Simon Gerhalter
Graz University of Technology, Graz, Austria

Samir Hodžić
NXP Semiconductors, Gratkorn, Austria

Marcel Medwed
NXP Semiconductors, Gratkorn, Austria

Marcel Nageler
Graz University of Technology, Graz, Austria

Artur Folwarczny
NXP Semiconductors, Leuven, Belgium

Ventzi Nikov
NXP Semiconductors, Leuven, Belgium

Jan Hoogerbrugge
NXP Semiconductors, Eindhoven, Netherlands

Tobias Schneider
NXP Semiconductors, Gratkorn, Austria

Gary McConville
NXP Semiconductors, Gratkorn, Austria

Maria Eichlseder
Graz University of Technology, Graz, Austria

Keywords: Low-latency block cipher, Memory encryption

Abstract

Modern CPU architectures deploy a variety of security features to mitigate software attacks, including logical isolation, memory tagging, and shadow stacks. Building such features on cryptographic isolation rather than logical checks can reduce memory overhead and improve robustness against misconfiguration and low-cost physical attacks, but it requires a cipher that adds little latency or frequency overhead. At present, there is no suitable low-latency design for encrypting 32-bit words as commonly used in microcontrollers. In this paper, we propose a 32-bit tweakable block cipher tailored to memory encryption for microcontroller units. The design is optimized for low latency through a careful choice of round-function components and by leveraging an attack scenario similar to that used for SCARF. To mitigate attack vectors introduced by that scenario, we deploy a complex tweak-key schedule. Owing to the shortage of suitable 32-bit designs, we compare our design to several low-latency ciphers with different block sizes, and our hardware implementation shows competitive latency numbers.