# Efficient Parallel Implementation of CTR Mode of ARX-Based Block Ciphers on ARMv8 Microcontrollers
## 2 Background
### NEON Engine and ASIMD Instructions
#### 2.2.3. Revised CHAM Block Cipher  
In ICISC'17 [16], CHAM family was proposed for efficient encryption in environments with limited resources such as 8-bit and 16-bit. CHAM family is an ARX-based ultra-lightweight block ciphers that does not use Sbox operation. The key schedule of CHAM family does not renew the round keys, effectively reducing the memory space for storing round keys. Furthermore, the CHAM family has shown that H/W and S/W implementation are also more efficient than other lightweight block ciphers. In H/W implementation, it can be implemented with a smaller area than SIMON [17] block cipher that shows the most optimal performance. In S/W implementation, it provides more efficient performance  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Cipher** & \(Block\) \(Size\) & \(Key\) \(Size\) & \(Round\) \(Number\) & \(Word\) \(Size\) \\ \hline
**LEA-128** & 128 & 128 & 24 & 32 \\
**LEA-192** & 128 & 192 & 28 & 32 \\
**LEA-256** & 128 & 256 & 32 & 32 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Parameters of LEA [1].  
Figure 3: HIGHT round function [2] (\(SK\): subkey, \(F_{0}\), \(F_{1}\): functions, and \(\ll\)\(\ll\): rotate operation).  
than the SPECK [17] block cipher, which shows the most optimal performance in S/W. The CHAM family can be classified into three block ciphers according to parameters, and the composition of the CHAM family is shown in Table 3. In the key schedule of CHAM, it is composed of \(ROL_{1}\), \(ROL_{11}\), \(ROL_{8}\) and \(XOR\) operations. Through these operations, round keys (\(2*k/w\)) that are much less than the round required for each CHAM block ciphers are generated. In the round function of CHAM, it is made up of modular addition, rotate operations (\(ROL_{1}\) and \(ROL_{8}\)), and \(XOR\) operations. These operations are performed on only one word in each round of CHAM. Thus, it performs the round function with only very light operations compared to other lightweight block ciphers. Figure 4 shows the round function of CHAM. Recently, in ICISC'19 [3], the inventor of original CHAM revealed a new differential characteristic using the SAT solver in the existing CHAM family, and proposed a revised CHAM family to provide sufficient security. Using the SAT solver, the differential characteristics of the existing CHAM-64/128 and CHAM-128/\(k\) were found in rounds 39 and 62, and any related-key differential characteristics to round 47 were found in the CHAM family. The revised CHAM family is the same as the CHAM family, but, in order to provide sufficient security for these differential characteristics, the revised CHAM family is a version that increases the number of rounds from 80 to 88 in CHAM-64/128, from 80 to 112 in CHAM-128/128, and from 96 to 120 in CHAM-128/256, respectively. Despite the increase in the number of rounds in the revised CHAM family, in case of H/W implementation, the revised CHAM family remains the same as that of the existing CHAM family. In case of S/W implementation, the revised CHAM family is comparable to SPECK, which is known to have the best performance in S/W.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline Cipher & \(Block\)\(Size\) & \(Key\)\(Size\) & \(Round\)\(Number\) & \(Word\)\(Size\) \\ \hline
**CHAM-64/128** & 64 & 128 & 80 & 16 \\
**CHAM-128/128** & 128 & 128 & 80 & 32 \\
**CHAM-128/256** & 128 & 256 & 96 & 32 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Parameters of CHAM [16].  
Figure 4: CHAM round functions [16] (\(RK_{odd}\): \(RK_{immod2k/w}\), \(RK_{even}\): \(RK_{i+1 mod2k/w}\), \(ROL_{8}\) and \(ROL_{1}\): rotate operations).