# PAGE--Practical AES-GCM Encryption for Low-End Microcontrollers
## 3 Face-Light: Fast AES-CTR Mode Encryption for Low-End Microcontrollers
### Karatsuba Algorithm for GHASH
In Table 5, the performance comparison of polynomial multiplication is given. For 128-bit multiplication, the previous work requires 5675 clock cycles, while the proposed implementation requires 3896 clock cycles, which is 31.3% reduction \begin{table}
\begin{tabular}{c c c} \hline \hline
**Security Level** & **16-Byte** & **64-Byte** & **1024-Byte** \\ \hline
128-bit & 807 & 510 & 415 \\
192-bit & 868 & 548 & 446 \\
256-bit & 928 & 586 & 477 \\
128-bit 1 & 843 & 529 & 430 \\
192-bit 1 & 903 & 567 & 461 \\
256-bit 1 & 964 & 604 & 491 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Performance of AES-GCM evaluated by byte length for 16-byte, 64-byte, and 1024-byte messages (clock cycles per byte). 1: register optimized version. Figure 3: CPA (Correlation Power Analysis) attack result comparison between non-masked AES and masked FACE-LIGHT implementations, (**Top**) analyzed key value table of non-masked AES through CPA attack and graphical result of correlation of key values via CPA attack on non-masking AES, (**Bottom**) analyzed key value table of masked AES through CPA attack and graphical result of the correlation of key values via CPA attack on masked AES. Table 6 compares clock cycles for 128-bit binary field multiplication. Proposed method requires 4,230 clock cycles. This high performance was achieved by optimizing polynomial multiplication and reduction operations. This is 40.9% faster than work by [PERSON] and [PERSON]. Figure 4 shows the result of CPA on the proposed GHASH function. Gray waveform shows the correlations of wrong keys and the black waveform shows the correlation of a correct key. The correlation of the correct key is indistinguishable from the wrong keys. The proposed method successfully prevents the CPA. ## 6 Conclusions

In this paper, we proposed optimized implementations of AES-CTR and AES-GCM on low-end 8-bit AVR microcontrollers. The implementation of AES-CTR is accelerated with the re-designed look-up table. This novel approach skips AES-CTR computations by ShiftRows of Round 2. The proposed method is also applied to the previous work to improve the performance, further. The implementation of AES-GCM is accelerated with the efficient binary field multiplication. The required number of general purpose registers is optimized and certain part of Karatsuba algorithm is cached. This approach is also secure against SPA, TA, and CPA. With above efficient implementations, low-end microcontrollers can provide secure and fast encryption operations. Next research topic is efficient implementation of other lightweight block ciphers with other mode of operations on low-end microcontrollers. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Cen (2010)** & **This Work** & **This Work**1 \\ \hline
5,675 & 3,896 & 4,175 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of execution timing (in terms of clock cycles) for 128-bit wise polynomial multiplication. 1: register optimized version. Figure 4: CPA on the proposed implementation of GHASH function. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Cen (2010)** & **Method** & **TA/SPA Security** & **Timing (cc)** \\ \hline [PERSON] et al. [15] & [PERSON] + Masked Block Comb & TA only & 14,878 \\ [PERSON] and [PERSON] [10] & [PERSON] + Block-Comb with Dummy XOR and ILA & TA/SPA both & 7,162 \\ This Work & [PERSON] + Block Comb with Dummy XOR and ILA & TA/SPA both & 4,230 \\ This Work 1 & [PERSON] + Block Comb with Dummy XOR and ILA & TA/SPA both & 4,497 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison of binary field multiplication in terms of execution timing (in terms of clock cycles) and countermeasures. 1: register optimized version. **Author Contributions:** K.K. and S.C. designed the entire architecture. H.K. ([PERSON]), H.K. ([PERSON]), and Z.L. performed experiments. H.S. supervised the whole process as a corresponding author. All authors discussed contents of the manuscript and wrote the manuscript. All authors have read and agreed to the published version of the manuscript.