# Efficient Parallel Implementation of CTR Mode of ARX-Based Block Ciphers on ARMv8 Microcontrollers
## 3 Related Works
### Proposed Data Parallelism Technique  
In this section, we present an efficient data parallelism of LEA, HIGHT, and revised CHAM. In our data parallelism, the following techniques are used. First, the transpose operation is efficiently eliminated from the LEA and revised CHAM through the _ST4_ and _LD4_ instructions. However, since encryption is performed in units of 8-bit words in HIGHT, it is difficult to eliminate the transpose operation. Thus, we present the optimized transpose operation in HIGHT so that data parallelism can be efficiently applied. Second, we propose efficient register scheduling technique that can maximize the number of encryptions in parallel. Through proposed register scheduling, 24 encryptions are performed simultaneously for LEA, revised CHAM-128/128, and revised CHAM-128/256, and 48 encryptions are performed simultaneously for HIGHT and revised CHAM-64/128 on the NEON engine. Furthermore, to efficiently process multiple encryption simultaneously, we interleave the NEON instructions to minimize pipeline stalls. Interleaving NEON instructions is shown in Figure 7. In other words, when processing NEON instructions 1, 2, and 3, the pipeline stall is minimized by inserting other NEON instructions 1, 2, and 3 utilizing TEMP registers. Finally, we generally access memory with the maximum number of vector registers, effectively reducing the number of memory accesses.  
Figure 6: Optimization of HIGHT-CTR mode through partial pre-computation for the initial five rounds in previous work [7].  
by 232 are performed. Steps 6-7 perform \(ROR_{3}\) operation on one word to which modular addition is computed. As above, Steps 11-12 perform \(ROR_{5}\) operation on one word, and Steps 16-17 perform \(ROL_{9}\) operation on one word. By repeating the above process 24 times, the encryption of LEA-128 is completed. After that, the transpose operation is automatically applied through \(ST4\) instruction and stored in the memory, effectively reducing the computational overheads on the transpose operation. Similar to LEA-128, the proposed parallel implementation of LEA-192 and LEA-256 also perform 24 encryptions simultaneously. However, unlike LEA-128, both LEA-192 and LEA-256 take more vector registers to store round keys. Therefore, in LEA-192 and LEA-256, the \(v26\)-\(v31\) vector registers store the round keys, and the remaining \(v24\)-\(v25\) vector registers are used as the Temp registers.  
```
1:v0-v3 (Plaintexts), v28-v31 (Roundkeys)
2:v0-v3 (Ciphertexts)
3:Loading the PT, (x0: PT Address)
4:LD4 (v0.4s-v3.4s), [x0], #64
5:Loading the RK, (x1: RK Address)
6:LD1 (v28.4s-v31.4s), [x1], #64
7:Round Function
8:EOR v3.16b, v3.16b, v31.16b
9:EOR v24.16b, v2.16b, v3.16b
10:AD v24.4s, v3.4s, v24.4s
11:ROR\({}_{3}\) Operation
12:SHL v3.4s, v24.4s, #29
13:SRI v3.4s, v24.4s, #3
14:Round Function
15:EOR v2.16b, v2.16b, v31.16b
16:EOR v24.16b, v1.16b, v2.16b
17:ADD v24.4s, v24.4s
18:ROR\({}_{5}\) Operation
19:SHL v2.4s, v24.4s, #27
20:SRI v2.4s, v24.4s, #5
21:Round Function
22:RON v1.16b, v1.16b, v31.16b
23:EOR v2.16b, v1.16b, v2.16b
24:ADD v24.4s, v1.4s, v24.4s
25:ROL\({}_{9}\) Operation
26:SHL v1.4s, v24.4s, #9
27:SRI v1.4s, v24.4s, #23
```  
**Algorithm 1** Data parallel implementation of LEA-128 Round Function.