`prim_prince`

is an (unhardened) implementation of the 64bit PRINCE block cipher. It is a fully unrolled combinational implementation with a configurable number of rounds (data and key state registers placed half-way in the design can optionally be enabled). Due to the mirrored construction of this cipher, the same circuit can be used for encryption and decryption, as described below. Further, the primitive supports a 32bit block cipher flavor which is not specified in the original paper.

It should be noted, however, that reduced-round and/or 32bit versions **are not secure** and must not be used in a setting where cryptographic cipher strength is required. I.e., this primitive is only intended to be used as a lightweight data scrambling device.

This paper compares several lightweight ciphers, where PRINCE has been found to be the fastest candidate with the lowest circuit complexity among the algorithms compared.

Name | type | Description |
---|---|---|

DataWidth | int | Block size, can be 32 or 64. |

KeyWidth | int | Key size, can be 64 for block size 32, or 128 for block size 64 |

NumRounds | int | Half the number of the reflected PRINCE rounds. Can range from 1 to 5. The effective number of non-linear layers is 2 + 2 * NumRounds. |

UseOldKeySched | bit | If set to 1, fall back to the original keyschedule (not recommended). Defaults to 0. |

HalfwayDataReg | bit | If set to 1, instantiates a data register half-way in the data path |

HalfwayKeyReg | bit | If set to 1, instantiates a key register half-way in the data path. This is only required if the key is not static and changes with every new data input. |

Name | In/Out | Description |
---|---|---|

clk_i | input | Clock input |

rst_ni | input | Reset input |

valid_i | input | Data valid input |

data_i | input | Plaintext input |

data_i | input | Plaintext input |

key_i | input | Key input |

dec_i | input | Assert for decryption |

valid_o | output | Data valid output |

data_o | output | Output of the ciphertext |

/-----------------\ clk_i / rst_ni | | -------------->| | dec_i | | -------------->| PRINCE | valid_i | | valid_o -------------->| DataWidth |---------------> key_i | KeyWidth | =====/========>| NumRounds | [KeyWidth] | UseOldKeySched | data_o | HalfwayDataReg |=======/=======> data_i | HalfwayKeyReg | [DataWidth] =====/========>| | [DataWidth] | | | | \-----------------/

The PRINCE module is fully unrolled and combinational by default. But since data and key state registers can optionally be enabled, the primitive also has a clock, reset and valid input besides the key and plaintext inputs. On the output side it exposes the ciphertext with its corresponding valid signal.

The internal construction follows the the algorithm described in the original paper. The block size is 64bit and the key size is 128bit. In its original formulation, this cipher has 11 rounds (but 12 non-linear layers), which are arranged in a mirrored structure, which allows the same circuit to be used for encryption and decryption with a lightweight tweak applied to the key:

k0, k0_prime, k1 = key_derivation(key_i, dec_i); // decryption mode if (dec_i) { swap(k0, k0_prime); k1 ^= ALPHA_CONSTANT; } state = data_i ^ k0; state ^= k1; state ^= ROUND_CONSTANT[0]; // forward pass for (int i=1; i < 6; i++) { state = sbox4_layer(state); state = mult_layer(state); state = shiftrows_layer(state); state ^= ROUND_CONSTANT[i] data_state ^= (k & 0x1) ? k0 : k1; } // middle part state = sbox4_layer(state); state = mult_layer(state); state = sbox4_inverse_layer(state); // reverse pass for (int i=6; i < 11; i++) { data_state ^= (k & 0x1) ? k1 : k0; state ^= ROUND_CONSTANT[i] state = shiftrows_inverse_layer(state); state = mult_layer(state); state = sbox4_inverse_layer(state); } state ^= ROUND_CONSTANT[11]; state ^= k1; data_o = state ^ k0_prime;

The multiplicative layer is an involution, meaning that it is its own inverse and it can hence be used in the reverse pass without inversion.

It should be noted that the actual choice of the `ALPHA_CONSTANT`

used in the key tweak can have security impacts as detailed in this paper. The constant chosen by the designers of PRINCE does not have these issues - but proper care should be taken if it is decided to modify this constant. Also, this paper proposes an improved key schedule to fend against attacks on the FX structure of PRINCE (see Appendix C), and this improvement has been incorporated in this design. The improvement involves alternating the keys `k0`

and `k1`

between rounds, as opposed to always using the same key `k1`

.

The reduced 32bit variant mentioned above and all reduced round variants are non-standard and must only be used for scrambling purposes, since they **are not secure**. The 32bit variant leverages the same crypto primitives and key derivation functions as the 64bit variant, with the difference that the multiplication matrix is only comprised of the first two block diagonal submatrices (^M0 and ^M1 in the paper), and the shiftrows operation does not operate on nibbles but pairs of 2 bits instead.