# Design Trends and Comparative Analysis of Lightweight Block Ciphers for IoTs
## 4 Related Work
### Feistel Network (FN)
This paper proposes an improved S-box layer for the RoadRuner [32] lightweight block cipher, aiming to optimize its hardware performance. The new S-box design consists of eight different 4-bit S-boxes as depicted in Figure 24, each derived from affine transformations and a shared quadratic permutation, reducing area consumption by 51% compared to the traditional lookup table (LUT) approach. The optimized design enhances hardware efficiency by reusing the same quadratic permutation in the construction of each 4-bit S-box, significantly lowering resource overhead. The implementation, synthesized on 0.18 \(\upmu\)m CMOS technology, achieves a reduced area of 124 gate equivalents (GEs), while the traditional LUT method requires 251 GE. This optimization makes RoadRuner more suitable for hardware-limited environments, such as smart cards, by allowing more compact and efficient implementations for parallelism and pipelining. The improved Roadruner algorithm focuses on hardware optimization, reducing area consumption by 51% through a shared quadratic permutation across multiple S-boxes. However, this optimization introduces increased complexity in S-box composition and limits its efficiency in high-parallelism or software-based applications. Additionally, while security remains comparable to the original, the improvements do not significantly enhance resilience against advanced cryptanalysis. LWBCLLWBC the MANTRA [33] cipher is an ultra-LWBC designed for resource-constrained applications such as RFID and IoTs. It operates on 64-bit plaintext and supports both 80-bit and 128-bit keys. The cipher uses a Feistel network within a Feistel structure as depicted in Figure 25, with a strong S-box and permutation layer that provides robust resistance to linear, differential, and zero correlation attacks. With a low footprint, MANTRA requires only 1662 gate equivalents (GEs) for a 128-bit key and 1374 GEs for an 80-bit key. The design minimizes memory and power consumption, making it highly suitable for embedded systems. Security analysis demonstrates that MANTRA performs well against  
Figure 23: Improved DLBCL algorithm layers. various cryptanalytic attacks, including biclique and key collision attacks, while offering efficient performance in both hardware and software implementations. MANTRA is optimized for software-based applications but less efficient for hardware implementations. Its computational complexity is high, and while resistant to basic attacks, its security against advanced cryptanalysis remains unverified. The low gate equivalent (GE) count may impact long-term security, and performance on non-ARM architectures and execution speed require further evaluation. FlexAEAD [34] is a lightweight authenticated encryption with associated data (AEAD) cipher family designed for efficiency and security in resource-constrained environments. The algorithm integrates both encryption and authentication in a single process, making it more resource-efficient than separate encryption and hashing methods. FlexAEAD v1.1, an improved version, addresses vulnerabilities identified in earlier versions, such as padding attacks and iterated differential attacks. It uses a key-dependent permutation function (PFK) along with multiple rounds involving S-box layers, mix layers, and shuffle operations  
Figure 24: Design of the merged Roadrunner S-Box layer implementation. Figure 25: MANTRA Feistel structure. to ensure strong cryptographic properties, as illustrated in Figure 26. The cipher supports various block and key sizes, and its performance is optimized for multi-core processing, allowing parallelization. Its security has been evaluated against differential and linear cryptanalysis, demonstrating its resistance to these attacks. FlexAEAD is well-suited for applications requiring lightweight encryption with built-in authentication, making it ideal for IoTs and other embedded systems. The FlexAEAD algorithm has higher computational overhead due to extra XOR operations and key-dependent permutations.