What's the difference between word-oriented and byte-oriented ciphers?

Question

I am currently learning about the RC4 cipher and its improved version called Spritz.

The paper of Spritz says

We do not consider other stream-cipher proposals here, and expect that for many applications other word-oriented architectures may be a better choice than the byte-oriented RC4/Spritz style.

Now, what I don't quite understand:

• What's the difference between a word-oriented and a byte-oriented cipher/algorithm?
• When should either a word- or byte-oriented cipher be used, and
• What are the advantages/disadvantages of each?

---

I found some papers that introduce a byte- or word-oriented cipher, but without elaborating clearly what's the idea behind it. To my surprise, googling for "word oriented byte oriented" and checking several Wikipedia pages on computer architecture/CPUs didn't really yield useful results to me.

Answer 1

To my understanding the only difference between word oriented and byte oriented is that word length depends on the processor used, so maybe 32 bits or 64 bits long, for example.

The idea of a word oriented cipher is that it uses native operations to hardware, processing words instead of bits, making for higher speeds, but clearly that makes designs technology dependent which may not always be the best way to go. Mixing addition mod $2^{16}$ with $GF(2)^{16}$ and multiplication mod $2^{16}+1$ can be complex to analyze. Thus word oriented operations have a complex algebraic representation which may be considered a plus for the designer, but then reliable analysis of such operations also hampers the designer.

Answer 2

Since you ask about basics, let's start with basics:

• Byte = 8bits
• Word = 16bits
• Double word = 32bits

This comes from programing languages, and this is more about implementation rather than design itself.

Perhaps better term than byte-oriented might be byte-optimized. This means that algorithm was designed for implementation on processor that can process a specified amount of data at one cycle.

Let's take two opposite sides: 8-bit microprocessor, and modern 64-bit desktop processor. One might not even have multiplication instruction, second can multiply two 64-bit numbers in one cycle. Now, if your algorithm only used 8-bit additions, you would use 8-bit processor to it's full, but that 64-bit processor would waste most of what it can do in that cycle! This doesn't mean that 8-bit processor won't be able to execute 16-bit addition however. This can be done, but it will take more than one cycle to complete.

So byte-oriented algorithm is one that tries to use 8bit sized that and shuffle that. Qword-oriented algorithm will however mostly do operations on 64-bit sized data. This offers speedup for more powerful processors, but perhaps some operations might be very slow on 8bit processors (for example multiplication requires 4 times more multiplications for 2 times smaller data operations).

Modern wisdom is using bigger blocks than smaller, but using simple instructions that can be easily executed on hardware with smaller data. I'd suggest looking into Chacha20 design in that matter. It is optimized to use blocks as big as 128-bit (modern processors can even take 256-bit values for some calculations, using SSE and AVX, Chacha is designed with SSE in mind), but using only 3 instructions: addition, xor and rotation. All those can be very well emulated on smaller processors, so there isn't big loss of performance on those, but fast processors shine. This allows Chacha20 to achieve very good score on big powerful processors but retain most of it's potential at weak microprocessors.