# Efficient Parallel Implementation of CTR Mode of ARX-Based Block Ciphers on ARMv8 Microcontrollers
###### Abstract
Thus, it needs to optimize ARX-based block ciphers on IoT devices to make various IoT services operate smoothly. As massive amounts of data are communicated in wireless communication, the mode of operation such as Cipher Block Chaining (CBC) mode, Output FeedBack (OFB) mode, Cipher FeedBack (CFB) mode, and CounTeR (CTR) mode needs to be applied. Among them, CTR mode is the most widely used in industrial applications because it has the following advantages. Each block in CTR mode can be processed independently, which makes the encryption process in parallel. In addition, the CTR mode requires only the implementation of encryption process because the decryption process is identical to the encryption one. Until now, various studies have been conducted for CTR mode optimization. In CHES'18 [4], [PERSON] et al. proposed the first optimized method, called FACE, of AES-CTR mode in Intel Core i2 and i7 processors. The proposed method not only reduced unnecessary operations by looking up the five caches but can be applied to various platforms. In ICISC'19 [5], [PERSON] et al. efficiently optimized the AES-CTR mode in 8-bit AVR widely used as a low-end processor by extending the concept of FACE from [4]. In MDPI electronics'20 [6], [PERSON] et al. proposed optimized implementation of CHAM-CTR mode in 8-bit AVR MCU. They effectively reduced some operations in the initial some round functions of the revised CHAM by pre-computing round operations related to the fixed nonce value in the input block of CTR mode. In MDPI electronics'20 [7], [PERSON] et al. optimized HIGHT-CTR, LEA-CTR mode, and CTR-DRBG in 8-bit AVR MCU. HIGHT-CTR and LEA-CTR mode were optimized in the same way as [6], and in CTR-DRBG, in addition to applying the CTR mode optimization, computational overheads were efficiently reduced by looking up the pre-computation table without computing some operations within CTR-DRBG. Until now, most works on CTR mode optimization have considered only optimization on 8-bit-AVR MCU in embedded IoT devices. However, recently, ARMv8 has been widely used in various IoT devices such as smart phones and tablets. ARMv8 equips the NEON engine that can process tasks in parallel, which can be used for accelerating cryptographic operations. In this article, we propose the first parallel implementations of CTR mode optimization of ARX-based block ciphers (LEA, HIGHT, and revised CHAM) in ARMv8 architecture. For parallel implementation, we propose data parallelism and vector register scheduling to process multiple encryption simultaneously. Moreover, we apply the proposed parallel implementation to the CTR mode optimization. Our implementations pre-compute the initial few rounds by using the property that the nonce part of input block is fixed during encryption, and utilized the precomputed values for efficiency. Through the proposed methods, the maximum encryption was processed simultaneously by utilizing NEON engine. Furthermore, the actual operation can be skipped by utilizing the precomputed values for the initial few rounds in CTR mode. Thus, we achieved enhanced performance of 8.52%, 8.62%, and 15.87%, respectively, than related works in LEA-CTR mode, HIGHT-CTR mode, and revised CHAM-64/128-CTR mode. ContributionsThe contributions of this work are as follows. First parallel implementation of CTR mode on embedded devices using ARMv8 architectureUntil now, CTR mode optimization has been conducted only on 8-bit AVR, Intel Core i2, and Intel Core i7 [4; 5; 6; 7; 8]. However, there are many types of IoT platforms. Among them, ARMv8 is widely used in various IoT devices, and it supports a NEON engine that is capable of efficient parallel processing. Therefore, we present a first parallel implementation of CTR mode with ARX-based block ciphers on ARMv8 architecture. For parallel implementation, we not only present an efficient data parallelism, but also present register scheduling that maximizes the use of vector registers to simultaneously process multiple encryptions.