Key-based dynamic S-Box approach for PRESENT lightweight block cipher

Abstract

Internet-of-Things (IoT) is an emerging technology that interconnects millions of small devices to enable communication between the devices. It is heavily deployed across small scale to large scale industries because of its wide range of applications. These devices are very capable of transferring data over the internet including critical data in few applications. Such data is exposed to various security threats and thereby raises privacy-related concerns. Even devices can be compromised by the attacker. Modern cryptographic algorithms running on traditional machines provide authentication, confidentiality, integrity, and non-repudiation in an easy manner. IoT devices have numerous constraints related to memory, storage, processors, operating systems and power. Researchers have proposed several hardware and software implementations for addressing security attacks in lightweight encryption mechanism. Several works have made on lightweight block ciphers for improving the confidentiality by means of providing security level against cryptanalysis techniques. With the advances in the cipher breaking techniques, it is important to increase the security level to much higher. This paper, focuses on securing the critical data that is being transmitted over the internet by PRESENT using key-based dynamic S-Box. Security analysis of the proposed algorithm against other lightweight block cipher shows a significant improvement against linear and differential attacks, biclique attack and avalanche effect. A novel key-based dynamic S-Box approach for PRESENT strongly withstands cryptanalytic attacks in the IoT Network.

1. Introduction

One of the notable revolutions in this modern technological era is IoT Technology and it has become part of day-to-day routine activities. It also contributes to the economic growth of a country. Interconnection of devices has been in practice for the last five decades, the term IoT was coined in 1999 [1][2] and the real boom of IoT has been realized only in the last five years. With the exponential growth of IoT, its applications have also expanded into agriculture, vehicles, transportation, healthcare, manufacturing, civil structures and even lifestyle. IoT connects devices such as smart gadgets or sensors that are located in separate networks with different access mechanisms. These devices are also capable of interacting with one another through the internet. Simultaneously, since billions of IoT gadgets, applications, and networks are currently being used, the potential to increase its effectiveness is high. In recent days, devices with edge computing technology have moved ahead by performing computing near the source of data. Many smart devices require personal information of the user to provide personalized and customized services. To secure data, few basic security principles of IoT devices are to be familiarized [3].

Confidentiality: Confidentiality and privacy are significantly identical concepts. Measures for maintaining confidentiality aim to provide protection against unauthorized access to sensitive data. Data is frequently categorized based on the scope and nature of the attack that could result from it getting into the attacker.

Integrity: Integrity refers to maintaining the data throughout its full lifecycle in terms of consistency, accuracy, and dependability. Data cannot be altered while in transmission, and precautions need to be taken to prevent unauthorized parties from changing the data.

Availability: Data should be available consistently and easily to authorized persons for ease of access.

In near future, IoT paradigm has the scope to take autonomous decisions even in a critical infrastructure. The security of IoT devices has been a concern for a long time because of chances of both minor and major attacks. A large portion of these attacks originate from direct security flaws, such as the use of default passwords on the network. Majority of the IoT network relies on resource-constrained sensors that frequently transmit sensitive and private data. A more common secured IoT architecture is shown in Fig. 1, It takes researcher’s focus to secure the transmitting data between sensors and the server rather than focusing on reducing complexity [4]. The traditional asymmetric encryption algorithms like RSA, Elliptic Curve Cryptography(ECC) and Diffie-Hellman algorithms are used largely to encrypt small data because of the time taken to process the cipher text with the two keys (namely private and public key) of larger size. Moreover, these algorithms require high resources in terms of power, memory and processing. On the other hand, symmetric algorithms like DES, AES and RC4 are faster than asymmetric algorithms and allow the encryption of larger data [5].

Fig. 1. Secured IoT Architecture.

The symmetric algorithms have two distinct styles of processing the plaintext, namely, stream and block ciphers. A key used by stream ciphers has the same size as the data. Plaintext is processed in a bit fashion to create the encrypted text. Only few lightweight stream ciphers with high throughput have been proposed by researchers. Some examples are Salsa20/12 [6], Rabbit [7], HC-128 [8] and SOSEMANUK [9] which are part of software oriented stream ciphers. Trivium [10], MICKEY 2.0 [11] and Grain [12] are hardware oriented stream ciphers. Despite having a low throughput, Grain 128 [12] is one of the most popular and appropriate lightweight cyphers for restricted devices. They utilize LFSR and a non-linear filtering function.

Symmetric block ciphers are predominant in practice than Symmetric stream ciphers. This is because symmetric block ciphers use key as block. whereas in stream cipher, a proper pseudorandom generator is necessary to generate keys. Block ciphers are popularly implemented with three different structures, namely: Feistel Structure, Substitution Permutation Network(SPN) and Add-Rotate-XOR(ARX) [13]. Few common algorithms like DES [14], TEA [15], CAST [16] and GOST [17] fall under Fiestel Structure and algorithms like AES [18], Kalyna [19], SHARK [20], PRESENT [21][22], TWINE [23], PICARO [24], SKINNY [25], GIFT [26] and Serpent [27] come under Substitution Permutation Network. Likewise, Chaskey [28], IDEA [29], LEA [30], HIGHT [31] are algorithms of Add-Rotate-XOR structure.

Like any cryptographic algorithm, the key issue for the PRESENT algorithm is to keep its security from being compromised by several types of advanced attacks. It is critical to maintain PRESENT's resistance against differential and linear cryptanalysis as well as other well-known assaults as cryptanalysis techniques progress. The proposed work focuses the confidentiality in the security triad for securing the data against improvised cryptanalytic attacks. Results are compared with the relevant implementations like ANU, LED, L-Block and FEW [43] for the evaluation of the proposed algorithm.

2. Related Work

2.1 Substitution Permutation Network

An SPN is a recursive construction of substitution and permutation [32], in which a different key is used in each round for XOR operation to produce a cipher text from a plain text. The functional operations used in the first, last and intermediate rounds are varied in SPN. The number of S-Boxes needed for SPN is determined from the block size and the word size. Substitution adds confusion and permutation adds diffusion properties to the SPN structure. A well-designed S-Box holds the property of avalanche effect, and a minor change in the plaintext or key affects the cipher text largely. AES [33], PRESENT [21] and GIFT [26] algorithms are commonly deployed with the SPN structure.

2.2 PRESENT: A Lightweight method

With the evolution of quantum computers, the use of block sizes of over 128-bit has diminished because of the limited resources on the devices. This brings the PRESENT into the implementation on resource constrained devices “Ultra-Lightweight Block Cipher”. PRESENT is a Substitution Permutation Network based cipher which consists of 31 rounds with a block size of 64 bits and key sizes of 80 bits and 128 bits [21]. The algorithm can withstand differential and linear cryptanalysis attacks to a reasonable extent. Algebraic attacks are possible with minimal S-boxes and when seven S-boxes (block size of 28 bits) are used, attack is not possible.

Linear and differential cryptanalysis is used to choose the sixteen numbers of good S-Boxes from SERPNET, Finite Fields and Hummingbird. Among sixteen S-Boxes, a random S-Box is chosen for each round of the PRESENT algorithm. Round key value of 64-bit is of 16 digits, where each digit is a 4-bit value. All 16 digits are XORed and a single 4-bit value is obtained to select the S-Box from the chosen sixteen good S-Boxes. The Linear and differential cryptanalysis of this approach is considerably better than the original PRESENT [34].

A lightweight mechanism for resource constrained environment is proposed in [35], in which a Key scheduling algorithm is used to generate 30 subkeys of each 64-bit length to cater to I-PRESENT-80 and I-PRESENT-128. It performs 15 round functions, an involutive function and another 15 inverse round functions to produce ciphertext. Encryption and decryption of this approach use the same circuit. [36] The confusion property is added to S-Box and fused with GRP (group operation) for a hybrid cryptosystem. Implementations are tested in LPC2129 Processor against fused S-boxes of PRESENT, TEA, CLEFIA with GRP. It is found that PRESENT consumes very less memory when compared to other lightweight algorithms. To withstand the property of avoiding fixed points in S-Box, [37] genetic algorithm based S-Boxes (S1 and S2) are proposed. Dynamic S-Box is chosen by splitting block into 8-bits along with key selection function. It enhances the diffusion rate and solves the anti-fixed point problem of S-Box in PRESENT.

PRESENT algorithm is proposed with two design approaches to overcome few security issues in resource limited IoT environment. Both approaches aim to reduce the implementation size and the energy required for the key generation phase. The basic idea was to divide the 80-bit key into four 20-bit words and 128-bit key into four 32-bit words. Dividing the key of size 16-bit words requires five clock cycles and eight clock cycles respectively. Experimental results show a significant reduction in area, and a subsequent downfall is also observed in the performance of both 80-bit and 128-bit key size.

To maintain the higher level of complexity in S-Box design, several S-Box generator schemes are proposed by researchers. An ordered elliptic curve and binary sequence based S-Box generator scheme proposed [38] with strong security mechanism against modern security attacks with nonlinearity range between 0.117 and 0.172.

In practical applications, most of the IoT devices transmit only few bits of data which on average is less than 64 bits. An improved version of PRESENT cipher is GIFT [26], which comes in two different block sizes of 64 and 128 bits with a common key size of 128 bits. It provides a higher throughput with lighter S-Box. It also comes with reduced rounds of operation and a simple key schedule. RECTANGLE [39] is another cipher derived from PRESENT with rounds reduced to 25 for meeting the lightweight property. Chatterjee et. al reduced the encryption round from 31 to 25 by adding a new layer in between substitution and permutation [40]. Key generation for each round is updated by encrypting the round key with delta value function of Tiny Encryption Algorithm (TEA) for 80-bit key.

Several approaches including dynamic S-Box on the PRESENT algorithm have been proposed to solve anti-fixed point in [37]. To improve the performance of PRESENT, the number of logic gates and critical path delay is dramatically reduced by using Karnaugh map in [41]. ANU [43] is a very light-weight cipher built on the Feistel network that is intended for use in the Internet of Things (IoT). The ANU cipher seeks to offer secure communication while reducing memory and power usage. Compared to other lightweight ciphers, it has a far more compact structure for a 128-bit key length.

3. Methodology

This section explains in detail about the proposed substitution using key-based dynamic S-Box, Permutation and Adding Round key process for encryption and decryption. The simplified diagram of the operations is shown in Fig. 2.

Fig. 2. Key-based dynamic S-Box approach for PRESENT.

An algorithmic representation of each operation is presented in Algorithm 1. The detailed explanation of the implementation of the three operations is provided alongside the key generation for each round.

3.1 Substitution using key-based dynamic S-Box

S-Box in PRESENT cipher in Table 1 is a 4-bit substitution technique, where a 4-bit (nibble) input is mapped to the 4-bit output. It is initially loaded with a 64-bit value (4-bit X 16). For each round, a new S-Box is computed from the key.

Table 1. S-Box of PRESENT algorithm

Algorithm 1. PRESENT algorithm using Key-based dynamic S-Box

A traditional S-Box technique uses the same S-Box for all 31 rounds of encryption. With the evolution, key based S-Box proposed with the fixed key for each round. All the previous proposed schemes are having the linear property in the S-Box generation techniques, which enables the attacker to leverage the algorithm and get chance of compromising the system with advanced cryptanalytic attacks. In this approach, we proposed a novel technique for S-Box generation that completely relies on the dynamic key used for encryption rather than the fixed S-Box and fixed key based S-Box techniques.

In this approach, LSB 4-bit (nibble) selected from the round key as round constant. S-Box is divided into 16 4-bits and the round constant (4-bit) is selected from the round key. It is then XORed with the 4-bit of S-Box value to key-based dynamic S-Box for the next round. The same is represented in Fig. 3. The values in the S-Box are varied regularly to keep attackers away from the cryptanalysis. Performance of the S-box largely relies on factors such as the avalanche effect, nonlinearity, diffusion property, anti-fixed point and fixed point. This approach addresses almost all aforementioned performance factors.

Fig. 3. Key-based dynamic S-Box.

3.2 Permutation

Permutation involves a large number of operations. It changes the original bit order and produces the shuffled output for the next round input state. In this permutation layer, i^th input bit of a state is moved to P(i) bit of the output state. Permutation simply swaps the bit within a state to produce output state. Initially 64 bits are arranged in a sequence fashion; after the first permutation, the state changes as shown in Table 2.

Table 2. Permutation function

From the Table 2, the bits 0, 21, 42 and 63 remain unchanged in their initial positions. The remaining 60 bits are swapped by grouping them into 20 3-bit groups to exchange their positions. Bit b1 is swapped with bit b4 and again bit b1 is swapped with bit b16. From the group of 20, 1 group completes the permutation and the remaining 19 groups follow the same procedure. This can be represented as follows:

Swap (b₁, b₄) and Swap (b₁, b₁₆)

3.3 Key Generation

PRESENT Cipher has 80-bit and 128-bit keys that run key schedule algorithm to generate a 64-bit key for the add round key operation. For the 128-bit key, the input size recommended for NIST statistical tests is 100-bit. Key generation for 128-bit architecture is shown in Fig. 4 Initially, the 128 bit key is stored as K₁₂₇K₁₂₆K₁₂₅…..K₂K₁K₀ in the Key Register K. For the first round, the leftmost 64-bit of the original 128-bit secret key is chosen as K₁, and for the next 31 rounds, the key is generated as below:

Fig. 4. PRESENT Key generation for 128-bit.

• 61 bits Left Shift of Key K, i.e.., K_i=[K₆₆K₆₅K₆₄……K₁K₀K₁₂₇K₁₂₆…..K₆₈K₆₇] for any i^th round

• Update the Key Register K=K_i for K= [K₁₂₇K₁₂₆K₁₂₅…..K₂K₁K₀]

• Substitute leftmost four bits of K [K₁₂₇K₁₂₆K₁₂₅K₁₂₄] with S-Box [K₁₂₇K₁₂₆K₁₂₅K₁₂₄]

• Substitute next four leftmost bits of K [K₁₂₃K₁₂₂K₁₂₁K₁₂₀] with S-Box [K₁₂₃K₁₂₂K₁₂₁K₁₂₀]

• Perform XOR operation for 5-bits of Least Significant Bit in round counter i with K[K₆₆K₆₅K₆₄K₆₃K₆₂]

For the 80-bit key, initially the key is stored as K₇₉K₇₈K₇₇…..K₂K₁K₀ in the Key Register K. The leftmost 64-bits in key K is used as key K₁ in the first round. For further rounds, the key is generated as follows:

• 61 bits Left Shift of Key K, i.e.., K_i=[K₁₈K₁₇K₁₆……K₁K₀K₇₉K₇₈…..K₂₀K₁₉] for any ith round

• Update the Key Register K=K_i for K= [K₇₉K₇₈K₇₇…..K₂K₁K₀]

• Substitute leftmost four bits of K [K₇₉K₇₈K₇₇K₇₆] with S-Box [K₇₉K₇₈K₇₇K₇₆]

• Substitute next four leftmost bits of K [K₇₅K₇₄K₇₃K₇₂] with S-Box [K₇₅K₇₄K₇₃K₇₂]

• Perform XOR operation for 5-bits of Least Significant Bit in round counter i with K[K₁₉K₁₈K₁₇K₁₆K₁₅]

3.4 Add Round Key

In this step, the 64-bit state is XORed with the 64-bit round key that is generated from the key schedule. A bitwise XOR operation is performed with equal size of bits from the input state and the key at this stage. These all operations are repeated for 31 rounds to acquire the ciphertext.

4. Results

The increasing popularity of Lightweight cryptography algorithm is promising for both new conveniences and new privacy concerns. This section provides the performance analysis of key-based dynamic S-Box technique against the PRESENT-80, ANU-128, L-Block, FEW and LED-80 algorithms. Implementations of the algorithm are purely based on the specifications provided. The results discussed and provided are implemented using Python 3.10.2 on Intel i5 windows 10 machine. Initially, the CPU performance for testing is maintained below 10%. The values provided in the results are obtained from the average of runs at each stage. Security parameters like linear cryptanalysis, differential cryptanalysis, biclique attacks and hamming distances are analyzed. Additionally, efficiency parameters like memory utilization, computational cost and encryption time are analyzed in this section.

4.1 Linear cryptanalysis

Linear cryptanalysis is a kind of traditional security attack targeted mostly on symmetric block cipher to identify the linear relationships between the plaintext, ciphertext, and the key used. Linear relationships of each known plaintext and ciphertext can be tabulated as Linear Approximation Table (LAT) against each input and output bits for the corresponding key, also it is known as correlation probability. Bias for the linear probability can be denoted as |P_L-1/2| for the proposed key based dynamic S-Box. Bias probability for n rounds are calculated using Matsui’s Piling-up lemma [43]. Table 3 shows the comparisons of linear cryptanalysis attack for various lightweight algorithms.

Table 3. Linear attack comparisons

For three rounds of proposed algorithm, it was found ten S-Boxes are active. Bias(ε) can be calculated as

ε = 2⁹ × (2⁻²)^{^10}

ε = 2⁻¹¹

Extending the above to 18 rounds by 6 times, the bias(ε) given as

ε = 2⁵× (2⁻¹¹)^{^6}

ε = 2⁵ × (2⁻⁶⁶)

ε = 2⁻⁶¹

Linear attack complexity can be determined as follows

N_L = 1(ε)²

For 18 rounds,

N_L = 1/(2^-61)^{^2}

N_L = 2¹²²

N_L Indicates the number of known plaintext and ciphertext pairs

4.2 Differential cryptanalysis

Block cipher analysis using differential cryptanalysis is a form of selective plaintext attack. It entails researching the likelihood that particular plaintext differential values may differentially propagate during the encryption process. The block cipher's key can be obtained by locating a high probability differential trail. The difference distribution table is used to investigate the S-box, a non-linear element of our design. The difference between the high probability input and output for each round is taken into account while forming the differential trails. A non-zero input or output difference characterizes an active S-box. As like linear cryptanalysis, amount of chosen plaintext (ND) is required to perform the differential attack on the algorithm.

N_D ≈ c ⁄ P_D

Where c is a constant and P_D is the probability of differential characteristics of R^th round for previous R-1 rounds.

For three rounds of proposed algorithm, it was found nine S-Boxes are active. Similarly, 54 S-Boxes are active for 18 rounds. Table 4 shows the comparisons of differential cryptanalysis attack for various lightweight algorithms. Total differential probability represented as

Table 4. Differential attack comparisons

P_D = (2⁻²)⁵⁴

= 2⁻¹⁰⁸

Differential attack complexity can be determined as follows

N_D ≈ c ⁄ P_D

N_D = 1/2⁻¹⁰⁸

N_D = 2¹⁰⁸

Comparisons of linear and differential cryptanalytic attacks for the proposed scheme with the other lightweight algorithms shown in Fig. 5, which indicates the significant improvement of the proposed scheme to withstand against linear and differential cryptanalysis.

Fig. 5. Analysis of linear and differential cryptanalytic attacks

4.3 Biclique Attack

Biclique attack helps to enhance the cryptanalysis of block ciphers, which is based on meet in the middle (MITM) attack. Biclique attack is the process of building two sets of plaintext-ciphertext pairings. These bicliques selected with care to have certain characteristics that might provide insight into the encryption key. This attack's main strategy is to create bicliques on the target subcipher and utilize them to increase computation efficiency. Table 5 shows the comparison of biclique attack with other lightweight ciphers. The computational complexity of this attack computed as follows.

Table 5. Biclique attack comparison

C_total = 2^k−2d (C_biclique + C_precomp + C_recomp + C_falsepos).

where,

– k = 80 and d = 4.

– C_biclique is a computational single biclique

– C_precomp is a computational precomputation

– C_recomp is a computational recomputing

– C_falsepos is a computational false positive

4.4 Hamming Distance

Avalanche effect of the proposed algorithm is calculated against the inner round operation and against the ciphertext’s of 1-bit, 2-bit and 4-bit change in plaintext. Hamming distance method is used for calculating the avalanche effect, while the number of bit positions at which two ciphertext or intermediate ciphertext differs are also taken into account. The avalanche effect of a bit variation in plaintext with same key in the round operation is shown in Table 6.

Table 6. Avalanche effect of inner round operation

Avalanche effect over bit(s) variation in plaintext with same key against ciphertext is shown in the Table 7 and Avalanche effect on ciphertext over different message size is shown in the Table 8 and Fig. 6 shows the significant improvement of the number of bit variations in the ciphertext with respect to the input bit variation.

Table 7. Avalanche effect over bit(s) variation

Fig. 6. Analysis of avalanche effect on ciphertext

Table 8. Avalanche effect on Ciphertext over different message size

4.5 Memory utilization

Memory utilization is an important performance factor which can be used to choose an algorithm with minimal memory. This metric focuses particularly on memory utilization during execution of the algorithm to store the intermediate results. Current memory and peak memory for each size of messages are considered for memory comparison between algorithms. The additional XOR operation in the round function of Key-based dynamic S-Box slightly requires higher memory when compared to the traditional algorithm. The memory utilization of the proposed algorithm with Key-based dynamic S-Box against the PRESENT algorithm is show in Table 9, and Table 10 represents the constant utilization of memory over the PRESENT algorithm with respect to all sizes of the messages.

Table 9. Current Memory Utilization

Table 10. Peak Memory Utilization

Memory utilization analysis proposed scheme shown in Fig. 7 shows the very marginal amount of difference around 0.01% is required over the PRESENT algorithm.

Fig. 7. Current memory and peak memory utilization comparison

4.6 Computational Cost

The energy consumed for executing the algorithm is measured from the implementation of the schemes discussed. Asymptotic analysis and implementation results are provided against the algorithms. Asymptotic analysis provides elegant result and it is abstract, so the implementation result gives the real computational cost. Measuring computational cost of an algorithm running on a typical computer is a bit tricky because of the noises from processes, other threads and caching strategies. To avoid noise, algorithm runs K times and the average CPU cycle is determined for each of the message size. The results obtained are provided in the Table 11 which indicates the constant among all different size of messages.

Table 11. Percentage of computational cost over PRESENT

4.7 Encryption Time

Time consumed by the algorithm for converting plaintext to ciphertext is termed as encryption time. Encryption time is calculated against different input sizes and the average time is calculated for the algorithm. Measuring the actual CPU time spent for the encryption process is quite difficult because the CPU is frequently utilized by other processes, which naturally interrupts the memory transfer. The comparison results with the average values are provided in the Table 12. A tradeoff between security and performance always holds the impact in encryption algorithms. An increase in encryption time is noticed in the table trade-off with the security provided by the proposed algorithm.

Table 12. Analysis of encryption time

5. Conclusion

In this research work, the key-based dynamic S-Box is implemented for PRESENT lightweight block cipher algorithm. The S-Box of PRESENT is used for the first round of the operation and for subsequent rounds, S-Box is dynamically constructed based on the round key generated from the key schedule algorithm. Linear and differential cryptanalysis requires 2¹²² known plaintext and 2¹⁰⁸ chosen plaintexts respectively. Biclique attack requires 2^79.81 computational complexity and 2²³ as data complexity to break the algorithm, which is comparatively higher than previous schemes. The inner round hamming distance of 31.65 is achieved against the 31.19 of previous implementations. Even a better avalanche effect for 1-bit, 2-bit and 4-bit with average hamming distance of 31.91, 31.83 and 31.97 respectively is achieved. The constant rate of increase in memory utilization, computation time and encryption time is also achieved even as the of message size increases. The dynamism of the S-Box breaks the myth of linearity in the proposed algorithm and helps hold the attackers from identifying the linear probability. This proposed algorithm can also be tested with the hardware implementations. In future work, it is planned to reduce the memory utilization, computation time and encryption time of the algorithm.