For some IoT devices, the data that needs to be sent is confidential, and hence sending it in plain text is not acceptable. Therefore, I've been considering how to encrypt data sent between IoT devices. An article I recently read on the RFID Journal website mentions the NSA-developed SPECK and SIMON ciphers as particularly suited to IoT applications:

NSA is making the ciphers [...] publicly available at no cost, as part of an effort to ensure security in the Internet of Things (IOT), in which devices are sharing data with others on the Internet.


NSA researchers developed SIMON and SPECK as an improvement on block cipher algorithms already in use that were, in most cases, designed for desktop computers or very specialized systems

Why should I select a newer algorithm such as SIMON or SPECK for my IoT device, especially for applications where power is constrained (e.g. battery power only)? What are the benefits compared to other encryption systems such as AES?


In "The Simon and Speck Block Ciphers on AVR 8-bit Microcontrollers" Beaulieu et al. investigate the implementation of SIMON and SPECK on a low-end 8-bit microcontroller and compare the performance to other cyphers. An Atmel ATmega128 is used with 128 Kbytes of programmable flash memory, 4 Kbytes of SRAM, and thirty-two 8-bit general purpose registers.

Three encryption implementations are compared:

  1. RAM-minimizing

    These implementations avoid the use of RAM to store round keys by including the pre-expanded round keys in the flash program memory. No key schedule is included for updating this expanded key, making these implementations suitable for applications where the key is static.

  2. High-throughput/low-energy

    These implementations include the key schedule and unroll enough copies of the round function in the encryption routine to achieve a throughput within about 3% of a fully- unrolled implementation. The key, stored in flash, is used to generate the round keys which are subsequently stored in RAM.

  3. Flash-minimizing

    The key schedule is included here. Space limitations mean we can only provide an incomplete description of these implementations. However, it should be noted that the previous two types of implementations already have very modest code sizes.

To compare different cyphers a performance efficiency measure - rank - is used. The rank is proportional to throughput divided by memory usage.

SPECK ranks in the top spot for every block and key size which it supports. Except for the 128-bit block size, SIMON ranks second for all block and key sizes.


Not surprisingly, AES-128 has very good performance on this platform, although for the same block and key size, SPECK has about twice the performance. For the same key size but with a 64-bit block size, SIMON and SPECK achieve two and four times better overall performance, respectively, than AES.

Comparing SPECK 128/128 to AES-128 the authors find that the memory footprint of SPECK is significantly reduced (460 bytes vs. 970 bytes) while throughput is only slightly decreased (171 cycles/byte vs. 146 cycles/byte). Thus SPECK's performance (in the chosen metric) is higher than AES. Considering that speed is correlated with energy consumption the authors conclude that "AES-128 may be a better choice in energy critical applications than SPECK 128/128 on this platform." The authors however are uncertain whether heavy usage of RAM access (high-speed AES implementations) are more energy efficient than a register-based implementation of SPECK. In either case a significant reduction in flash memory usage can be achieved which might be of relevance on low-end microcontrollers.

If an application requires high speed, and memory usage is not a priority, AES has the fastest implementation (using 1912 bytes of flash, 432 bytes RAM) among all block ciphers with a 128-bit block and key that we are aware of, with a cost of just 125 cycles/byte. The closest AES competitor is SPECK 128/128, with a cost of 138 cycles/byte for a fully unrolled implementation. Since speed is correlated with energy consumption, AES-128 may be a better choice in energy critical applications than SPECK 128/128 on this platform. However, if a 128-bit block is not required, as we might expect for many applications on an 8-bit microcontroller, then a more energy effcient solution (using 628 bytes of flash, 108 bytes RAM) is SPECK 64/128 with the same key size as AES-128 and an encryption cost of just 122 cycles/byte, or SPECK 64/96 with a cost of 118 cycles/byte.

Additionally, this talk has an Enigma figure in it, who could resist a cypher that references Enigma?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.