What is the official, generally accepted definition of "lightweight crypto"?

Question

I frequently stumble upon the term "lightweight crypto". It tends to be used is a for special algorithms that use less resources, for constrained systems. Yet, it's somewhat unclear to me where to draw the line between "regular algorithms" and "special algorithms".

Since even some well-known cryptographers use the term "lightweight cryptography", I assume there must be an official, generally accepted definition for it. Yet, I fail to find it... since every source I trace down seems to define the term a bit different. For example: some even put AES into the basket when they were able to make it run on some limited-abilities piece of hardware, while others explicitly exclude AES from the lightweight crypto group. Same for ChaCha20, etc.

To avoid confusion, knowing the official definition (and maybe even having a reference to point to) would definitely help.

TL;DR

What is the official, generally accepted definition of "lightweight crypto"? And where (reference) is it defined?

Answer 1

There is no official definition, of course. However, at least in my experience, the word is used consistently.

The word lightweight typically refers to something that is significantly less expensive to use than other stuff, while at the same time achieving the same desired effect, but this lightweight-ness has some cost. (If there was no cost to lightweight-ness, it would not be lightweight, but just "better".) This means that the lightweight stuff may be desirable in some situations, but not in others.

Typically, a lightweight block cipher will be amenable to implementations that are small or use little power or ..., compared to the usual block ciphers. This happy state is achieved at some cost, perhaps by reducing the security margin or having more rounds, etc.

Note that people may talk about lightweight public key cryptography, but it is lightweight only when compared to ordinary public key cryptography, not compared to other kinds of cryptography such as block ciphers.

People also talk about lightweight implementations of cryptographic primitives. Again, lightweight refers to some reduced cost, typically achieved by increasing some other cost. People may be interested in an AES implementation with extremely small gate count, for instance, even if it would be slower or use more power than other implementations.

The word lightweight is of course not limited to cryptography, but is used everywhere, with somewhat differing meanings. Consult your dictionary. In technical contexts, it usually has positive connotations in my experience.

Answer 2

"Lightweight" implies a comparison with a reference implementation or with another "heavyweight" implementation, so it's always context dependent. Since there is no single industry standard algorithm or protocol, let alone an industry standard reference implementation of each, nothing can be used to measure other algorithms to meaningfully sort them into lightweight or heavyweight categories.

It's generally used in a comparative description, where algorithm A takes orders of magnitude fewer instructions (faster) to perform a crypto operation than algorithm B. "AES is the lightweight symmetric algorithm used for bulk data encryption while heavyweight RSA is only used for key exchange."

It might be used to describe an algorithm designed to fit on a low-power or hardware constrained CPU, such as might be found on a smart card. "We chose the lightweight 1000-byte implementation of Skein for the smart card cryptography so that we could spend less on the chips."

It might even be used to describe the strength of an algorithm: "PBKDF2 was chosen over the lightweight SHA-256 in order to thwart brute force password guessing attacks."

And of course it might be used in marketing speak, where it means precisely what the salesman intends it to mean, and nothing more.

And these change over time. Today's CPUs can run heavyweight algorithms faster than 20-year-old machines could run the lightweight algorithms of their day. I don't think we can define a meaningful, lasting reference here that says "any algorithm that takes fewer than X instructions or processes within X cycles or performs X megabytes per second is considered lightweight".