Practical applications of Lightweight Block
Ciphers to Secure EtherNet/IP Networks

Jordon Woods
Innovasic
October 14, 2015

Authors
Jordon Woods
Chief Technical Officer
Innovasic, Inc.

Patricia Muoio
Director of Research and Development
G2, Inc.

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

2

A New Era?
•50B Internet connected devices by 2025 (IoT)•Of that 50B, ~40% will be Industrial devices (Industry 4.0, IIoT)–•(Source: IHS 2013, Internet Connected Devices)

These devices are sensors,
actuators, field devices…

Technical Track© 2015 ODVA, Inc.

•…used in Building Automation, Factory
Automation, Process Automation,
Water/Wastewater, Transportation, Smart Grid,etc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

3

Constraints of the IIOT•

Realities––––

Widely dispersed
Interconnected
Homogeneous networks
Not very secure• Enormous attack surface• Consistency across platforms– Hardware, SW, languages, devices, etc.

•Constraints––––

Limited processing resources
Limited memory
Cost-constrained
Area/footprint constrained

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

4The Promise of Lightweight Cryptography•The small size and limited processing
power of many connected devices could
inhibit encryption and other robust security
measures.
– Edith Ramirez, chair, US Federal TradeCommission•

Cryptographic solutions must be easy toimplement and have high performance on awide range of severely constrained devices.
Cryptography should be an aid, not ahindrance, to achieving security

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

5

Why Not AES?
•Existing cryptographic algorithms were, for themost part, designed to meet the needs of thedesktop computing era– AES was designed specifically for environmentsthat support a standard PC architecture– Power, memory and size essentiallyunconstrained– Substantial Latency/overhead– Over the last 15 years, a lot of effort has gone
into reshaping the AES into a solution which will
work in physically constrained systems– Still falls short for highly-constrained devices

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

6

The Promise of Lightweight Cryptography•Lightweight cryptography lends itself toimplementation as a block cipher– Small hardware footprint compared tocomparable AES implementations– Scalable, pipelined architecture– In-line encryption/decryption– Comparatively low latency– Can be realized by small circuits with minimal
power requirements– Provides comparable security to AES for a given
key sizeTechnical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

7

SIMON & SPECK•••

Most Lightweight cryptography are designed
for specific platforms (PRESENT, KATAN,Piccolo, etc.)
Poor performance on other platforms can ruin
overall performance
SIMON & SPECK••••

Two families of highly flexible block ciphers.
High performance on ASICs, FPGAs,
Microcontrollers and Microprocessors.
Flexible and secure
SIMON and SPECK are generalists

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

8

SIMON••••

Versatile in hardware and software
For pure hardware apps SIMONoutperforms SPECK
Small, fast, low energy and power.
Record breaking performance on ASICs
and FPGAs
Excels on microcontrollers andmicroprocessors too

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

9SPECK••••

Versatile in software and hardware
For pure software apps SPECK
outperforms SIMON
Small, fast, low energy and power.
Record breaking performance on
microcontrollers and microprocessors
Excels on ASICs and FPGAs as well

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

10

SIMON••SIMON & SPECK achieve robust encryption using
repeated rounds of simple functions
For SIMON, each round consists of a two-stage
Feistel map. The Feistel map for the SIMONalgorithm is given by:
𝑅𝑘 𝑥, 𝑦 = 𝑦 ⊕ 𝑓 𝑥 ⊕ 𝑘, 𝑥

Where 𝑘 is the round key and𝑓 𝑥 = 𝑆𝑥 & 𝑆 8 𝑥 ⊕ 𝑆 2 𝑥.

The inverse of the round function is used fordecryption:
𝑅𝑘−1 𝑥, 𝑦 = 𝑦, 𝑥 ⊕ 𝑓 𝑦 ⊕ 𝑘Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

11

SPECK•The SPECK algorithm also utilizes a Feistelbased map:
𝑅𝑘 𝑥, 𝑦 =𝑆 −𝛼 𝑥 + 𝑦 ⊕ 𝑘, 𝑆𝛽 𝑦 ⊕ 𝑆 −𝛼 𝑥 + 𝑦 ⊕ 𝑘 ,with rotation amounts α = 7 and β = 2, if n =16 (block size = 32) and α = 8 and β = 3otherwise

The inverse of the round function uses
modular subtraction for decryption:
𝑅𝑘 𝑥, 𝑦 = 𝑆 𝛼 𝑥 ⊕ 𝑘 − 𝑆 −𝛽 𝑥 ⊕ 𝑦 , 𝑆 −𝛽 𝑥 ⊕ 𝑦 .

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

12

SIMON & SPECK Parameters•Each algorithm makes use of “rounds” or iterations operating
on a given block sized and key size

SIMON Parameters
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

SPECK Parameters
www.odva.org

13

Key Schedule•

Likewise, each algorithm generates “sub-keys” for each round. Sub-keys
depend only upon the block/key size and thus, may be pre-calculated
li+m−1 = (ki + S−αl) ⊕ i andki+1 = Sβki ⊕ li+m−1.

SPECK key expansion,
SIMON 2, 3, & 4 word Key Expansion
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

where Ri is the SPECK round function with i acting
as round key.
www.odva.org

14

SIMON Example•A simple SIMON 32/64 implementation– 3 Pipeline stages to buffer 8-bit data toa 32-bit block– Pad bytes are needed for messages notcomprised of an even number of block– Eight additional pipeline stages– Four SIMON rounds per pipeline stage– A total of 11 pipeline stages for a total of
88 nS latency at 125 MHz

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

15

SIMON Example•

BUT:– Sub-keys can be pre-calculated and stored
to reduce hardware footprint– Intermediate round results can aren’t
needed, so the cypher block can be reused on subsequent rounds– Need to add only a small amount of control
logic

•

Further optimizations are readily feasible.
– All 44 rounds of SIMON 64/128 can be
performed in a single pipeline stage– Can be clocked at 300 MHz for a 130nm
process node
– 8 pipeline stages (7 data buffering, 1 forSIMON) total less than 27 nS of totallatency at 300 MHz

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

16

SIMON & SPECK Peformance•

For most platforms and constraints
SIMON, SPECK or both outperform
existing block ciphers––––––

ASIC/FPGA area
ASIC/FPGA efficiency (throughput/area)
Latency
Ease of side-channel protection
Power and energy efficiency
Software performance (size, speed,energy) on 8-, 16-, 32- and 64-bit
processors

AES

PRESENT

SIMON

SPECK
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

17

SIMON & SPECK vs. AES•For a given block and key size,
SIMON & SPECK provide comparable
or superior security to AESAESPRESENT•For a given block and key size,
SIMON is more efficient than AES

Technical Track© 2015 ODVA, Inc.

Size

Algorithm

Area (GE)128/128

SIMON

1234

SPECK

1280

AES

2400

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

18

Application to CIP Security•CIP Security uses proven, open security
technologies:–X.509v3 Digital Certificates used to provide
cryptographically secure identities to users AESand devices– TLS (Transport Layer Security) and DTLS
(Datagram Transport Layer Security)
PRESENT
cryptographic protocols used to provide
secure transport of EtherNet/IP traffic– Hashes or HMAC (keyed-Hash Message
Authentication Code) as a cryptographic
method of providing data integrity andmessage authentication to EtherNet/IP
traffic– Encryption as a means of encoding
messages or information in such a way as
to prevent reading or viewing of EtherNet/IP
data by unauthorized parties
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

19

Application to CIP Security•

Obvious applications of SIMON & SPECK
to CIP Security is message encryption
AES•

However, CIP Security is also strongly
focused on authentication– Digital Certificates for identity
establishment– HMAC for message authentication••PRESENTHash algorithms and RSA based
certificate exchange also requiresignificant resources
An alternative for highly-constrained
devices may be attractive

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

20

Alternative for Authentication•Cipher-based message authentication
code (CMAC) provides an alternativemeans of message authentication based AES
on a symmetric key block cipher––––NIST special publication 800-38BPRESENT
Proven implementations with AES (IPSEC)
Suitable for SIMON & SPECKMay be more appropriate for highlyconstrained devices– In extremely constrained environments, thesymmetric keys can be pre-shared

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

21

CMAC Overview•The CMAC algorithm:– Takes a message (M), of bit length Mlen– Chains the block cypher by acting on aAES
single block (Mi) and using a bitwise
exclusive-or to sum the output of eachstage in the chain
PRESENT– Produces a MAC, a.k.a message
authentication code, (T), of bit length Tlen
– T is appended to the outgoing message– On ingress, the process is repeated and theresulting MAC is compared to the MAC
appended to the message••

Technical Track© 2015 ODVA, Inc.

The CMAC algorithm also makes use of subkeys
Distinct from the sub-keys generated foreach SIMON/SPECK round2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

22Setting a High Bar••ODVA makes consistent use of proventechnologies
Clearly, to be of use, SIMON & SPECK must
be standardized and pass a high-level ofscrutiny with the security community– SIMON and SPECK have been submitted forinclusion in ISO 29192-2, the standard forlightweight block ciphers. This proposal iscurrently in review– Significant analysis of this technology has
already been performed and shows great
promise for robust security in constrained
applications– Open technology. The algorithm andassociated research are public domain

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

AESPRESENT

www.odva.org

23

A Practical Example•Goals:– Based upon an existing Ethernet/IP DLRAES
demonstration– Integrated SIMON IP with Switch IP.
– No changes to stack or application SW.
PRESENT– Completely transparent to Demooperation.

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

24

Demonstration Parameters•SIMON 32/64• 32 rounds; Key 64 bits
• Message encryption only•• Layer 3 and aboveLatency• 11 stages @ 125 mhz; 88 ns•

AESPRESENT

Input data

• 8 bit, 1-3 pad bytes added•

Key change process• Key expansion pre-computed tominimize latency• Requires pipeline flush and stall
Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

25

Demonstration Operation
••

•
•
•

Linear Sensor provides position information.
– Control module routes data to PLC
PLC provides simple ladder logic to routeAES
linear sensor data to the display RapidPlatform– Control module renders position on thePRESENT
display
The encrypted link is shown in red between
the REM-based modules labeled a and b withthe security algorithm enabled.
A network tap installed on the encrypted link
and on the unencrypted link.
A network analyzer demonstrates secure linkis operational and transparent to operation.

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

26

A Practical Example•

Goals:
 Based upon an existing Ethernet/IP DLR
AESdemonstration
 Integrated SIMON IP with Switch IP.
 No changes to stack or application SW.
PRESENT Completely transparent to Demooperation.
− 200 uS DLR beacon traffic unaffected byencryption− SIMON effectively looks like a slow wire
(88 nS on ingress and egress)

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

27

Conclusions•

Ethernet has enjoyed unprecedented
success as a communication medium– The promised explosions of IoT, iIoT andAES
Industry 4.0 threaten to dwarf thissuccess•Don’t believe in the IOT explosion?
Consider this:PRESENT– How many MAC Addresses did you use in1998? Typically less than 5:•Work computer, home computer, a laptop. . .

– Move to 2014. Now how many MAC
Addresses do you use? Typically 10 to15:•

Technical Track© 2015 ODVA, Inc.

Cell phone, IP phone, laptop (2 – 1 for wired,
1 for wireless), laser printer (2 – samereason), set top box (2), TV, BluRay player,tablet, computer at home (2), wireless AP, . . .
2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

28

Conclusions•••

Ethernet’s continued success will give rise
to a host of new applications with extremely
AES
limited resources
SIMON & SPECK potentially address suchapplications and should be considered as
CIP security technologies evolve.
Lightweight block cyphers offer:––––––A small hardware footprint (SIMON)
Small software footprint (SPECK)
Scalability
In-line encryption/decryption;
Low latency; Low jitter
Comparable security to AES

Technical Track© 2015 ODVA, Inc.

2015 Industry Conference & 17th Annual Meeting
All rights reserved.

www.odva.org

29

THANK YOU