Updates on CLOC and SILC Version 3
Tetsu Iwata*, Kazuhiko Minematsu, Jian Guo,Sumio Morioka, and Eita Kobayashi
DIAC 2016
September 26, 2016, Nagoya, Japan* Supported in part by JSPS KAKENHI, Grant‐in‐Aid for Scientific Research (B), Grant Number 26280045

Outline• Review of the schemes– Specification of CLOC and SILC, security, implementation• Updates from version 2 to version 3• Discussion• Future plan2

CLOC and SILC
• CLOC [1]– Compact Low‐Overhead CFB, FSE 2014
– Suitable for handling short input data on smallmicroprocessors• SILC [2]– SImple Lightweight CFB, DIAC 2014
– Hardware oriented version of CLOC

[1] Iwata, Minematsu, Guo, Morioka: CLOC: Authenticated Encryption for Short Input. FSE 2014 3[2] Iwata, Minematsu, Guo, Morioka, Kobayashi: SILC: SImple Lightweight CFB. DIAC 2014

Overview of CLOC and SILC
• HASH and PRF: variants of CBC‐MAC• ENC: variant of CFB encryption mode4

Parameters of CLOC and SILC•••

: blockcipher: nonce length: tag length5

CLOC v3

6

SILC v3

7

Security of CLOC and SILC
• CLOC and SILC are provably secure up to the standard
birthday bound– Privacy: against nonce‐respecting adversaries– Authenticity: against nonce‐reusing adversaries–/2 , is the number of total blocks,length in bits

is the block8

Implementation• A: associated data of a blocks• M: a plaintext of m blocks• CLOC– 1 + a + 2m blockcipher calls when |A| ≥ 1– 2 + 2m calls when |A| = 0– No precomputation beyond the blockcipher key schedule• SILC– 3 + a + 2m blockcipher calls– No precomputation beyond the blockcipher key schedule

9Software Implementation• CLOC and SILC with AES (from DIAC 2015)– Intel (R) Core (TM) i5‐4570 3.20GHz (Haswell family),
AES‐128, AES‐NI– CLOC and SILC run at 4.56 cpb• seral AES runs at 4.44 cpb, very close to the speed ofseral AES• Latest performance at public benchmark (SUPERCOP)– Intel (R) Core (TM) i5‐6600 (Skylake) :– 2.82 cpb for long messages, 7.81 cpb for 64‐byte messages

10

Software Implementation• Intel (R) Core (TM) i5‐4570 3.20GHz (Haswell family), longmessages (2048 bytes), vperm (vector permutation)– [update] CLOC with TWINE runs at 14.6 cpb– SILC with Present runs at about 70 cpb– SILC with LED runs at about 130 cpb• CLOC Implementations on Atmel AVR ATmega128 (FSE 2014)– 8‐bit microprocessor– the RAM usage is low and Init is fast, and it is fast for short
input data, up to around 128 bytes

11

Hardware Implementation(from DIAC 2015)• ASIC implementation– reference implementation (non‐optimized, encryption‐
and‐decryption implemented)– Environment: 90nm standard cell library with logic
synthesis done by Synopsys DC Version D‐2010.03‐SP1‐1• CLOCAES
AES128_CLOC
AES Core
ratio

TWINE
18991.5 TWINE80_CLOC
10207.8 TWINE Core
1.9 ratio

5917.81459.5
4.1

in GE (Gate Equivalent)
12Hardware Implementation(from DIAC 2015)• ASIC implementation– reference implementation (non‐optimized, encryption‐
and‐decryption implemented)– Environment: 90nm standard cell library with logic
synthesis done by Synopsys DC Version D‐2010.03‐SP1‐1• SILCAESTWINEPRESENTAES128_SILC 17466.0 TWINE80_SILC 5178.0 PRESENT80_CLOC
AES Core
10207.8 TWINE Core
1459.5 PRESENT Coreratio
1.7 ratio
3.5 ratio

5532.3
1817.33.0

in GE (Gate Equivalent)13

Hardware Implementation• Area optimized ASIC implementation with dedicated API[Banik, Bogdanov, Minematsu, DIAC 2015]
DesignArea (AES128_CLOC Aggressive
13672.8
AES128_CLOC Conservative 18966.5
AES128_SILC Aggressive
13678.3
AES128_SILC Conservative 18100.0) Area (GE)
3107
4311
31094114• Reference implementations were submitted to ATHENa
14

Outline• Review of the schemes– Specification of CLOC and SILC, security, implementation• Updates from version 2 to version 3• Discussion• Future plan

15

CLOC v216CLOC v317

Updates from Version 2 to 3
• No changes in specifications (both for CLOC and SILC)• Two submission documents, “CLOC v2” and “SILC v2,” weremerged into one submission “CLOC and SILC v3”– following the request by CAESAR• Recommended parameter sets
– 3 in “CLOC v2”
aes128n12t8clocv2, aes128n8t8clocv2, twine80n6t4clocv2– 4 in “SILC v2”
aes128n12t8silcv2, aes128n8t8silcv2, present80n6t4silcv2,led80n6t4silcv2– 3 + 4 = 7 ‐> 5 in “CLOC and SILC v3”
18

Updates from Version 2 to 3
• 5 recommended parameter sets for “CLOC and SILC v3”• specified the ordering:
1. aes128n12t8clocv3
2. aes128n12t8silcv3
3. twine80n6t4clocv3
4. present80n6t4silcv3
5. led80n6t4silcv3• dropped aes128n8t8clocv2 and aes128n8t8silcv2

19

Updates from Version 2 to 3
• CAESAR Use Cases:– Use Case 1: Lightweight applications– Use Case 2: High‐performance applications– Use Case 3: Defense in depth• Targeted use cases of 5 recommended parameter sets
1. aes128n12t8clocv3 Use Case 1
2. aes128n12t8silcv3
Use Case 1
3. twine80n6t4clocv3 Use Case 1
4. present80n6t4silcv3 Use Case 1
5. led80n6t4silcv3
Use Case 1• CLOC and SILC have some features of Use Case 3, but this is20
not a targeted use case

Other Updates• n=96 is listed as a possible choice of the block length of theunderlying blockcipher• added Simon and Speck as possible options

21

Outline• Review of the schemes– Specification of CLOC and SILC, security, implementation• Updates from version 2 to version 3• Discussion• Future plan22

History: CCM, EAX, and EAX‐prime• CCM (NIST SP 800‐38C)– complex specification, not online, a number of limitations
were pointed out [3]• EAX (ISO/IEC 19772)– simple design, AES‐CMAC plus AES‐CTR– provably secure– precomputation cost (EK(0), EK(1), and EK(2)) can be anissue for highly constrained devices; time and memory[3] Rogaway, Wagner: A Critique of CCM. IACR ePrint 2003/070

23

History: CCM, EAX, and EAX‐prime• EAX‐prime (ANSI C12.22)– reduces precomputation complexity of EAX– efficiently handles short input data with small memory• was not proposed with a proof of security– standardized by ANSI for Smartgrid– ANSI pushed EAX‐prime to NIST, and NIST requested publiccomments for inclusion of it into NIST SP‐800 series– EAX‐prime was seriously broken [4]• single‐query forgery etc.
• was not adopted in the NIST standard[4] Minematsu, Lucks, Morita, Iwata: Attacks and Security Proofs of EAX‐Prime. FSE 201324

From CCM, EAX, and EAX‐prime to CLOCand SILC
• There is a public need for a scheme like CCM, EAX, and EAX‐prime:– constrained devices, blockcipher‐based, design simplicity,small footprint– low memory requirement, low precomputation complexity,and provable security• CCM ‐> EAX ‐> EAX‐prime ‐> CLOC and SILC
– catch “the public need”

25

64‐bit blockciphers• 64‐bit blockciphers are in use:
– TDES, Kasumi, Present,…
• Many new designs for lightweight applications– LED, TWINE, Prince, Midori, Rectangle,…
• a blockcipher cannot be used by itself– encryption mode, MAC for authentication, AE mode
– in modes, block length matters, not for general purpose
applications– for low‐powered, small‐bandwidth, or limited‐lifetimecommunications26

64‐bit blockciphers• showing “the right way” of using 64‐bit blockciphers to theoutside world is important– Generic composition works– CCM and GCM are for 128‐bit blockciphers• there is a 64‐bit block version of GCM– CLOC and SILC give one right way

27

Outline• Review of the schemes– Specification of CLOC and SILC, security, implementation• Updates from version 2 to version 3• Discussion• Future plan28

Future Plan
• Future plan (from DIAC 2015, still in progress):– Analysis of CLOC and SILC in terms of INT‐RUP security– Designing a variant of SILC for empty associated data29

Thank you• Review of the schemes– Specification of CLOC and SILC, security, implementation• Updates from version 2 to version 3• Discussion• Future plan
• Web site:– http://www.nuee.nagoya‐u.ac.jp/labs/tiwata/AE/– documents, slides, test vectors

30