D.VAM.11.-Suggested Algos for LWC.dvi

Project co-funded by the European Commission within the 6th Framework Programme Dissemination Level PU Public X PP Restricted to other programme participants (including the Commission services) RE Restricted to a group specified by the consortium (including the Commission services) CO Confidential, only for members of the consortium (including the Commission services) The information in this document is provided as is, and no warranty is given or implied that the information is fit for any particular purpose. The user thereof uses the information at its sole risk and liability. In this deliverable we discuss which protocols and algorithms should be used for applications in which lightweight cryptography is needed. First, we point out that the most important practical application in this context is RFID. Subsequently, we discuss the question which algorithms are suitable in the context of RFID only. As a part of our discussion we report on the previous activities of ECRYPT in the field of RFID security. These activities have consisted of two deliverables in which lightweight implementations of AES and ECC have been discussed, and of two workshops that we have organized. The findings of these two workshops are summarized in this deliverable. It turns out that today, mostly symmetric cryptographic algorithms can be considered for RFID systems. Consequently, the question arises which type of symmetric primitive should be used: stream ciphers, block ciphers or hash functions. Another ECRYPT activity that is currently work in progress is the eSTREAM project. This project is aimed at finding new stream ciphers (also suitable for lightweight implementations). However, this effort is still work in progress. Therefore the algorithms are still under evaluation and recommendations can not be made at this point. Consequently, the last issue that discuss is whether block ciphers or hash functions are more suitable. We provide evidence that lightweight implementations of the popular hash functions (MD family) cannot compete with lightweight implementations of block ciphers (AES). It turns out that AES is more suitable for lightweight implementations.