ECRYPT Low Cost Ciphers Page

Implementations of low cost block ciphers in Atmel AVR devices.
(see also our hash functions project)

Please refer to the following companion paper whenever you use the source codes: T. Eisenbarth, Zheng Gong, T. Guneysu, S. Heyse, S Indesteege, S. Kerckhof, F. Koeune, T. Nad, T. Plos, F. Regazzoni, F.-X. Standaert, L. van Oldeneel tot Oldenzeel, Compact Implementation and Performance Evaluation of Block Ciphers in ATtiny Devices, in the proceedings of Africacrypt 2012, Lecture Notes in Computer Science, vol 7374, pp 172-187, Ifrane, Morocco, July 2012, (pdf file).

Block ciphers that are efficiently implemented in low cost embedded devices are important components for securing new applications in ubiquitous computing. This page reports on the performance evaluation of standard and emerging block ciphers, in the Atmel AVR 8-bit RISC microcontrollers. In order to increase the transparency of the evaluation, we make all source codes used in the evaluations available under an open source license. The performance indicators chosen are: code size (rom and ram), cycle count, energy consumption. The throughput was computed with a 10MHz clock and the power consumption was measured on a Printed Circuit Board embedding only an Atmel Attiny 45 device, with a shunt resistor of 22.5 Ohms and a coupling capacitor of 100nF.

The ciphers under investigation are:

- AES: specification and source code.
- DESXL: specification and source code.
- HIGHT: specification and source code.
- IDEA: specification and source code.
- KASUMI: specification and source code.
- KATAN: specification and source code.
- KLEIN: specification and source code.
- mCRYPTON: specification and source code.
- NOEKEON: specification and source code.
- PRESENT: specification and source code main + sbox.
- SEA: specification and source code.
- TEA: specification and source code.

For comparison, we also evaluated B. Poettering's open source code for the AES Rijndael (http://point-at-infinity.org/avraes/), next denoted as Rijndael Furious.

The interface used for evaluating our metrics is also available here.

The performance evaluations of the different ciphers are given below (new results are in red):

Cipher Block size [bits] Key size [bits] Code size (encryption + decryption) [bytes] RAM words (encryption + decryption) [bytes] Cycle count (encryption + key scheduling) Cycle count (decryption + key scheduling) Energy consumption (encryption) [uJ]
AES v1 128 128 1659 33 4557 7015 19.2
AES Rijndael Furious 128 128 1568 192 3629 4462 15.3
AES Rijndael [1] 128 128 2606 0 6637 7429 -
DESXL v1 64 184 820 48 84602 84602 348.9
DESXL [1] 64 184 3192 0 8531 7961 -
HIGHT v1 64 128 402 32 19503 20159 79.8
HIGHT [1] 64 128 5672 0 2964 2964 -
IDEA v1 64 128 836 232 avg. ~8250 * avg. ~22729 34.3
IDEA [1] 64 128 596 0 2700 15393 -
KASUMI v1 64 128 1264 24 11939 11939 47.6
KATAN v1 64 80 338 18 72063 88525 289.2
KLEIN v1 64 80 1268 18 6095 7658 25.1
mCRYPTON v1 64 96 1076 28 16457 22656 68.0
NOEKEON v1 128 128 364 32 23517 23502 95.9
PRESENT v1 64 80 1000 18 11342 13599 45.3
PRESENT [1] 64 80 936 0 10723 11239 -
SEA v1 96 96 426 24 41604 40860 173.7
SEA [1] 96 96 2132 0 9654 9654 -
TEA v1 64 128 648 24 7408 7539 30.3
TEA [1] 64 128 1140 0 6271 6299 -

* The source code for IDEA uses a multiplier that does not run in constant time. For convenience, it also includes a version with HW multiplier that is more efficient but does not run on Atmel Attiny 45 devices (and is not reported in the table).


[1] Thomas Eisenbarth, Sandeep Kumar, Christof Paar, Axel Poschmann, Leif Uhsadel, A Survey of Lightweight-Cryptography Implementations, IEEE Design & Test, volume 24, Issue 6, pp 522-533, November 2007.