# Efficient Parallel Implementation of CTR Mode of ARX-Based Block Ciphers on ARMv8 Microcontrollers
## 3 Related Works
### Parallel Implementation of CTR Mode of Operation on the NEON Engine
#### 4.2.1. LEA-CTR Optimization  
We describe how to efficiently process multiple encryption simultaneously by applying the proposed LEA-CTR mode optimization. In CTR mode optimization, the positions of the counter and nonce are not decided within the block. In addition, the size of the counter is not determined, and, for consideration of security, counters are used typically to have a period of \(2^{32}\) on 32-bit processors. Unlike previous work [7], we change the counter position in order to apply the proposed technique to one more round compared to the previous work [7]. Figure 11 shows the optimization of the LEA-CTR mode that can bypass some round operations of the initial four rounds by using a fixed nonce value. To give detailed description of round function up until the optimized rounds, we express \(X_{i,j}\) word (\(i\in 0,4,j\in 0,3\)) as the word at which each round function is completed. \(X_{0,0}\), word, which is a part of the input block, is a variable counter, and the remaining \(X_{0,1}\), \(X_{0,2}\), and \(X_{0,3}\) words are fixed nonce. In the Round 1, the words except for \(X_{0,0}\) word are nonce, so the round operations can be efficiently skipped through pre-computation. In the Round 2, \(X_{1,2}\) and \(X_{1,3}\) words are still the results of fixed nonces, so round operations are efficiently bypassed by looking up the pre-computation table. The remaining \(X_{1,0}\) and \(X_{1,1}\) words are affected by the variable counter, so round operations are required, and round operations are performed through pre-computation with fixed nonce. In the Round 3, round function operations of \(X_{2,1}\) and \(X_{2,0}\) words affected by the variable counter in the Round 2 and Round 3 and \(X_{2,2}\) word affected by the counter from the previous rounds are required. Some round operations are efficiently performed by looking up the pre-computation table rather than computing the round operations. In the Round 4 rounds, all words except \(X_{3,0}\) word are affected by the variable counter, so the round operation of the Round 4 is partially reduced through the pre-computation on the \(X_{3,0}\) word. The parallel implementation of LEA-CTR mode simultaneously processes the same number of encryptions as the proposed parallel implementation of LEA. To process the same number of encryptions as the proposed parallel implementation of LEA, the register scheduling for parallel implementation of LEA-CTR mode is similar to the proposed parallel implementation of LEA, and the following differences exist. The \(v26\)-\(v28\) vector registers are used to store the pre-computation table when performing 1-4 rounds, and the remaining \(v29\)-\(v31\) vector registers store the round keys. After round 4, the same register scheduling as the parallel implementation of LEA is applied. Algorithm 5 shows the optimization of the initial four rounds in LEA-CTR mode for four plaintexts. The rest of the plaintexts are processed by efficiently interleaving NEON instructions using the Temp registers. In Steps 1-2, the round keys and pre-computation table for rounds 1-2 are loaded into vector registers, respectively. In Steps 3-6, which are the steps of performing Round 1, only the \(X_{0,0}\) word, the variable counter, requires the round operations. By bypassing the round operations for the remaining words, the computational overheads required for Round 1 are efficiently reduced. Steps 7-14 show the round operations of Round 2. Steps 7-10 are the round operation process for \(X_{1,0}\) word that is affected by the variable counter in Round 2. Steps 11-14 are the process of performing the round operations of the word containing the variable counter, and the remaining \(X_{1,2}\) and \(X_{1,3}\) words are for nonce, so round operations are not required. In Steps 15-16, the round keys and pre-computation table to be used in Round 3 and Round 4 are loaded into vector registers. Steps 17-29 represent the round operations process in Round 3.