In this work we present the new GAP package FFCSA - Finite Field Constructions, Search, and Algorithms. It was designed to enable Design Space Exploration for hardware implementations of cryptographic algorithms defined over finite fields. FFCSA constructions and searches are used to produce the design space, and FFCSA algorithms, parameterized for the current candidate field, are used to generate expressions needed for implementation in hardware.

This survey presents the rich history of the Welch-Gong (WG) Stream cipher family. It has been a long journey that lead the WG stream ciphers to become practical. The evolutionary path is a combination of mathematical endeavour and engineering striving to transfer pure mathematical functions to practical encryption algorithms for various applications. This path began as the pioneering work on WG transformation sequences with 2-level autocorrelation, leading to important breakthroughs in the early 2000’s, such as the submission of the first WG stream cipher to the eSTREAM competition in 2005 and the subsequent introduction of the WG stream cipher family WG ( m , l ), followed by extensive work on particular instances proposed for various (mostly lightweight) applications. A recent construction using a WG permutation is the authenticated encryption WAGE, submitted to the NIST LWC competition in 2019. The story of the WG stream cipher is by far not finished. The future opens numerous possibilities for WG stream ciphers and WAGE, with applications in both lightweight environments and in high-performance computing. We conclude the survey with new ideas and open problems.

With the rise of new technologies the demand for efficient cryptographic hardware and design space exploration is rising. This work presents a framework for the automated synthesis of datapaths that use tower-field constructions for finite field arithmetic. The key idea is a novel encoding of the underlying algebraic structure with the dual view as both a finite field and a vector space. The framework uses symbolic computation capabilities of GAP to generate the expressions, needed for hardware implementations, on-the-fly, and compiles them into synthesizable datapaths, test-vectors and testbenches. It supports implementation of expressions defined over different sized finite fields, tower fields, or even several isomorphic finite fields within the same hardware module.

2 Methodology 5 2.1 Cell Libraries and Tools . . . . . . . . . . . . . . . . . 5 2.2 VHDL Compatibility . . . . . . . . . . . . . . . . . . . 5 2.3 Synthesis Scripts . . . . . . . . . . . . . . . . . . . . . . 6 2.4 Simulation . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.5 Aggregating Data . . . . . . . . . . . . . . . . . . . . . 6 2.6 Presentation of Data . . . . . . . . . . . . . . . . . . . 6

ACE is a permutation based authenticated encryption (AE) and hash algorithm which provides 128-bit security for AE and hash with a single hardware circuit. In this note, we report updates on ACE since its selection as a round 2 candidate of the NIST lightweight cryptography standardization competition [3]. This report includes: new third party cryptanalysis and implementation results, applications of ACE in IEEE 802.11X and CoAP handshake protocols for Internet of Things, and comparisons with current NIST standards. We do not plan any future tweaks for ACE.

A binary de Bruijn sequence is a sequence of period 2n in which every binary n-tuple occurs exactly once in each period. A de Bruijn sequence has good randomness properties, such as long period, ideal tuple distribution, and high linear complexity, and can be generated by a nonlinear feedback shift register (NLFSR). Finding an efficient NLFSR that can generate a de Bruijn sequence with a long period is a significant challenge. “Composited construction” is a technique for constructing a de Bruijn sequence of period 2 n+k by an NLFSR from a de Bruijn sequence of period 2 n through a composition operation repeatedly applying k times. The goal of this article is to further investigate the composited construction of de Bruijn sequences with efficient hardware implementations, and determine randomness properties such as linear complexity. Our contributions in this article are as follows. First, we present a generalized construction of composited de Bruijn sequences that is constructed by adding a combination of conjugate pairs of different lengths in the feedback function of the composited construction, which results in generating a class of de Bruijn sequences of size 2 k , whereas the original composited construction can generate only two sequences. Second, we investigate the linear complexity and the correlation property of the new class of de Bruijn sequences. We prove theoretically that the linear complexity of this class of de Bruijn sequences is optimal or close to optimal. Interestingly, we also prove that the linear complexities of all the sequences of this class are equal, which strengthens Etzion's conjecture (JCTA 1985, IEEE-IT 1999) about the number of de Bruijn sequences with equal linear complexity. This is the first known construction of de Bruijn sequences of an arbitrarily long period whose linear complexities are determined theoretically. Finally, we implement our construction in hardware to demonstrate its practicality. We synthesize our implementations for a 65 nm ASIC and a Xilinx Spartan FPGA and present hardware areas, and performances of de Bruijn sequences of periods in the range of 2 160 to 2 1056 . For instance, a class of de Bruijn sequences of period 2 160 (resp. 2 288 ) can be implemented with an area of 3.43 (resp. 6.71) kGEs in 65 nm ASIC, and 83 (resp. 229) slices in Spartan6 FPGA.

. In this document, we report the activity progress of the WAGE authenticated cipher after the round 2 submission to NIST. The following activities were performed on WAGE : additional security analysis, proposing side-channel countermeasures and their evaluation in hardware and software, additional feature as pseudorandom bit generator, and some usecase studies for Internet of Things (IoT) protocol applications. We also propose a tweak to increase the throughput of WAGE .

Due to the rapid growth of using Internet of Things (IoT) devices in the daily life, the need to achieve an acceptable level of security and privacy according to the real security risks for these devices is rising. Security risks may include privacy threats like gaining sensitive information from a device, and authentication problems from counterfeit or cloned devices. It becomes more challenging to add strong security features to extremely constrained devices compared to battery operated devices that have more computational and storage capabilities. We propose a novel application specific instruction-set architecture that allows flexibility on many design levels and achieves the required security level for the Electronic Product Code (EPC) passive Radio Frequency Identification (RFID) tag device. Our solution moves a major design effort from hardware to software, which largely reduces the final unit cost. The proposed architecture can be implemented with 4,662 gate equivalent units (GEs) for 65 nm CMOS technology excluding the memory and the cryptographic units. The synthesis results fulfill the requirements of extremely constrained devices and allow the inclusion of cryptographic units into the datapath of the proposed application-specific instruction set processor (ASIP).

This paper explores tower field constructions and hardware optimizations for the WG-16 stream cipher. The constructions ${\mathbb {F}}_{(((2^2)^2)^2)^2}$ and ${\mathbb {F}}_{(2^{4})^4}$ were chosen because their small subfields enable high speed arithmetic implementations and their regularity provides flexibility in pipeline granularity. A design methodology is presented where the tower field constructions guide how to proceed systematically from algebraic optimizations, through initial hardware implementation, selection of submodules, pipelining, and finally detailed hardware optimizations to increase clock speed. The highest frequency WG(16, 32) keystream generator, obtained for the 65 nm ASIC library, reached a clock speed of 2.44 GHz at 26.3 kGE, and the smallest area keystream generator achieved a clock speed of 0.33 GHz at 9.9 kGE. The highest frequency FPGA implementation on a Xilinx Spartan 6 reached a clock speed of 256 MHz using 631 slices. In addition, the paper demonstrates that LFSR feedback polynomials can be optimized to increase security without hurting performance, and retiming optimizations can be used to increase clock speed without increasing area.

This paper presents the hardware design and analysis of ACE and WAGE, two candidate ciphers for the NIST Lightweight Cryptography standardization. Both ciphers use sLiSCP's unified sponge duplex mode. ACE has an internal state of 320 bits, uses three 64 bit Simeck boxes, and implements both authenticated encryption and hashing. WAGE is based on the Welch-Gong stream cipher and provides authenticated encryption. WAGE has 259 bits of state, two 7 bit Welch-Gong permutations, and four lightweight 7 bit S-boxes. ACE and WAGE have the same external interface and follow the same I/O protocol to transition between phases. The paper illustrates how a hardware perspective influenced key aspects of the ACE and WAGE algorithms. The paper reports area, power, and energy results for both serial and parallel (unrolled) implementations using four different ASIC libraries: two 65 nm libraries, a 90 nm library, and a 130 nm library. ACE implementations range from a throughput of 0.5 bits-per-clock cycle (bpc) and an area of 4210 GE (averaged across the four ASIC libraries) up to 4 bpc and 7260 GE. WAGE results range from 0.57 bpc with 2920 GE to 4.57 bpc with 11080 GE.

There have been numerous works that focus on optimizing the AES cipher to minimize area. Even with the notion of gate equivalents, the different tools and ASIC libraries used to synthesize the designs makes it hard to objectively compare them. We benchmark and analyze AES-128 encryption cores by implementing and synthesizing them using a set of four ASIC libraries. We show how different implementations of internal AES functions lend themselves better to different architectural options. Using this analysis, we design our own 8-bit AES encryption core, which has a 13% improvement in area and 9% improvement in throughput/area over the next smallest design on STMicro’s 65 nm process. It has an area of 1960 GE and a latency of 216 clock cycles.

This paper presents a design automation toolkit for hardware implementations of linear and non-linear feedback shift registers (FSRs). The toolkit is implemented in the GAP computer algebra system and generates both executable GAP code and VHDL for synthesizable hardware. To design an FSR, the user needs only to provide a template and instantiate a few parameters. The primary objects are LFSRs; NLFSRs; and arbitrary combinational functions, which are modelled as FILFUNs, for “filtering functions”. Conventional feedback functions are modelled as univariate or multivariate polynomials. More complex functions can be modelled as FILFUNs. The paper demonstrates the capabilities of the toolkit using the WG-7 and WG-8 keystream generators and the Grain v1 stream cipher. Less than 30 lines of GAP code are required to generate a complete datapath in VHDL.

A binary de Bruijn sequence is a sequence of period 2n in which every n-tuple occurs exactly once in one period. A de Bruijn sequence is attractive because of having good statistical properties such as long period, balance, high linear complexity and ideal n-tuple distribution. A nonlinear feedback shift register (NLFSR) can be used to generate a de Bruijn sequence. A filtering de Bruijn sequence generator (FDBG) is an NLFSR-based filtering generator constructed by applying a filter function to the internal state of the NLFSR generating a de Bruijn sequence. If the filtering function is balanced, then an FDBG inherits the properties long period, balance, and the lower bound of linear complexity, but its ideal t-tuple distribution property is unknown. In this paper we study ideal t-tuple distribution of filtering de Bruijn (DB) sequence generators. First, we present a construction of a q-ary de Bruijn sequence from a binary de Bruijn sequence. Then, we describe the construction of the FDBG and investigate the ideal t-tuple distribution for two types of the FDBGs. The conditions on the filtering functions for having the ideal t-tuple distribution in the filtering sequences are presented. Finally, we perform an experiment on FDBGs with WG transformations as filtering functions to validate our result and find filtering functions with good cryptographic properties.

A binary de Bruijn sequence with period 2(n) is a sequence in which every tuple of n bits occurs exactly once. De Bruijn sequence generators have randomness properties that make them attractive for pseudorandom number generators and as building blocks for stream ciphers. Unfortunately, it is very difficult to find de Bruijn sequence generators with long periods (e.g., 2128) and most known de Bruijn sequence generators are computationally quite expensive. In this article, we present "OcDeb-k-n" and the first hardware implementation of de Bruijn sequence generators. OcDeb-k-n efficiently computes a composited de Bruijn sequence where k levels of composition are added to a de Bruijn sequence of period 2n. Numerically, OcDeb reduces the bit operations used for computing the feedback function significantly from theta(k(2)+nk) to theta(k log k + log n). Furthermore, it enables efficient parallelization and hardware retiming. Comprehensive result analysis is conducted for 65 nm ASIC technology. For example, OcDeb-32-32 has an area of 643 GE with 1.45 Gbps performance, and with parallelization it generates up to 25.4 Gbps at the cost of 4,787 GE. The area of OcDeb-512-32 generating a de Bruijn sequence of period 2544 is 7,304 GE and the performance is 1.25 Gbps.

Two lightweight block cipher families, Simon and Speck, have been proposed by researchers from the NSA recently. In this paper, we introduce Simeck, a new family of lightweight block ciphers that combines the good design components from both Simon and Speck, in order to devise even more compact and efficient block ciphers. For Simeck32/64, we can achieve 505 GEs (before the Place and Route phase) and 549 GEs (after the Place and Route phase), with the power consumption of 0.417 μW in CMOS 130nm ASIC, and 454 GEs (before the Place and Route phase) and 488 GEs (after the Place and Route phase), with the power consumption of 1.292 μW in CMOS 65nm ASIC. Furthermore, all of the instances of Simeck are smaller than the ones of hardware-optimized cipher Simon in terms of area and power consumption in both CMOS 130nm and CMOS 65nm techniques. In addition, we also give the security evaluation of Simeck with respect to many traditional cryptanalysis methods, including differential attacks, linear attacks, impossible differential attacks, meet-in-the-middle attacks, and slide attacks. Overall, all of the instances of Simeck can satisfy the area, power, and throughput requirements in passive RFID tags.

Pseudorandom number generators (PRNGs) are very important for EPC Class 1 Gener- ation 2 (EPC C1 G2) Radio Frequency Identification (RFID) systems. A PRNG is able to provide a 16-bit random number that is used in many commands of the EPC C1 G2 standard, and it can also be used in future security extensions of the EPC C1 G2 standard, such as mutual authentication protocols between the readers and tags. In this paper, we investigate efficient ASIC hardware imple- mentations of Warbler (a lightweight PRNG), and demonstrate that Warbler can meet the area and power consumption requirements in passive RFID systems. Warbler is built upon three nonlinear feedback shift registers (NLFSRs) and four WG-5 transformation modules. We employ two design options to implement Warbler and three different compilation methods to further optimize the area, maximum operating frequency, and power consumption. We can achieve an area of 498 GEs after the place and route phase in a CMOS 65nm ASIC, with a maximum frequency of 1430 MHz and a total power consumption of 1.239W at 100 KHz. Accordingly, an area of 534 GEs after the place and route phase, with a maximum frequency of 250 MHz and a total power consumption of 0.296 W at 100 KHz can be obtained in a CMOS 130nm ASIC. Our results show that the LFSR counter- based design is better than the binary counter-based one in terms of area and power consumption. In addition, we show that the areas of WG-5 transformation look-up tables depend on the specific decimation values.

In this paper, we first present some new results about the Welch-Gong (WG) transformations, followed by a description of the WG stream cipher family which is built upon an LFSR and a WG transformation over an extension field. The randomness properties of keystreams produced by a decimated WG cipher are derived based on the new results. We also discuss the selection criteria for choosing the optimal parameters for a WG cipher in order to achieve the maximum level of security. Finally, we present the optimal parameters for the WG transformations over F2m, 7 ≤ m ≤ 16 based on the proposed criteria.

WG-8 is a lightweight instance of the Welch-Gong (WG) stream cipher family, targeting for resource-constrained devices like RFID tags, smart cards, and wireless sensor nodes. Recent work has demonstrated the advantages of tower field constructions for finite field arithmetic in the AES and WG-16 ciphers. In this paper we explore three different tower field constructions for WG-8. The first tower field is tailored to FPGA cells. The second tower field uses a Type-I optimal normal basis. The third tower field exploits algebraic properties of the WG permutation and trace functions. All of the methods use a parallel LFSR to provide data rates from one to eleven bits per clock cycle. Among the three tower fields, the Type-I ONB construction offers the best trade-off in area, speed, and power consumption. However, a plain monolithic look-up table implementation with 256 entries is smaller and faster than the tower field constructions. Our analysis of the tower field options and comparisons to each other and to the monolithic look-up table will provide lessons for future work in exploring novel tower field constructions for WG and other ciphers.