# Evaluating the Performance of Lightweight Ciphers in Constrained Environments--The Case of Saturnin
###### Abstract  
The use of lightweight cryptographic algorithms is essential for addressing security in highly constrained environments such as the Internet of Things. In this paper, the performance of lightweight block ciphers in such highly constrained environments is studied. More precisely, focusing--as a case study--on an important family of lightweight ciphers called \"Saturnin\", which has been evaluated as a candidate for standardization in the relative ongoing NIST's competition, we analyze its efficiency in case that it is implemented in a specific resource-constrained environment. To evaluate the results, a comparative study with the Advanced Encryption Standard (AES) is performed, through an appropriate experimental environment. Our results illustrate that significant gain in performance can be achieved, since Saturnin--whose design is inspired by the design of AES--can be almost two times faster than AES in such restricted environments. lightweight cryptography; performance; Saturnin +
Footnote †: journal:  
as lightweight cryptographic standards. NIST received 57 submissions to be considered for standardization. After the initial review of the submissions, 56 were selected as Round 1 Candidates (announced in April 2019). The second round consisted of 32 out of the initial 56 candidates (announced in August 2019). Currently, this competition is in its third round, where the finalists are 10 algorithms (announced in March 2021). Due to the high importance of the aforementioned NIST competition, there is a strong research interest in analyzing several aspects of these lightweight ciphers, including their efficiency (see, e.g., [1] and the references therein, as well as [6]). In this paper, we focus, as a case study, on a specific candidate of the NIST competition, called Saturnin [7], in order to estimate its performance (based on measurements of the time needed to perform encryption and decryption) in a realistic restricted environment. Saturnin has been chosen as an indicative example due to the fact that its design is inspired by the design of AES, whereas it is also being considered as a post-quantum secure cipher. Saturnin was a candidate cipher at the 2 nd round of the NIST competition, but it is not one of the finalists announced in March 2021. However, as it is analyzed in the status report on the second round of the NIST Lightweight Cryptography Standardization Process [8], the Saturnin team has provided a significant analysis on its security, based on the fact that the security arguments for the AES are also applicable for Saturnin since they share a common structure (although this does not mean that Saturnin is bound to achieve exactly the same security level as AES). According to [8], the main reason that Saturnin has not been chosen as a finalist for the third round was the fact that the original submission is an Encrypt-then-MAC implementation and, thus, _it does not rank as favorably as single-pass candidates in terms of throughput_. However, taking into account the security advantages of the Saturnin, and especially the fact that it is explicitly designed to resist quantum attacks with a 256-bit key and block size (despite the fact that such a resistance was not a formal requirement by the standardization process), it is of interest to further focus on its performance compared to AES. To this end, encryption and decryption have been implemented into an appropriate restricted environment, whereas a comparative study with AES, within the same environment and the same key size, is also conducted. It should be pointed out that, as it has been shown in a recent comprehensive work [6] in which all the 32 candidates in the Round 2 algorithms were examined in several platforms, the execution time of the algorithms varies significantly. Hence, any new information on the performance of lightweight ciphers on specific restricted environments is of importance, towards assisting the relevant stakeholders in selecting an appropriate algorithm for a given platform.