Study and applications of the new NIST lightweight encryption with authentication standard in hardware implementations

Study and applications of the new NIST lightweight encryption with authentication standard in hardware implementations Carlos Fern´ andez-Garc´ ıa Instituto de Microelectr´ onica de Sevilla (CSIC-US) Jerez de la Frontera, C´ adiz [email protected] Carlos J. Jim´ enez-Fern´ andez Instituto de Microelectr´ onica de Sevilla (CSIC-US) Sevilla, Sevilla [email protected] Abstract—In this paper, we present the comparison between the Advanced Encryption Standard (AES) and the lightweight Authenticated Encryption with Associated Data (AEAD) algorithm suite ASCON which was selected by the National Institute of Standards and Technology (NIST) of the United States of America in 2023. The latter algorithm is not intended to replace AES, but to be used in resource-constrained devices such as IoT devices that may store and share sensitive information. Both algorithms are explained in terms of the data they process and their building blocks. Finally, a comparison is made between the hardware implementation of a variant of the ASCON algorithm suite, the AES algorithm, and the AES using the Galois Counter Mode, showing that the ASCON suite is more suitable for its implementation in resource-constrained devices with an average reduction in LUTs of 33.87% compared to the other two alternatives. Index Terms—AEAD, NIST, Lightweight Cryptography, AES. Contribution Type: Original Research I. INTRODUCTION With the increasing number of small computing devices that may store and share sensitive data in the different IoT applications, there is a need to increase the security of this data transmission by applying encryption and authentication methods. The resource-constrained nature of IoT devices makes it difficult to implement the many standard encryption and authentication methods optimised for desktop and server environments, both on the software side due to lack of processing power, and on the hardware side due to space and power constraints. The Rijndael algorithm was selected by the NIST as the Advanced Encryption Standard in 2001 [1] and since then has been widely used in a lot of applications. This block cipher allows the encryption/decryption of 128-bit blocks using 128/192/256-bit keys. Although its selection was motivated by its software implementation efficiency compared to the previous standard, and its hardware implementation in today’s technologies is pretty acceptable in terms of speed, area, and power [2][3][4], it is still too much for the computational resources available in the kind of devices employed in the IoT field. Furthermore, it is not capable of performing an authentication mechanism on its own without the implementation of a mode operation scheme such as the Galois-Counter-Mode (GCM). The efforts made to find methods to implement encryption and authentication methods in resource-constrained devices have mainly been divided into two branches: one aimed at the hardware implementation of AES trying to reduce its resource consumption [2] or by hardware-software co-design implementing the most expensive operation in hardware [5], and another whose main objective was the design of new encryption algorithms whose resource consumption is lower than AES and which also implement some authentication method within the algorithm itself. Among the processes and competitions to select new encryption algorithms, the following stand out: the eSTREAM, the ECRYPT Stream Cipher Project, which called for submissions of new stream ciphers suitable for widespread adoption in 2004, and the CAESAR competition which called for submissions of authenticated encryption ciphers in 2014. Finally, in 2018 NIST initiated a process, to solicit, evaluate, and standardize schemes that provide authenticated encryption with associated data and optional hashing capabilities for constrained environments where the performance of current NIST cryptographic standards is not acceptable, known as the Lightweight Cryptography (LWC) standardization process [6]. After 3 rounds, the NIST decided in 2023 to select as the standard for lightweight cryptography applications the ASCON family [7]. The ASCON cipher suite provides three authenticated ciphers ASCON-128 and ASCON-128a, both using 128-bit keys, and ASCON80-pq, with increased resistance against quantum key-search, two hash functions ASCON-HASH and ASCON-HASHA, and the extendable output functions ASCON-XOF and ASCON-XOFA. This article presents a comparison between the AES algorithm and the ASCON algorithm suite, both in terms of functionality and resource consumption when implemented in hardware, and it is organized as follows: in section II and III both the AES and ASCON algorithm are presented respectively, in IV a hardware implementation of both algorithms is performed in a Xilinx 7-series FPGA, and finally in V the hardware implementation results are compared and analyzed. II. ADVANCED ENCRYPTION STANDARD As mentioned above, the AES algorithm was selected by NIST in 2001 as the standard symmetric block cipher. Designed by cryptographers Joan Daemen and Vincent Rijmen it is one of the most widely used algorithms to date. The AES algorithm executes nrounds during which 3 basic operations known as layers are applied consecutively JNIC 2024 ISBN:978-84-09-62140-8 632 to perform the encryption or decryption of 128-bit blocks of data using a set of subkeys derived from the initial key. The number of rounds is 10, 12, and 14 depending on the key length which can be 128, 192, and 256 bits, respectively, and the process by which the subkeys are generated is known as the key schedule and will vary depending on the size of the key to be used. Figure 1 shows a diagram of the AES encryption process showing the different layers and their order of execution: the key addition layer, which is used to mix the data to encrypt with the key, the substitution layer, which is responsible for applying the non-linear transformation to the data being processed, and the diffusion layer, to apply a linear transformation, which in turn is divided into two sublayers: the shiftrows sublayer and the mixcolumn sublayer. Note that the mixcolumn sublayer is not applied in the last round. To perform the decryption operation, the inverse of each layer is applied in reverse order to the encryption operation. Figure 1. AES Encryption Process Scheme To better explain the algorithm, the 128-bit data block is usually represented as the so-called state matrix, where the 16 bytes, from B0to B15, that make up the 128-bit block are represented by the matrix in Figure 2. B0B4B8B12 B1B5B9B13 B2B6B10 B14 B3B7B11 B15 Figure 2. State matrix representation of the AES 128-bit data block The first layer is called the Key Addition Layer and consists of performing the xor operation between the state matrix and the corresponding subkey in each round. Note that during the execution of the first round, this operation is performed between the 128-bit plaintext to be encrypted and the key to be used. Figure 3 shows the state matrix after the key addition layer has been applied to the current state in round i, where SKa idenotes the subkey byte ain round i. B0⊕SK0 iB4⊕SK4 iB8⊕SK8 iB12 ⊕SK12 i B1⊕SK1 iB5⊕SK5 iB9⊕SK9 iB13 ⊕SK13 i B2⊕SK2 iB6⊕SK6 iB10 ⊕SK10 iB14 ⊕SK14 i B3⊕SK3 iB7⊕SK7 iB11 ⊕SK11 iB15 ⊕SK15 i Figure 3. State matrix after the application of the key addition layer The second layer Byte Substitution Layer performs a substitution operation that maps each byte from the result of applying the previous layers to a different value using a look-up table. The third layer ShiftRows Sublayer consists of a cyclic shift between the rows of the state matrix. This layer is performed by shifting the second row of the state matrix by three positions to the right, the third row by two positions to the right, and the fourth row by one position to the right. The state matrix after applying this sublayer is shown in Figure 4. B0B4B8B12 B5B9B13 B1 B10 B14 B2B6 B15 B3B7B11 Figure 4. State matrix after applying the ShiftRows layer The fourth layer Mixcolumn Sublayer performs a linear transformation that mixes each column of the state matrix after the shiftrows layer application, as indicated by the product shown in Equation 1 for the first column, resulting in the state matrix shown in Figure 5.     C0 C1 C2 C3    =    02 03 01 01 01 02 03 01 02 01 02 03 03 01 01 02    ×    B0 B5 B10 B15    (1) The key schedule is the process by which the set of subkeys used in each round of the AES algorithm is generated and it has a structure such as that observed in Figure 6 for encryption using a key of 128 bits. Where the gfunction can be observed in Figure 7. This process divides the subkey into 4 32-bit words and applies the xor operation and the g Study and applications of the new NIST lightweight encryption with authentication standard in hardware implementations 633 C0C4C8C12 C1C5C9C13 C2C6C10 C14 C3C7C11 C15 Figure 5. State matrix representation after the mixcolumn layer function between these words to generate the next subkey, it is important to note that the first subkey is the initial key. The g function is applied to the most significant 32-bit word of the subkey and consists of applying a shift operation, followed by a substitution box, and finally the xor with a constant (RC[i]) that depends on the round being performed. Figure 6. AES Encryption Key Schedule Scheme In order to authenticate the encrypted message, to know if a trusted source has sent the message, there is a need for an authentication method such as the generation of a Message Authentication Code (MAC), also known as an Authentication Tag (T). In authenticated encryption, there are three different methods to generate these MACs, depending on the time that the code was generated with respect to the encryption of the message, in the Encrypt-and-MAC both the ciphertext and the MAC are generated simultaneously from the message to be encrypted, another scheme is the MAC-then-Encrypt where first the authentication tag is generated from the message to be encrypted and then the message and the MAC are Figure 7. AES Encryption Key Schedule g Function encrypted together to generate the ciphertext. Finally, the most secure method is the Encrypt-then-MAC, where the ciphertext is generated before the authentication code, and the authentication code is generated from the ciphertext. One of the most employed methods of authenticated encryption using block ciphers such as the AES algorithm is the Galois Counter Mode of Operation (GCM), which follows an Encrypt-then-MAC scheme. Modes of operation are schemes that use block ciphers as building blocks to encrypt long blocks of data; among the more popular modes of operation are the Electronic Code Book (ECB), Cipher Block Chaining Mode (CBC), Cipher Feedback Mode (CFB), Output Feedback Mode (OFB), Counter Mode (CTR) and Galois Counter Mode (GCM). Of all these, only the GCM mode of operation provides an authentication method; this mode of operation uses a CTR scheme to encrypt the data and uses an additional block known as Associated Data in conjunction with a Galois field multiplier (GFM) to generate a MAC as shown in Figure 8; then the receiver of the message only needs to decrypt the message using the CTR mode and compute the tag using the associated data received, and in case the authentication tag generated by the receiver and the one sent by the origin do not match, it is interpreted that the source of the message is not a reliable source or that the message has been modified by a third party during the sending process. III. LIGHTWEIGTH CRYPTOGRAPHY STANDARD: ASCON As mentioned in the introduction, in 2018, NIST launched a process to select a standard for lightweight cryptography applications, that called for the submission of authenticated encryption algorithms. The submitted algorithms would be classified into different profiles depending on the physical, performance and security characteristics of the algorithm. The NIST project focused mainly on block ciphers, authenticated encryption algorithms, HASH functions, MACs, cryptographic permutations, and stream ciphers. In evaluating these algorithms, NIST relied on general properties of these primitives, such as security strength, which should be at least 112 bits; flexibility, in the sense that an efficient implementation of the algorithm should be possible on different platforms; C. Fern´andez-Garc´ıa and C. J. Jim´enez-Fern´andez 634 IV GFM H Figure 8. GCM Mode of operation scheme low overhead for multiple functions, which could be achieved by sharing the same logic for different functions such as encryption, decryption, and hashing; and protection against side-channel and fault attacks, among others [8]. This process received 57 submissions in March 2019, of which only 32 were selected in August 2019 [9], the second round started after the selection of the 32 candidates and ended with the selection of the 10 finalists in March 2021 [10]. The final round ended in February 2023 [11] with the selection of the ASCON cipher suite, which had already been selected in the above-mentioned CAESAR competition. The ASCON family includes three Authenticated Encryption with Associated Data ciphers, ASCON-128, ASCON- 128a, and ASCON-80pq, and provides two hash functions and two extendable output functions, ASCON-HASH, ASCONHASHA, ASCON-XOF, and ASCON-XOFA, respectively. The ASCON algorithm is based on the construct known as sponge functions and uses a 320-bit permutation as its main element. The ASCON 320-bit permutation, denoted as p, operates on a 320-bit state which is updated by applying the permutation pa(ppermutation atimes) and pb(ppermutation btimes). The 320-bit state, S, is divided into an outer part Srof rbits known as the rate, and an inner part Sc, known as the capacity where c= 320 −r. The permutation papplies 3 transformations to the ASCON state: the round constant addition, the substitution layer, and the linear layer. In order to explain the application of these transformations the ASCON state is divided into 5 64-bit registers as follows S=Sr|Sc=x0|x1|x2|x3|x4, where the operand |denotes concatenation. Figures 9, 10, and 11 show a scheme of each operation effect in the ASCON state register. The constant addition layer adds a round constant, whose value depends on the round of the permutation, to the x2 register from the ASCON state. The subsitution layer updates the state with 64 parallel applications of a 5-bit s-box, that modifies the data formed by x0(i)|x1(i)|x2(i)|x3(i)|x4(i), being ithe i’th bit of each register. The linear diffusion layer provides diffusion within each 64-bit register xiby applying the Equation from 2 to 6. Figure 9. ASCON permutation round constant layer Figure 10. ASCON permutation substitution layer Figure 11. ASCON permutation linear layer x0=x0⊕(x0≫19) ⊕(x0≫28) (2) x1=x1⊕(x1≫61) ⊕(x1≫39) (3) x2=x2⊕(x2≫1) ⊕(x2≫6) (4) x3=x3⊕(x3≫10) ⊕(x3≫17) (5) x4=x4⊕(x4≫7) ⊕(x4≫41) (6) Figures 12 and 13 show the ASCON family authentication encryption and decryption with associated data schemes respectively, and these figures show the inputs of the algorithm: a key, K, which is used with a nonce, N, and a constant known as the initialization vector, IV, in the initialization process. The associated data, A, is processed by xoring Ai to the ASCON state rate, and the plaintext, P, from which the ciphertext is obtained by performing the xor operation between the plaintext and the corresponding block from the state rate depending on the ASCON AEAD variant. Finally, at the end of the finalization phase, an authentication tag, T, is generated in which the key is also used. The width of the rate, the blocks width, the aand bround number, and the IVs values are shown in Table I. Highlight that not all the data blocks mentioned before are mandatory, just the key and the nonce. The associated data and plaintext are optional and its processing can be suppressed. Study and applications of the new NIST lightweight encryption with authentication standard in hardware implementations 635 Figure 12. ASCON authenticated encryption with associated data scheme Figure 13. ASCON authenticated decryption with associated data scheme Parameters Variants ASCON-128 ASCON-128a Key width 128 bits 128 bits Nonce width 128 bits 128 bits Tag width 128 bits 128 bits Data block width 64 bits 128 bits a rounds 12 12 b rounds 6 8 IV Constant 0x80400c0600000000 0x80800c0800000000 Table I PARAMETERS FOR THE ASCON-AEAD VARIANTS IV. HARDWARE IMPLEMENTATION In this section, a comparison is made between the hardware implementation of the ASCON-128a algorithm, an AES core that can perform the encryption and decryption operation, based on the implementation from the Hadipourh GitHub repository [12], and an AES-GCM implementation developed by the Cryptographic Engineering Research Group (CERG) at George Mason University [13]. The selection of the ASCON- 128a variant for its comparison with the AES algorithm is due to its key size of 128 bits, which is the same key length used in the AES hardware implementations against which the ASCON hardware implementation will be compared in this article. The AES implementation uses two 128-bit registers for the state and the key schedule as shown in Figure 14. Figure 14. AES top view The AES-GCM implementation uses an AES encryption core, a 96-bit register, and a 32-bit register used as the IV and the counter value for the CTR mode of operation respectively, two 128-bit registers to store the hash key (H in Figure 8) and the key, a 128-bit register for the cipher state, and two 128-bit registers for the Galois multiplication unit. The ASCON implementation uses a 320-bit register for the cipher state and a 128-bit register to store the key used in the operation. Figure 15 shows a block diagram of the cipher implementation. Figure 15. ASCON top view Table II shows the resource consumption difference in terms of LUTs, and slice regs of the three algorithms hardware implementation. Algorithm LUTs Regs AES 2752 273 AES-GCM 2562 876 ASCON128a 1755 494 Table II AES AND ASCON HARDWARE IMPLEMENTATION COMPARISON V. CONCLUSION In this paper, we have presented the AES and ASCON algorithms, compared them with each other, and performed a hardware implementation in the Artix 7-Series Xilinx FPGA. The results of this comparison show that the hardware implementation of the ASCON algorithm is more suitable for resource-constrained devices, being its resource consumption in terms of LUTs 36.23% less than the AES hardware implementation, and 31.50% less than the AES-GCM. In addition, the ASCON algorithm allows the authentication of the data transmission without the need for any additional circuitry in comparison to the AES algorithm which requires the implementation of a mode of operation such as the Galois Counter Mode. ACKNOWLEDGMENT This work has been funded by SPIRS (Secure Platform for ICT Systems Rooted at the Silicon Manufacturing Process) Project with Grant Agreement No. 952622 under the European Union’s Horizon 2020 research and innovation programme. The Authors want to thank Project Grant PID2020116664RB- I00 funded by MCIN/AEI/10.13039/501100011033. C. Fern´andez-Garc´ıa and C. J. Jim´enez-Fern´andez 636 REFERENCES [1] M. Dworkin, E. Barker, J. Nechvatal, J. Foti, L. Bassham, E. Roback, and J. Dray, “Advanced Encryption Standard (AES),” 2001-11-26 2001. [2] A. Moradi, A. Poschmann, S. Ling, C. Paar, and H. Wang, “Pushing the Limits: A Very Compact and a Threshold Implementation of AES,” in Advances in Cryptology – EUROCRYPT 2011, K. G. Paterson, Ed. Berlin, Heidelberg: Springer Berlin Heidelberg, 2011, pp. 69–88. [3] X. Zhang and K. Parhi, “High-speed VLSI architectures for the AES algorithm,” IEEE Transactions on Very Large Scale Integration (VLSI) Systems, vol. 12, no. 9, pp. 957–967, 2004. [4] M. McLoone and J. McCanny, “High Performance Single-Chip FPGA Rijndael Algorithm Implementations,” in Cryptographic Hardware and Embedded Systems — CHES 2001, C¸ . K. Koc¸, D. Naccache, and C. Paar, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2001, pp. 65–76. [5] M. A. Hasamnis and S. S. Limaye, “Design and implementation of Rijindael’s encryption algorithm with hardware / software co-design using NIOS II processor,” in 2012 7th IEEE Conference on Industrial Electronics and Applications (ICIEA), 2012, pp. 1386–1389. [6] NIST, “Lightweight Cryptography,” 2018, https://csrc.nist.gov/projects/ lightweight-cryptography. [7] C. Dobraunig, M. Eichlseder, F. Mendel, and M. Schl¨ affer, “Ascon v1.2,” 2021, https://csrc.nist.gov/CSRC/media/Projects/ lightweight-cryptography/documents/finalist-round/updated-spec-doc/ ascon-spec-final.pdf. [8] NIST, “Report on Lightweight Cryptography,” 2017, https://csrc.nist. gov/pubs/ir/8114/final. [9] ——, “Status Report on the First Round of the NIST Lightweight Cryptography Standardization Process,” 2019, https://csrc.nist.gov/pubs/ ir/8268/final. [10] ——, “Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process,” 2021, https://csrc.nist.gov/pubs/ ir/8369/final. [11] ——, “Status Report on the Final Round of the NIST Lightweight Cryptography Standardization Process,” 2023, https://csrc.nist.gov/pubs/ ir/8454/final. [12] “Hadipourh AES Repository,” 2001, https://github.com/hadipourh/ AES-VHDL. [13] “CERG AES-GCM Repository,” 2001, https://github.com/GMUCERG/ AESGCM. Study and applications of the new NIST lightweight encryption with authentication standard in hardware implementations 637