# Difference between lightweight, online and low memory Authenticated Encryption schemes

What is the basic difference between the following types of Authenticated Encryption (AE) schemes?

1. Lightweight Authenticated encryption
2. Online Authenticated Encryption
3. Authenticated Encryption for low memory devices

Are they all the same or is there a specific difference between them?

-
@downvoters: How so? I think this is a reasonable question, particularly given one or more of them are given as key features of CAESER submissions. – figlesquidge Mar 21 '14 at 12:48
@figlesquidge I guess it's due to lack of research. The question doesn't have the seemingly obligatory "what have you tried" clause. OP if you can please add some details, like demonstrate how they are similar and why that is confusing, I guess it would re-open the question. I hope this helps. – rath Mar 21 '14 at 18:10
That's a fair point, but two down-votes and 4 close-votes without anyone leaving a comment seems rather poor form. It is very clear what this question is asking. It might not have been asked well, but "unclear what you're asking" doesn't seem an acceptable reason to close it. [/rant] – figlesquidge Mar 21 '14 at 18:12
@figlesquidge - I guess the question being closed because it's "unclear what you're asking" suffices in lieu of comments. I second Rath's comment. In my opinion, the question seems extremely vague, and too broadly open to interpretation. Adding some links, references, and/or previous research to the question might help provide context, and make the question answerable. However, if this question seems clear to you - go ahead and answer it. – hunter Mar 21 '14 at 19:10
Related to the “unclear what you're asking” votes… here's my humble point of view. After all, we've accepted alike questions with similar research efforts. – e-sushi Mar 23 '14 at 13:15

Thought I'd begin with some references for you that might be of interest. These terms are used as key 'selling points' for a number of schemes, including many of the CAESAR submissions. Some examples using the terms specifically are given below - most of which are from CAESER because I have the zoo in-front of me:

• "Online": OCB, Ascon, CBA, APE, NORX
• "memory-constrained devices": Ketje / Keyak / Spongewrap,
• "lightweight": PRESENT, JAMBO, APE, BLINKER (presented CT-RSA14)

Also, there was an eCrypt report on Lightweight crypto.

I can't provide a decent distinction between the 1 & 3, since low memory footprint is a more specific sub-aim of lightweight. Both of these are types of schemes designed to be run in highly restricted environments, such as on embedded devices. These often have constraints that actually affect what operations you can/cannot run on them, such that more efficient algorithms than an AES-based mode may be preferred.

Online AE deals with something completely different. Let A be some associated data, $M=(M_1,\dots,M_n)$ a message, encrypting to $C=(C_0,\dots,C_n)$ and tag $T$. The scheme is online if $C_i$ can be calculated without knowledge of $M_j$ for any $j>i$.

Often lightweight or small footprint ciphers are 'online'. This is because it allows them to process plaintext blocks as they come through. In contrast, an offline cipher would have to collect the complete plaintext before calculating the ciphertext, which means it must have enough memory to store $n$ blocks of data, which not all devices will do - especially for example a small industrial sensor reporting on large amounts of data.

Recently there has been some controversy about the validity of an online decryption function, since they release unverified plaintext (for example, see the CAESER mailing list or this paper). For categorization of some schemes under development, see here.

-
One may also note that there are "semi-online" schemes where the size of the input (but not the contents) must be known from start (e.g. CCM). – Thomas Pornin Mar 27 '14 at 13:27