PRINTcipher: A Block Cipher for IC Printing

PRINTcipher: A Block Cipher for IC Printing

L. Knudsen, G. Leander, A. Poschmann, and M. Robshaw

Axel PoschmannDivision of Mathematical Sciences, School of Physical and Mathematical Sciences

18 August 2010

Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010

Outline

• Motivation• PRINTcipher• Security Analysis• Implementation Results• Conclusions

2

Axel Poschmann PRINTcipher: A Block Cipher for IC Printing 18.08.2010 3

Acknowledgement

Dr. Jasmin Wörle

Project


Motivation

Organic electronics,

Still in its infancy:

A.k.a.

Allows unique devices

Polymer electronicsPlastic electronics,

IC Printing

Ultra-constrained

15um structure width

Ideal for low-cost RFID tags


Outline

• Motivation• PRINTcipher• Security Analysis• Implementation Results• Conclusions

5


Observations

11 GE

SS

28 GE

→ - 50%• Smaller S-box save GE (but need to increase rounds)


Observations

• Storage is most expensive → minimize block size

11 GE

SS

28 GE



Observations

• Storage is most expensive → minimize block size• BUT! State size is lower bounded -> minimize key schedule

11 GE

SS

28 GE



Observations

• Storage is most expensive → minimize block size• BUT! State size is lower bounded -> minimize key schedule• In RFID scenarios key is most likely fixed

11 GE

SS

28 GE



Observations

• Storage is most expensive → minimize block size• BUT! State size is lower bounded -> minimize key schedule• In RFID scenarios key is most likely fixed• Addition: non-fixed vs. fixed value (n bits)

11 GE

SS

28 GE

→ - 50%

n x 2.67 GE n/2 x 0.67 GE→ - 87.5%

• Smaller S-box save GE (but need to increase rounds)


Observations

• Storage is most expensive → minimize block size• BUT! State size is lower bounded -> minimize key schedule• In RFID scenarios key is most likely fixed• Addition: non-fixed vs. fixed value (n bits)

11 GE

SS

28 GE

→ - 50%

n x 2.67 GE n/2 x 0.67 GE→ - 87.5%

• Smaller S-box save GE (but need to increase rounds)

0 GE

• Bit permutations are for free


S-Box

• 3 x 3 S-box• optimal wrt. LC and DC• min occurrence of single-bit to single-bit differences/masks• 384 optimal S-boxes in total


S-Box


c1

S

p

c2

23

23

6


S-Box


c1

S

p

c2

23

23

6

1


S-Box


c1

S

p

c2

23

23

6 423

1


S-Box


c1

S

p

c2

23

23

6 423

5 bit/S-box

1


PRINTcipher

47... ...0

48 x


PRINTcipher

47... ...0

48 x


PRINTcipher

sk1 48 bit

47... ...0

48 x


PRINTcipher

sk1 48 bit

47... ...0

48 x


PRINTcipher

sk1 48 bit

47... ...0

48 x


PRINTcipher

sk1 48 bit

sk2 32 bit

47... ...0

k = sk1||sk2 = 80 bit

48 x


PRINTcipher

sk1 48 bit

sk2 32 bit

vs. slide attacks

47... ...0

k = sk1||sk2 = 80 bit

48 x

PRINTcipher-48


PRINTcipher

sk1 48 bit

sk2 32 bit

vs. slide attacks

47... ...0

k = sk1||sk2 = 80 bit

48 x

sk1 96 bit

sk2 64 bit

PRINTcipher-48k = sk1||sk2 = 160 bitPRINTcipher-96

96 x

95... ...0


Outline

• Motivation• PRINTcipher•Security Analysis• Implementation Results• Conclusions

9


Security Analysis I

• Differential and Linear Cryptanalysis• let p denote the probability and

q = (2p-1)2 the correlation of a linear characteristic• max p = 1/4, max q = 1/4• same for any key-dependent permuted S-box• min 1 active S-box per round• s round characteristic ps = qs = 2-2s

➡ LC and DC impractical

• High order DC and Algebraic attacks• S-box has deg 2, allows quadratic equation system• but 48 rounds -> expected deg close to max

➡ not feasible


Security Analysis II

• Statistical Saturation attacks• upper bounded by 30 rounds


Outline

• Motivation• PRINTcipher• Security Analysis•Implementation Results• Conclusions

12

input

State[Reg-48/96]

KeyXOR

output

48/96

6/7

48/96

pLayer

sBoxLayer

gen RCi

done RC XOR

48/96

48/96


Implementation Results IUMCL18G212T3 library

48 CLK 96 CLK

round

input

State[Reg-48/96]

KeyXOR

output

48/96

6/7

48/96

pLayer

sBoxLayer

gen RCi

done RC XOR

48/96

48/96



48 CLK 96 CLK

503GE

967GE

round

input

State[gReg-3/48/96]

KeyXOR

output

3

6/7

3 3

3S-box

pLayer

randPerm

gen RCi

done

NLFSR

RC XOR

48/96

48/96

3

48*16 = 768 CLK 96*32 = 3072 CLK

serial

input

State[Reg-48/96]

KeyXOR

output

48/96

6/7

48/96

pLayer

sBoxLayer

gen RCi

done RC XOR

48/96

48/96



48 CLK 96 CLK

503GE

967GE

round

input

State[gReg-3/48/96]

KeyXOR

output

3

6/7

3 3

3S-box

pLayer

randPerm

gen RCi

done

NLFSR

RC XOR

48/96

48/96

3

48*16 = 768 CLK 96*32 = 3072 CLK

serial

input

State[Reg-48/96]

KeyXOR

output

48/96

6/7

48/96

pLayer

sBoxLayer

gen RCi

done RC XOR

48/96

48/96


Implementation Results I

402 GE 726 GE

UMCL18G212T3 library

48 CLK 96 CLK

503GE

967GE

round


Implementation Results II

0

500

1.000

1.500

2.000

2.500

3.000

3.500

PRINTcipher-48

KTANTAN48 GOST

KATAN48PRESENT

AES(tbp)

AES

PRINTcipher-96

8080

256160

80128128

80

GE


Outline

• Motivation• PRINTcipher• Security Analysis• Implementation Results•Conclusions

15


Conclusions

• considered IC printing• proposed PRINTcipher-48 and PRINTcipher-96• PRINTcipher:• takes advantage of unique features of IC printing• requires only 402 GE• provides good scalability: +100 GE = 16x faster• object of study rather than being suitable for deployment


Conclusions

• considered IC printing• proposed PRINTcipher-48 and PRINTcipher-96• PRINTcipher:• takes advantage of unique features of IC printing• requires only 402 GE• provides good scalability: +100 GE = 16x faster• object of study rather than being suitable for deployment

Please study PRINTcipher!


Thank you!

Axel PoschmannDivision of Mathematical Sciences Nanyang Technological UniversitySPMS-MAS-04-20, 50 Nanyang AvenueSingapore 639798 T (65) 6513-7459 GMT+8h E [email protected] www.ntu.edu.sg/home/aposchmann/

Questions?

mailto:[email protected]

mailto:[email protected]

http://www.ntu.edu.sg/home/aposchmann/

http://www.ntu.edu.sg/home/aposchmann/

Documents

PRINTcipher: A Block Cipher for IC Printing