in ENC and PRF are computed in parallel• AES‐CLOC: about 4.9 cpb (P = 1)
• serial AES‐128 encryption: about 4.3 cpb

28

LED Reference Code• Inconsistency in the description of LED in the submission
document and the LED reference code
– The LED reference code will be updated soon
– The reference code of SILC remains unchanged

29

Conclusions• Designed SILC and analyzed the security and the efficiency• SILC is suitable for use within constrained HW devices

http://pixabay.com/en/silk‐yarn‐thread‐spool‐thread‐196539/

30