Information Technology Reference
In-Depth Information
4
Estimate of the Hardware Implementation and Security
While the FPGA implementation of the cipher SCO-1 oriented to hardware the con-
sumption of the logical cells is independent of type of the boxes
S
2;1
used as elementary
building blocks for constructing the boxes and
S
(
e
)
32;96
. While the VLSI implementation
the critical path and required number of nand gates depend on the type of the elemen-
tary building blocks, however in all cases the implementation cost and the depth of the
critical path are comparatively small.
The elementary box
S
(
v
)
2;1
can be implemented with 7 nand gates. In this case the time
delay of
S
(
e
)
2;1
equals about 2
t
⊕
,where
t
⊕
is the time delay of the XOR operation. The
implementation with 16 nand gates provides the time delay
t
⊕
. Thus, the time delay cor-
responding to one active layer of the box
S
(
e
)
32;96
is approximately equal to
t
⊕
(expensive
(E) implementation) and 2
t
⊕
(cheap (C) implementation). Time delay of the six-layer
SCO boxes used in SCO-1 is equal to 6
t
⊕
and 12
t
⊕
for respective implementation vari-
ants. The critical path of one round of the cipher SCO-1 equals 15
t
⊕
(E) and 27
t
⊕
(C).
The critical path of the full SCO-1 equals 122
t
⊕
(E) and 218
t
⊕
(C) (see Table 4).
Conservative estimate shows that implementation of the boxes
S
(
e
)
32;96
and
S
(
e
)
32;96
takes about 1000 (C) and 2300 (E) nand gates. The last figures define the implementa-
tion cost of the additional instruction of some hypothetical microcontroller while im-
plementing the ciphers SCO-2 and SCO-3 in firmware.
One round of the hardware-oriented cipher SCO-1 can be implemented using about
4,400 (C) and 9,600 (E) gates. In the case of the implementation hardware architecture
described in [5] all rounds are implemented, the implementation is free of pipelining
though. For full round SCO-1 we have the implementation cost 35,200 (C) and 76,800
(E) nand gates. To the last figures one should add some gate count corresponding to
two 64-bit registers for input and output data and to the 128-bit register for key. This
makes about 1,500 additional nand gates. The whole implementation cost of SCO-1 is
presented in Table 4 which compares hardware evaluation for different ciphers.
One can see that the fastest implementation corresponds to 128-bit cipher Rijndael
(performance
z
35 bit/
t
⊕
) and the cheapest one corresponds to the C variant of the
SCO-1 (580 gate/bit). The SCO-1 (
z
≈
1
.
≈
0
.
30
−
0
.
52 bit/
t
⊕
)isfasterthanRC6(
z
≈
0
.
15
bit/
t
⊕
), Triple-DES (
z
≈
0
.
29 bit/
t
⊕
),andTwofish(
z
≈
0
.
27 bit/
t
⊕
). It is remarkable that
SCO-1 is cheaper than DES (
840 gate/bit). The structure of the COS-based ciphers
suites well for the pipeline-architecture implementation. Such implementation of SCO-
1 with 85,000 gates provides performance
z
≈
1 bit/
t
⊕
. Hardware implementation
efficacy of the SCO-1 is due to designing it at bit level. Using the SCO boxes
S
(
e
)
64;192
one can design a 128-bit SCO-based cipher having the round structure similar to that of
SCO-1. We have estimated that in this case the performance 8.3 bit/
t
⊕
=
4
.
can be easy get
for a pipelined implementation with about 170,000 gates.
Our preliminary security estimations for SCO-1, SCO-2, and SCO-3 show that the
most useful linear and differential characteristics (DCs) correspond to the case of few
active bits, the differential attack (DA) being more efficient than linear one. The last
corresponds to the results on analysis of different DDP-based ciphers presented in [3].
Let
p
Pr
→
∆
denote the probability that the
r
(
r
)=
∆
∆
input difference transforms
