## 1 Introduction
Lightweight block ciphers are mainly intended for devices that have limited computation capabilities, low power, and small footprints. The ubiquitous spread of IoT and other constrained devices has increased the demand for LWC security solutions. LWC should be designed with constraints, while maintaining a certain level of security. LWC designers must balance security and the limited resources of the constrained devices. A tradeoff between security, cost, and performance should be considered when designing any lightweight cryptographic primitive [7], as illustrated in Figure 1.  
Figure 1: Tradeoffs of lightweight cryptography. Cryptographic hardware architectures entail tradeoffs between the security level, system performance, and cost. Parallel architecture provides high performance but, in turn, increases the cost. On the other hand, serial architecture has low costs, but the system performance is degraded. The length of the secret key in the cryptographic algorithms reflects the tradeoff of security versus cost. A longer key increases the security of the system but also raises the cost because more resources are utilized. Meanwhile, reducing the key length helps to reduce the cost but lowers the level of security too. In addition, rounds in cryptographic algorithms affect the system's performance and security. A higher number of rounds guarantees a higher level of security but reduces the throughput of the system. In contrast, reducing the number of rounds increases the system performance but reduces the security level. Confidentiality can be guaranteed using block and stream ciphers where only authorized entities can access the message. However, encryption ciphers do not guarantee the tampering of the encrypted message will not occur [11]. Authenticated encryption (AE) schemes can overcome this problem and provide authenticity and integrity to the message on top of the confidentiality provided by the encryption cipher. The AE can be extended to encompass some additional non-encrypted data, as in a network packet header, where both the payload and the header are authenticated but encryption is applied only to the payload. In IPsec and transport layer security (TLS), AE techniques are commonly employed. As of August 2018, the current version of TLS no longer supports non-AE algorithms like AES in cipher block chaining (CBC) mode, although end-to-end encryption is provided by such techniques in popular messaging applications. Three separate common methods referred to as generic composition are used to create authenticated encryption schemes [12]. The order of the encryption and authentication activities varies between these methods. The first composition, encrypt-then-MAC (EtM), is a sequential encryption and authentication. It begins with the encryption of the message followed by the authentication of the encrypted version of the message. The second composition, encrypt-and-MAC (E&M), is a concurrent encryption and authentication method whereby encryption and authentication are carried out independently for the original input messages. The third composition, MAC-then-encrypt (ME), refers to the use of authentication then encryption. Initially, it computes a MAC for the message, then encrypts both the resulting MAC tag and the original message in combination. When examined from numerous security perspectives, most of the current AE techniques are weak. Generic composition approaches have been subjected to a number of security attacks, and EtM proved to be the most secure [12; 13]. In industries and other critical environments, the deployed devices encounter resource limitations, lacking the necessary computation and communication capabilities. Despite these conditions, and the insufficiency of the conventional cryptographic algorithms, it is important to guarantee security for these devices. Several surveys, as referenced in [11; 14; 15; 16; 17; 18], have been conducted to address the importance of information protection within lightweight devices.