# Software Design and Experimental Evaluation of a Reduced AES for IoT Applications
## 2 Related Work
### Development and Evaluation  
The author of [32] found that AES is not appropriate for constrained environments, such as RFID tags and sensor networks; therefore, they proposed a lightweight cryptographic algorithm called Present, based on substitution-permutation network primitives. Present works on a block length of 64 bits, supporting two options for key lengths of 80 and 128 bits. For lightweight applications requiring moderate security levels, the authors recommended deploying the cryptographic algorithm using the 80-bit key length mode. Present consists of 31 rounds of encryption that use a single 4-bit S-box and a single-bit permutation table. The authors also showed that Present is robust against different types of attacks, such as differential and linear cryptanalysis [33; 34]. Celfia [35] is a lightweight cryptographic algorithm proposed by Sony Corporation labs. Celfia components are based on a Feistel networking structure divided into four data lines. Celfia uses two F-functions, each with 32 bits, for each encryption round. The F-functions were developed based on the concept of the diffusion switching mechanism (DSM) [36], and two different S-boxes were employed to enhance the overall diffusion. The number of rounds was therefore reduced to 10, 11, or 12 for the key lengths of 128, 192, and 256 bits (respectively). Celfia has shown robustness against different types of attacks and a processing encryption time comparable to that of AES. Mini-AES [37] was designed for educational purposes rather than to be considered for use secure applications. This algorithm is designed to operate in the finite field of GF(24). The plaintext is divided into blocks of 16 bits, each of which enters an encryption round that consists of four main components: NibbleSub, ShiftRow, MixColumn, and KeyAddition. 16-bit key length is used in Mini-AES encryption rounds. Mini-AES components operate in the same manner as Rijndael [38], but the design of the components is not justified in the finite field of GF(24). The work of [37] also illustrated the vulnerability of Mini-AES to square attacks. The work of [39] presented another AES variant that operates in GF(24) with the objective of performing cryptanalysis experiments on a simplified AES version, in order to understand how attacks might work. Their results suggested that the simplified version of AES is still robust against algebraic and man-in-the-middle attacks. The work of [40] highlighted the importance of the design trade-off between robust security solutions and performance optimization in terms of the area of system chips, power consumption, and memory utilization for lightweight applications. They implemented AES using the Xilinx ISE-13.2 suite and provided full pipeline encryption and decryption to utilize silicon costs. The authors also highlight the benefits of lightweight cryptographic algorithms and integrated 8-bit Kogge stone adder with x-tea to provide faster computation for large applications. The work of [41] also designed a variant of the AES S-Box to maximize performance, achieve high throughput, and utilize area efficiency. The problem of arithmetic implementations usually consuming exorbitant amounts of power is solved by implementing a solution for S-BOX construction based on [PERSON]'s field. The proposed solution is implemented using Die-to-Die (D2D) and With-In-Die (WID) variations. Table 2 compares the cryptographic algorithms discussed in this section. We focused mainly on AES, Present, and Celfia due to the fact that, among multiple block ciphers, both Present and Celfia have been certified and published in ISO/IEC 29192-2:2019 [42] as suitable cryptographic algorithms for lightweight applications.