How to count Gate Equivalent (GE) of Sbox used in block Cipher. For example how much area does the Sbox of Block Cipher Prince take? And How is it calculated?
$\begingroup$
$\endgroup$
4
-
$\begingroup$ Prince's $RC_0$ is interesting. Never seen that before... $\endgroup$– Paul UszakJul 19, 2018 at 10:42
-
$\begingroup$ PRINCE complete block cipher is interesting, the way they have introduced apha reflection property and used it for making block cipher with low latency. $\endgroup$– cryptJul 19, 2018 at 17:28
-
1$\begingroup$ The Shannon entropy formula governs the theoretical minimum compressed size of any data set. I'm wondering if there might be an equivalent formula that governs the theoretical minimum number of simple gates to synthesise an S transformation. And so die area = process * min. theoretical number * some factor? Just thinkin'. $\endgroup$– Paul UszakJul 19, 2018 at 20:46
-
$\begingroup$ one way of doing is impliment, synthesise to find it, i am interested if there exist some way to approximate it on paper $\endgroup$– cryptJul 20, 2018 at 7:38
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
2
This basically boils down to find a "good" implementation of the S-box and then compute the GE by weighting the operations used (e.g. XOR = 1GE), that is, as you already commented, synthesize the implementation.
Note that the resulting GE greatly depend on the optimization of your implementation, the technology library used etc.
Wikipedia lists some software for this:
- https://en.wikipedia.org/wiki/Logic_synthesis#Commercial_tools_for_logic_synthesis
- https://en.wikipedia.org/wiki/Logic_synthesis#Free_tools
I've never used a tool to design an ASIC, I have only some basic experience with FPGA development, so cannot tell you more about the different tools.
-
$\begingroup$ Any good open source synthesis tool for counting GE? $\endgroup$– cryptAug 1, 2018 at 17:42
-
$\begingroup$
$\endgroup$
3
"Gate equivalence" is just a marketing tool, and has no real relevance for serious work. The only thing that matters in the end is whether you have used up the actual resources (LUTs, FFs, RAMs, routing resources, etc.) of any particular chip with your actual design. If you give me "GE" in a paper, I will most likely eat you alive on the reviews as you are most likely peddling snake oil.
In order to compare S-Boxes, you need to make the S-Boxes in a target process. As in example, I had to make a reference AES S-Box to do power comparisons against other ciphers. I then take those circuits and put them against layout at different nodes.
-
$\begingroup$ Completely disagree. I have seen, for instance, papers eaten alive for not providing a GE figure, but only states FPGA's resources (LUTs, RAMs, etc) which are very specific to the target FPGA. GE is the way we make comparison in ASIC design without being technology dependent. $\endgroup$– RuggeroAug 1, 2018 at 7:49
-
$\begingroup$ @Ruggero GE is totally arbitrary and can easily be manipulated. I should say that I have never seen it used as a quantitative measurement by anyone who actually makes ICs and fabricates them. If you fabricate your ICs, you do not have to fabricate your data. The logical fallacy is the assumption that GE is not technology dependent at this point in time. When Metal stopped scaling proportionally with 350nm, the assumptions behind GE failed. For example, at 14nm, my XOR is smaller than my NAND in absolute area due to routing, and my INV is the same as the NAND. $\endgroup$– b degnanAug 1, 2018 at 11:37
-
1$\begingroup$ @b degnan I have seen, first hand, GE being actually used in IC manufacturing, with good approximation (for the purely digital parts of course). It can be, however, that things get different below 28nm, on this I have no experiences. $\endgroup$– RuggeroAug 1, 2018 at 12:32
$\begingroup$
$\endgroup$
1
The standard EDA (Electronic Design Automation) tools for hardware synthesis take as input a design and a technology library and produce a gate level equivalent design with the technology library (e.g. CMOS 45nm, FiNFET 14nm, FDSOI 28nm, in the case of PRINCE paper, the authors used Nandgate 45nm and UMC 90nm)
Additional output describes some properties of the gate level output, including the area expressed in e.g. squared millimeters.
The technology library is basically a list of gates and describes how they are made, and in its documentation you can find how big they are (again, in area).
The way to compute GE is to divide the area of your synthetized, gate level design by the area of a NAND2 (that is a NAND with only 2 input) of your target technology library. This figure is supposed to be approximately independent on the target technology, so you can use it to make estimation of the area of the same design in different technologies.
In practice the approximation error is about 5% or 10% but it's still a good estimation and widely used.
In papers, when the design is small, e.g. an SBOX, you can often count gates manually and then compare it with your technology NAND2 gate. See, as example, section 5.4 of this very good paper on AES SBOX.
-
$\begingroup$ any free open source EDA tool for hardware synthesis? $\endgroup$– cryptAug 3, 2018 at 16:50