AN IMPROVED S-BOX OF LIGHTWEIGHT BLOCK CIPHER
ROADRUNNER FOR HARDWARE OPTIMIZATION
Juhua Liu
1
and Wei Li
2
and Guoqiang Bai
3*
1
Institute of Microelectronics, Tsinghua University, Beijing, China
Liujh14@mails.tsinghua.edu.cn
2
Institute of Microelectronics, Tsinghua University, Beijing, China
3
Tsinghua National Laboratory for Information Science and Technology
*Corresponding Author’s Email: baigq@tsinghua.edu.cn
Abstract
Recently, the need for designing block ciphers
targeting on resource constrained device has been
repeatedly expressed by professionals. Currently,
Roadrunner is one of the most software efficient
lightweight ciphers. Its security is provable against linear
and differential attacks. In this paper, we design a novel
S-Box layer, in order to improve the performance for
hardware implementation. Furthermore, the new S-Box
layer has eight different 4-bit S-Boxes, which are
decomposable. We decompose each 4-bit S-Box by
exploiting affine transformations and a single shared
quadratic permutation. After being decomposed, these
eight 4-bit S-boxes can be merged into one component,
sharing the same quadratic permutation. In this way, we
can save the area consumption by 51%, compared to the
traditional implementation of old S-box layer by using
look up tables (LUTs).
Keywords
Lightweight, novel S-Box, hardware implementation,
Roadrunner, area-optimization
INTRODUCTION
Over the last few decades, a series of lightweight block
ciphers has been proposed, such as Roadrunner[1], Lblock
[2], Present [3],and so on. Amongst all these lightweight
ciphers, Roadrunner, as proposed in LightSec 2015, is
designed to achieve high efficiency in software
implementation. At the same time, Roadrunner has a
relatively high security margin in contrast to most light
weight ciphers [1]. Its security is provable against
differential and linear attacks [1].
In Lblock [2], the author used 8 different 4-bit
S-Boxes to build up the S-Box layer. Besides, these 8
S-Boxes are chosen carefully to fulfill the following
conditions: no fix point, completed, best non linearity, best
differential probability, and good algebraic order etc [2].
However, in Roadrunner [1], one single 4-bit S-Box is
used eight times to compose the S-Box layer. Since each
of these 8 4-bit S-Boxes has the same level of security,
apparently, the S-Box layer in Lblock is much safer than
the one in Roadrunner. Nevertheless, both of them didn’t
take the hardware implementation efficiency into account.
In this paper, we proposed a novel S-Box layer to
improve the hardware performance of Roadrunner. This
S-Box layer consists of eight different optimal 4-bit
S-Boxes, which fulfill the natural requirement to be
resistant against linear and differential cryptanalysis [4].
According to the notion of linear equivalent S-Boxes [5],
these eight S-Boxes belong to 2 different S-Box classes
and can be individually decomposed into affine
transformations and a single shared quadratic permutation.
Thereby this sharable quadratic permutation can be reused
in an iterative manner to help many various S-Boxes
merged into one component and thus reduce the resource
overhead [4].
DESCRIPTION OF ROADRUNNER
Roadrunner is a kind of lightweight block cipher, it
relies on a Feistel-type structure, which is shown in Figure
1. The block length of Roadrunner is 64-bit and two key
sizes of 80 and 128 bits are supported. 10 rounds are
required by 80-bit key and 128-bit key requires 12 rounds.
It employs a variant Feistel structure where whitening
keys (WK0 and WK1) are used to XOR the left part of the
state in the first and last round. There is no swap operation
in the final round.The decryption algorithm of Roadrunner
is the reverse of encryption procedure where the order of
whitening keys, round keys and constants are used
reversely [6]. Let
01234567
|| || || || || || ||xxxxxxxx
denote a 64-bit
plaintext. The left input data and the right input data of
each round F function are
and
respectively. The function F also takes the Ci as the
constant and 96-bit round key. The output of F function
will be XORed with
. F is a 4-round
substitution-permutation network (SPN) type function as
shown on top right of Figure 1, where SLK is a
consecutive application of S-Box layer (S), diffusion layer
(L), and key XOR operation (K), as illustrated on the
bottom right of Figure 1. The last function S takes the
same S-Box in the SLK. After the second SLK function,
round constant is XORed with the rightmost byte of the
state, which is x3 exactly. For the round
,
the round constant is
, where NR is the