. In this paper, we present the quantum implementation and analysis of the recently proposed block cipher, DEFAULT. DEFAULT is consisted of two components, namely DEFAULT-LAYER and DEFAULT-CORE. Two instances of DEFAULT-LAYER is used before and after DEFAULT-CORE (the so-called ‘sandwich construction’). We discuss about the the various choices made to keep the cost for the basic quantum circuit and that of the Grover’s oracle search, and compare it with the levels of quantum security specified by the United States’ National Institute of Standards and Technology (NIST). All in all, our work nicely fits in the research trend of finding the possible quantum vulnerability of symmetric key ciphers.

Quantum Implementation and Analysis of DEFAULT

At 2003, the SM4 block cipher was introduced that is a Chinese domestic cryptographic. It is mandated in the Chinese National Standard for Wireless LAN Wired Authentication and Privacy Infrastructure (WAPI), because the algorithm was developed for use in wireless sensor networks to provide safety network environment. The SM4 block cipher uses a 128-bit block size and a 32-bit round key. It consists of 32 rounds and one reverse translation R. In this paper, we present the optimized implementation of the SM4 block cipher on 8-bit AVR microcontrollers, which are widely used in wireless sensor devices; the optimized implementation of the SM4 block cipher on 32-bit RISC-V processors, which are open-source-based computer architectures, and the optimized implementation of SM4 on 64-bit ARM processors with parallel computation, which are widely used in smartphones and tablets. In the AVR microcontroller, three versions are implemented for various purposes, including speed-optimization, memory-optimization, and code size-optimization. As a result, the speed-optimization, memory-optimization, and code size-optimization versions achieved 205.2 cycles per byte, 213.3 cycles per byte, and 207.4 cycles per byte, respectively. This is faster than the reference implementation written in C language (1670.7 cycles per byte). The implementation on 32-bit RISC-V processors achieved 128.8 cycles per byte. This is faster than the reference implementation written in C language (345.7 cycles per byte). The implementation on 64-bit ARM processors achieved 8.62 cycles per byte. This is faster than the reference implementation written in C language (120.07 cycles per byte).

/pdf/optimized-implementation-of-sm4-on-avr-microcontrollers-risc-266fcjyz.pdf

Optimized Implementation of SM4 on AVR Microcontrollers, RISC-V Processors, and ARM Processors

. With the recent development of Internet of Things (IoT) devices, related security issues are also increasing. In particular, the pos-sibility of accessing and hijacking cryptographic devices is also increasing due to the rapid increase in usage of these devices. Therefore, research on cryptographic technologies that can provide a safe environment even in resource-constrained environments has been actively conducted. Among them, there are increasing security issues of side-channel analysis for devices due to their physical accessibility. The lightweight block cipher PIPO was recently proposed in ICISC 2020 to address these issues. The PIPO has the characteristic of providing robust security strength while having less overhead when using the side-channel analysis countermeasures. A diﬀerential fault attack is a type of side-channel analysis that induces fault in cryptographic operations and utilizes diﬀerence information that occurs. Diﬀerential fault attacks on the PIPO have not yet been studied. This paper proposed a single-bit ﬂip-based diﬀerential fault attack on the lightweight block cipher PIPO for the ﬁrst time. We show that simulations enable the recovery of the correct secret key with about 98% probability through 64 fault ciphertexts. Therefore, the PIPO does not provide security against diﬀerential fault attacks. When using the PIPO cipher on IoT devices, designers must apply appropriate countermeasures against fault-injection attacks.

https://onlinelibrary.wiley.com/doi/pdfdirect/10.1049/ise2.12078

Differential Fault Attack on Lightweight Block Cipher PIPO

Parallel quantum addition for Korean block ciphers

In this paper, we propose a quantum circuit for the SPEEDY block cipher for the first time and estimate its security strength based on the post-quantum security strength presented by NIST. The strength of post-quantum security for symmetric key cryptography is estimated at the cost of the Grover key retrieval algorithm. Grover’s algorithm in quantum computers reduces the n-bit security of block ciphers to n2 bits. The implementation of a quantum circuit is required to estimate the Grover’s algorithm cost for the target cipher. We estimate the quantum resource required for Grover’s algorithm by implementing a quantum circuit for SPEEDY in an optimized way and show that SPEEDY provides either 128-bit security (i.e., NIST security level 1) or 192-bit security (i.e., NIST security level 3) depending on the number of rounds. Based on our estimated cost, increasing the number of rounds is insufficient to satisfy the security against quantum attacks on quantum computers.

/pdf/speedy-quantum-circuit-for-grovers-algorithm-3ewg6fig.pdf

SPEEDY Quantum Circuit for Grover’s Algorithm

PIPO is a lightweight block cipher and shows better performance than other block cipher algorithms on low-end microcontrollers (e.g. 8-bit AVR). In addition, PIPO block cipher can utilize the efficient masking method by minimizing the number of non-linear operations. Therefore, PIPO block cipher can prevent side-channel attacks, efficiently. In this paper, we propose an efficient first-order masking technique using a 2-byte random mask by taking an advantage of PIPO block cipher. We present a new OR operation masking technique. Among functions of PIPO, the masked S-layer with 23 AND operations, 5 OR operations, and 46 XOR operations is used. Operations of PIPO block cipher are implemented in AVR assembly languages. The proposed implementation showed 1.5\(\times \) faster performance enhancements compared to the unprotected C implementation in the encryption process and 2.2\(\times \) faster performance enhancements compared to the unprotected optimized assembly implementation.

Masked Implementation of PIPO Block Cipher on 8-bit AVR Microcontrollers.

Grover search algorithm can be used to find the n-bit secret key at the speed of √ n, which is the most effective quantum attack method for block ciphers. In order to apply the Grover search algorithm, the target block cipher should be implemented in quantum circuits. Many recent research works optimized the expensive substitute layer to evaluate the need for quantum resources of AES block ciphers. Research on the implementation of quantum circuits for lightweight block ciphers such as SIMON, SPECK, HIGHT, CHAM, LEA, and Gimli, an active research field, is also gradually taking place. In this paper, we present optimized implementations of GIFT block ciphers for quantum computers. To the best of our knowledge, this is the first implementation of GIFT in quantum circuits. Finally, we estimate quantum resources for applying the Grover algorithm to the our optimized GIFT quantum circuit.

Grover on GIFT.

/pdf/optimized-implementation-of-sm4-on-avr-microcontrollers-risc-1e01eq3hz4.pdf

Siwoo Eum

Papers

Masked Implementation of PIPO Block Cipher on 8-bit AVR Microcontrollers.

Grover on GIFT.

Optimized Implementation of SM4 on AVR Microcontrollers, RISC-V Processors, and ARM Processors

Optimized Implementation of SM4 on AVR Microcontrollers, RISC-V Processors, and ARM Processors

SPEEDY Quantum Circuit for Grover’s Algorithm