In "The Simon and Speck Block Ciphers on AVR 8-bit Microcontrollers" Beaulieu et al. investigate the implementation of SIMON and SPECK on a low-end 8-bit microcontroller and compare the performance to other cyphers. An Atmel ATmega128 is used with 128 Kbytes of programmable flash memory, 4 Kbytes of SRAM, and thirty-two 8-bit general purpose registers.
Three encryption implementations are compared:
- RAM-minimizing
These implementations avoid the
use of RAM to store round keys by including the pre-expanded round keys
in the flash program memory. No key schedule is included for updating this
expanded key, making these implementations suitable for applications where
the key is static.
- High-throughput/low-energy
These implementations
include the key schedule and unroll enough copies of the round function in
the encryption routine to achieve a throughput within about 3% of a fully-
unrolled implementation. The key, stored in flash, is used to generate the
round keys which are subsequently stored in RAM.
- Flash-minimizing
The key schedule is included here.
Space limitations mean we can only provide an incomplete description of
these implementations. However, it should be noted that the previous two
types of implementations already have very modest code sizes.
To compare different cyphers a performance efficiency measure - rank - is used. The rank is proportional to throughput divided by memory usage.
SPECK ranks in the top spot for every block and key size which it supports. Except for the 128-bit block size, SIMON
ranks second for all block and key sizes.
...
Not surprisingly, AES-128 has very good performance on this platform, although for the same block and key size, SPECK has about twice the performance. For the same key size but with a 64-bit block size,
SIMON and SPECK achieve two and four times better overall performance, respectively, than AES.
Comparing SPECK 128/128 to AES-128 the authors find that the memory footprint of SPECK is significantly reduced (460 bytes vs. 970 bytes) while throughput is only slightly decreased (171 cycles/byte vs. 146 cycles/byte).
Thus SPECK's performance (in the chosen metric) is higher than AES. Considering that speed is correlated with energy consumption the authors conclude that "AES-128 may be a better choice in energy critical applications than SPECK 128/128 on this platform." The authors however are uncertain whether heavy usage of RAM access (high-speed AES implementations) are more energy efficient than a register-based implementation of SPECK. In either case a significant reduction in flash memory usage can be achieved which might be of relevance on low-end microcontrollers.
If an application requires high speed, and memory usage is not a priority, AES has the fastest implementation (using 1912 bytes of flash, 432 bytes RAM) among all block ciphers with a 128-bit block and key that we are aware of, with a cost of just 125 cycles/byte. The closest AES competitor is SPECK 128/128, with a cost of 138 cycles/byte for a fully unrolled implementation. Since speed is correlated with energy consumption, AES-128 may be a better choice in energy critical applications than SPECK 128/128 on this platform. However, if a 128-bit block is not required, as we might expect for many applications on
an 8-bit microcontroller, then a more energy effcient solution (using 628 bytes of flash, 108 bytes RAM) is SPECK 64/128 with the same key size as AES-128 and an encryption cost of just 122 cycles/byte, or SPECK
64/96 with a cost of 118 cycles/byte.
Additionally, this talk has an Enigma figure in it, who could resist a cypher that references Enigma?
