## 3 Proposed Method
### PRESENT Block Cipher
#### 3.2.2 Permutation Layer (pLayer)  
The efficiency of bit-slicing implementation is most visible in pLayer. Instructions are executed efficiently if the operand is given in the size of the computer word (e.g., 32-bit or 64-bit for modern processors). In this case, it can complete the given instructions at one time. Since the pLayer permutes every single bit, a lot of instructions are needed to implement it in software. Note that bit-wise permutation is especially cumbersome to implement in software, but it is not a problem in hardware, as it can be performed through simple wiring. Therefore, bit-wise permutation in software is more optimized if it is implemented using a lookup table. In bit-slicing, each register stores bits in blocks, so bit shifts can be treated as permuting values in a register, which is as efficient as in hardware implementation. Therefore, in bit-slicing, bit shifts in pLayer are calculated as simple value shifts between registers. The implementation of the proposed technique replaces permutation \(P\) by performing \(P0\) operation after \(P1\) operation. The proposed technique is based on the idea of [15], in which the computation of the \(P\) in two successive rounds by replacing the permutation \(P\) with \(P0\) and \(P1\). In each round, instead of using \(P\), \(P0\) and \(P1\) are used alternately. Executing \(P0\) and \(P1\) consumes fewer cycles than \(P\). However, this process requires the round key to be computed beforehand. Since we do not perform the key schedule in advance, additional calculations are required. Therefore, \(P\) was used as a combination of \(P0\) and \(P1\) in one round using only the advantage that \(P0\) and \(P1\) were faster. Since several blocks are encrypted by bit-slicing, the key update operation is also modified to the form shown Algorithm 2. Note that the rotation step is now revised; it only performs shift operations and utilizes the S-boxes combinational circuit form. round_counter is changed and added in 32-bit form. To prevent overusing registers in the GPU, the proposed technique calculates the round keys on-the-fly. Therefore, the key update is performed every round. ```
0:\(Round\ r,\ X=\{x_{0},x_{1}x_{2},\cdots,x_{78},x_{79}\}\)
0:\(Y=\{y_{0},y_{1}y_{2},\cdots,y_{78},y_{79}\}\)
1:For\(i=1\) to



The fact that bit permutation works efficiently in bit-slicing also applies to GIFT. In the proposed scheme, the last step of S-box \(\{S0,S1,S2,S3\}\leftarrow\{S3,S1,S2,S0\}\) is not performed, but a part of sLayer is performed in pLayer. As S1 and S3 change, the value of the S-box is transferred to the pLayer. Since it has been converted to a bit-slicing representation, it is possible to move the values in consideration of the changes in the values of S1 and S3 without additional operation. Through this technique, the execution time of the S-box can be further reduced. Using an S-box composed of bit-wise operators for four input bits is shown in the Algorithm 3. ```
0:x3,x2,x1,x0
0:x3,x2,x1,x0
1:\(x1=(x0\wedge x2)\oplus x1\)
2:\(x0=(x1\wedge x3)\oplus x2\)
3:\(x3=x3\oplus x2\)
4:\(x1=x1\oplus x3\)
5:\(x3=\sim x3\)
6:\(x2=(x0\wedge x1)\oplus x2\)
```
**Algorithm 3** GIFT S-box

#### 3.3.2 Permutation Layer (pLayer)

The last step of S-box \(\{S0,S1,S2,S3\}\leftarrow\{S3,S1,S2,S0\}\) is processed in pLayer. Since S1 and S3 have changed, value permutation takes place in the pLayer. Since the movement path of bits is known in pLayer, if the existing S1 and S3 are moved appropriately, the operation is possible without additional operation. The process is similar to the pLayer of the PRESENT block cipher. Similarly, pLayer with bit-sliced implementation is computed as a simple value shift between registers. Due to this reason, we found that the efficiency of bit-slicing implementation is most visible in pLayer. #### 3.3.3 Roundkey Update

Since several blocks are encrypted by bit-slicing, the picture key update operation is also changed. Rotation operations are changed to move values.