Resource-efficient cryptographic primitives become fundamental for realizing both security and efficiency in embedded systems like RFID tags and sensor nodes. Among those primitives, lightweight block cipher plays a major role as a building block for security protocols. In this paper, we describe a new family of lightweight block ciphers named KLEIN, which is designed for resource-constrained devices such as wireless sensors and RFID tags. Compared to the related proposals, KLEIN has advantage in the software performance on legacy sensor platforms, while its hardware implementation can be compact as well. Key words. Block cipher, Wireless sensor network, Low-resource implementation. in both hardware and software. At FSE'07, Leander et al. [31] proposed a family of new lightweight variants of DES, which are called DESL\DESX\DESXL. The main idea of the new variants of DES is to use just one S-box recursively, instead of eight different S-boxes. Bogdanov et al. proposed [2] an ultralightweight block cipher which is called PRESENT. The design of PRESENT is extremely hardware efficient, since it uses a fully wired diffusion layer without any algebraic unit. KATAN and KTANTAN are designed as a family of ultra-lightweight block ciphers by De Cannière et al. [15] . Both KATAN and KTANTAN use an 80-bit key length with 32, 48, or 64-bit block size, while KTANTAN is more compact in hardware since its key will be unchangeably burnt on devices. In [17], Engels et al. proposed a novel ultra-lightweight cryptographic algorithm with 256-bit key length and 16-bit block size, referred to as Hummingbird, for resource-constrained devices. The security of any block cipher should be extensively analyzed before its wide implementation. Biham et al. have discovered an impossible differential attack on 31 of the 32 rounds [1] of Skipjack. A truncated differential attack was also published against 28 rounds of Skipjack by Knudsen et al. [27]. Granboulan [22] presented a revised result in the differential analysis of Skipjack. By exploiting its periodic key schedule, a complementation slide attack is mounted on the full 32 rounds of Skipjack [42] . The attack requires only 2 32.5 known texts and 2 44 encryptions of Skipjack. In a NESSIE report, Knudsen and Raddum [26] showed that "indirect mode" NOEKEON was still vulnerable to certain peculiar kinds of related-key cryptanalysis, and discovered weaknesses in NOEKEON-variant ciphers which cast doubt on the design strategy behind NOEKEON and thus on its security. As a result NOEKEON was not selected by NESSIE. Although PRESENT has a hardware-efficient diffusion layer, different attacks have been applied to PRESENT due to its diffusion property, e.g. the weak key attack [39, 40] , the linear attack [6] and the saturation attack [7] . Recently, Bogdanov and Rechberger [4] have proposed a meetin-the-middle attack on KTANTAN. It remains a challenging work to design a lightweight block cipher which has a good security margin and resists all known attacks. The performance of a block cipher is also an important factor for resource-constrained devices. Most of the lightweight proposals claim their efficiency in hardware. The area in Gate equivalents (GE) is often used as a measure for the compactness of the hardware implementation. Generally speaks, one GE is equal to the area which is required by two-input NAND gate with the lowest driving strength of the appropriate technology [41]. PRESENT, for example, has a compact implementation with 1570 GE in a 64-bit width datapath [3], as well as an very lightweight implementation with 1000 GE [43] . mCrypton and DESXL are also competitive since they are close to the 2000 GE barrier. HIGHT is less attractive since its area in GE is over 3000 GE, which is close to the best AES implementation [23] (with 3100 GE) and [19] (with 3400 GE). KATAN and KTANTAN are the most hardware-efficient block ciphers which require less than 1000 GE [15] . Usually, sensors have better power and hardware capabilities than RFID tags. Since software implementations have the advantages of flexibility and economy in manufacture and maintenance, it is believed that software-efficient block ciphers are more practical for sensors. In this paper, a new family of block ciphers called KLEIN is designed for resource-constrained devices. Compared to the related proposals, KLEIN has the advantage of the software performance on legacy sensor platforms and at the same time its hardware implementation can also be compact. Our security analysis shows that KLEIN has a conservative security margin against various cryptanalyses. The remainder of this paper is organized as follows. Section 2 and 3 describe the design rationale and the specification of the KLEIN family. In Section 4, the security of KLEIN is analyzed by considering known attacks. Compared to related lightweight proposals, a detailed performance of KLEIN is discussed in Section 5. Section 6 concludes the paper.
For example, in REF , the authors describe a new family of lightweight block ciphers named KLEIN, which are designed to be usable as building blocks for security in resource-constrained devices.
KLEIN: A New Family of Lightweight Block Ciphers
RFIDSec
Computer Science Physics