## 4 Emerging Lightweight Security Approaches
### Symmetric Encryption--Lightweight AES Approaches
#### 4.1.4 Authenticated Lightweight Encryption (ALE)  
Authenticated Lightweight Encryption (ALE) [79] is a new AES-128 mode of operation, which can be compared with the high-performance authenticated encryption scheme called Offset Codebook (OCB) mode that is also used with AES block cipher. However, the designers of ALE argue that ALE requires less memory and a smaller circuit than OCB.  
ALE supports both encryption and authentication/integrity by generating a message authentication code (MAC) while it encrypts the data. It is a _single-pass_ scheme because the encryption and authentication are done in the same AES rounds. On the other hand, strategies such as Encrypt-then-MAC (EtM), which were reviewed earlier, require two AES  
Figure 8: A lightweight AES proposal (LAES) [78] replaces MixColumns with Permutation.  
operations, or two passes: first, plaintext data go through all AES rounds, and then the encrypted data plus header fields have to go through all AES rounds to generate the MAC.  
Moreover, ALE's design relies on a nonce (i.e., a random number used once) and associated data, in addition to the message, which is divided into blocks of 128 bits and an equally sized master key k. Associated data are data that do not need to be encrypted, but need to have an MAC calculated. For these reasons, ALE is considered a single-pass authenticated encryption with associated data (AEAD) algorithm.  
The design of ALE is novel compared to the previous AES lightweight schemes described in this section. ALE not only optimizes its hardware architecture by using parallel MixColumns and a high-performance S-Box, but it also reduces the number of AES rounds in most operations. It decreases the encryption from ten rounds to four, including a simpler four-round key schedule.  
ALE also can be considered a hybrid scheme, as it is referenced in the survey by [PERSON] et al. [22]. ALE's hybrid nature comes from mixing block cipher and stream cipher operations since it uses features from the LEX streaming cipher [88], where a block cipher outputs (or leaks) bits as it encrypts. The way that ALE works is that, while it encrypts the associated data using four AES rounds, it leaks sixteen bytes (128 bits) of data, which are then XORed with the first message or plaintext block to create the ciphertext, and so on. There is an initialization phase to generate the key state and data state. Then, the data state is used as input to create the associated data, also using four AES rounds. This simplified explanation shows how AES can be used using less rounds.  
When ALE is implemented in an application-specific integrated circuit (ASIC) or chip, in terms of the circuit size, ALE is compared to a stream cipher called ASC-1 [89]. ALE is roughly half the size of ASC-1's implementation, but its speed is around 4.5 times faster than that of ASC-1. The algorithm requires only 2500 gate equivalents (GEs) of area, which is significantly smaller than that of the lightweight implementations for AES-OCB and AES-CCM. In the use of parallel software using Intel's AES new instructions (AES-NI), ALE significantly outperforms AES-GCM, AES-CCM, and ASC-1. Given its hardware efficiency and high performance, it is regarded as an all-round AEAD algorithm.