# Software Design and Experimental Evaluation of a Reduced AES for IoT Applications
###### Abstract  
IoT devices include RFID tags, microprocessors, sensors, readers, and actuators. Their main characteristics are their limited resources and computing capabilities, which pose critical challenges to the reliability and security of their applications. Encryption is necessary for security when using these limited-resource devices, but conventional cryptographic algorithms are too heavyweight and resource-demanding to run on IoT infrastructures. This paper presents a lightweight version of AES (called LAES), which provides competitive results in terms of randomness levels and processing time, operating on GF(2\({}^{4}\)). Detailed mathematical operations and proofs are presented concerning LAES rounds design fundamentals. The proposed LAES algorithm is evaluated based on its randomness, performance, and power consumption; it is then compared to other cryptographic algorithm variants, namely Present, Clefia, and AES. The design of the randomness and performance analysis is based on six measures developed with the help of the NIST test statistical suite of cryptographic applications. The performance and power consumption of LAES on a low-power, 8-bit microcontroller unit were evaluated using an Arduino Uno board. LAES was found to have competitive randomness levels, processing times, and power consumption compared to Present, Clefia, and AES.  
lightweight cryptography; randomness analysis; internet of things +
Footnote †: journal:  
0000-0001-13273-3300/00000-0000-0000-0000-0000-0000-0000-0000-00000-0000-00000-0000-00000-0000-0000  
is an ongoing challenge. IoT-constrained devices, such as wireless sensors, need to provide rigorous security for transmitting huge volumes of data while eluding several attacks and vulnerabilities [7; 8]. In order to achieve security when using these limited-resource devices, encryption is required; however, conventional cryptographic algorithms are too heavyweight and resource-demanding to run effectively on IoT infrastructures [9].  
Cryptographic algorithm output should be random, so that output analysis cannot predict the algorithm. An algorithm of this kind is said to be indistinguishable from a random permutation [10; 11]; therefore, it is crucial to use statistical randomness tests to evaluate algorithm output. As indicated by NIST, the randomness test should take place in the early stages of cryptographic algorithm design, to determine whether or not the cryptographic algorithm is suitable for a particular cryptographic application; further cryptanalysis can then be applied to assess the robustness of its design. Usually, if a cryptographic algorithm fails the randomness test, a relationship exists between the plaintext and ciphertext bits that can be discovered through the use of the relevant cryptanalytic tools and analysis.  
This paper is motivated by the advances of the information technology era, which have led to increased connections between different types of IoT devices with special security requirements based on multiple constraints. It is almost impossible to use common cryptographic algorithms to meet these different cryptographic constraints, considering application contexts and available resources [6; 12; 13]. Usually, IoT devices are characterized by limited power resources (e.g., the limited computational power of microprocessors and microcontrollers), limited memory size, compact hardware implementation, and limited battery life. The research community and the International Organization for Standardization (ISO) were prompted to standardize the principle of lightweight cryptography in ISO/IEC 29192-2012, a multi-part international standard that specifies the prerequisites, guidance, and design recommendations for lightweight cryptographic algorithms.