With the establishment of the AES the need for new block ciphers has been greatly diminished; for almost all block cipher applications the AES is an excellent and preferred choice. However, despite recent implementation advances, the AES is not suitable for extremely constrained environments such as RFID tags and sensor networks. In this paper we describe an ultra-lightweight block cipher, present . Both security and hardware efficiency have been equally important during the design of the cipher and at 1570 GE, the hardware requirements for present are competitive with today's leading compact stream ciphers.

/pdf/present-an-ultra-lightweight-block-cipher-33ym33ql7r.pdf

PRESENT: An Ultra-Lightweight Block Cipher

We present a new block cipher LED. While dedicated to compact hardware implementation, and offering the smallest silicon footprint among comparable block ciphers, the cipher has been designed to simultaneously tackle three additional goals. First, we explore the role of an ultra-light (in fact non-existent) key schedule. Second, we consider the resistance of ciphers, and LED in particular, to related-key attacks: we are able to derive simple yet interesting AES-like security proofs for LED regarding related- or single-key attacks. And third, while we provide a block cipher that is very compact in hardware, we aim to maintain a reasonable performance profile for software implementation.

The LED block cipher

In this paper we propose a new family of very efficient hardware oriented block ciphers. The family contains six block ciphers divided into two flavors. All block ciphers share the 80-bit key size and security level. The first flavor, KATAN, is composed of three block ciphers, with 32, 48, or 64-bit block size. The second flavor, KTANTAN, contains the other three ciphers with the same block sizes, and is more compact in hardware, as the key is burnt into the device (and cannot be changed).

The smallest cipher of the entire family, KTANTAN32, can be implemented in 462 GE while achieving encryption speed of 12.5 KBit/sec (at 100 KHz). KTANTAN48, which is the version we recommend for RFID tags uses 588 GE, whereas KATAN64, the largest and most flexible candidate of the family, uses 1054 GE and has a throughput of 25.1 Kbit/sec (at 100 KHz).

/pdf/katan-and-ktantan-a-family-of-small-and-efficient-hardware-1nbl4htw1x.pdf

KATAN and KTANTAN -- A Family of Small and Efficient Hardware-Oriented Block Ciphers

This paper presents a block cipher that is optimized with respect to latency when implemented in hardware. Such ciphers are desirable for many future pervasive applications with real-time security needs. Our cipher, named PRINCE, allows encryption of data within one clock cycle with a very competitive chip area compared to known solutions. The fully unrolled fashion in which such algorithms need to be implemented calls for innovative design choices. The number of rounds must be moderate and rounds must have short delays in hardware. At the same time, the traditional need that a cipher has to be iterative with very similar round functions disappears, an observation that increases the design space for the algorithm. An important further requirement is that realizing decryption and encryption results in minimum additional costs. PRINCE is designed in such a way that the overhead for decryption on top of encryption is negligible. More precisely for our cipher it holds that decryption for one key corresponds to encryption with a related key. This property we refer to as α-reflection is of independent interest and we prove its soundness against generic attacks.

/pdf/prince-a-low-latency-block-cipher-for-pervasive-computing-3rf9hqsh69.pdf

PRINCE: a low-latency block cipher for pervasive computing applications

In this paper, we propose a new block cipher HIGHT with 64-bit block length and 128-bit key length. It provides low-resource hardware implementation, which is proper to ubiquitous computing device such as a sensor in USN or a RFID tag. HIGHT does not only consist of simple operations to be ultra-light but also has enough security as a good encryption algorithm. Our hardware implementation of HIGHT requires 3048 gates on 0.25 μm technology.

/pdf/hight-a-new-block-cipher-suitable-for-low-resource-device-2vmhkebofj.pdf

HIGHT: a new block cipher suitable for low-resource device

The hash function FORK-256 was published at the first NIST hash workshop and FSE 2006. It consists of simple operations so that its performance is better than that of SHA-256. However, recent papers show some weaknesses of FORK-256. In this paper, we propose newly modified FORK-256 which has no microcoliisions and so is resistant against existing attacks. Furthermore, it is faster than the old one.

New FORK-256.

We propose new double-block-length hash functions. Our approach for constructing collision-resistant double-block-length hash functions is to convert a blockcipher E with n -bit block length and 2n -bit key length to a 3-round Feistel cipher E * with 2n -bit block length, and then to embed E * in PGV compression functions. We prove that 12 hash functions with the group-1 PGV compression functions in which E * is embedded are collision-resistant in the ideal cipher model. Furthermore, since our hash functions have the hash rate 2/3, they are more efficient than any other existing double-block-length hash functions in terms of the number of blockcipher calls required for processing messages.

A New Double-Block-Length Hash Function Using Feistel Structure

In this paper, we introduce new compression function design principles supporting variable output lengths (multiples of size n). They are based on a function or block cipher with an n-bit output size. In the case of the compression function with a (t + 1)n-bit output size, in the random oracle and ideal cipher models, their maximum advantages from the perspective of collision resistance are O(t2q/2tn + q2/2(t + 1)n). In the case of t = 1, the advantage is near-optimal. In the case of t > 1, the advantage is optimal.

/pdf/compression-function-design-principles-supporting-variable-19b4jagulx.pdf

Compression Function Design Principles Supporting Variable Output Lengths from a Single Small Function

Abstract Cell-based assays can monitor virus infection at a single-cell level with high sensitivity and cost-efficiency. For this purpose, it is crucial to develop molecular probes that respond selectively to physiological changes in live cells. We report stimuli-responsive light-emitters built on a T-shaped benzimidazole platform, and consecutive borylation reactions to produce a library of homologs displaying systematic changes in fluorescence quantum yield and environmental sensitivity. We find that certain fluorophores localize selectively at the endoplasmic reticulum, and interact with proteins involved in the stress signaling pathways. Notably, the mono-borylated compound responds selectively to the stress conditions by enhancing fluorescence, and detects avian influenza virus infection at the single-cell level. Our findings demonstrate the unprecedented practical utility of the stress-responsive molecular probes to differentiate cellular states for early diagnosis. 

/pdf/orthogonally-tunable-and-er-targeting-fluorophores-detect-1ivq6gf3.pdf

Jesang Lee

Papers

HIGHT: a new block cipher suitable for low-resource device

New FORK-256.

A New Double-Block-Length Hash Function Using Feistel Structure

Compression Function Design Principles Supporting Variable Output Lengths from a Single Small Function

Orthogonally-tunable and ER-targeting fluorophores detect avian influenza virus early infection