Efficient and flexible hardware structures of the 128 bit CLEFIA block cipher

IET Computers & Digital TechniquesVolume 14, Issue 2 p. 69-79 Research ArticleFree Access Efficient and flexible hardware structures of the 128 bit CLEFIA block cipher Bahram Rashidi, Corresponding Author Bahram Rashidi b.rashidi@abru.ac.ir Department of Electrical Engineering, Ayatollah Boroujerdi University, Boroujerd, 9199-69411 IranSearch for more papers by this author Bahram Rashidi, Corresponding Author Bahram Rashidi b.rashidi@abru.ac.ir Department of Electrical Engineering, Ayatollah Boroujerdi University, Boroujerd, 9199-69411 IranSearch for more papers by this author First published: 09 January 2020 https://doi.org/10.1049/iet-cdt.2019.0157Citations: 7AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract In this study, high-throughput and flexible hardware implementations of the CLEFIA lightweight block cipher are presented. A unified processing element is designed and shared for implementing of generalised Feistel network that computes round keys and encryption process in the two separate times. The most complex blocks in the CLEFIA algorithm are substitution boxes ( and ). The S-box is implemented based on area-optimised combinational logic circuits. In the proposed S-box structure, the number of logic gates and critical path delay are reduced by using the simplification of computation terms. The S-box consists of three steps: a field inversion over and two affine transformations over . The inversion operation is implemented over the composite field instead of inversion over which is an important factor for the reduction of area consumption. In addition, we proposed a flexible structure that can perform various configurations of CLEFIA to support variable key sizes: 128, 192 and 256 bit. Implementation results of the proposed architectures in 180 nm complementary metal–oxide–semiconductor technology for different key sizes are achieved. The results show improvements in terms of execution time, throughput and throughput/area compared with other related works. 1 Introduction In the past few years, several lightweight block ciphers for hardware implementation have been proposed. Block ciphers are used for data protection in cryptographic applications. These cryptographic primitives have been an important area of cryptographic researches [[1]-[3]]. Many lightweight block ciphers have been proposed to reduce the costs of hardware consumption than that of advanced encryption standard (AES), which is one of the most important and applicable block ciphers. The AES could be too expensive for hardware implementation [[4]]. CLEFIA [[5], [6]] is a block cipher with 128 bit data block size and 128, 192 and 256 bit key length, which is suitable for hardware implementation such as embedded crypto-processor that is used in the cryptographic application systems. This block cipher was developed by SONY corporation to provide flexibility and security in cryptographic applications [[5]]. This block cipher improves the security of the encryption process with the use of techniques such as diffusion switch mechanisms, multiple diffusion matrices and two different non-linear S-boxes [[6]]. The CLEFIA block cipher was standardised in the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) (ISO/IEC 29192-2) [[7]]. Also, the CLEFIA is proposed to Application for Cryptographic Techniques towards the Revision of the e-Government Recommended Ciphers List and The Internet Engineering Task Force for use in the Internet and the e-Government. Several application-specific integrated circuits (ASIC) implementations of the CLEFIA algorithm have been reported in [[6]-[10]]. Akishita and Hiwatari [[8]] proposed very compact hardware implementations of CLEFIA with 128 bit keys based on 8 bit shift registers. The implementations are based on serialised architectures in the data processing (encryption process) part. In [[9]], five high-performance hardware architectures for the 128 bit CLEFIA block cipher is presented. In [[10]], both fault diagnosis schemes and original structures for the CLEFIA are proposed. In recent years, several field-programmable gate array-based implementations of the CLEFIA algorithm have been reported in the literatures [[11]-[17]]. For example, in [[12]], a compact dual-cipher hardware architecture is proposed to support the CLEFIA and the AES algorithms. The architecture is implemented based on adequately scheduling and merging the processing structures. In [[13]], a pipelined implementation of CLEFIA is presented. In [[16]], a compact and high-throughput hardware structure for CLEFIA cipher by using addressable shift registers and RAM blocks is proposed. The focus of this paper is the design and implementation of efficient Very-large-scale integration (VLSI) structures for the CLEFIA block cipher. The throughput, speed processing and flexibility of this block cipher are important factors for hardware implementations. Therefore, the proposed structures are implemented based on efficient components for high-throughput and versatile applications. The implementation results of proposed architectures in 180 nm complementary metal–oxide–semiconductor (CMOS) technology for different key sizes are achieved. The results show that the proposed structures have high-throughput and low-computation time with acceptable hardware consumption compared with other related works. The contributions of this paper are as follows: A unified processing element is designed and shared for implementing generalised Feistel network (GFN) that computes the intermediate key and encryption process in the two separate times. The most complex blocks in the CLEFIA algorithm are substitution boxes and . The S-box is implemented based on area-optimised combinational logic circuits. In the proposed S-box structure, the number of logic gates and critical path delay (CPD) are reduced by using simplification of computation terms. The S-box consists of three steps: a field inversion over and two affine transformations over . The inversion operation is implemented based on an efficient structure over the composite field instead of the field . This is an important factor for reduction of area consumption. We proposed a flexible structure that can perform various configurations of CLEFIA to support variable key sizes 128, 192 and 256 bit. Therefore, this architecture provides versatile implementations that enable adaptive security level using a variable key size. The flexible structure is the suitable candidate for a broad range of applications with multiple levels of security. The rest of this paper is organised as follows. Section 2 recalls the CLEFIA block cipher and the proposed hardware structures are described. Section 5 shows a comparison between our works and other related works. Moreover, this paper is concluded in Section 6. 2 Description of the CLEFIA block cipher The CLEFIA cryptographic algorithm is a block cipher that can process 128 bit data blocks, using 128, 192 and 256 bit secret keys. In this case, we have a flexible key size. This block cipher was developed by SONY corporation [[5]] and standardised by ISO/IEC 29192-2 [[7]]. The numbers of rounds of CLEFIA are 18, 22 and 26 for 128, 192 and 256 bit keys, respectively. The CLEFIA algorithm is suitable for efficient hardware implementation of the block ciphers for cryptographic applications. Data processing part and a key scheduling part are two main parts of the CLEFIA. A fundamental structure for CLEFIA is defined as d-branch r-round GFN which is used for the definition of the data processing part and the key scheduling part. The CLEFIA uses a 4-branch and an 8-branch GFNs. The function uses two different 32 bit F-functions and . For d 32 bit inputs and outputs , and 32 bit round keys , and are defined as Algorithms 1 and 2 (see Figs. 1 and 2), respectively. Fig. 1Open in figure viewer Algorithm 1: computation Fig. 2Open in figure viewer Algorithm 2: computation 2.1 F-functions Two F-functions and are used in the . Algorithms 3 and 4 (see Figs. 3 and 4) shows the computations of F-functions and , respectively. As seen from these algorithms, the and are constructed based on two non-linear 8 bit S-boxes and and two matrices and . In each F-function, two S-boxes and are used in the different order and different matrix is used ( for and for ). Two matrices and used in each F-function are defined as follows: The multiplication operations of these matrices by the vector T are performed in the binary finite field constructed by the irreducible primitive polynomial . Fig. 3Open in figure viewer Algorithm 3: function computation Fig. 4Open in figure viewer Algorithm 4: function computation 2.1.1 S-box S0 This block is constructed based on four 4 bit S-boxes , , and as the following computations: where and are input and output of S-box , respectively (). The values of these 4 bit S-boxes are presented in Table 1. The multiplication by 0×2 in terms 0×2t0 and 0×2t1 is performed in constructed by the primitive polynomial . Table 1. Values of four 4 bit S-boxes , , and x 0 1 2 3 4 5 6 7 8 9 a b c d e f e 6 c a 8 7 2 f b 1 4 0 5 9 d 3 6 4 0 d 2 b a 3 9 c e f 8 7 5 1 b 8 5 e a 6 4 c f 7 2 3 1 0 d 9 a 2 6 d 3 4 5 e 0 7 8 9 b f c 1 2.1.2 S-box S1 The 8 bit S-box , for input x and output y, is defined as follows: The S-box consists of three steps: two affine transformations f and g over and a field inversion over [[5]]. The inverse function is performed in defined by a primitive polynomial . 2.2 Key schedules of the CLEFIA block cipher The CLEFIA key scheduling supports 128, 192 and 256 bit keys and it produces whitening keys () and round keys () for the data processing (encryption process) part of CLEFIA cipher. The key schedule consists of the two steps. In the first step, we have been generating L from K. Also, expanding K and L for generating the round keys are performed in the second step, where K and L are the key (main key) and an intermediate key, respectively. The key schedule, to generate L from K, for a 128 bit key and 192/256 bit keys uses a 128 bit and a 256 bit , respectively. For the 128 bit key scheduling, 24 32 bit constant values () as round keys and as an input are applied to to generate intermediate key L. In the next step, the K and L are used to generate the round keys () by using 36 32 bit constant values (). Algorithm 5 (see Fig. 5) shows the 128 bit key scheduling. Fig. 5Open in figure viewer Algorithm 5: key scheduling for 128 bit keys In the key scheduling for 192 bit keys, the 128 bit values , are generated from the 192 bit main key , where , are 32 bit numbers. In this case, and , where is not of . The constant values , where as round keys and as a 256 bit input are applied to to generate the two 128 bit values , . The key scheduling for a 256 bit key is similar to 192 bit key. However, in case of 256 bit constant key values, number of and initialisation of are different from case 192 bit key. Algorithm 6 (see Fig. 6) shows key scheduling for 192 and 256 bit keys. Fig. 6Open in figure viewer Algorithm 6: key scheduling for 192 and 256 bit keys In the key scheduling algorithms, we have the DoubleSwap function [] which is defined as follows: where are the 128 bit numbers. As seen from Algorithms 5 and 6, we need to compute 60, 84 and 92 32 bit constant values for 128, 192 and 256 bit keys, respectively. The constant values for k = 128, 192 and 256, are generated by Algorithm 7 (see Fig. 7). In step 5 of Algorithm 7, the field multiplication by (0×0002)−1 is performed in the finite field constructed by a primitive polynomial . Fig. 7Open in figure viewer Algorithm 7: constant values generation 3 Proposed hardware structures for 128, 192 and 256 bit keys In this section, we present hardware structures for implementation of the CLEFIA block cipher. 3.1 Hardware structure of the F-functions The multiplication operations of the and matrices by the vector T are performed in the binary finite field constructed by the irreducible primitive polynomial . In the following, we present the proposed method for implementation of these matrix multiplications in more details. The numbers 0×2, 0×4, 0×6, 0×8 and 0×A are equal to field elements z, , , and , respectively, in field . Therefore, the matrix multiplication for is presented as follows: Also, for we have The computations of , , and are performed based on multiplication by terms z, and modulo irreducible polynomial . Let be an element in , also in vector representation A is equal to vector , where . The multiplication by z, and in are equal to , and , respectively. Figs. 8a–c show structures for multiplication by z, and , respectively, over with irreducible polynomial . Fig. 8Open in figure viewer Hardware structures for multiplication by(a) z, (b) , (c) over with irreducible polynomial 3.1.1 Hardware structure of the S-box S0 The 4 bit S-boxes (, , and ) in the structure of S-box are important blocks in the VLSI implementation. Here, we use Karnaugh mapping to simplify expressions for each of the four S-box outputs. Then, the expressions are simplified by using simplification of algebraic terms. The input bits and the output bits are denoted by and , respectively, where . For further optimisation, after simplification by Karnaugh mapping, we factorised the similar algebraic terms to reduce the number of logic gates. The proposed simplifications of four S-boxes , , and are presented in Table 2. Table 2. Proposed simplifications of four S-boxes , , and Outputs After simplification by Karnaugh mapping Further simplification of algebraic terms For example, in the structure of 4-input S-box , the hardware consumption for the original expressions after simplification by Karnaugh mapping is equal to 32 2-input AND gates, 13 2-input OR gates and 4 NOT gates. After factorisation, the hardware consumption is reduced to 17 2-input AND gates, 10 2-input OR gates, 2 2-input exclusive OR (XOR) gates, 1 2-input exclusive NOR (XNOR) gates and 4 NOT gates. Therefore, the hardware resources of the S-boxes are reduced by using the simplification of the algebraic expressions. Figs. 9a–d show the proposed structures of S-boxes , , and , respectively. As seen in these figures, the S-boxes are constructed using only logic gates with an optimised structure. The CPD of S-boxes , , and , in the proposed structures are reduced to , , and , respectively, where , and are time delay of the 2-input XOR gate, 2-input OR gate and the 2-input AND gate, respectively. Fig. 9Open in figure viewer Proposed structures of 4 bit S-boxes(a),(b),(c),(d) The area and CPD of S-box S0 when directly synthesising the equations using Synopsys Design Compiler tool based on the library of standard cells with 180 nm CMOS technology are equal to 209 gate equivalent (GE) and 0.964 ns, respectively. 3.1.2 Hardware structure of the S-box S1 As mentioned before, the S-box consists of three steps: two affine transformations f and g over and a field inversion over [[5]]. Implementation of inversion operation over the composite field instead of inversion over is an important factor for reduction of area consumption [[18]]. Here, for the proposed implementation, we use the composite field defined by the following irreducible polynomials [[5]]: where is a root of . We define an isomorphic mapping from to and also its inverse isomorphic mapping from to as follows: where , . The affine transformation f and the isomorphic mapping is merged to a single matrix operation as The inverse isomorphic mapping and the affine transformation g is also merged to a single matrix operation as These matrix representations can be presented based on the following computations for hardware implementation: (1) The hardware resources for implementation of the merged mappings and are equal to (two 2-input XOR gates, two 2-input XNOR gates and two NOT gates) and (two 2-input XOR gates and four 2-input XNOR gates), respectively. In the following, we present the proposed hardware structure of the field inversion over composite field . Let be an arbitrary element in , where , the inversion () can be calculated as follows: (2)where and vector representation of is equal to (1, 1, 0, 0) [[5]]. Fig. 10a shows the structure of field inversion operation over composite field . This operation is constructed based on four sub-blocks that consist of multiplication by constant , four field multiplications, one field inversion, one field squaring and two field additions. The sub-blocks multiplication, inversion and squaring are defined over with primitive polynomial . The multiplication and inversion, squaring operations over are implemented based on [[19], [20]]. However, in the proposed implementation, we applied further optimisation in the structures of multiplication and inversion over for reducing CPD and area consumption. Fig. 10Open in figure viewer Proposed structures of(a) S-box , (b) Squaring over , (c) Multiplication over , (d) Multiplication by constant , (e) Inversion over Let and be two field elements in , where and . The multiplication of these two field elements is computed as follows [[19]]: (3) (4) (5) (6)The hardware structure of field squaring, field multiplication and multiplication by constant over are shown in Fig. 10b–d, respectively. As seen from Fig. 10c, the similar terms , are implemented by resource sharing of XOR gates. For implementation of the field inversion over , i.e. , we have [[19]] (7) (8) (9) (10)In the following, we apply further simplifications on and terms, which are as below: (11) (12) (13) (14)Fig. 10e shows the proposed efficient hardware structure for field inversion over . The hardware consumption and CPD for the original field inversion expressions are equal to (23 2-input XOR gates and 11 2-input AND gates) and (), respectively. After further simplifications on and terms, the hardware consumption and CPD are equal to (11 2-input XOR gates, 9 2-input AND gates, 3 2-input NAND gates and 3 NOT gates) and (), respectively. Therefore, in the proposed structure, the number of logic gates and CPD is reduced. The area and CPD of S-box S1 when directly synthesising the equations using DC compiler are equal to 291 GE and 2.59 ns, respectively. 3.2 Proposed hardware structures of key schedules of CLEFIA block cipher Fig. 11a shows the proposed structure for generation of the constant values. In this structure, four constant values are generated at each clock cycle (CC). The initial value is loaded into Reg1 and to are generated in the first CC, while LD signal is equal to '1'. In the other CCs LD signal is equal to '0' and the next constant values are computed. The constant values for 128, 192 and 256 bit keys are generated by the proposed structure in 15, 21 and 23 CCs, respectively. If for implementation multiplication by (0×0002)−1 (or ), i.e. we have [[20], [21]] (15)As seen from Fig. 11b, the multiplication by is implemented based on five XOR gates. Fig. 11Open in figure viewer Proposed structures for generating the constant values(a),(b) Multiplication by over The proposed structures for generation of round keys for cases 128 and 192/256 bit main keys are shown in Figs. 12a and b, respectively. Multiplexer with control signal Ct and D flip-flop is used for implementation of two conditions i odd and i even in Algorithms 6 and 7 (line 6 in Algorithm 6 and lines 13 and 19 in Algorithm 7). If i be an even number zero input of multiplexer is selected and for odd number of i one input of multiplexer is selected. Therefore, in these structures, for loops with even number and odd number the output of D flip-flop is equal to '0' and '1', respectively. Table 3 shows operations and control signals of the proposed structure for 192 bit round key generation (Fig. 12b). For example, in the first CC, we have computation of term . In this case, for computing this term, the control signals and are equal to '1' and other control signals are set to '0'. Also, the next CCs and computation terms are implemented by the proposed structure based on Table 3. Table 3. Operations and control signals of the proposed structure for 192 bit round key generation Control signals , , , , , , Operations 0100001 0001100 1010010 0010100 0000001 0001101 0010010 0010110 0000001 0001101 0010010 Fig. 12Open in figure viewer Proposed structures for generating the round keys for cases(a) 128 bit, (b) 192 and 256 bit main keys 3.3 Hardware structure of the CLEFIA block cipher In the CLEFIA block cipher, function is used for generating the L (the first part) and encryption processing (the second part) in two separate times. The proposed structure of CLEFIA block cipher for the 128 bit key is shown in Fig. 13a. Also, the timing diagram of the proposed structure for case 128 bit key is presented in Fig. 14a. In the first part of computations, the control signals and are set to '0' and '1', respectively. Now, constant values , , and and main key K are applied to the structure. In this case, the structure is configured for computing the 32 bit parts and of L based on applied constant values and main key. The block (for 128 bit key) at each CC computes two rounds of computations. Therefore, generating the L required to ten CCs. After computation of L, the control signals and are set to '1' and '0', respectively, and the structure is configured for computing the ciphertext in the encryption process. Also, round key generator block based on two inputs L and K generates , , and for encryption part. In this structure, the start of the data processing and generating of round keys is concurrent. The proposed structures for 192 and 256 bit key are shown in Figs. 13b and c, respectively. The functionality of proposed structures for the 192 and the 256 bit key is similar to 128 bit structure. Fig. 13Open in figure viewer Proposed structures of CLEFIA block cipher for(a) 128 bit key, (b) 192 bit key, (c) 256 bit key Fig. 14Open in figure viewer Timing diagrams of the proposed structures for cases(a) 128 bit key, (b) Flexible structure configured for 256 bit key 4 Proposed flexible structures for CLEFIA block cipher In this section, we present a flexible structure for implementation of the CLEFIA block cipher. As mentioned before, the CLEFIA block cipher has several key sizes. The flexible architecture is for the realisation of the CLEFIA block cipher with different security levels and security configuration management. Here, key sizes 128, 192 and 256 are supported by the proposed structure. The proposed flexible structure for implementation of the CLEFIA block cipher is shown in Fig. 15. The width of the registers and multiplexers are equal to 32 bit. The structures are configured based on five control signals , , and . The control signal is used to select the initial constant values for related key size configuration. The configuration between generating L from the main key and encryption process (round keys are generated concurrently with the encryption process) is performed based on the control signal . In this case, if , the structure is configured for generating the L from the main key and also if the encryption process is started. The timing diagram of the proposed flexible structure configured for 256 bit key is presented in Fig. 14b. For both parts generating the L from main key and encryption process, in the first CC, the control signal is equal to '1' and for other CCs this control signal is equal to '0'. The control signal is used for selecting between cases 192 and 256 bit keys (for = '1' 192 bit key is selected; otherwise, 256 bit key is selected for computations). The hardware consumption and CPD of the proposed flexible structure of the CLEFIA block cipher are presented in the following section. Fig. 15Open in figure viewer Proposed flexible structure of the CLEFIA block cipher 5 Results and comparison The ASIC implementation results of the proposed structures with other ASIC implementations of the CLEFIA block cipher are compared in this section. The ASIC results are achieved by using Synopsys Design Compiler tool based on the library of standard cells with 180 nm CMOS technology. The area is usually measured in and GE, where one GE is equivalent to the area of a 2-input NAND gate with the lowest driving strength of the corresponding technology. In other words, this metric represents the amount of consumed area normalised to the area of one 2-input NAND gate. The performance and results of the designs are evaluated in terms of CPD, area, computation time, throughput and throughput/area. The results of the proposed works are achieved based on different key sizes (128, 192 and 256 bit). Table 4 shows the results of the proposed implementations and other related works for CLEFIA cipher. The area and critical path values are achieved from post-synthesis results (after performing place and route). In this table, configurations (128-128, 128-192 and 128-256) are separated to provide the comparisons between the existing designs and the proposed ones. The optimisation in works [[6], [9], [10]] is based on area and speed. In [[9]], five high-performance hardware architectures for the 128 bit CLEFIA block cipher is presented. In [[10]], both fault diagnosis schemes and original structures for the CLEFIA are proposed. Akishita and Hiwatari [[8]] proposed very compact hardware implementations of CLEFIA with 128 bit keys based on 8 bit shift registers. The implementations are based on serialised architectures in the data processing part. Table 4. Results of the proposed implementations and other related works on CLEFIA cipher Works Technology, nm Area (GE) Number of CCs CPD (Norm.), ns Time (Norm.), ns Thr. (Norm.), Mbps Thr./area (Norm.), Mbps/GE [[6]], type-A, Table, A, 128-128 90 10,380 18 2.76 (8.52) 49.68 (153.36) 2576.49 (834.64) 0.248 (0.080) [[6]], type-A, Table, S, 128-128 90 11,160 18 1.75 (5.40) 31.50 (97.2) 4063.49 (1316.87) 0.364 (0.118) [[6]], type-A, Com., A, 128-128 90 6050 18 4.76 (14.70) 85.68 (264.6) 1493.93 (483.75) 0.247 (0.079) [[6]], type-A, Com., S, 128-128 90 9330 18 1.90 (5.87) 34.20 (105.66) 3742.69 (1211.43) 0.401 (0.129) [[6]], type-A, T-box, A, 128-128 90 13,830 18 1.77 (5.46) 31.86 (98.28) 4017.58 (1302.40) 0.291 (0.094) [[6]], type-A, T-box, S, 128-128 90 21,070 18 1.34 (4.14) 24.12 (74.52) 5306.80 (1717.66) 0.252 (0.082) [[6]], type-B, Table, A, 128-128 90 8100 36 2.77 (8.55) 99.72 (307.8) 1283.59 (415.85) 0.159 (0.051) [[6]], type-B, Table, S, 128-128 90 12,250 36 1.93 (5.96) 69.48 (214.56) 1842.26 (596.57) 0.150 (0.049) [[6]], type-B, Com., A, 128-128 90 5490 36 6.75 (20.84) 243 (750.24) 526.75 (170.61) 0.096 (0.031) [[6]], type-B, Com., S, 128-128 90 6900 36 2.77 (8.55) 99.72 (307.8) 1283.59 (415.85) 0.186 (0.025) [[9]], area, 128-128 90 5979 18 4.43 (13.68) 79.7 (246.24) 1605.94 (519.82) 0.269 (0.087) [[9]], S, 128-128 90 12,009 13 3.37 (10.40) 42.62 (135.2) 3003 (946.75) 0.250 (0.079) [[9]], A, 128-128 90 4950 36 4.97 (15.34) 178.85 (552.24) 715.69 (231.78) 0.145 (0.047) [[9]], S, 128-128 90 9377 36 2.57 (7.93) 92.41 (285.48) 1385.10 (448.37) 0.148 (0.048) [[10]], S, 128-128 65 9423 18 1.65 (6.81) 29.63 (122.58) 4310 (1044.22) 0.457 (0.111) this work, 128-128 180 8667 15 3.08 46.2 2770.56 0.320 [[9]], A, 128-192 90 8536 22 4.84 (14.94) 106.50 (328.68) 1201.85 (389.44) 0.141 (0.046) [[10]], A, 128-192 65 14,388 22 1.88 (7.76) 41.42 (170.72) 3090 (749.77) 0.215 (0.052) this work, 128-192 180 14,303 21 3.41 71.61 1787.46 0.125 [[9]], A, 128-256 90 8482 26 4.84 (14.94) 125.87 (388.44) 1016.95 (329.52) 0.120 (0.039) [[10]], A, 128-256 65 14,320 25 1.88 (7.75) 45.86 (193.75) 2620 (660.65) 0.183 (0.046) this work, 128-256 180 14,179 23 3.41 78.43 1632.03 0.115 CCs: clock cycles; CPD: critical path delay; Thr.: throughput; Norm.: normalised; throughput; Com.: compact, S: speed is improved; and A: area is improved. The bold values are used to denote the results of the proposed works. The employed 180 nm ASIC technology is not so recent compared with the 90 and 65 nm ones, which were used in the competitive designs. To ensure a fair and clear comparison, for different technologies (90 and 65 nm), the parameters CPD, time, throughput and throughput/area (Table 4) of other works are normalised (scaled) to 180 nm technology based on presented methods in works [[22], [23]]. The proposed structures archived the better timing information based on the normalised results. As given in this table, the proposed structures consume acceptable hardware resources with reasonable timing characteristics compared with the other architectures. We also get improvements in terms of area, throughput and throughput/area. Results of the proposed implementation on flexible CLEFIA cipher are shown in Table 5. This structure supports three main key sizes of 128, 192 and 256 bit. As given in Table 5, the proposed structure consumes an acceptable area with low CPDs. Table 5. Results of the proposed implementations on flexible CLEFIA cipher Works Technology Area (GE) Number of CCs (128/192/256) CPD, ns Time, ns (128/192/256) Thr., Mbps (128/192/256) Thr./area, Mbps/GE (128/192/256) this work 180 nm 14,951 (15/21/23) 4.045 (60.675/84.945/93.035) (2109.6/1506.86/1375.823) (0.141/0.101/0.092) 6 Conclusion Efficient and flexible ASIC implementations of the lightweight CLEFIA block cipher are presented. The most complex blocks in the CLEFIA algorithm are substitution boxes ( and ). The S-box is implemented based on area-optimised combinational logic circuits by further simplification of the algebraic structure of S-boxes. The S-box is implemented based on a field inversion over and two affine transformations over . The proposed structure of inverse is designed over the composite field , which is an important factor for the reduction of area consumption. Besides, we proposed a flexible structure that can perform various configurations of CLEFIA cipher to support variable key sizes 128, 192 and 256 bit. This architecture provides a versatile implementation that supports different security levels using a variable key size. Implementation results of the proposed architectures in 180 nm CMOS technology for different key sizes are achieved. The results show improvements in terms of area, throughput and throughput/area compared with other existing works. 7 References [1]Hatzivasilis, G., Fysarakis, K., Papaefstathiou, I., et al.: 'A review of lightweight block ciphers', J. Cryptogr. Eng., 2018, 8, (2), pp. 141– 184 [2]Mohd, B.J., Hayajneh, T., Vasilakos, A.V.: 'A survey on lightweight block ciphers for low-resource devices: comparative study and open issues', J. Cryptogr. Eng., 2015, 58, pp. 73– 93 [3]Kitsos, P., Sklavos, N., Parousi, M., et al.: 'A comparative study of hardware architectures for lightweight block ciphers', J. Cryptogr. Eng., 2012, 38, pp. 148– 160 [4]Rezaeian Farashahi, R., Rashidi, B., Sayedi, S.M.: 'FPGA based fast and high-throughput 2-slow retiming 128 14;bit AES encryption algorithm', Microelectron. J., 2014, 45, pp. 1014– 1025 [5] The 128 bit block cipher CLEFIA: algorithm specification, Sony Corporation, Version 1, 2010 [6]Shirai, T., Shibutani, K., Akishita, T., et al.: 'The 128 14;bit block cipher CLEFIA (extended abstract)'. Proc. Int. Workshop on Fast Software Encryption, Luxembourg, 2007 (LNCS, 4593), pp. 181– 195 [7] CLEFIA standardization in ISO/IEC 29192-2. Available at http://www.sony.net/Products/cryptography/clefia/standard/iso.html, accessed in November 2012 [8]Akishita, T., Hiwatari, H.: 'Very compact hardware implementations of the block cipher CLEFIA'. Proc. Int. Workshop on Selected Areas in Cryptography, Toronto, Canada, 2012 (LNCS, 7118), pp. 278– 292 [9]Sugawara, T., Homma, N., Aoki, T., et al.: 'High-performance ASIC implementations of the 128 14;bit block cipher CLEFIA'. Proc. Int. Workshop on Selected Areas in Cryptography, Seattle, WA, USA, 2008 (LNCS, 7118), pp. 2925– 2928 [10]Mozaffari-Kermani, M., Azarderakhsh, R.: 'Efficient fault diagnosis schemes for reliable lightweight cryptographic ISO/IEC standard CLEFIA benchmarked on ASIC and FPGA', IEEE Trans. Ind. Electron., 2013, 60, (12), pp. 5925– 5932 [11]Chaves, R.: ' Embedded systems design with FPGA: compact CLEFIA implementation on FPGAs' ( Springer, New York, 2013, 1st edn.), pp. 225– 243 [12]Resende, J.C., Chaves, R.: 'Dual CLEFIA/AES cipher core on FPGA'. Proc. Int. Symp. Applied Reconfigurable Computing, Bochum, Germany, 2015 (LNCS, 9040), pp. 229– 240 [13]Kryjak, T., Gorgon, M.: 'Pipeline implementation of the 128 14;bit block cipher CLEFIA in FPGA'. Proc. Int. Conf. Field Programmable Logic and Applications, Prague, Czech Republic, 2009, pp. 373– 378 [14]Suryawanshi, V.A., Manna, G.C., Dorale, S.S.: 'Compact and high-speed hardware implementation of the block – cipher clefia', Int. J. Comput. Appl., 2016, 133, (8), pp. 17– 20 [15]Proenca, T., Chaves, R.: 'Compact CLEFIA implementation on FPGAS'. Proc. 21st Int. Conf. Field Programmable Logic and Applications, Chania, Greece, 2012, pp. 512– 517 [16]Bittencourt, J.C., Resende, J.C., Oliveira, W.L., et al.: 'CLEFIA implementation with full key expansion'. Proc. Euromicro Conf. Digital System Design, Funchal, Portugal, 2015, pp. 555– 558 [17]Hanley, N., Neill, M.: 'Hardware comparison of the ISO/IEC 29192-2 block ciphers'. Proc. Computer Society Annual Symp. VLSI, Amherst, MA, USA, 2012, pp. 57– 62 [18]Rudra, A., Dubey, P.K., Jutla, C.S., et al.: 'Efficient Rijndael encryption implementation with composite field arithmetic'. Proc. Cryptographic Hardware and Embedded Systems (CHES), Paris, France, 2001 (LNCS, 2162), pp. 171– 184 [19]Paar, C.: 'Efficient VLSI architectures for bit-parallel computation in Galois fields'. PhD thesis, Institute for Experimental Mathematics, University of Essen, Essen, Germany, June 1994 [20]Rashidi, B., Sayedi, S.M., Rezaeian Farashahi, R.: 'Efficient implementation of bit-parallel fault-tolerant polynomial basis multiplication and squaring over ', IET Comput. Digit. Tech., 2016, 10, (1), pp. 18– 29 [21]Rashidi, B., Rezaeian Farashahi, R., Sayedi, S.M.: 'Fast and pipelined bit-parallel Montgomery multiplication and squaring over '. Proc. 12th Int. Iranian Society of Cryptology Information Security and Cryptology (ISCISC), Gillan, Iran, 2015, pp. 17– 22 [22]Stillmaker, A., Baas, B.: 'Scaling equations for the accurate prediction of CMOS device performance from 180 to 7 nm', Integr. VLSI J., 2017, 58, pp. 74– 81 [23]Wong, H.-S., Frank, D.J., Solomon, P., et al.: 'Nanoscale CMOS', Proc. IEEE, 1999, 87, (4), pp. 537– 570 Citing Literature Volume14, Issue2March 2020Pages 69-79 FiguresReferencesRelatedInformation