3

There are many recommended modes of operation for block ciphers as described by NIST here, e.g. for DES and AES.

However, I am struggling to find any for lightweight ciphers. I am particularly interested in modes of operation for PRESENT, Clefia and other standardised lightweight ciphers, and why they are suggested.

Red Book 1
  • 1,025
  • 10
  • 26

1 Answers1

4

When using lightweight ciphers, the block size can make a huge difference to security. Fortunately, there has been a lot of work in recent years on tight bounds for modes of operations, and methods for going beyond the birthday bound. These modes are not stated as being especially for lightweight ciphers, so don't search for that. However, there is no doubt that when using lightweight ciphers with block sizes smaller than 128, then different modes of operation are needed (of course, depending on how much you want to encrypt). Here are three examples of work to look at (and the references therein):

  1. CENC is Optimally Secure
  2. New Blockcipher Modes of Operation with Beyond the Birthday Bound Security
  3. Better Bounds for Block Cipher Modes of Operation via Nonce-Based Key Derivation
Yehuda Lindell
  • 28,270
  • 1
  • 69
  • 86