EPCBC - A Block Cipher Suitable for Electronic Product Code ...

Table 1. Hardware implementation results of some lightweight block ciphers and the AES.
key block cycles/ T’put FOM
Algorithm Ref. size size block (@100 Tech. Area block 96-bits
KHz) [µm] [GE] [ bits×109
clk·GE2 KLEIN-64 [25] 64 64
]
207 30.9 0.18 1,220 208 156
PRINTcipher-48 ∗
[32] 80 48 768 6.25 0.18 402 387 387
KATAN48 [12] 80 48 255 18.8 0.13 927 219 219
KLEIN-80 [25] 80 64 271 23.62 0.18 1,478 108 81
PRESENT-80 [44] 80 64 547 11.7 0.18 1,075 101 76
PRESENT-80 This paper 80 64 516 12.4 0.18 1,030 117 88
EPCBC-48 This paper 96 48 396 12.12 0.18 1,008 119 119
KLEIN-96 [25] 96 64 335 19.1 0.18 1,528 82 61
EPCBC-96 This paper 96 96 792 12.12 0.18 1,333 68 68
PRESENT-128 This paper 128 64 528 12.12 0.18 1,339 68 51
PRESENT-128 [43] 128 64 559 11.45 0.18 1,391 59 44
AES [40] 128 128 226 56.64 0.13 2,400 98 74
PRINTcipher-96 ∗
[32] 160 96 3,072 3.13 0.18 726 59 59
DESXL
∗
Hard-wired Keys
[34] 184 64 144 44.4 0.18 2,168 95 71
It can be seen that EPCBC(48,96) has a slightly smaller area footprint then PRESENT-80, while
having a slightly lower speed resulting in a somewhat similar FOM. However, this is only the case if
we consider messages that match the block length of the cipher. In that sense it is a best case scenario
for every algorithm. If we focus on the EPC scenario with a given block length of 96-bit, the picture
changes. The efficiency of PRESENT, AES and any other algorithm, for which the block length is not 96
bits (or that divides 96), drops significantly. As one can see in the last column, EPCBC’s efficiency stays
the same (as it does for the other algorithms with similar block lengths). If the block cipher is going to
be used as a compression function, e.g. in Davies-Meyer or Hirose Mode, the same drop in efficiency for
96-bit messages can be observed.
No implementation figures for MESH have been published so far, but for MESH-96 at least 1,345 GE
are required (in our technology) to store the 288 bits internal state (GE), which is already more than
what is required for EPCBC(96,96). As MESH-96 operates on 16-bit words, a 16-bit datapath seems a
natural choice, but, given the rather complex round function of MESH-96, it is not clear, if this would
be optimal with regards to compact area.
7 Conclusion
In this paper, we designed the EPCBC block ciphers which use a 96-bit key and are provable secure
against related-key differential/boomerang attacks. When evaluating the security of EPCBC we could
leverage on the extensive analyses published for PRESENT, providing a good “trust” starting point for
our design, contrary to other exotic, i.e. not easy to analyze, lightweight block cipher designs. Nevertheless
during the security evaluation of EPCBC(96,96), we improved the bounds for the differential/linear
resistance of PR-n, n ≥ 64, and proved new results on the DC/LC resistance of PR-n, n < 64, when
evaluating the security of EPCBC(48,96). For the envisioned scenario of EPC applications, we showed
that the chosen block sizes of 48 and 96 bits allow EPCBC to outperform other lightweight or standardized
algorithms, such as KLEIN, PRESENT and AES, regardless if used as a block cipher or as a
compression function. We also presented two optimized serialized PRESENT architectures that are both
smaller and faster than previous results.