Low-latency Implementation of the GIFT Cipher on RISC-V Architectures

Conventional cryptographic algorithms, such as AES-128, have successfully met most security and privacy requirements in modern applications. However, emerging domains like the automotive industry, the Internet of Things (IoT), sensor networks, healthcare systems, and RFID tags operate in constrained computational environments. These scenarios demand cryptographic algorithms tailored for efficiency, with requirements such as low energy consumption, small code size, and minimal chip area. To address this, the National Institute of Standards and Technology (NIST) has initiated efforts to standardize lightweight cryptography.

In 2018, NIST issued a call for lightweight AEAD (authenticated encryption with associated data) algorithms capable of low chip area usage, minimal RAM and ROM requirements, and support for low-energy, low-power, and low-latency implementations. Several submissions were inspired by the GIFT family of block ciphers, including algorithms like ESTATE, Fountain, GIFT-COFB, HyENA, LOTUS-AEAD, and others.

GIFT Cipher Overview

The GIFT family of block ciphers includes GIFT-64 and GIFT-128. Derived from the PRESENT cipher, GIFT offers a smaller, faster, and more secure alternative, addressing vulnerabilities like linear hulls. GIFT has undergone multiple security evaluations while maintaining a high security margin. Its low computational requirements make it a strong candidate for constrained environments.

However, GIFT’s hardware-oriented design, including a bit-oriented permutation layer, poses challenges for software implementations. Optimizing software performance requires specialized techniques to enhance encryption latency (number of clock cycles per block encryption) or throughput (bits encrypted per clock cycle). Depending on the use case, optimizations may involve parallelized implementations or latency reduction strategies.

This research focused on optimizing encryption latency for the GIFT cipher using bitslicing and fixslicing as acceleration techniques. While prior studies evaluated these techniques on ARM and x86 architectures, their performance on RISC-V remained unexplored. Given RISC-V’s growing adoption as the “Linux of the open-hardware movement,” assessing these techniques on RISC-V is essential.