On Ciphers that Continuously Access the Non-Volatile Key
Open accessAbstract
Due to the increased use of devices with restricted resources such as limited area size, power or energy, the community has developed various techniques for designing lightweight ciphers. One approach that is increasingly discussed is to use the cipher key that is stored on the device in non-volatile memory not only for the initialization of the registers but during the encryption/decryption process as well. Recent examples are the ciphers Midori (Asiacrypt’15) and Sprout (FSE’15). This may on the one hand help to save resources, but also may allow for a stronger key involvement and hence higher security. However, only little is publicly known so far if and to what extent this approach is indeed practical. Thus, cryptographers without strong engineering background face the problem that they cannot evaluate whether certain designs are reasonable (from a practical point of view) which hinders the development of new designs.In this work, we investigate this design principle from a practical point of view. After a discussion on reasonable approaches for storing a key in non-volatile memory, motivated by several commercial products we focus on the case that the key is stored in EEPROM. Here, we highlight existing constraints and derive that some designs, based on the impact on their throughput, are better suited for the approach of continuously reading the key from all types of non-volatile memory. Based on these findings, we improve the design of Sprout for proposing a new lightweight stream cipher that (i) has a significantly smaller area size than almost all other stream ciphers and (ii) can be efficiently realized using common non-volatile memory techniques. Hence, we see our work as an important step towards putting such designs on a more solid ground and to initiate further discussions on realistic designs.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
We ruled out TMDTO distinguishing attacks against Fruit-80, similar to Fruit and Plantlet ciphers.
“As discussed in the introduction, we ruled out TMDTO distinguishing attacks against Fruit-80 (similar to Fruit and Plantlet ciphers [23,26]).”
From Fruit-80: A Secure Ultra-Lightweight Stream Cipher for Constrained Environments (2018) · cites this paper as [26]
The Plantlet paper’s “Distinguishing attacks” section says a distinguishing attack may be possible but requires at least 2^58 memory, making countermeasures unreasonable for ultra-lightweight devices. Its trade-off discussion says certain Sprout key-recovery attacks do not appear effective against Plantlet. This supports treating those attacks as impractical, but not a categorical claim that TMDTO distinguishing attacks were ruled out; the paper makes no claim about Fruit-80. (LLM, conf=0.82)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 20
- Nitesh Saxena and Ahmad-Reza Sadeghi, editors, Radio Frequency Identification: Security and Privacy Issues -10th International Workshop, RFIDSec 2014, Oxford, UK, July 21-23, 2014, Revised Selected Papers, volume 8651 of Lecture Notes in Computer Science, pages 1-18. Springer, 2014.
- Frederik Armknecht and Vasily Mikhalev. On lightweight stream ciphers with shorter internal states. In Gregor Leander, editor, Fast Software Encryption - 22nd International Workshop, FSE 2015, Istanbul, Turkey, March 8-11, 2015, Revised Selected Papers, volume 9054 of Lecture Notes in Computer Science, pages 451-470. Springer, 2015.
- Subhadeep Banik. Some results on Sprout. In Alex Biryukov and Vipul Goyal, editors, Progress in Cryptology -INDOCRYPT 2015 -16th International Confer- ence on Cryptology in India, Bangalore, India, December 6-9, 2015, Proceedings, volume 9462 of Lecture Notes in Computer Science, pages 124-139. Springer, 2015.
- Subhadeep Banik, Andrey Bogdanov, Takanori Isobe, Kyoji Shibutani, Harunaga Hiwatari, Toru Akishita, and Francesco Regazzoni. Midori: A block cipher for low energy. In Advances in Cryptology-ASIACRYPT 2015, pages 411-436. Springer, 2015'.
- Andrey Bogdanov, Lars R. Knudsen, Gregor Leander, Christof Paar, Axel Poschmann, Matthew J. B. Robshaw, Yannick Seurin, and C. Vikkelsoe. PRESENT: an ultra-lightweight block cipher. In Pascal Paillier and Ingrid Verbauwhede, editors, Cryptographic Hardware and Embedded Systems -CHES 2007, 9th International Workshop, Vienna, Austria, September 10-13, 2007, Proceedings, volume 4727 of Lecture Notes in Computer Science, pages 450-466. Springer, 2007.
- Raymond E Barnett and Jin Liu. An EEPROM programming controller for passive UHF RFID transponders with gated clock regulation loop and current surge control. Solid-State Circuits, IEEE Journal of, 43(8):1808-1815, 2008.
- Christophe De Cannière, Orr Dunkelman, and Miroslav Knezevic. KATAN and KTANTAN -A family of small and efficient hardware-oriented block ciphers. In Christophe Clavier and Kris Gaj, editors, Cryptographic Hardware and Embedded Systems -CHES 2009, 11th International Workshop, Lausanne, Switzerland, September 6-9, 2009, Proceedings, volume 5747 of Lecture Notes in Computer Science, pages 272-288. Springer, 2009. [Cry] Cryptominisat-2.9.10. http://www.msoos.org/cryptominisat2/.
- Zhaoxian Cheng, Xiaoxing Zhang, Yujie Dai, and Yingjie Lu. Design techniques of low-power embedded EEPROM for passive RFID tag. Analog Integrated Circuits and Signal Processing, 74(3):585-589, 2013.
- Mathieu David, Damith C Ranasinghe, and Torben Larsen. A2U2: a stream cipher for printed electronics RFID tags. In RFID (RFID), 2011 IEEE Interna- tional Conference on, pages 176-183. IEEE, 2011.
- Muhammed F Esgin and Orhun Kara. Practical cryptanalysis of full Sprout with TMD tradeoff attacks. In International Conference on Selected Areas in Cryptography, pages 67-85. Springer, 2015.
- Tim Good and Mohammed Benaissa. Hardware performance of eStream phase-iii stream cipher candidates. In Proc. of Workshop on the State of the Art of Stream Ciphers (SACS'08), 2008.
- Jian Guo, Thomas Peyrin, Axel Poschmann, and Matt Robshaw. The LED block cipher. In Cryptographic Hardware and Embedded Systems-CHES 2011, pages 326-341. Springer, 2011.
- Jesung Kim, Jong Min Kim, Sam H Noh, Sang Lyul Min, and Yookun Cho. A space-efficient flash translation layer for CompactFlash systems. IEEE Transac- tions on Consumer Electronics, 48(2):366-375, 2002.
- Lars R. Knudsen, Gregor Leander, Axel Poschmann, and Matthew J. B. Rob- shaw. PRINTcipher: A Block Cipher for IC-Printing. In Stefan Mangard and François-Xavier Standaert, editors, Cryptographic Hardware and Embedded Systems, CHES 2010, 12th International Workshop, Santa Barbara, CA, USA, August 17-20, 2010. Proceedings, volume 6225 of Lecture Notes in Computer Science, pages 16-32. Springer, 2010.
- Kyoung-Su Lee, Jung-Hoon Chun, and Kee-Won Kwon. A low power CMOS compatible embedded EEPROM for passive RFID tag. Microelectronics Journal, 41(10):662-668, 2010.
- Virginie Lallemand and María Naya-Plasencia. Cryptanalysis of full Sprout. In Rosario Gennaro and Matthew Robshaw, editors, Advances in Cryptology -CRYPTO 2015 -35th Annual Cryptology Conference, Santa Barbara, CA, USA, August 16-20, 2015, Proceedings, Part I, volume 9215 of Lecture Notes in Computer Science, pages 663-682. Springer, 2015.
- Andrey Nuykin, Alexander Kravtsov, Sergey Timoshin, and Igor Zubov. A low cost EEPROM design for passive RFID tags. In Communications and Electronics (ICCE), 2012 Fourth International Conference on, pages 443-446. IEEE, 2012.
- Yan Na, Tan Xi, Zhao Dixian, and Min Hao. An Ultra-Low-Power Embedded EEPROM for Passive RFID Tags. Chinese Journal of Semiconductors, 27(6), 2006.
- Jivan Parab, Santosh A Shinde, Vinod G Shelake, Rajanish K Kamat, and Gour- ish M Naik. Practical aspects of embedded system design using microcontrollers. Springer Science & Business Media, 2008.
- Roel Verdult, Flavio D Garcia, and Baris Ege. Dismantling megamos crypto: Wirelessly lockpicking a vehicle immobilizer. In Supplement to the 22nd USENIX Security Symposium (USENIX Security 13), pages 703-718, 2015.
Cited by
Sorted by citations
Fruit-80: A Secure Ultra-Lightweight Stream Cipher for Constrained Environments
Amin Ghafari, V., & Hu, H. (2018) · Entropy · doi:10.3390/e20030180 · Cited by 45 · see citing works
- Authors
- Mikhalev, V., Armknecht, F., & Müller, C.
- Affiliations
- University of Mannheim (DE)
- Venue
- IACR Transactions on Symmetric Cryptology
- Published
- 2017-02-03
- Pages
- 52-79
- ISSN
- 2519-173X (ISSN-L)
- OpenAlex
- W4213193213
- Cited by
- 79
- References
- 0
- Citations by year
- 2026: 2 · 2025: 4 · 2024: 9 · 2023: 6 · 2022: 16 · 2021: 12 · 2020: 8 · 2019: 8 · 2018: 6 · 2017: 8
- FWCI
- 4.89
- Type
- journal article
- Language
- en
- Open access
- diamond
- doi.org
- Locations
- IACR Transactions on Symmetric Cryptology (publishedVersion, cc-by)
- Funders
- Deutsche Forschungsgemeinschaft
- Austrian Science Fund (COMET K1, P12345-B51)
- Österreichische Forschungsförderungsgesellschaft (COMET K1)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- lightweight stream cipher, EEPROM, sprouts, Midori, throughput constraints, resource-constrained devices
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
