# Efficient Parallel Implementation of CTR Mode of ARX-Based Block Ciphers on ARMv8 Microcontrollers
## 3 Related Works
### Parallel Implementation of CTR Mode of Operation on the NEON Engine
#### 4.2.2 HIGHT-CTR Optimization
Since revised CHAM-128/128 and CHAM-128/256 are almost the same as the revised CHAM-64/128 except for word units, the proposed parallel implementation of CTR mode in revised CHAM-128/128, and CHAM-128/256 can be easily applied by changing only the lane of the vector register. Thus, we explain on a basis from revised CHAM-64/128. In common with HIGHT, revised CHAM-64/128 encrypts 64-bit blocks, and our target platform is a 64-bit processor, so the block of CTR mode consists typically of a 32-bit variable counter and a 32-bit fixed nonce. Revised CHAM-CTR mode optimization is the same as in the existing work [6], and is shown in Figure 5. Optimization of CHAM-CTR mode proposed in [6] reduces the computational overheads of round functions during encryption by pre-computing some operations in the initial few rounds using a fixed nonce part in the same way as the HIGHT-CTR and LEA-CTR optimization. To simultaneously process as many encryptions as possible, the proposed parallel implementation of the revised CHAM-CTR mode uses the same register scheduling as the proposed parallel implementation of revised CHAM, except that the \(v28\)-\(v31\) vector registers are used to store the RK and pre-computation table. Algorithm 7 shows the parallel implementation of the initial seven rounds in the CTR mode optimization of revised CHAM-64/128. After the seven rounds, the round functions are performed in the same way as the proposed parallel implementation of revised CHAM-64/128. In Algorithm 7, round functions until seven rounds are shown for eight plaintexts, and the remaining plaintexts are encrypted with interleaving NEON instructions using the Temp registers. As shown in Figure 5, a block of the revised CHAM-CTR mode consists of \(X_{0,2}\) and \(X_{0,3}\) words, which are a fixed nonce part, and \(X_{0,0}\) and \(X_{0,1}\) words, which are a variable counter part. In Step 1, the round keys used for Round 1 are loaded into vector registers. In Round 1, round operations of \(X_{0,0}\) and \(X_{0,1}\) words are required. Since \(X_{0,0}\) and \(X_{0,1}\) words are all variable counter parts, pre-computation is impossible, so the round function is normally performed for \(X_{0,0}\) and \(X_{0,1}\) words. In Step 2, the pre-computed values to be used in Round 2 and Round 4 are loaded into vector registers. In Round 2, the round function is performed for \(X_{1,0}\) word with \(X_{1,1}\) word. At this time, the pre-computed value is used, so that the computational overheads for the \(ROL_{8}\) and \(XOR\) operations to be originally performed are reduced. In Steps 3-8, the round operations for \(X_{1,0}\) word are processed by using the pre-computed value. ```
0:v0-v3(Plaintexts), v28-v31(Roundkeys and Table)
0:v0-v3(Ciphertexts) Loading RK (x1: RK Address)
1:LD1 [v29.8h], [x1], #16 Loading the table (x2: pre-computation table Address)
2:LD1 [v28.8h-v29.8h], [x2], #32
2 Round Function
3:EDR v1.16b, v27.16b, v1.16b
4:ADD v24.8h, v1.8h, v28.8h
5:SHL v1.8h, v24.8h, #16
6:SHL v1.8h, v24.8h, #15
7:MOV1 v29.8h, #1
8:ADD v27.8h, v27.8h, v29.8h
3 Round Function
9:MOV1 v29.8h, #1
10:ADD v27.8h, v27.8h, v29.8h Loading RK
11:LD1 [v30.8h-v31.8h], [x1], #32
4 Round Function
12:REV16 v24.16b, v0.16b
13:EDR v24.16b, v30.16b, v24.16b
14:ADD v24.8h, v29.8h, v24.8h
15:SHL v3.8h, v24.8h, #16
17:MOV1 v29.8h, #18
18:ADD v27.8h, v27.8h, v29.8h Loading the table
19:LD1 [v30.8h-v31.8h], [x2]
20:found Function
21:EDR v1.16b, v27.16b, v1.16b
22:ADD v24.8h, v1.8h, v30.8h
23:SHL v1.8h, v24.8h, #1
24:SRL v1.8h, v24.8h, #15
25:MOV1 v29.8h, #1
26:ADD v27.8h, v27.8h, v29.8h Loading RK
27:LD1 [v28.8h-v29.8h], [x1], #32
7 Round Function
28:SHL v24.8h, v3.8h, #1
29:BR v24.8h, v3.8h, #15
20:ERO v24.16b, v24.16b, v28.16b
30:ADD v24.8h, v24.8h, v31.8h
31:REV16 v2.16b, v24.16b
32:MOV1 v29.8h, #1
33:ADD v27.8h, v27.8h, v29.8h
```

**Algorithm 7** Parallel implementation of the revised CHAM-64/128-CTR mode optimization.