Lightweight cryptography aims to achieve security with minimal resource footprints and low computational overhead. In particular, efficient implementations of linear layers are recognized as a crucial component. Boyar et al. showed that finding an optimal implementation of linear layers reduces to the Shortest Linear Program (SLP) problem, which is NP-hard. Consequently, various heuristic methods have been developed to search for near-optimal solutions. In this work, low-latency implementations are prioritized, and a heuristic search algorithm named HILL (Heuristic Implementation for Low-Latency Linear layers) is proposed. To further balance cost and delay, the h-XOR metric is integrated into HILL, where 2/3-input XOR gates are dynamically weighted to achieve an optimized trade-off between the circuit area and depth. Compared with the heuristic search proposed by Li et al. (FSE 2019), which yields an AES MixColumns implementation requiring 315 gate equivalents (GEs) at depth 3, our approach achieves 270.4 GEs at the same depth, corresponding to a 14.2% area reduction. To the best of our knowledge, this is one of the most efficient hardware implementations of AES linear layers in terms of both area and depth. Furthermore, implementation costs are minimized for all 4254 Maximum Distance Separable (MDS) matrices proposed by Li et al.

The hardware security of cryptographic devices has emerged as a matter of significant concern. To protect these devices against side channel attacks, the Ishai, Sahai, and Wagner (ISW) masking scheme was proposed to conceal sensitive data involved in xor gate and and gate operations in the circuit. Subsequently, numerous formal verification tools based on the t-probing model have been suggested to determine the security of circuits. In particular, both tightPROVE and Tornado are capable of directly assessing whether circuits meet the t-probing security. However, these tools encounter increased processing times when dealing with complex, large-scale circuits, as they necessitate a comprehensive scan of the entire circuit. In contrast, this article introduces a novel approach that visualizes composite ISW circuits and reevaluates the leakage of features within graph structures. More precisely, a new leakage structure is delineated by representing circuits as directed graphs. The theoretical underpinnings of this leakage structure and its potential extensions are explored, offering a direct method to validate the security of ISW masking circuits. Furthermore, a dataset of ISW masking circuits and an algorithm for its generation are presented. Three machine learning (ML) methods are utilized to perform an experiment on the dataset. The results demonstrate that the highest classification accuracy is attained at 99%, with a significant enhancement in efficiency (71%) compared to the performance of both tightPROVE and Tornado.

Lightweight block ciphers are critical for securing IoT devices such as RFID tags and wireless sensors. Their security assessment directly affects the reliability of billions of connected devices. Neural differential distinguishers offer a promising cryptanalysis tool, but the performance of existing distinguishers still needs improvement. This paper proposes a general framework for SPN, Feistel, and ARX cipher structures. (1) We design an adaptive evolutionary optimizer that dynamically adjusts crossover and mutation using population information entropy, which searches for input differences with higher bias scores and thus improves the quality of differentials for distinguishers. (2) We present a novel Interactive-SE Residual Network (ISRN) that integrates multi-scale convolution with channel attention, enhancing feature representation. Based on this framework, we obtain enhanced neural distinguishers for 6–9 rounds of PRESENT, 4–6 rounds of GIFT, 8–9 rounds of LBLOCK, and 9–11 rounds of SIMON, as well as new distinguishers for 7–9 rounds GIFT, and 10–round LBLOCK, 12–round SIMON. Control experiments validate the contribution of each module. Our results provide practical benchmarks for evaluating the security margins of lightweight ciphers in IoT devices, helping designers identify vulnerable rounds and develop more resilient algorithms.

Recently, there has been a growing interest in scenarios that employ a few (imbalanced) power traces for deep learning based side-channel analysis (DL-SCA). Finding a lightweight DL-SCA architecture that is more generalizable and faster to learn is of great importance when handling such situations. In this work, an initial analysis is conducted on the capability of learning and the susceptibility to attacks of prevalent DL-SCA models, focusing on cases that culminate in an unsuccessful attack. Subsequently, a meta-learning technique, known as prototypical networks, is delineated for the construction of a lightweight deep learning framework. In contrast to conventional DL-SCA models, the proposed architecture, designated as PN-SCA, does not predict the probability of a power trace belonging to an intermediate value in classification. Instead, it facilitates the learning of an encoder capable of embedding power consumption data within a latent space, while also establishing templates, or prototypes, for diverse categories. Moreover, we developed a metric that is specifically intended for the selection of hyperparameters due to the unique training phase of PN-SCA. Finally, four distinct scenarios are established with few (including one imbalanced) power traces to evaluate the correctness of our architecture. The results clearly illustrate the advantages of our PN-SCA in terms of generalization, reduced training costs (with a decrease in profiling traces by over 50

The guess-and-determine technique find wide applications in the recovery of unknown variables within given system of relations. The fundamental concept behind this technique involves guessing certain unknown variables and deducing the remaining ones based on the relational system. In the context of symmetric cryptography analysis, the guess-and-determine technique is employed to deduce partial subkey information to recover the master key. The set of variables that need to be guessed is called the guess basis.The crux of the guess-and-determine technique lies in identifying the minimal guess basis. By introducing new equal relations and initial constraints, this paper enhances the minimal guess basis mixed integer linear programming (MILP) model. The new model offers a more comprehensive depiction of key schedule, thereby enabling a more accurate and efficient derivation of the minimal guess basis.The novel model is applied to the eight-sided fortress (ESF) block cipher algorithm. By extending forward by three rounds and backward by three rounds based on a nine-round impossible differential distinguisher, a 15-round impossible differential attack is conducted. Utilizing the new model, the minimal guess basis required for key recovery is determined to be 54 bits. This represents a significant improvement compared to the existing result of 58 bits.The results indicate that for a 15-round impossible differential attack on the ESF algorithm, the data complexity is 2 31.18 CP, the time complexity involves 2 61.67 iterations of 15-round encryption, and the memory complexity is 2 66.18 bytes. Furthermore, this paper introduces, for the first time, a principle for designing key scheduling algorithms based on the guessing basis. This principle is applied to the ESF algorithm, where the minimal guess basis is employed to determine the positions of S -boxes and the parameters for cyclic shifts within the key scheduling algorithm. Without altering the consumption of software or hardware resources, a global optimal search is conducted among various key scheduling candidate approaches. By employing an equivalence class partitioning approach derived from 2108 instances of nine-round impossible differential distinguishers, the search space is reduced. Eventually, a selection process identifies a set of eight novel key schedule algorithms that achieve the maximum value of 77 bits for the minimal guess basis. These new key scheduling algorithms exhibit enhanced resistance against impossible differential attacks.

Griesmer codes, a class of optimal linear codes that meet the Griesmer bound, play an important role in fields such as data storage and information security due to their exceptional properties. Thus, they remain a major research focus in modern coding theory and cryptography. Based on the unions of subfields of finite fields, this paper constructs a new class of minimal linear codes and systematically determines their parameters. Under certain conditions, we provide the parameters and weight distribution and find that some codes satisfy the Grismer bounds. This means they have the best possible coding performance. Finally, these coding schemes combine minimal linear codes. They can be used to design secret sharing schemes with good access structures. This gives strong coding support for real information security applications.

In order to evaluate the ability of LBC-IoT algorithm to resist linear analysis, the set of linear approximations with the longest number of rounds was solved based on the MILP automated search technique using both direct search and iterative linear approximation loop construction methods and obtained the initial key guessing basis for each linear approximation with the longest possible number of extended rounds. The initial key guessing basis was further compressed by combining the minimum guessing basis technique, which filtered out the optimal linear approximation for key recovery attack. The results show that the LBC-IoT algorithm had a total of 6 linear approximations of 23 rounds with linear bias of 2-15, among which there existed the only optimal linear approximation with a guessing basis size of only 52 bit. The first key recovery attack of up to 30 rounds was launched against the LBC-IoT algorithm based on the upward and downward expansion of this distinguisher by 3 and 4 rounds, respectively. The data, time, and storage complexity of this attack was 230 KP, 277.9 30 rounds of encryption, and 252, respectively. Compared with the existing results, the number of rounds of the attack has been increased by 4 rounds as a whole, which leads to less than 7% of the security redundancy rounds of the LBC-IoT algorithm, which is not recommended to use in practical communication data encryption anymore.

The rapid advancement of vehicular ad hoc networks (VANETs) has introduced significant security challenges, particularly in ensuring message authenticity and integrity over open wireless channels. Traditional cryptographic schemes based on number-theoretic assumptions are increasingly vulnerable to quantum attacks, motivating the integration of post-quantum cryptography. This article proposes a novel quantum-resistant lattice-based aggregate signature scheme (QR-LBAS) that provides quantum resistance and is tailored for VANETs. Based on the hardness of the ring short integer solution (Ring-SIS) problem over NTRU lattices, the proposed scheme enables efficient aggregation of multiple signatures into a compact form, thereby reducing communication overhead while maintaining strong security guarantees. In addition, the scheme supports efficient batch verification at roadside units (RSUs), improving scalability in high-density vehicular environments. Security analysis shows that the scheme achieves existential unforgeability under adaptive chosen-message attacks within the random oracle model. Comprehensive evaluation demonstrates improved computational and communication efficiency compared with existing post-quantum schemes. Furthermore, we provide a system-level performance analysis, showing that QR-LBAS achieves favorable scalability and reduced RSU workload, making it suitable for practical VANET deployments and long-term security in the quantum era.

Objective The Draco algorithm is a stream cipher based on the Consisting of the Initial Value and Key-prefix (CIVK) scheme. It claims to provide security against Time Memory Data TradeOff (TMDTO) attacks. However, its selection function has structural flaws that attackers can exploit. These weaknesses can compromise its security. To address these vulnerabilities and lower the hardware costs associated with the Draco algorithm, this paper proposes an improved version called Draco-F. This new algorithm utilizes state bit indexing and dynamic initialization. Methods Firstly, to address the small cycle problems of the selection function and the high hardware costs in the Draco algorithm, the Draco-F algorithm introduces a new selection function. This function employs state bit indexing to extend the selection function's period and reduce hardware costs. Specifically, the algorithm generates three index values based on 17 status bits from two Nonlinear Feedback Shift Registers (NFSRs). These index values serve as subscripts to select three bit of data stored in non-volatile memory. The output bit of the selection function is produced through specified nonlinear operations on these three bit of data. Secondly, while ensuring uniform usage of NFSR state bits, the Draco-F algorithm further minimizes hardware costs by simplifying the output function. Finally, Draco-F incorporates dynamic initialization techniques to prevent key backtracking. Results and Discussions Security analysis of the Draco-F algorithm, including evaluations against universal TMDTO attacks, zero stream attacks, selective IV attacks, guessing and determining attacks, key recovery attacks, and randomness testing, demonstrates that Draco-F effectively avoids the security vulnerabilities encountered by the original Draco algorithm, thereby offering enhanced security. Software testing results indicate that the Draco-F algorithm achieves a 128-bit security level with an actual 128-bit internal state and higher key stream throughput compared to the Draco algorithm. Additionally, hardware testing results reveal that the circuit area of the Draco-F algorithm is smaller than that of the Draco algorithm. Conclusions In comparison to the Draco algorithm, the Draco-F algorithm significantly enhances security by addressing its vulnerabilities. It also offers higher key stream throughput and a reduced circuit area.

Objective ARIA is established as the Korean national Standard block cipher (KS X 1213) in 2003 to meet the demand for robust cryptographic solutions across government, industrial, and commercial sectors in South Korea. Designed by a consortium of Korean cryptographers, the algorithm adopts a hardware-efficient architecture that supports 128-, 192-, and 256-bit key lengths, providing a balance between computational performance and cryptographic security. This design allows ARIA to serve as a competitive alternative to the Advanced Encryption Standard (AES), with comparable encryption and decryption speeds suitable for deployment in resource-constrained environments, including embedded systems and high-performance applications. The security of ARIA is ensured by its Substitution-Permutation Network (SPN) structure, which incorporates two distinct substitution layers and a diffusion layer to resist classical cryptanalytic methods such as differential, linear, and related-key attacks. This robustness has promoted its adoption in secure communication protocols and financial systems within South Korea and internationally. With the emergence of quantum computing, challenges to classical ciphers arise. Quantum algorithms such as Drover's algorithm reduce the effective key strength of symmetric ciphers, necessitating reassessment of their post-quantum security. In this study, ARIA's quantum circuit implementation is optimized through tower-field decomposition and in-place circuit optimization, enabling a comprehensive evaluation of its resilience against quantum adversaries. Methods The quantum resistance of ARIA is evaluated by estimating the resources required for exhaustive key search attacks under Drover's algorithm. Drover's quantum search algorithm achieves quadratic speedup, effectively reducing the security strength of a 128-bit key to the classical equivalent of 64 bit. To ensure accurate assessment, the quantum circuits for ARIA's encryption and decryption processes are optimized within Drover's framework, thereby reducing the required quantum resources. The core technique employed is tower-field decomposition, which transforms high-order finite field operations into equivalent lower-order operations, yielding compact computational representations. Specifically, the S-box and linear layer circuits are optimized using automated search tools to identify efficient combinations of low-order field operations. The resulting quantum circuits are then applied to estimate Drover-attack resource requirements, and the results are compared against the National Institute of Standards and Technology (NIST) post-quantum security standards. Results and Discussions Optimized quantum circuits for all four ARIA S-boxes are constructed using tower-field decomposition and automated circuit search tools (Fig. 7, Table 2). By integrating these with the linear layer, a complete quantum encryption circuit is implemented, and Drover-attack resource requirements are reevaluated (Tables 5 and 6). Detailed implementation data are provided in the Clifford+T gate set. The experimental results show that ARIA-192 does not meet the NIST Level 3 post-quantum security standard, indicating vulnerabilities to quantum adversaries. In contrast, ARIA-128 and ARIA-256 comply with Level 1 and Level 3 requirements, respectively. Further optimization is theoretically feasible through methods such as pseudo-key techniques. Future research may focus on developing automated circuit search tools to extend this framework, enabling systematic post-quantum security evaluations of ARIA and comparable symmetric ciphers (e.g., AES, SM4) within a generalized assessment model. Conclusions This study investigates the quantum resistance of classical cryptographic algorithms in the context of quantum computing, with a particular focus on the Korean block cipher ARIA. By leveraging the distinct algebraic structures of ARIA's four S-boxes, tower-field decomposition is applied to design optimized quantum circuits for all S-boxes. Additionally, the circuit depth of the ARIA linear layer is optimized through an in-place quantum circuit implementation, resulting in a more efficient realization of the ARIA algorithm in the quantum setting. A complete quantum encryption circuit is constructed by integrating these optimization components, and the security of the ARIA family of algorithms is evaluated against quantum adversaries using Drover's key search attack model. The results demonstrate improved implementation efficiency under the newly designed quantum scheme. However, ARIA-192 exhibits resistance below the NIST Level 3 quantum security threshold, indicating a potential vulnerability to quantum attacks.

With the increasing popularity of the Internet of Things (IoT), network security faces significant challenges due to emerging network attacks. Therefore, ensuring user security and privacy has become a crucial research focus in Vehicular Ad Hoc Networks (VANETs). Over the past decade, numerous signature schemes have been proposed for VANETs, particularly certificateless signatures which have made notable progress in addressing issues related to certificate management and key escrow. However, traditional signature schemes based on conventional security assumptions encounter new security challenges with the advent of quantum computing. In this regard, lattice-based cryptography is considered promising in resistance quantum attacks. Consequently, we propose an efficient NTRU lattice-based certificateless signature scheme for VANETs (NTRU-CLS) that is provably unforgeability in the random oracle model based on the Small Integer Solution (SIS) assumption. The security analysis demonstrates that our scheme provides unforgeability both Type-I and Type-II adversaries in the random oracle model by utilizing the SIS problem on the NTRU lattice. Furthermore, comparative results indicate that our proposed scheme offers significant advantages in terms of computation cost compared to existing approaches while also minimizing communication overhead when compared to other lattice-based schemes. Overall, our scheme has better meet the requirements of VANET environments in terms of security, communication overheads, and computation costs.

CutMix data augmentation can provide a large amount of augmented data for DL-SCA (deep learning side channel attacks) by generating new power traces. However, traces generated by CutMix may lose dependency with the new label, which may reduce the accuracy of the training model. In light of this, we propose an improved intra-class CutMix data augmentation method. Firstly, the original traces are classified by the label. Then, the original traces are selected by the same label constraint to generate new traces according to CutMix, which can ensure the dependency between the generated trace and its label. Furthermore, in order to maintain balance among different classified datasets, the traces are generated sequentially according to distinct labels. Finally, based on the augmented traces, the Multilayer Perceptron (MLP) and Convolutional Neural Network (CNN) models can be constructed and trained to recover the key of AES. In order to verify the effectiveness of the proposed method, we conduct experimental evaluations using the MLP and CNN models based on DPA-contest v4 dataset and ASCAD dataset. The test results show that the traces generated with the intra-class CutMix method can be very similar to the original traces, and the MLP and CNN models can be effectively trained based on the generated traces to recover the key of AES. Besides, compared with existing data augmentation methods, the proposed method can complete secret key recovery with faster convergence and fewer traces.

In deep learning-based side-channel analysis (DL-SCA), there may be a proliferation of model parameters as the number of trace power points increases, especially in the case of raw power traces. Determining how to design a lightweight deep learning model that can handle a trace with more power points and has fewer parameters and lower time costs for profiled SCAs appears to be a challenge. In this article, a DL-SCA model is proposed by introducing a non-trained DL technique called random convolutional kernels, which allows us to extract the features of leakage like using a transformer model. The model is then processed by a classifier with an attention mechanism, which finally outputs the probability vector for the candidate keys. Moreover, we analyze the performance and complexity of the random kernels and discuss how they work in theory. On several public AES datasets, the experimental results show that the number of required profiling traces and trainable parameters reduce, respectively, by over 70% and 94% compared with state-of-the-art works, while ensuring that the number of power traces required to recover the real key is acceptable. Importantly, differing from previous SCA models, our architecture eliminates the dependency between the feature length of power traces and the number of trainable parameters, which allows for the architecture to be applied to the case of raw power traces.

Low-Latency has been an important criterion in the design of block ciphers, especially in lightweight cryptography for IoT (Internet of Things) constrained devices to ensure secure real-time data transmission with limited resources. However, the design of most low-latency block ciphers today employ the socalled substitution permutation network (SPN) structure with few exceptions, such as the SCARF cipher. In this article, by adopting the ideas of parallel execution for bridging the gap in latency between the standard Feistel and SPN structures, we propose a new low-latency cipher that uses the standard Feistel structure named as Low Latency Block Cipher (LLBC It has a 128-bit block length with 128-bit (or 256-bit) key length. For the purpose of minimizing the latency and implementation costs, we were able to specify two 4-bit S-boxes, which not only have good cryptographic properties but are also excellent in terms of their hardware performance. More specifically, these S-boxes require only 18.5 GEs (Gate Equivalents) and have depth 3, which to the best of our knowledge are currently the best performing low-latency 4-bit S-boxes. Using these S-boxes in the design of LLBC, we achieve a significant reduction in both latency and implementation cost compared to Midori and QARMA. For instance, implementation of LLBC on the NanGate 45 nm open cell library achieves delay of about 2.79 ns which can be compared to the delay of PRINCE, Midori, and QARMA being 4.06 ns, 4.94 ns, and 4.02 ns, respectively. Moreover, standard security analysis shows that LLBC has enough security margin against various known attacks.

With the continuous development of quantum technology, the quantum security of symmetric ciphers has attracted widespread attention. This study focuses on the security of 1K-AES, employing both quantum and classical slide attacks to analyze its security. On the one hand, for the 1K-AES with MixColumns in the last round, using the CNS algorithm achieves a success rate of 74%, an improvement from 63%, under a query complexity of O(2(2n/5)) and classical memory complexity of O(2(n/5)) without the need for quantum random access memory, where n denotes the block size. When using a quantum random access memory, the universal quantum claw-finding algorithm improves the success rate to 100% with a query complexity of O(2(n/3)) and quantum random memory complexity of O(2(n/3)). Additionally, under the chosen plaintext attack, the success rate of the classical slide attack is also increased to 100%. On the other hand, for the 1K-AES with no MixColumns in the last round, the universal quantum claw-finding algorithm is used to perform a quantum slide attack, with both time and memory complexity of O(2(n/3)). Compared with the classical slide attack, this method achieves sub-exponential acceleration; compared with Grover's search, the query complexity reduces from O(2(n/2)) to O(2(n/3)).

Objective In 2017,the PFP algorithm was introduced as an ultra-lightweight block cipher to address the demand for efficient cryptographic solutions in constrained environments,such as the Internet of Things(IoT).With a hardware footprint of approximately 1 355 GE and low power consumption,PFP has attracted attention for its ability to deliver high-speed encryption with minimal resource usage.Its encryption and decryption speeds outperform those of the internationally recognized PRESENT cipher by a factor of 1.5,making it highly suitable for real-time applications in embedded systems.While the original design documentation asserts that PFP resists various traditional cryptographic attacks,including differential,linear,and impossible differential attacks,the possibility of undiscovered vulnerabilities remains unexplored.This study evaluates the algorithm's resistance to related-key differential attacks,a critical cryptanalysis method for lightweight ciphers,to determine the actual security level of the PFP algorithm using formal cryptanalysis techniques. Methods To evaluate the security of the PFP algorithm,Satisfiability Modulo Theories(SMT)is used to model the cipher's round function and automate the search for distinguishers indicating potential design weaknesses.SMT,a formal method increasingly applied in cryptanalysis,facilitates automated attack generation and the detection of cryptographic flaws.The methodology involved constructing mathematical models of the cipher's rounds,which are tested for differential characteristics under various key assumptions.Two distinguisher models are developed:one based on single-key differentials and the other on related-key differentials,the latter being the focus of this analysis.These models automated the search for weak key differentials that could enable efficient key recovery attacks.The analysis leveraged the nonlinear substitution-permutation structure of the PFP round function to systematically identify vulnerabilities.The results are examined to estimate the probability of key recovery under different attack scenarios and assess the effectiveness of related-key differential cryptanalysis against the full-round PFP cipher. Results and Discussions The SMT-based analysis revealed a critical vulnerability in the PFP algorithm.A related-key differential characteristic with a probability of 2-62 is identified,persisting through 32 encryption rounds.This characteristic indicates a predictable pattern in the cipher's behavior under related-key conditions,which can be exploited to recover the secret key.Such differentials are particularly concerning as they expose a significant weakness in the cipher's resistance to related-key attacks,a critical threat in IoT applications where keys may be reused or related across multiple devices or sessions.Based on this finding,a key recovery attack is developed,requiring only 263 chosen plaintexts and 248 full-round encryptions to retrieve the 80-bit master key.The efficiency of this attack demonstrates the vulnerability of the PFP cipher to practical cryptanalysis,even with limited computational resources.The attack's relatively low complexity suggests that PFP may be unsuitable for applications demanding high security,particularly in environments where adversaries can exploit related-key differential characteristics.Moreover,these results indicate that the existing resistance claims for the PFP cipher are insufficient,as they do not account for the effectiveness of related-key differential cryptanalysis.This challenges the assertion that the PFP algorithm is secure against all known cryptographic attacks,emphasizing the need for thorough cryptanalysis before lightweight ciphers are deployed in real-world scenarios.(Fig.2:Related-key differential characteristic with probability 2-62 in 32 rounds;Table 1:Attack complexity and resource requirements for related-key recovery.) Conclusions In conclusion,this paper presents a cryptographic analysis of the PFP lightweight block cipher,revealing its vulnerability to related-key differential attacks.The proposed key recovery attack demonstrates that,despite its efficiency in hardware and speed,PFP fails to resist attacks exploiting related-key differential characteristics.This weakness is particularly concerning for IoT applications,where key reuse or related keys across devices is common.These findings highlight the need for further refinement in lightweight cipher design to ensure robust resistance against advanced cryptanalysis techniques.As lightweight ciphers continue to be deployed in security-critical systems,it is essential that designers consider all potential attack vectors,including related-key differentials,to strengthen security guarantees.Future work should focus on enhancing the cipher's security by exploring alternative key-schedule designs or increasing the number of rounds to mitigate the identified vulnerabilities.Additionally,this study emphasizes the effectiveness of SMT-based formal methods in cryptographic analysis,providing a systematic approach for identifying previously overlooked weaknesses in cipher designs.

In the era of the highly pervasive Internet of Things (IoT), the optimized implementation of lightweight cryptographic algorithms for protecting data security has extensively received attention, for instance, the Piccolo cipher. Piccolo is an ultra-lightweight block cipher designed for extremely resource-constrained devices. Currently, many optimized implementations of Piccolo have been proposed; however, these implementations are heavily rely on optimizing different architectures. Actually, these implementation schemes have all neglected the optimization of the core components. How to achieve the new optimized implementation of the Piccolo cipher (via both the architectures and the core components) appears to be an interesting problem. In this article, new circuit structures for components (key schedules and round functions) of the Piccolo are first proposed using fewer logic gates. Based on these circuit structures, three architectures (iterative, integrated iterative, and scalar) are proposed to maximize implementation performances. To demonstrate their effectiveness and practicality, these architectures are simulated and synthesized on different field-programmable gate arrays (FPGA) devices. Compared with the existing architectures of Piccolo, the results indicate that the iterative architectures and the integrated iterative architecture provide a better trade-off between area and throughput, and the scalar architectures provide the highest throughput. Especially for Piccolo-128, the area of its iterative architecture is 30 look-up tables (LUTs) and 22 slices less than the best known implementation; the throughput and efficiency are 68.56% higher and twice higher than the best known implementation, respectively. Compared with other block ciphers, the efficiency and area-delay product of the Piccolo-128 iterative architecture outperform PRESENT, GIFT, SIMON, Midori, SIMON, and SIMECK. Compared with the best results, its encryption efficiency has increased by 31.53%, and the area-delay product has decreased by 44.63%. To optimize implementations for resource-constrained Internet of Things (IoT) devices, new, efficient circuit structures for key schedules and round functions of the Piccolo are proposed. Furthermore, three iterative architectures are presented, showing improved area and efficiency compared with existing designs, particularly enhancing the performance of Piccolo-80/128 against other block ciphers. In addition, the scalar architectures with the highest throughput compared with existing architectures are designed. image

Both the diffusion property and the area consumption are two important evaluation criteria in the design and implementation of symmetric encryption algorithms. Many AND-Rotation-XOR (AND-RX) block ciphers are usually designed by reducing the diffusion property to minimize the area consumption. On the other hand, these AND-RX block ciphers use multiple round function operations to achieve the enough diffusion property, which always induce more area consumption in their hardware implementation. How to trade off the diffusion property and the area consumption appears to be an interesting task in the design of block cipher. In this paper, HDLBC as a new family of lightweight block cipher (with 64-bit plaintext and 64-bit/128-bit key) for the Internet of Things (IoT) is proposed. More specifically, the HDLBC is designed by using only two F-functions (RA1 and RA2), where the non-linear layer of the F-functions is constructed by the NAND operation that consumes the least area among the non-linear logic operations. To the best of our knowledge, HDLBC cipher requires the minimum number of F-functions to provide the diffusion property, where the F-functions require fewer implementation resources than the F-functions of existing similar encryption algorithms. It illustrates the hardware implementation of HDLBC cipher on SMIC 0.18μm requires only 1248 Gate Equivalents (GEs), its throughput rate is 256 Kbps at 100 KHz. Compared with other encryption algorithms, the implementation performance of HDLBC cipher achieves well-balanced in both the area consumption and diffusion property. Moreover, the security analysis shows that HDLBC cipher has enough security margin against various known attacks, such as differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero correlation cryptanalysis, etc.

In this article, we identify certain instances of bent functions, constructed using the so-called P_τ property, that are provably outside the completed Maiorana–McFarland ( ℳℳ^# ) class. This also partially answers an open problem in posed by Kan et al. (IEEE Trans Inf Theory, https://doi.org/10.1109/TIT.2022.3140180 , 2022). We show that this design framework (using the P_τ property), can provide instances of bent functions that are outside the known classes of bent functions, including the classes ℳℳ^# , 𝒞,𝒟 and 𝒟_0 , where the latter three were introduced by Carlet in the early nineties. We provide two generic methods for identifying such instances, where most notably one of these methods uses permutations that may admit linear structures. For the first time, a set of sufficient conditions for the functions of the form h(y,z)=Tr(yπ (z)) + G_1(Tr_1^m(α _1y),… ,Tr_1^m(α _ky))G_2(Tr_1^m(β _k+1z),… ,Tr_1^m(β _τz))+ G_3(Tr_1^m(α _1y),… ,Tr_1^m(α _ky)) to be bent and outside ℳℳ^# is specified without a strong assumption that the components of the permutation π do not admit linear structures.