EPCBC - A Block Cipher Suitable for Electronic Product Code ...

xored to each round. Therefore this boils down to the subkeys being cyclic with period t, in which case
F consists of t rounds of the cipher. The adversary needs to find a slid pair (P0,C0) and (P1,C1) such
that P0 = F(P1) and C0 = F(C1). Then with these chosen plaintexts, he only needs to attack t rounds
instead of the entire cipher. In EPCBC, the key schedule is essentially a block cipher by itself where the
input is the secret key and the output of each round is a subkey. So it is highly unlikely that the subkeys
will be periodic to allow a slide attack. We have also added different round constants to each round to
ensure that the subkeys do not repeat.
Algebraic Attacks In 2002, it was claimed in [17] that the XSL method is able to break AES by
expressing the cipher as a sparse system of quadratic equations and solving it. However in 2005, it was
proven in [14] that the XSL attack does not work. Instead, practical results on algebraic cryptanalysis of
block ciphers have been obtained by applying the Buchberger and F4 algorithms within MAGMA [39].
Therefore, the authors of PRESENT applied the F4 algorithm on MAGMA to solve a mini version of
PRESENT [10]. They found that even when considering a system consisting of seven S-boxes, i.e. a block
size of 28 bits, they were unable to obtain a solution in a reasonable time to even a two-round version
of the reduced cipher. Therefore they conclude that algebraic attacks are unlikely to pose a threat to
PRESENT, which can be written as a system of 11067 quadratic equations in 4216 variables, arising
from 527 S-boxes. The EPCBC cipher also uses the PRESENT S-box which can be described by 21
quadratic equations in 8 input/output-bit variables over GF(2) [10]. There are 12×32+12×33 = 780
S-boxes in EPCBC(48,96). Thus it can be expressed as a system of 780×21 = 16380 quadratic equations
in 780×8 = 6240 variables. In a similar way, EPCBC(96,96) has 1560 S-boxes and it can be expressed
as a system of 32760 quadratic equations in 12480 variables. Hence both versions of EPCBC result in
a more complex system of quadratic equations than that of PRESENT. Therefore we do not expect
algebraic attacks to be a threat to EPCBC too.
6 Implementation of EPCBC
To demonstrate the efficiency of our proposal we have implemented EPCBC(48,96) and EPCBC(96,96)
in VHDL and used Synopsys DesignVision 2007.12 to synthesize them using the Virtual Silicon (VST)
standard cell library UMCL18G212T3, which is based on the UMC L180 0.18µm 1P6M logic process
and has a typical voltage of 1.8 Volt [45].
Figure 1 depicts serialized hardware architectures for EPCBC(48,96) (top) and EPCBC(96,96) (bottom).
Components that contain mainly sequential logic are presented in rectangles while purely combinational
components are presented in ovals. Naturally the architecture of EPCBC is very similar to a
serialized PRESENT architecture, as published previously e.g. in [44,43]. A significant difference is in
the key schedule of EPCBC(48,96), as it does not perform any operation on the left halve of the key
(i.e. LKey) in every round. This allows to store LKey in the simplest flip-flops available (4.67 GE per
bit) contrary to the State and RKey, which have to be stored in flip-flops with two inputs (6 GE).
Another optimization is that every round requires only n/4 clock cycles, n being the block size, as
compared to n/4+1 clock cycles e.g. [44,43]. This can be achieved by by simply wiring the S-box output
directly as input to the Permutation layer, thus combining the execution of the S-box look-up of the last
chunk of a round with the Permutation layer into one clock cycle. Note that this optimization can also be
applied to PRESENT. Thus, a second contribution of this paper are optimized serialized PRESENT-80
and PRESENT-128 implementations that requires only 516 and 528 clock cycles (compared to previously
547 and 559, respectively [44]). Note that in order to apply this speed-up trick a second S-box has to be
implemented (22.3 GE 3 ), while the MUX (11 GE) for the S-box input can be saved. In principal this
would result in a 6 GE larger area requirement compared to the design strategy of [44]. However, since
3 We hereby acknowledge the support of Dag Arne Osvik to derive a more compact S-box.