AES Smaller Than S-Box

Abstract

This paper explores state-of-the-art software implementations of “size-minimum” AES on low-end microcontrollers. In embedded environments, reducing memory size often has priority over achieving faster speed. Some recent lightweight block ciphers can be implemented in 200 to 300 ROM bytes, while the smallest software implementation of AES including key scheduling, encryption and decryption is, as far as we know, around 1 K ROM bytes.

The first purpose of this study is to see how small AES could be. To do this, we aggressively minimize code and data size of AES by introducing a ring multiplication for computing the S-box without any lookup table, a compact algorithm for embedding MixColumns into InvMixColumns, and a tiny loop for processing AddRoundKey, ShiftRows and SubBytes at the same time. As a result, we achieve a 192-byte AES encryption-only code and a 326-byte AES encryption-decryption code on the RL78 microcontroller. We also show that an AES-GCM core can be implemented in 429 bytes on the same microcontroller. These codes include on-the-fly key scheduling to minimize RAM size and their running time is independent of secret information, i.e. timing-attack resistant.

The second purpose of this research is to see what processor hardware architecture is suitable for implementing lightweight ciphers from a minimalist point of view. A simple-looking algorithm often results in very different size and speed figures on different low-end microcontrollers in practice, even if their instruction sets consist of similar primitive operations. We show concrete code examples implemented on four low-end microcontrollers, RL78, ATtiny, Cortex-M0 and MSP430 to demonstrate that slight differences of processor hardware, such as carry flag treatment and branch timing, significantly affect size and speed of AES.

Appendix: Low End Microcontrollers Comparison Chart

This table is not intended to be exhaustive, but to illustrate typical cases in implementing lightweight symmetric ciphers for readers’ convenience.

	RL78	ATtiny	CortexM0	MSP430
Hardware Registers
- Register Size	8,16	8	32	8,16
- Number of General Registers	8	32	13	12
Addressing Modes
- Number of Operands	2	2	2,3	2
- Read-Modify(-Write) Instructions	R-M	No	No	R-M-W
- Post-Increment Addressing	No	Yes	No	Yes
Code Length (bytes)
- Operation equivalent to xor reg,[mem]	1-3	4	4	2,4
- Conditional Short Jump	2	2	2	2
- Subroutine Call	3	2	4	4
Instruction Latency (cycles)
- Read from Memory (RAM/ROM)	1/4	2/3	2	2
- Operation equivalent to xor reg,[mem]	1	2	2	2-3
- Conditional Short Jump (taken/not-taken)	4/2	2/1	3/1	2/2
- Call+Return	9	7	7	7
Supported Instructions
- Shift with multiple counts	Yes	No	Yes	No
- Rotate Shift without carry	Yes	No	Yes	No
- Rotate Shift with carry	Yes	Yes	No	Yes
- Carry preserving increment/decrement	Yes	Yes	No	No
- Conditional Skip	Yes	Yes	No	No