# PAGE--Practical AES-GCM Encryption for Low-End Microcontrollers
## 3 Face-Light: Fast AES-CTR Mode Encryption for Low-End Microcontrollers
### Karatsuba Algorithm for GHASH
To evaluate the side channel attack countermeasure, the power usage during encryption operation is measured by Chipwhisperer-Lite (CW1173). ### Performance Evaluation of FACE-LIGHT

Table 1 presents the comparison of execution timing for various AES implementations. Previous AES implementations support the ECB (Electronic CodeBook) mode of operation, while the proposed implementation is targeting for the CTR mode of operation. Both implementations perform same AES encryption as a core operation. [PERSON] et al. [17] proposed the size optimized implementation, while [PERSON] et al. [18] proposed the speed optimized implementation. FACE-LIGHT and Extended FACE for AES-128 are faster than previous works by 18 and 34 clock cycles per byte, respectively. Implementations of FACE-LIGHT are 11.5%, 9.6%, and 8.3% faster than [PERSON] et al. for 128-bit, 192-bit, and 256-bit security levels, respectively. Implementations of Extended FACE are 21.5%, 18.1%, and 15.6% faster than [PERSON] et al. for 128-bit, 192-bit, and 256-bit security levels, respectively. In Table 2, the comparison of functionality is given. FACE-LIGHT does not update the table throughout the execution. The execution timing of encryption keeps constant timing. Second, target applications are different. FACE-LIGHT targets for the 8-bit microcontrollers or above, while FACE is targeting for 32-bit processors or above. The FACE method only supports by Round 2, while FACE-LIGHT is expandable up-to the Round 3. Lightweight ciphers can be implemented in masked way to deal with side channel attacks. Most lightweight ciphers are based on the ARX structure, which have significant overheads for Arithmetic-to-Boolean operation during masking operations. On the contrary, AES based on SPN structures has a relatively short operation time with the masked implementation. This is an advantage over other lightweight ciphers when it comes to the masking operation. Table 3 presents the execution timing of unmasked LEA, masked LEA, and masked AES implementations. For the LEA-128 with masking technique, the execution timing increases when the masking method is adopted, while masked AES ensures relatively short execution timing. Figure 3 presents a graph of key values and coefficient of correlation estimated via CPA on the non-masked AES and masked AES implementation. In the AES implementation without masking technique, the coefficient of correlation of all of the key values is notably higher than others. The masked AES implementation shows all key values have equal coefficients of correlation. \begin{table}
\begin{tabular}{c c c c} \hline
**Security Level** & **[PERSON] et al. [17]** & **[PERSON] et al. [18]** & **FACE-LIGHT (This work)** & **Extended FACE (This work)** \\ \hline
128-bit & 177 & 156 & 138 & 122 \\
192-bit & N/A & 186 & 168 & 153 \\
256-bit & N/A & 217 & 199 & 183 \\ \hline \end{tabular}
\end{table} 
Table 1: Comparison of AES on 8-bit AVR (Alf and Vegard’s RISC processor)microcontrollers, in terms of clock cycles per byte. \begin{table}
\begin{tabular}{c c c} \hline
**Basic LEA-128 [19]** & **Masked LEA-128 [20]** & **Masked AES-128 (This Work)** \\ \hline
168 & 2,286 & 388 \\ \hline \end{tabular}
\end{table} 
Table 3: Evaluation of LEA (Lightweight Encryption Algorithm) and AES implementations on 8-bit AVR microcontrollers, in terms of clock cycles per byte. ### Performance Evaluation of PAGE

In Table 4, the performance evaluation of AES-GCM operation is given. In case of AES-GCM-128, the clock cycles per byte of 16-byte, 64-byte and 1024-byte is 807, 510, and 415, respectively. The rest of the AES-GCM-192 and AES-GCM-256 follows the same pattern. The long message encryption is more efficient than short message encryption, because all AES-GCM computations need one encryption on the counter value and one pre-calculation of multiplication value during the initial stage. The register optimized version is also evaluated. The performance is slower than normal version by 2.8%\(\sim\)3.5%. The result shows that register optimized version is also competitive.