FAN: A Lightweight Authenticated Cryptographic Algorithm

Abstract

The wide application of the low-end embedded devices has largely stimulated the development of lightweight ciphers. In this paper, we propose a new lightweight authenticated encryption with additional data (AEAD) algorithm, named as Fan, which is based on a first non-Grain-like small-state stream cipher that adopts a novel block-wise structure, inspired by the 4-blade daily electric fan. It takes a 128-bit key, a 64-bit initial vector (IV), and a 192-bit state, promising 128-bit security and up to 72-bit authentication tag with the IV-respecting restriction. It consists of a nonlinear spindle, four linear blades and an accumulator, and updates by constant mutual feedbacks between the linear and nonlinear parts, which rapidly provides highly confused level by parallel diffusing the fastest-changing state of spindle. The key is used both in the initialization and generation phases as part of input and state respectively, making Fan suitable for resource-constrained scenarios with internal state diminishment but no security loss. A thorough security evaluation of the entire AEAD mode is provided, which shows that Fan can achieve enough security margin against known attacks. Furthermore, Fan can be implemented efficiently not only in hardware environments but also in software platforms, whose operations are carefully chosen for bit-slice technique, especially the S-box is newly designed efficiently implemented by logic circuit. The hardware implementation requires about 2327 GE on 90 nm technology with a throughput of 9.6 Gbps. The software implementation runs about 8.0 cycle/byte.

Supported by the National Natural Science Foundation of China (No. 61902030, 62002024, 62022018).

Appendices

7 Appendix 1: Test Vector

Test vectors for Fan are shown in hexadecimal notation as follows:

• 1. For $K_i =\,$0x00 for $i=\,0,1,\ldots ,15$, $IV_i =\,$0x00 for $i=\,0,1,\ldots ,7$, $AD =\,$0x00,...,0x00 with the length of 1000 bits, and $P =\,$0x00,...,0x00 with the length of 1000 bits, the 43 ciphertext blocks are

  e29535,b2b2ea,50e2ef,1b5efa,c60360,cb0f96,8befa5,a0320e,7aebab,487cb6,

  3c1b7f,c59257,9dfb14,b11fec,6a5d00,0d9e2d,e90c43,d764f5,aeeeb8,16d92b,

  dbef72,b18a89,5f3c53,63458e,c5598a,05192d,60a802,eaf8af,23cd9d,dfd45e,

  d5861c,351acc,2c65ce,42ceed,4c6bf9,a1d5a7,9bca1a,76eeaf,f57e22,dc6a35,

  982ede,9be801,4f4359, and the 72-bit tag is 3a4003,dfd872,051da1.

• 2. For $K_i =\,$0xff for $i=\,0,1,\ldots ,15$, $IV_i =\,$0xff for $i=\,0,1,\ldots ,7$, $AD =\,$0xff,...,0xff with the length of 1000 bits, and $P =\,$0xff,...,0xff with the length of 1000 bits, the 43 ciphertext blocks are

  2ee752,8fc727,71e76c,8ef6f2,35ba5d,766f7b,950166,f57fa4,aecc81,e8ec28,

  1c5146,a5a477,9ad473,835004,169666,1fd55d,3e2df9,866f6a,744317,99f6c8,

  083573,9cbb54,6a3003,e16638,f67cb5,3ec873,ea2220,dab472,f8fdeb,9dba39,

  88f6d6,784c90,9f1875,34b40d,8547b1,9cc976,12d5b5,a43ed9,f62af8,160427,

  b0cdd1,b71eff,c3761e, and the 72-bit tag is a8255a,f41333,05928c.

8 Appendix 2: AES MixColumn with 92 XOR Gates

The compact implementation of AES MixColumn with 92 XOR gates and depth 6 [17] is shown as follows.

9 Appendix 3: Comparison Outline Diagram for Different Phases

To show the differences for all phases, we focus on the spindle shown in Fig. 8, since the blades and accumulator update part are not differing much from each other.

10 Appendix 4: Gate Count for Fan

For the hardware implementation of Fan, the area requirement is occupied as shown in Table 7, according to the 90 nm Digital Standard Cell Library given in Table 6 referred to [22].

Fig. 8.

The main difference: state update function of the spindle in different phases.

Table 6. Reference of 90 nm digital standard cell library

Table 7. Gate count for Fan