- Cipher

Authenticated Encryption Cipher with Associated Data

Second round candidate of the CAESAR competition

The newest version: picipherv2.01.pdf version from 12 October 2015

Current reference implementation: source code

Reference implemntation on GitHub with test vectors: C

About - Cipher

π-Cipher is robust
Offers an intermediate level of nonce-misuse resistance by using SMN.

π-Cipher is tag second preimage resistant
It offers certain level of tag-second preimage resistance and that level depends on the number of blocks of the input message.

π-Cipher is secure
It is designed to support different levels of security with 96, 128 and 256 bits of secret key.

π-Cipher is multi-platform
It can run on different platforms (from 8-bit MCUs to latest 64-bit CPUs) depending on the purpose. There are 16-bit, 32-bit and 64-bit versions.

π-Cipher is simple
It uses two pass counter based sponge component that is based on ARX operations.

π-Cipher is incremental
Incrementality can be achieved with adding some additional data overhead on the existing message blocks.

π-Cipher is parallel
Associated data, and message blocks can be processed in parallel.

π-Cipher is narrow/wide block flexible
The flexibility of block sizes allows secure authenticated encryption of data in rest and secure incremental mode of operation.

Implementations

Software Implementations

Reference implementation in C (by Daniel Otte) C

Implementation in Ada (by Daniel Otte) Ada

Implementation on Atmel AVR 8-bit MCU (by Daniel Otte)
(code size 2.26 KB, speed 741.7 cpb)

Hardware Implementations

High speed implementation compliant with GMU API (by Ekawat "Ice" Homsirikamol)

Lightweight implementation prepared for GMU benchmarking (by Mohamed El Haddedy) code

VHDL implementation of 16-bit version (by Mohamed El Haddedy) code
VHDL implementation of 32-bit version (by Mohamed El Haddedy) code
VHDL implementation of 64-bit version (by Mohamed El Haddedy) code

Table of measurements for FPGA and ASIC can be found here

Resources

Second Round

v2.01 version from 10 October 2015

v2.0 version from 29 August 2015

First Round

v1.1 version from 28 November 2014

v1.0 version from 14 March 2014

Changelog

Version v2.01

Corrected pseudo-code algorithms given in the initial documentation v2.0

Version v2.0

Padding rule
Reduction of the number of rounds
Added privacy and integrity proofs for π-Cipher

Version v1.1

Changes in the padding rule as it was pointed out by Gäetan Leurent and Thomas Fuhr

Publications

π-Cipher with Intermediate Tags
Under review

16-bit Reconfigurable Encryption Processor for π-Cipher (+slides)
23rd Reconfigurable Architectures Workshop (RAW 2016), Chicago (Best Paper Award)

π-Cipher v2.0
DIAC Workshop 2015

The ARX Structure of π-Cipher
The 4th Conference on Logic and Applications LAP 2015

Lightweight version of π-Cipher (+slides)
NIST Lightweight Cryptography Workshop 2015

CAESAR candidate PiCipher
DIAC Workshop 2014

π-Cipher: Candidate for Authenticated Encryption in the Upcoming Zettabyte Era
CrossFyre Workshop 2014

π-Cipher: Authenticated Encryption for Big Data
The 19th Nordic Conference on Secure IT Systems NordSec 2014

Cryptanalysis

State recovery attacks against π-cipher
ACSW '16 Proceedings of the Australasian Computer Science Week Multiconference

Key Recovery Attack against 2.5-round π-Cipher
Proceedings of the FSE 2016 - 23rd International Conference on Fast Software Encryption

Response letter
Reacion of the designers of π-Cipher to the authors of the paper
"Key Recovery Attack against 2.5-round π-Cipher"