PRINTcipher: A Block Cipher for IC Printing
L. Knudsen, G. Leander, A. Poschmann, and M. Robshaw
Axel PoschmannDivision of Mathematical Sciences, School of Physical and Mathematical Sciences
18 August 2010
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010
Outline
• Motivation• PRINTcipher• Security Analysis• Implementation Results• Conclusions
2
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 3
Acknowledgement
Dr. Jasmin Wörle
Project
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 4
Motivation
Organic electronics,
Still in its infancy:
A.k.a.
Allows unique devices
Polymer electronicsPlastic electronics,
IC Printing
Ultra-constrained
15um structure width
Ideal for low-cost RFID tags
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010
Outline
• Motivation• PRINTcipher• Security Analysis• Implementation Results• Conclusions
5
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 6
Observations
11 GE
SS
28 GE
→ - 50%• Smaller S-box save GE (but need to increase rounds)
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 6
Observations
• Storage is most expensive → minimize block size
11 GE
SS
28 GE
→ - 50%• Smaller S-box save GE (but need to increase rounds)
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 6
Observations
• Storage is most expensive → minimize block size• BUT! State size is lower bounded -> minimize key schedule
11 GE
SS
28 GE
→ - 50%• Smaller S-box save GE (but need to increase rounds)
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 6
Observations
• Storage is most expensive → minimize block size• BUT! State size is lower bounded -> minimize key schedule• In RFID scenarios key is most likely fixed
11 GE
SS
28 GE
→ - 50%• Smaller S-box save GE (but need to increase rounds)
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 6
Observations
• Storage is most expensive → minimize block size• BUT! State size is lower bounded -> minimize key schedule• In RFID scenarios key is most likely fixed• Addition: non-fixed vs. fixed value (n bits)
11 GE
SS
28 GE
→ - 50%
n x 2.67 GE n/2 x 0.67 GE→ - 87.5%
• Smaller S-box save GE (but need to increase rounds)
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 6
Observations
• Storage is most expensive → minimize block size• BUT! State size is lower bounded -> minimize key schedule• In RFID scenarios key is most likely fixed• Addition: non-fixed vs. fixed value (n bits)
11 GE
SS
28 GE
→ - 50%
n x 2.67 GE n/2 x 0.67 GE→ - 87.5%
• Smaller S-box save GE (but need to increase rounds)
0 GE
• Bit permutations are for free
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 7
S-Box
• 3 x 3 S-box• optimal wrt. LC and DC• min occurrence of single-bit to single-bit differences/masks• 384 optimal S-boxes in total
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 7
S-Box
• 3 x 3 S-box• optimal wrt. LC and DC• min occurrence of single-bit to single-bit differences/masks• 384 optimal S-boxes in total
c1
S
p
c2
23
23
6
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 7
S-Box
• 3 x 3 S-box• optimal wrt. LC and DC• min occurrence of single-bit to single-bit differences/masks• 384 optimal S-boxes in total
c1
S
p
c2
23
23
6
1
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 7
S-Box
• 3 x 3 S-box• optimal wrt. LC and DC• min occurrence of single-bit to single-bit differences/masks• 384 optimal S-boxes in total
c1
S
p
c2
23
23
6 423
1
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 7
S-Box
• 3 x 3 S-box• optimal wrt. LC and DC• min occurrence of single-bit to single-bit differences/masks• 384 optimal S-boxes in total
c1
S
p
c2
23
23
6 423
5 bit/S-box
1
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 8
PRINTcipher
47... ...0
48 x
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 8
PRINTcipher
47... ...0
48 x
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 8
PRINTcipher
sk1 48 bit
47... ...0
48 x
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 8
PRINTcipher
sk1 48 bit
47... ...0
48 x
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 8
PRINTcipher
sk1 48 bit
47... ...0
48 x
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 8
PRINTcipher
sk1 48 bit
sk2 32 bit
47... ...0
k = sk1||sk2 = 80 bit
48 x
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 8
PRINTcipher
sk1 48 bit
sk2 32 bit
vs. slide attacks
47... ...0
k = sk1||sk2 = 80 bit
48 x
PRINTcipher-48
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 8
PRINTcipher
sk1 48 bit
sk2 32 bit
vs. slide attacks
47... ...0
k = sk1||sk2 = 80 bit
48 x
sk1 96 bit
sk2 64 bit
PRINTcipher-48k = sk1||sk2 = 160 bitPRINTcipher-96
96 x
95... ...0
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010
Outline
• Motivation• PRINTcipher•Security Analysis• Implementation Results• Conclusions
9
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 10
Security Analysis I
• Differential and Linear Cryptanalysis• let p denote the probability and
q = (2p-1)2 the correlation of a linear characteristic• max p = 1/4, max q = 1/4• same for any key-dependent permuted S-box• min 1 active S-box per round• s round characteristic ps = qs = 2-2s
➡ LC and DC impractical
• High order DC and Algebraic attacks• S-box has deg 2, allows quadratic equation system• but 48 rounds -> expected deg close to max
➡ not feasible
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 11
Security Analysis II
• Statistical Saturation attacks• upper bounded by 30 rounds
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010
Outline
• Motivation• PRINTcipher• Security Analysis•Implementation Results• Conclusions
12
input
State[Reg-48/96]
KeyXOR
output
48/96
6/7
48/96
pLayer
sBoxLayer
gen RCi
done RC XOR
48/96
48/96
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 13
Implementation Results IUMCL18G212T3 library
48 CLK 96 CLK
round
input
State[Reg-48/96]
KeyXOR
output
48/96
6/7
48/96
pLayer
sBoxLayer
gen RCi
done RC XOR
48/96
48/96
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 13
Implementation Results IUMCL18G212T3 library
48 CLK 96 CLK
503GE
967GE
round
input
State[gReg-3/48/96]
KeyXOR
output
3
6/7
3 3
3S-box
pLayer
randPerm
gen RCi
done
NLFSR
RC XOR
48/96
48/96
3
48*16 = 768 CLK 96*32 = 3072 CLK
serial
input
State[Reg-48/96]
KeyXOR
output
48/96
6/7
48/96
pLayer
sBoxLayer
gen RCi
done RC XOR
48/96
48/96
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 13
Implementation Results IUMCL18G212T3 library
48 CLK 96 CLK
503GE
967GE
round
input
State[gReg-3/48/96]
KeyXOR
output
3
6/7
3 3
3S-box
pLayer
randPerm
gen RCi
done
NLFSR
RC XOR
48/96
48/96
3
48*16 = 768 CLK 96*32 = 3072 CLK
serial
input
State[Reg-48/96]
KeyXOR
output
48/96
6/7
48/96
pLayer
sBoxLayer
gen RCi
done RC XOR
48/96
48/96
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 13
Implementation Results I
402 GE 726 GE
UMCL18G212T3 library
48 CLK 96 CLK
503GE
967GE
round
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 14
Implementation Results II
0
500
1.000
1.500
2.000
2.500
3.000
3.500
PRINTcipher-48
KTANTAN48 GOST
KATAN48PRESENT
AES(tbp)
AES
PRINTcipher-96
8080
256160
80128128
80
GE
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010
Outline
• Motivation• PRINTcipher• Security Analysis• Implementation Results•Conclusions
15
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 16
Conclusions
• considered IC printing• proposed PRINTcipher-48 and PRINTcipher-96• PRINTcipher:• takes advantage of unique features of IC printing• requires only 402 GE• provides good scalability: +100 GE = 16x faster• object of study rather than being suitable for deployment
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 16
Conclusions
• considered IC printing• proposed PRINTcipher-48 and PRINTcipher-96• PRINTcipher:• takes advantage of unique features of IC printing• requires only 402 GE• provides good scalability: +100 GE = 16x faster• object of study rather than being suitable for deployment
Please study PRINTcipher!
Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 17
Thank you!
Axel PoschmannDivision of Mathematical Sciences Nanyang Technological UniversitySPMS-MAS-04-20, 50 Nanyang AvenueSingapore 639798 T (65) 6513-7459 GMT+8h E [email protected] www.ntu.edu.sg/home/aposchmann/
Questions?