FELICS Block Ciphers Brief Results

From CryptoLUX
Jump to: navigation, search

Note:

  • Block and key sizes are expressed in bits [b].
  • Code size (Code) and RAM consumption (RAM) are expressed in bytes [B].
  • Execution time (Time) is expressed in cycles [cyc.].
  • Security level (Sec.) is the ratio of the number of rounds broken in a single key setting to the total number of rounds.
  • For ciphers against which there is no attack (to the best of our knowledge) the security level is set to -1.
  • Details about cryptographic properties of each cipher are available here.
  • Results for assembly implementations are displayed in italic.
  • Cipher-r denotes the cipher Cipher with r rounds instead of the default number of rounds.


Scenario 1

A description of scenario 1 can be found here.

Results for scenario 1 - I: Encryption + Decryption (including key schedule). Encrypt 128 bytes of data using CBC mode. For each cipher, an optimal implementation on each architecture is selected.
Cipher Info Results
AVR MSP ARM
Cipher Block [b] Key [b] Sec. Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.] FOM
Chaskey 128 128 Cipher reference implementation 1320 229 20584 900 222 19058 492 228 9179 4.0
Chaskey-LTS 128 128 Cipher reference implementation 1320 229 33064 904 222 29170 492 228 12123 4.6
Speck 64 96 optimized reference implementation 958 294 39853 576 290 36698 484 308 15510 5.1
Speck 64 128 Optimized C code 866 302 44873 592 298 37850 334 312 16938 5.2
Simon 64 96 optimized reference implementation 1076 363 63627 758 362 50932 606 376 23749 7.0
Simon 64 128 Single round per loop iteration 1114 375 66591 780 374 53112 580 392 24893 7.2
RECTANGLE 64 80 Reference C implementation with key schedule 1144 352 66700 832 400 54431 653 426 34586 8.0
RECTANGLE 64 128 Reference C implementation with key schedule 1110 353 64791 846 406 54564 629 432 38450 8.2
LEA 128 128 Assembly implementation for AVR and ARM; optimized for speed 1652 631 60990 1154 630 51582 496 664 17735 8.2
SPARX 64 128 SPARX reference implementation 1190 392 65517 986 394 43437 1172 416 38053 8.6
SPARX 128 128 SPARX reference implementation 1728 753 83625 1118 760 67042 1144 788 67688 13.4
HIGHT 64 128 reference implementation; delta constants are computed when encryption key schedule is called 1406 333 94535 1258 330 129188 1464 380 89432 14.6
AES 128 128 AES_128_128 small footprint, 8-bit 3002 408 58208 2684 408 87850 3078 452 73612 15.5
SKINNY 64 128 Skinny 64-128 1088 339 92078 1006 342 112402 808 372 131239 15.9
Fantomas 128 128 reference implementation 3530 231 140512 4164 234 57430 2924 284 88366 17.3
SKINNY 128 128 Skinny 128-128 1126 547 76686 1158 546 142974 892 572 133573 17.7
Lilliput 64 80 Lilliput v1, easy C implementation 1886 476 81373 1940 470 132945 2400 580 111330 18.2
Robin 128 128 reference implementation 2490 231 183928 3170 238 76878 3332 1312 70380 18.2
Robin* 128 128 -1 5028 273 154294 3312 238 88838 3604 1308 83136 20.2
RC5-20 64 128 reference implementation 3646 365 252385 4094 372 409826 608 380 35093 22.1
RoadRunneR 64 128 Reference C implementation, no key schedule 2330 210 118113 3218 218 224521 2308 440 136554 22.2
PRIDE 64 128 Reference C implementation, no key schedule 1458 371 162422 2566 212 282041 2096 444 121336 22.7
RoadRunneR 64 80 Reference C implementation, no key schedule 2478 331 144556 3088 338 252491 2568 410 116720 22.7
LBlock 64 80 reference implementation 1820 483 222099 1632 324 316539 1944 542 156834 26.6
PRESENT 64 80 Speed-optimized implementation of Present with 80-bit key, 32-bit oriented 2152 448 245210 1838 450 205430 2086 474 273628 32.3
PRINCE 64 128 reference implementation 2428 363 290257 2028 236 451509 4120 492 192985 35.4
TWINE 64 80 Speed-optimized implementation of Twine with 80-bit key 4150 646 296625 3796 564 393320 2295 465 245264 38.3
Piccolo 64 80 Piccolo-64-80, speed-optimized 1948 316 413322 1354 310 354195 1212 374 324530 39.8
LED 64 80 Cipher reference implementation 5220 576 2236978 7004 252 2505640 3752 654 598424 144.8


Results for scenario 1 - II: Encryption (without key schedule). Encrypt 128 bytes of data using CBC mode. For each cipher, an optimal implementation on each architecture is selected.
Cipher Info Results
AVR MSP ARM
Cipher Block [b] Key [b] Sec. Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.]
Chaskey 128 128 Cipher reference implementation 562 25 9813 400 26 8144 204 36 4379
Chaskey-LTS 128 128 Cipher reference implementation 562 25 16213 402 26 13072 204 36 5659
Speck 64 96 optimized reference implementation 296 12 17789 186 18 15007 176 36 6539
Speck 64 128 Optimized C code 238 12 19885 186 18 15471 118 36 7696
Simon 64 96 optimized reference implementation 326 16 29741 254 26 22415 218 44 10036
Simon 64 128 Single round per loop iteration 326 16 31021 254 26 23327 188 40 10270
RECTANGLE 64 80 Reference C implementation with key schedule 342 15 31213 234 24 26543 208 52 15983
RECTANGLE 64 128 Reference C implementation with key schedule 338 15 30797 234 24 26543 204 52 16716
LEA 128 128 Assembly implementation for AVR and ARM; optimized for speed 478 25 27469 366 34 24240 164 72 8629
SPARX 64 128 SPARX reference implementation 356 10 30253 342 22 16863 436 48 17469
SPARX 128 128 SPARX reference implementation 612 19 37957 404 36 26896 436 68 29773
HIGHT 64 128 reference implementation; delta constants are computed when encryption key schedule is called 394 15 45949 462 22 59039 512 76 42253
AES 128 128 AES_128_128 small footprint, 8-bit 1026 26 24213 1022 36 34518 1208 84 30613
SKINNY 64 128 Skinny 64-128 272 13 42445 290 26 51727 280 60 65060
Fantomas 128 128 reference implementation 1650 23 68797 1954 42 29038 1412 72 44047
SKINNY 128 128 Skinny 128-128 368 21 36181 442 30 60840 368 60 64459
Lilliput 64 80 Lilliput v1, easy C implementation 500 26 35149 438 24 56312 672 128 50783
Robin 128 128 reference implementation 1652 25 90541 1976 44 39350 2108 1120 38594
Robin* 128 128 -1 2894 63 72509 2014 44 42014 2196 1120 40718
RC5-20 64 128 reference implementation 1216 15 74707 1282 24 140402 172 36 13579
RoadRunneR 64 128 Reference C implementation, no key schedule 1092 34 58484 1534 50 111175 1552 124 67240
PRIDE 64 128 Reference C implementation, no key schedule 730 23 73757 1830 48 133399 1224 100 55810
RoadRunneR 64 80 Reference C implementation, no key schedule 1300 37 56644 1372 54 110967 1552 124 56340
LBlock 64 80 reference implementation 606 145 107181 638 28 152399 876 212 78150
PRESENT 64 80 Speed-optimized implementation of Present with 80-bit key, 32-bit oriented 868 15 120781 778 28 98303 944 56 132871
PRINCE 64 128 reference implementation 1688 157 144285 1510 40 224495 3448 292 95870
TWINE 64 80 Speed-optimized implementation of Twine with 80-bit key 1800 137 145892 1594 114 191063 892 116 118008
Piccolo 64 80 Piccolo-64-80, speed-optimized 884 33 204509 632 38 172954 536 88 159342
LED 64 80 Cipher reference implementation 2622 240 1081812 4362 82 1186231 2092 304 283234


Results for scenario 1 - III: Decryption (without key schedule). Encrypt 128 bytes of data using CBC mode. For each cipher, an optimal implementation on each architecture is selected.
Cipher Info Results
AVR MSP ARM
Cipher Block [b] Key [b] Sec. Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.]
Chaskey 128 128 Cipher reference implementation 758 69 10771 500 62 10914 288 68 4800
Chaskey-LTS 128 128 Cipher reference implementation 758 69 16851 502 62 16098 288 68 6464
Speck 64 96 optimized reference implementation 512 42 20787 280 38 20483 264 56 8584
Speck 64 128 Optimized C code 450 42 23587 280 38 21059 172 52 8741
Simon 64 96 optimized reference implementation 534 47 31379 352 46 26323 290 60 12519
Simon 64 128 Single round per loop iteration 534 47 32659 352 46 27299 268 64 13570
RECTANGLE 64 80 Reference C implementation with key schedule 560 48 33715 340 46 25219 284 72 17223
RECTANGLE 64 128 Reference C implementation with key schedule 536 43 32595 340 46 25219 268 72 20533
LEA 128 128 Assembly implementation for AVR and ARM; optimized for speed 686 71 29755 466 70 24082 220 104 8407
SPARX 64 128 SPARX reference implementation 572 40 34083 452 42 25635 552 64 19880
SPARX 128 128 SPARX reference implementation 846 65 42395 520 72 37682 540 100 36061
HIGHT 64 128 reference implementation; delta constants are computed when encryption key schedule is called 594 45 47395 578 42 67747 600 92 46438
AES 128 128 AES_128_128 small footprint, 8-bit 1424 72 32467 1432 72 52150 1716 116 42114
SKINNY 64 128 Skinny 64-128 478 43 45171 386 46 55443 344 76 64068
Fantomas 128 128 reference implementation 2392 71 71715 2722 74 28392 2024 124 44319
SKINNY 128 128 Skinny 128-128 580 67 38499 512 66 78290 432 92 67628
Lilliput 64 80 Lilliput v1, easy C implementation 706 72 36491 542 60 59322 756 176 51255
Robin 128 128 reference implementation 1862 71 93387 2218 78 37528 2248 1152 31786
Robin* 128 128 -1 3158 113 81785 2322 78 46824 2432 1148 42418
RC5-20 64 128 reference implementation 1420 45 76407 1406 48 144466 236 60 14790
RoadRunneR 64 128 Reference C implementation, no key schedule 1238 58 59629 1684 66 113346 1636 140 67974
PRIDE 64 128 Reference C implementation, no key schedule 896 51 82867 1972 60 148642 1292 124 63001
RoadRunneR 64 80 Reference C implementation, no key schedule 1440 61 57565 1514 68 111794 1636 140 57832
LBlock 64 80 reference implementation 818 177 109331 736 50 157523 980 236 76713
PRESENT 64 80 Speed-optimized implementation of Present with 80-bit key, 32-bit oriented 1072 46 121859 886 48 103395 1046 72 139297
PRINCE 64 128 reference implementation 1886 187 145763 1598 60 226867 3548 316 97081
TWINE 64 80 Speed-optimized implementation of Twine with 80-bit key 1884 160 146157 1736 130 195186 992 136 122876
Piccolo 64 80 Piccolo-64-80, speed-optimized 1134 62 207251 756 56 179953 676 120 163959
LED 64 80 Cipher reference implementation 3106 282 1154797 3022 86 1318658 2308 360 314725


Scenario 2

A description of scenario 2 can be found here.

Results for scenario 2 - I: Balanced (globally efficient). Encrypt 128 bits of data using CTR mode. For each cipher, an optimal implementation on each architecture is selected.
Cipher Info Results
AVR MSP ARM
Cipher Block [b] Key [b] Sec. Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.] FOM
Chaskey 128 128 Cipher reference implementation 612 78 1471 388 70 1332 200 84 563 4.3
Chaskey-LTS 128 128 Cipher reference implementation 612 78 2271 390 70 1948 232 84 643 4.9
Speck 64 128 Optimized C code 504 58 2995 332 48 2256 278 60 965 5.1
Speck 64 96 optimized reference implementation 558 58 2725 372 48 2068 284 72 964 5.2
Simon 64 96 optimized reference implementation 652 62 4347 460 56 3124 414 68 1372 6.9
Simon 64 128 Single round per loop iteration 660 62 4523 468 56 3238 420 80 1422 7.2
LEA 128 128 Assembly implementation for AVR and ARM; optimized for speed 894 78 4029 722 78 3344 536 120 1146 7.9
RECTANGLE 64 128 Reference C implementation with key schedule 654 61 4459 480 54 3640 440 76 2400 8.6
RECTANGLE 64 80 Reference C implementation with key schedule 658 61 4511 480 54 3640 440 76 2400 8.6
SPARX 64 128 SPARX reference implementation 714 56 4475 580 52 2430 658 72 2443 8.7
SPARX 128 128 SPARX reference implementation 1172 72 5484 1188 78 2932 1480 112 2917 12.7
AES 128 128 AES_128_128 small footprint, 8-bit 1234 79 3414 1170 80 4617 1352 124 3969 14.1
RC5-20 64 128 reference implementation 1676 56 8342 1494 56 15670 396 76 1868 15.1
HIGHT 64 128 reference implementation; delta constants are computed when encryption key schedule is called 688 61 6309 636 52 7702 670 100 5666 15.6
SKINNY 64 128 Skinny 64-128 580 59 6103 472 56 6788 448 84 8560 18.2
Fantomas 128 128 reference implementation 1710 76 9335 1920 78 3646 1404 120 5505 18.3
Lilliput 64 80 Lilliput v1, easy C implementation 772 79 4605 998 90 5647 888 176 7580 18.5
SKINNY 128 128 Skinny 128-128 728 74 5214 734 74 7919 668 108 8189 19.1
Robin 128 128 reference implementation 2492 110 8344 1942 80 4935 2036 156 6962 22.6
Robin* 128 128 -1 2592 112 9465 1980 80 5268 2140 152 7364 23.8
RoadRunneR 64 80 Reference C implementation, no key schedule 1424 63 7407 1536 76 13798 1784 156 7194 24.2
RoadRunneR 64 128 Reference C implementation, no key schedule 1118 61 6125 1724 74 13340 1452 152 8244 24.4
PRIDE 64 128 Reference C implementation, no key schedule 1978 72 6055 1842 68 15480 1500 132 7145 24.5
LBlock 64 80 reference implementation 1362 58 10835 804 58 19372 1112 244 10245 29.4
PRESENT 64 80 Speed-optimized implementation of Present with 80-bit key, 32-bit oriented 1346 61 16927 1072 58 12610 1228 80 16894 36.5
TWINE 64 80 Speed-optimized implementation of Twine with 80-bit key 1516 60 22659 1922 136 23938 1144 148 16122 43.1
PRINCE 64 128 reference implementation 1444 78 20447 1576 76 28306 1168 260 15813 43.8
Piccolo 64 80 Piccolo-64-80, speed-optimized 1298 72 26023 798 76 21754 658 112 20225 45.7
LED 64 80 Cipher reference implementation 2584 265 135987 4422 104 148334 2220 336 36128 152.5


Results for scenario 2 - II: Small code size & RAM. Encrypt 128 bits of data using CTR mode. For each cipher, an optimal implementation on each architecture is selected.
Cipher Info Results
AVR MSP ARM
Cipher Block [b] Key [b] Sec. Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.]
AES 128 128 AES_128_128 small footprint, 8-bit 1234 79 3414 1170 80 4617 978 156 39915
Chaskey 128 128 Cipher reference implementation 612 78 1471 388 70 1332 182 80 627
Chaskey-LTS 128 128 Cipher reference implementation 612 78 2271 390 70 1948 182 80 787
Fantomas 128 128 reference implementation 1710 76 9335 1412 74 6234 1396 100 6997
HIGHT 64 128 reference implementation; delta constants are computed when encryption key schedule is called 822 54 6157 636 52 7702 524 88 13486
LBlock 64 80 reference implementation 918 60 18011 804 58 19372 592 84 14218
LEA 128 128 Assembly implementation for AVR and ARM; optimized for speed 894 78 4029 722 78 3344 534 84 1594
LED 64 80 Cipher reference implementation 1204 98 282309 950 102 207590 744 128 105320
Lilliput 64 80 Lilliput v1, easy C implementation 772 79 4605 650 68 7353 824 120 26084
Piccolo 64 80 Piccolo-64-80, speed-optimized 1298 72 26023 784 70 21916 658 112 20225
PRESENT 64 80 Speed-optimized implementation of Present with 80-bit key, 32-bit oriented 1480 54 16775 802 62 617154 588 80 201287
PRIDE 64 128 Reference C implementation, no key schedule 890 69 14423 944 68 26224 692 116 15877
PRINCE 64 128 reference implementation 1418 77 21581 1518 70 32558 1168 132 18947
RC5-20 64 128 reference implementation 936 66 22877 524 54 28331 362 64 2362
RECTANGLE 64 128 Reference C implementation with key schedule 834 52 4591 480 54 3640 440 76 2400
RECTANGLE 64 80 Reference C implementation with key schedule 834 52 4591 480 54 3640 440 76 2400
RoadRunneR 64 80 Reference C implementation, no key schedule 1424 63 7407 628 88 79370 574 140 21286
RoadRunneR 64 128 Reference C implementation, no key schedule 1118 61 6125 620 82 28270 702 88 17404
Robin 128 128 reference implementation 1712 78 12209 1406 72 7951 1400 112 9812
Robin* 128 128 -1 1800 82 15131 1452 76 9997 1448 116 12201
Simon 64 96 optimized reference implementation 720 55 4447 416 56 3502 320 64 2940
Simon 64 128 Single round per loop iteration 728 55 4635 424 56 3634 336 64 2432
SKINNY 64 128 Skinny 64-128 714 52 5951 472 56 6788 448 84 8560
SKINNY 128 128 Skinny 128-128 728 74 5214 734 74 7919 656 100 8329
SPARX 64 128 SPARX reference implementation 848 49 4323 496 54 2984 486 76 3370
SPARX 128 128 SPARX reference implementation 1200 71 5608 904 80 3676 932 108 4164
Speck 64 128 Optimized C code 638 51 2843 332 48 2256 254 60 1104
Speck 64 96 optimized reference implementation 634 51 2755 328 48 2198 250 60 1078
TWINE 64 80 Speed-optimized implementation of Twine with 80-bit key 888 66 45835 850 56 56294 564 84 33364


Results for scenario 2 - III: Best execution time. Encrypt 128 bits of data using CTR mode. For each cipher, an optimal implementation on each architecture is selected.
Cipher Info Results
AVR MSP ARM
Cipher Block [b] Key [b] Sec. Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.] Code [B] RAM [B] Time [cyc.]
AES 128 128 AES_128_128 small footprint, 8-bit 2944 86 2971 8844 92 2862 6624 372 2305
Chaskey 128 128 Cipher reference implementation 2034 77 1372 1542 68 858 560 100 256
Chaskey-LTS 128 128 Cipher reference implementation 3474 77 2140 2566 68 1434 688 100 335
Fantomas 128 128 reference implementation 2474 114 6699 1920 78 3646 2036 1160 3797
HIGHT 64 128 reference implementation; delta constants are computed when encryption key schedule is called 822 54 6157 808 52 7318 916 124 5369
LBlock 64 80 reference implementation 8570 64 10487 10556 64 15212 6728 236 7840
LEA 128 128 Assembly implementation for AVR and ARM; optimized for speed 5128 80 3401 4340 78 2202 1024 132 667
LED 64 80 Cipher reference implementation 2584 265 135987 4422 104 148334 2220 336 36128
Lilliput 64 80 Lilliput v1, easy C implementation 948 79 4542 1234 88 5373 1476 196 7334
Piccolo 64 80 Piccolo-64-80, speed-optimized 1298 72 26023 966 70 21448 692 128 20224
PRESENT 64 80 Speed-optimized implementation of Present with 80-bit key, 32-bit oriented 1480 54 16775 1244 58 12226 1476 100 16657
PRIDE 64 128 Reference C implementation, no key schedule 1978 72 6055 1842 68 15480 1816 136 6759
PRINCE 64 128 reference implementation 12482 76 14741 15728 76 21124 11788 192 11235
RC5-20 64 128 reference implementation 1676 56 8342 2978 50 14410 1528 80 1354
RECTANGLE 64 128 Reference C implementation with key schedule 788 54 4307 2272 52 2992 2352 96 1753
RECTANGLE 64 80 Reference C implementation with key schedule 792 54 4359 2272 52 2992 2352 96 1753
RoadRunneR 64 80 Reference C implementation, no key schedule 1424 63 7407 1536 76 13798 1784 156 7194
RoadRunneR 64 128 Reference C implementation, no key schedule 1118 61 6125 1724 74 13340 1452 152 8244
Robin 128 128 reference implementation 2492 110 8344 1942 80 4935 2044 1160 5051
Robin* 128 128 -1 2592 112 9465 1980 80 5268 2132 1160 5275
Simon 64 96 optimized reference implementation 1058 55 4083 824 56 2600 660 92 1122
Simon 64 128 Single round per loop iteration 930 55 4283 736 56 2744 632 88 1206
SKINNY 64 128 Skinny 64-128 714 52 5951 644 56 6404 692 108 8177
SKINNY 128 128 Skinny 128-128 904 74 5151 1002 74 7492 932 124 7936
SPARX 64 128 SPARX reference implementation 3170 47 3763 1916 46 1868 2988 92 2131
SPARX 128 128 SPARX reference implementation 7546 70 4806 4518 68 2274 2552 124 2623
Speck 64 128 Optimized C code 1050 52 2555 856 48 1632 596 80 652
Speck 64 96 optimized reference implementation 1326 52 2475 1026 48 1574 640 80 612
TWINE 64 80 Speed-optimized implementation of Twine with 80-bit key 2016 161 19117 1922 136 23938 1144 148 16122


Note:

  • Block and key sizes are expressed in bits [b].
  • Code size (Code) and RAM consumption (RAM) are expressed in bytes [B].
  • Execution time (Time) is expressed in cycles [cyc.].
  • Security level (Sec.) is the ratio of the number of rounds broken in a single key setting to the total number of rounds.
  • For ciphers against which there is no attack (to the best of our knowledge) the security level is set to -1.
  • Details about cryptographic properties of each cipher are available here.
  • Results for assembly implementations are displayed in italic.
  • Cipher-r denotes the cipher Cipher with r rounds instead of the default number of rounds.