3 Selected Design and Analysis Techniques for Contemporary Symmetric Encryption
53
In the second case, i.e., for those types of NVM which allow the key to be rewritable
(such as EEPROM and Flash), severe timing limitations for accessing the NVM may
occur. In particular, it depends on how the key stored in NVM needs to be accessed.
In some cases, implementation of ciphers which require continuous access to the
randomly selected bits of the key stored in rewritable types of NVM may lead to a
reduction of the throughput up to a factor of 50 [421]. However, designs that require
sequential access to the key bits are almost unaffected, irrespective of the underlying
NVM type.
With respect to area size, there is no big difference whether the key has to be
read only once or continuously during encryption, since the logic for reading the
key (at least once) has to be implemented anyway. Small extra logic may be needed
for synchronization with an NVM cipher which should not be clocked unless key
material is read from NVM.
3.2.3 The Stream Ciphers Sprout and Plantlet
The design principles discussed in Sect. 3.2.1 have been demonstrated by two
concrete keystream generators with keyed update function, namely Sprout and
Plantlet. Both ciphers have a similar structure (see Fig. 3.1) which was inspired by
Grain-128a [14]. The differences are the following:
1. Sprout and Plantlet have shorter internal state size compared to any of the Grain
family ciphers [265]
2. They use the round key function to make the state update key-dependent
2
7
7
f
LFSR
Counter
6
h
g
NFSR
…
…
29
IniƟalizaƟon phase
IniƟalizaƟon phase
Round key
funcƟon
Fig. 3.1 Overall structure of the Sprout and Plantlet ciphers
53
In the second case, i.e., for those types of NVM which allow the key to be rewritable
(such as EEPROM and Flash), severe timing limitations for accessing the NVM may
occur. In particular, it depends on how the key stored in NVM needs to be accessed.
In some cases, implementation of ciphers which require continuous access to the
randomly selected bits of the key stored in rewritable types of NVM may lead to a
reduction of the throughput up to a factor of 50 [421]. However, designs that require
sequential access to the key bits are almost unaffected, irrespective of the underlying
NVM type.
With respect to area size, there is no big difference whether the key has to be
read only once or continuously during encryption, since the logic for reading the
key (at least once) has to be implemented anyway. Small extra logic may be needed
for synchronization with an NVM cipher which should not be clocked unless key
material is read from NVM.
3.2.3 The Stream Ciphers Sprout and Plantlet
The design principles discussed in Sect. 3.2.1 have been demonstrated by two
concrete keystream generators with keyed update function, namely Sprout and
Plantlet. Both ciphers have a similar structure (see Fig. 3.1) which was inspired by
Grain-128a [14]. The differences are the following:
1. Sprout and Plantlet have shorter internal state size compared to any of the Grain
family ciphers [265]
2. They use the round key function to make the state update key-dependent
2
7
7
f
LFSR
Counter
6
h
g
NFSR
…
…
29
IniƟalizaƟon phase
IniƟalizaƟon phase
Round key
funcƟon
Fig. 3.1 Overall structure of the Sprout and Plantlet ciphers