SKINNY ie Light-weight

SKINNY ie Light-weight

While AES and SHA work well together within computer systems, they struggle in an IoT/embedded world as they take up: too much processing power; too much physical space; and consume too much battery power. So NIST outlines a number of methods which can be used for light-weight cryptography, and which could be useful in IoT and RFID devices [1]. They define the device spectrum as:

• Conventional cryptography. Servers and Desktops. Tablets and smart phones.
• Light-weight cryptography. Embedded Systems. RFID and Sensor Networks.

Embedded systems

With embedded systems, we commonly see 8-bit, 16-bit and 32-bit microcontrollers, and which would struggle to cope with real-time demands for conventional cryptography methods. And in the 40+ years since the first 4-bit processor, there is even a strong market for 4-bit processors. RFID and sensor network devices, especially, have limited numbers of gates available for security, and are often highly constrained with the power drain on the device.

So AES is typically a non-starter for many embedded devices. In light-weight cryptography, we often see smaller block size (typically 64 bits or 80 bits), smaller keys (often less than 90 bits) and less complex rounds (and where the S-boxes often just have 4-bits).

The constraints of IoT

For light-weight cryptography the main constraints that we have are typically related to power requirements, gate equivalents (GEs), and timing. With passive RFID devices, we do not have an associated battery for the power supply, and where the chip must power itself from energy coupled from the radio wave. An RFID device is thus likely to be severely constrained in the power drain associated with any cryptography functions, along with being constrained for the timing requirements and for the number of gates used. Even if an RFID device has an associated battery (active RFID), it may be difficult to recharge the battery, so the drain on power must often be minimised.

There is thus often a compromise between the cryptography method used and the overall security of the method. Thus often light-weight cryptography methods balance performance (throughput) against power drain and GE, and do not perform as well as main-stream cryptography standards (such as AES and SHA-256). Along with this the method must also have a low requirement for RAM (where the method requires the usage of running memory to perform its operation) and ROM (where the method is stored on the device). In order to assess the strengths of various methods we often define the area that the cryptography function will use on the device — and which is defined in µm².

Within cryptography, we use symmetric key encryption, and which is either a block cipher or a stream cipher. Generally stream ciphers are faster and have a smaller overhead on providing memory buffers.

SKINNY

SKINNY is one method thatis a contender for Round 2 of the NIST competition for light-weight block ciphers. It a 64-bit or 128-bit block size, and a key size of 64 bits, 128 bits and 256 bits. The methods are:

• SKINNY-64–64 (64-bit block, 64-bit key and 32 rounds);
• SKINNY-64–128 (64-bit block, 128-bit key, and 36 rounds);
• SKINNY-64–192 (64-bit block, 192-bit key, and 40 rounds);
• SKINNY-128–128 (128-bit block, 128-bit key, and 40 rounds);
• SKINNY-128–256 (128-bit block, 256-bit key, and 48 rounds);
• SKINNY-128–384 (128-bit block, 384 key, and 56 rounds).

For a 64-bit block it uses a 4x4 matrix for nibbles (4 bits), and a 4x4 matrix of bytes for a 128-bit block size. For the 4x4 matrix, each round we have operations of SC (SubCells); AC (AddConstants); ShiftRows (SR); and MixColums (MC):

For the SubCells (SC) we either have a 4-bit S-box (for 64-bit block) or a 8-bit S-box (for 128-bit block):

The AddRoundTweakey (ART) process takes part of the key, and applies it within each round. A demo is here:

https://asecuritysite.com/light/skinny

Conclusions

This SKINNY method is fairly easy to implement in hardware, and is fast in its operation.