A circuit area optimization of MK-3 S-box

Authors:
raw_author_name: Yanjun Li
raw_affiliation_string: Information Industry Information Security Evaluation Center, The 15th Research Institute of China Electronic Technology Group Corporation, Beijing, 100083, China
raw_author_name: Weiguo Zhang
raw_affiliation_string: Beijing Electronic Science and Technology Institute, No.7 Fufeng Road, Fengtai Distric, Beijing, 100083, China
raw_author_name: Jian Zou
raw_affiliation_string: College of Computer and Data Science, Fuzhou University, Fuzhou, 350108, China
raw_author_name: Jian Liu
raw_affiliation_string: Information Industry Information Security Evaluation Center, The 15th Research Institute of China Electronic Technology Group Corporation, Beijing, 100083, China

Abstract: Abstract In MILCOM 2015, Kelly et al. proposed the authentication encryption algorithm MK-3, which applied the 16-bit S-box. This paper aims to implement the 16-bit S-box with less circuit area. First, we classified the irreducible polynomials over $$\mathbb {F}_{2^n}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>F</mml:mi> <mml:msup> <mml:mn>2</mml:mn> <mml:mi>n</mml:mi> </mml:msup> </mml:msub> </mml:math> into three kinds. Then we compared the logic gates required for multiplication over the finite field constructed by the three types of irreducible polynomials. According to the comparison result, we constructed the composite fields, $$\mathbb {F}_{(2^4)^2}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>F</mml:mi> <mml:msup> <mml:mrow> <mml:mo>(</mml:mo> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>4</mml:mn> </mml:msup> <mml:mo>)</mml:mo> </mml:mrow> <mml:mn>2</mml:mn> </mml:msup> </mml:msub> </mml:math> and $$\mathbb {F}_{(2^8)^2}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>F</mml:mi> <mml:msup> <mml:mrow> <mml:mo>(</mml:mo> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>8</mml:mn> </mml:msup> <mml:mo>)</mml:mo> </mml:mrow> <mml:mn>2</mml:mn> </mml:msup> </mml:msub> </mml:math> . Based on the isomorphism of finite fields, the operations over $$\mathbb {F}_{2^{16}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>F</mml:mi> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>16</mml:mn> </mml:msup> </mml:msub> </mml:math> can be conducted over $$\mathbb {F}_{(2^8)^2}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>F</mml:mi> <mml:msup> <mml:mrow> <mml:mo>(</mml:mo> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>8</mml:mn> </mml:msup> <mml:mo>)</mml:mo> </mml:mrow> <mml:mn>2</mml:mn> </mml:msup> </mml:msub> </mml:math> . Similarly, elements over $$\mathbb {F}_{2^8}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>F</mml:mi> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>8</mml:mn> </mml:msup> </mml:msub> </mml:math> can be mapped to the corresponding elements over $$\mathbb {F}_{(2^4)^2}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>F</mml:mi> <mml:msup> <mml:mrow> <mml:mo>(</mml:mo> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>4</mml:mn> </mml:msup> <mml:mo>)</mml:mo> </mml:mrow> <mml:mn>2</mml:mn> </mml:msup> </mml:msub> </mml:math> . Next, the SAT solver was used to optimize the operations over smaller field $$\mathbb {F}_{2^4}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>F</mml:mi> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>4</mml:mn> </mml:msup> </mml:msub> </mml:math> . At last, the architecture of the optimized MK-3 S-box was worked out. Compared with the implementation proposed by the original designer, the circuit area of the MK-3 S-box in this paper is reduced by at least 55.9%.