Efficient (Masked) Hardware Implementation of Grain-128AEADv2

Abstract

We consider the efficient hardware implementation of Grain-128AEADv2, which is the second version of Grain-128AEAD (one of the lightweight cryptography finalist candidates). In order to counteract side-channel attacks, the efficient masked hardware implementation of Grain-128AEADv2 is also considered under the idea of domain-oriented masking. In detail, the so-called pipeline-like pre-computation technique is applied to increase the throughput-area ratio of the (masked) hardware implementation of Grain-128AEADv2. The performance of the (masked) hardware implementation of Grain-128AEADv2 is evaluated on ASIC and FPGA. For the unmasked version, the highest throughput-area ratio can be $2.14 \mathrm{M}\mathrm{b}\mathrm{p}\mathrm{s}/GE$ on ASIC and $9.34 \mathrm{M}\mathrm{b}\mathrm{p}\mathrm{s}/\mathrm{S}\mathrm{l}\mathrm{i}\mathrm{c}\mathrm{e}$ on FPGA. For the masked version, the highest throughput-area ratio can be $0.37 \mathrm{M}\mathrm{b}\mathrm{p}\mathrm{s}/GE$ on ASIC and $1.72 \mathrm{M}\mathrm{b}\mathrm{p}\mathrm{s}/\mathrm{S}\mathrm{l}\mathrm{i}\mathrm{c}\mathrm{e}$ on FPGA. Then, the security of the masked hardware implementation of Grain-128AEADv2 is verified with the simulated T-Test. To the best of our knowledge, this is the first published work about the (masked) hardware implementation of Grain-128AEADv2. In light of this, this contribution may help researchers and practitioners to accurately compare the efficiency and the security of the hardware implementation of Grain-128AEADv2 with those of other lightweight cryptography algorithms.