Fast Skinny-128 SIMD Implementations for Sequential Modes of Operation

Abstract

This paper reports new software implementation results for the Skinny-128 tweakable block ciphers on various SIMD architectures. More precisely, we introduce a decomposition of the 8-bit S-box into four 4-bit S-boxes in order to take advantage of vector permute instructions, leading to significant performance improvements over previous constant-time implementations. Since our approach is of particular interest when Skinny-128 is used in sequential modes of operation, we also report how it benefits to the Romulus authenticated encryption scheme, a finalist of the NIST LWC standardization process.

Appendices

Appendix

This appendix formally defines the S-box decompositions $D_{4444}$ and $D_{4454}$ introduced in Sect. 3.

A $D_{4444}$ Decomposition

$$\begin{aligned} \begin{gathered} S_0 \begin{pmatrix}x_7\\ x_6\\ x_5\\ x_4\end{pmatrix} = \begin{pmatrix} 0\\ 0\\ 0\\ x_7\\ x_5\\ \lnot (x_7 \vee x_6) \oplus x_4\\ 0\\ x_6 \end{pmatrix} S_1 \begin{pmatrix}x_3\\ x_2\\ x_1\\ x_0\end{pmatrix} = \begin{pmatrix} \lnot \big ((\lnot (x_3 \vee x_2) \oplus x_0) \vee x_3\big ) \oplus x_1\\ x_3\\ x_2\\ 0\\ 0\\ 0\\ \lnot (x_3 \vee x_2) \oplus x_0\\ \lnot (x_2 \vee x_1) \end{pmatrix} ~\\~\\ S_2 \begin{pmatrix}x_7\\ x_6\\ x_5\\ x_4\end{pmatrix} = \begin{pmatrix} 0\\ 0\\ 0\\ x_6\\ x_7\\ 0\\ x_4\\ (x_7 \vee \lnot x_4) \oplus x_5 \end{pmatrix} S_3 \begin{pmatrix}x_3\\ x_2\\ x_1\\ x_0\end{pmatrix} = \begin{pmatrix} \lnot (x_2 \vee x_1) \oplus x_3\\ x_2\\ x_1\\ \lnot \big ((\lnot (x_2 \vee x_1) \oplus x_3) \vee x_2\big )\\ 0\\ x_0\\ \lnot \big ((\lnot (x_2 \vee x_1) \oplus x_3) \vee x_0\big )\\ \lnot \big ((\lnot (x_2 \vee x_1) \oplus x_3) \vee x_0\big )\\ \end{pmatrix} \\~\\~\\ S_0 \begin{pmatrix}x_7\\ x_6\\ x_5\\ x_4\end{pmatrix} \oplus S_1 \begin{pmatrix}x_3\\ x_2\\ x_1\\ x_0\end{pmatrix} = \begin{pmatrix}y_3\\ x_3\\ x_2\\ x_7\\ x_5\\ y_6\\ y_5\\ y_2\end{pmatrix} S_2 \begin{pmatrix}y_3\\ x_3\\ x_2\\ x_7\end{pmatrix} \oplus S_3 \begin{pmatrix}x_5\\ y_6\\ y_5\\ y_2\end{pmatrix} \vee \begin{pmatrix}0\\ 0\\ 0\\ 0\\ 0\\ 0\\ 0\\ y_3\end{pmatrix} = \begin{pmatrix}y_7\\ y_6\\ y_5\\ y_4\\ y_3\\ y_2\\ y_1\\ y_0\end{pmatrix} \end{gathered} \end{aligned}$$

B $D_{4454}$ Decomposition

$$\begin{aligned} \begin{gathered} S_0 \begin{pmatrix}x_7\\ x_6\\ x_5\\ x_4\end{pmatrix} = \begin{pmatrix} x_5\\ \lnot (x_7 \vee x_6) \oplus x_4\\ 0\\ x_6\\ 0\\ 0\\ 0\\ x_7 \end{pmatrix} S_1 \begin{pmatrix}x_3\\ x_2\\ x_1\\ x_0\end{pmatrix} = \begin{pmatrix} 0\\ 0\\ \lnot (x_3 \vee x_2) \oplus x_0\\ \lnot (x_2 \vee x_1)\\ \lnot \big ((\lnot (x_3 \vee x_2) \oplus x_0) \vee x_3\big ) \oplus x_1\\ x_3\\ x_2\\ 0 \end{pmatrix} ~\\~\\ S_2 \begin{pmatrix}x_7\\ x_6\\ x_5\\ x_4\\ x_3\end{pmatrix} = \begin{pmatrix} \lnot (x_6 \vee x_5) \oplus x_7\\ x_6\\ x_5\\ \lnot \big ((\lnot (x_6 \vee x_5) \oplus x_7) \vee x_6\big )\\ 0\\ x_4\\ \lnot \big ((\lnot (x_6 \vee x_5) \oplus x_7) \vee x_4\big )\\ \lnot \big ((\lnot (x_6 \vee x_5) \oplus x_7) \vee x_4\big ) \vee x_3\\ \end{pmatrix} S_3 \begin{pmatrix}x_3\\ x_2\\ x_1\\ x_0\end{pmatrix} = \begin{pmatrix} 0\\ 0\\ 0\\ x_2\\ x_3\\ 0\\ x_0\\ (x_3 \vee \lnot x_0) \oplus x_1 \end{pmatrix} \\~\\~\\ S_0 \begin{pmatrix}x_7\\ x_6\\ x_5\\ x_4\end{pmatrix} \oplus S_1 \begin{pmatrix}x_3\\ x_2\\ x_1\\ x_0\end{pmatrix} = \begin{pmatrix} x_5\\ y_6\\ y_5\\ y_2\\ y_3\\ x_3\\ x_2\\ x_7 \end{pmatrix} S_2 \begin{pmatrix} x_5\\ y_6\\ y_5\\ y_2\\ y_3\\ \end{pmatrix} \oplus S_3 \begin{pmatrix} y_3\\ x_3\\ x_2\\ x_7 \end{pmatrix} = \begin{pmatrix}y_7\\ y_6\\ y_5\\ y_4\\ y_3\\ y_2\\ y_1\\ y_0\end{pmatrix} \end{gathered} \end{aligned}$$