%%class
\documentclass{iaesarticle2}

%%required package. add for your convenient, but do not remove the initial
\usepackage{amsmath, amsfonts, amssymb, float, fancyhdr}
\usepackage{url, mathtools}
\usepackage{textcase}
\usepackage[figuresright]{rotating}
\usepackage{authblk, graphicx, indentfirst, lastpage, lipsum}
\usepackage[warn]{textcomp}
\setlength{\affilsep}{0cm}
\renewcommand\Authfont{\normalsize}
\renewcommand\Affilfont{\normalfont\small}
\usepackage{subfig, caption, epstopdf}
\usepackage[left=2.5cm, right=2cm, top=1.5cm, bottom=2cm, includehead, includefoot]{geometry}
\usepackage{caption}
\captionsetup{labelsep=period}
\usepackage{titlesec}
\titleformat{\section}
  {\normalfont\normalsize\bfseries\uppercase}{\thesection}{1em}{}
\titlespacing*{\section}{0cm}{0.7cm}{0cm}

%%leave copyright info to the editor
\CopyrightLine[Copyright]{2020}{Institute of Advanced Engineering and Science.}

%%author
\author[1*]{\bfseries Minh Nguyen Hieu}
\author[2]{\bfseries Duy Ho Ngoc}
\author[3*]{\bfseries Canh Hoang Ngoc}
\author[4]{\bfseries Trung Dinh Phuong}
\author[5]{\bfseries Manh Tran Cong}
%%author's affiliation
\affil[1*]{Institute of Cryptographic Science and Technology, Hanoi, Vietnam}
\affil[2]{Cyber Command 86, Vietnam Ministry of Defence, Danang, Vietnam}
\affil[3*]{Thuongmai University, Hanoi, Vietnam}
\affil[4]{Vietnam Government Information Security Committee, Hanoi, Vietnam}
\affil[5]{Le Quy Don Technical University, Hanoi, Vietnam}

%%title and shortitle (for footer)
\title{New primitives of controlled elements $\mathbf{F}_{2/4}$ for block ciphers}
\shorttitle{New primitives of controlled elements $\mathbf{F}_{2/4}$ for block ciphers (Minh Nguyen Hieu)}

%%starting
\begin{document}

%%indentation. do not change
\setlength{\parindent}{1.27cm}

%%header and footer setting. do not change
\pagestyle{fancy}
\fancyhfoffset{0cm}

%%journal info
\journalname{International Journal of Electrical and Computer Engineering (IJECE)}
\journalshortname{IJECE}
\journalhomepage{http://iaesjournal.com/online/index.php/IJECE}
\vol{9}
\no{1}
\months{Feb}
\years{2019}
\issn{2088-8708}%, DOI: 10.11591/ijece.v9i1.pp.xx-xx}

%%build title
\maketitle

%%border setting. do not change
\hrule
\vspace{.1em}
\hrule
\vspace{.5em}
\noindent
\parbox[t][][s]{0.275\textwidth}{%
\textbf{Article Info}
\vspace{.5em}
\hrule
\vspace{.5em}
\begin{history}

%%article info. editor's privilege
Received Aug 1, 2019
\par 
Revised Nov 20, 2019
\par 
Accepted Dec 11, 2019

\end{history}
\vspace{.5em}
\hrule
\vspace{.5em}
\begin{keyword}

%%write keyword here. separate by \sep
Fast block cipher \sep FPGA device \sep Differential analysis \sep CSPN \sep Cryptography

\vspace{.5em}
\end{keyword}
\vspace{\fill}
}
\parbox{0.025\textwidth}{\hspace{0.5em}}
\parbox[t][][s]{0.7\textwidth}{%
\begin{abstract}
%% Text of abstract
This paper develops the cipher design approach based on the use of data-dependent operations (DDOs). A new class of DDO based on the advanced controlled elements (CEs) is introduced, which is proven well suited to hardware implementations for FPGA devices. To increase the hardware implementation efficiency of block ciphers, while using contemporary FPGA devices there is proposed an approach to synthesis of fast block ciphers, which uses the substitution-permutation network constructed on the basis of the controlled elements $\mathbf{F}_{2/4}$ implementing the $2\times2$ substitutions under control of the four-bit vector. There are proposed criteria for selecting elements $\mathbf{F}_{2/4}$ and results on investigating their main cryptographic properties. It is designed a new fast 128-bit block cipher MM-128 that uses the elements $\mathbf{F}_{2/4}$ as elementary building block. The cipher possesses higher performance and requires less hardware resources for its implementation on the bases of FPGA devices than the known block ciphers. There are presented result on differential analysis of the cipher MM-128.
\end{abstract}
}
\parbox[l]{\textwidth}{%
\rule{0.275\textwidth}{0.5pt} \hspace{0.5cm} \hrulefill
\\
\emph{\textbf{Corresponding Author:}}\\
%% correspondence info. separate by \\
%*Minh Nguyen Hieu,\\
%Institute of Cryptographic Science and Technology,\\
%105 Nguyen Chi Thanh, Hanoi, Vietnam\\
%Email: hieuminhmta@gmail.com\\
*Canh Hoang Ngoc,\\
Thuongmai University,\\
79 Ho Tung Mau, Hanoi, Vietnam\\
Email: canhhn@tmu.edu.vn

}
\vspace{.5em}
\hrule
\vspace{.1em}
\hrule


%% main text

\section{Introduction}
\label{}
To protect the information in high-speed information and telecommunication systems there is widely used hardware-based encryption, and most widely are used the block ciphers. There are two main variants for hardware implementation: 1) Programmable Logic Device (PLD); 2) Custom Very Large Integrated Circuits (VLSI). First variant is more flexible and faster, as well as economically more advantageous in case of production of comparatively small number of encryption devices. Currently on a mass scale there are available FPGA devices of new generation, which allow essentially improve the performance of information transformation. Earlier in works $[1]-[4], [7]-[12], [23]-[25]$ there was developed an approach to the synthesis of fast cipher oriented to efficient hardware implementation, which is based on applying the data-driven operations that are performed with the controlled substitution-permutation networks (CSPNs). The CSPN-based operating blocks are implemented in the form of a multilayer structure, the active layers of which represent cascades of the controlled elements (CEs) with a two-bit input for data. Between two sequential active layers there is located a fixed bit permutation implemented as interlacing wires.
\par
In the known publications there are formulated criteria for selecting the CEs $\mathbf{F}_{2/1}$ with one-bit control input and the CEs $\mathbf{F}_{2/2}$ with two-bit control input [1]. It has been estimated that the implementation of the elements $\mathbf{F}_{2/1}$ needs only 50$ \% $ of the resources of two standard cells of a typical FPGA device and there exist some prerequisites to implement some advanced CEs. The $\mathbf{F}_{2/2}$ type CEs controlled with two bits $ v_1 $ and $ v_2 $ has been proposed as main building block, while designing the DDO boxes. The $\mathbf{F}_{2/2}$ type CEs which provides construction of the CSPNs with high non-linearity and severe avalanche effect. These types of CEs were used for designing fast block ciphers suitable for effective implementation in FPGA devices, typical logic blocks of which contain the 16-bit memory cells.
\par
Currently there are widely available the FPGA devices with 64-bit memory cells. This makes reasonable to use the CEs $\mathbf{F}_{2/4}$ with four-bit controlled input for constructing the CSPN-based data-driven operations, replacing the CEs $\mathbf{F}_{2/1}$ and $\mathbf{F}_{2/2}$ in some given topology of CSPN. Such replacement provides higher non-linearity of the CSPNs containing the given number of the CEs and possibility to improve efficiency of the hardware implementation of block ciphers. Therefore CEs $\mathbf{F}_{2/4}$ are proven to be more powerful cryptographic primitives. They potentially support designing more efficient CEs than CEs $\mathbf{F}_{2/1}$ and $\mathbf{F}_{2/2}$. With the applied advanced DDOs the design of ciphers with less number of rounds is supported, yielding to higher performance/cost ratio.
\par
In this paper we consider the problem of developing criteria for selecting the CEs $\mathbf{F}_{2/4}$ well suitable for their use while constructing the CSPNs and in the design of the fast block ciphers oriented to efficient hardware implementation using the FPGA devices Virtex-5, Virtex-6 and Virtex-7 $[5]$.
\par The rest of the paper is organized as follows: Section 2 introduces the criteria to select the CEs $\mathbf{F}_{2/4}$ and presents basic cryptographic properties. In Section 3 a new DDO-based cipher, is proposed, well suited to FPGA implementations. FPGA synthesis results and comparisons with other known ciphers are also given. Finally, in Section 4 conclusions is discussed.
\section{CRITERIA TO SELECT THE CE\MakeLowercase{s} $\mathbf{F}_{2/4}$ AND BASIC CRYPTOGRAPHIC PROPERTIES}
\subsection{Criteria to select CEs $\mathbf{F}_{2/4}$}
\begin{figure}[h]
\centering
\includegraphics[scale=0.5]{Figure1}
\caption{Controlled element $\mathbf{F}_{2/4}$ (a) and its representation in the form of a pair of Boolean functions (b)}
\end{figure}
\label{}
Controlled element $\mathbf{F}_{2/4}$  has a two-bit input and output, and four-bit controlled input. Schematic representation of CEs $\mathbf{F}_{2/4}$  is shown in figure 1a.
\par
By analogy with representation of the elements $\mathbf{F}_{2/1}$  and $\mathbf{F}_{2/1} [1]$ the CEs $\mathbf{F}_{2/4}$  can be conveniently represented in the following variants: 
\begin{enumerate}
	\item[1.] As a pair of Boolean functions (BF) with six variables (see Figure 1b);
	\item[2.] As an ordered set of sixteen S-boxes of size $2\times 2$ one of which is selected depending on the value of the controlled 4-bit vector to perform transformation of the input two-bit binary vector $(x_1, x_2)$. (The controlled 4-bit vector take on 16 different values $V = (v_1, v_2, v_3, v_4) = (0,0,0,1); (0,0,1,0); (0,0,1,1); …; (1,1,1,1)$, to each of which an elementary S-box operation is to be assigned)
\end{enumerate}
\par
The first variant of representation is usually used in hardware implementation of CSPNs and in the investigation of linear properties of CEs and CSPNs. The second variant is used while selecting the CEs by specified criteria $[1], [3]$. Taking into account the results of the paper $[1], [2]$, the following criteria for selecting concrete variants of the CEs $\mathbf{F}_{2/4}$  has been formulated in the case of using the CEs $\mathbf{F}_{2/4}$  as elementary building blocks for constructing the CSPNs having higher non-linearity and stronger avalanche effect:
\begin{enumerate}
	\item[1.]	Criterion 1: Each of two outputs of the element $\mathbf{F}_{2/4}$  should be a non-linear BF of six variables: $y_1=f_1(x_1,x_2,v_1,v_2,v_3,v_4)$ and $y_2=f_2(x_1,x_2,v_1,v_2,v_3,v_4)$ each of which has a value of non-linearity (NL), close to the maximum possible value of NL for balanced BF of six variables.
	\item[2.]	Criterion 2: Each of the sixteen elementary modifications of the element $\mathbf{F}_{2/4}$, namely $F^{(0)}, F^{(1)}, F^{(2)}, …, F^{(15)}$ should be bijective transformation $(x_1,x_2)\rightarrow (y_1,y_2)$. 
	\item[3.]	Criterion 3: Each of the sixteen modifications CEs $\mathbf{F}_{2/4}$ should be an involution.
	\item[4.]	Criterion 4: The linear combination of two outputs $y_1$ and $y_2$, i.e. BF $f_3=y_1\oplus y_2$ should have non-linearity close to the non-linearity $NL(y_1)$ and $NL(y_2)$.
\end{enumerate}
\par
These criteria use the notion of the non-linearity (NL) of some BF $\varPhi$. The nonlinear is defined as distance from the BF $\varPhi$ to the set of all affine BF in the same number of variables. Using these criteria, and sorting different variants of CEs $\mathbf{F}_{2/4}$, one can find many specific elements of CEs $\mathbf{F}_{2/4}$, that are of interest for the use in the design of block ciphers. The computational difficulty of the complete sorting of all possible variants of the CEs $\mathbf{F}_{2/4}$  depends on the approach to implement the sorting. We have considered two approaches to this problem, previously used in the papers $[1], [2]$ for sorting the CEs $\mathbf{F}_{2/1}$  and $\mathbf{F}_{2/2}$. Actually, the following two approaches has been used: 
\begin{enumerate}
	\item[1.]	Sorting all possible pairs of Boolean functions $y_1=f_1(x_1,x_2,v_1,v_2,v_3,v_4)$ and $y_2=f_2(x_1,x_2,v_1,v_2,v_3,v_4)$;  
	\item[2.]	Sorting all possible sets of $16$ elementary S-box operations having the size $2 \times 2$, which are further denoted as modifications $F^{(0)}, F^{(1)}, F^{(2)}, ..., F^{(15)}$ realized by the element $\mathbf{F}_{2/4}$.
\end{enumerate}
\par
For first approach, the amount of computation required for the exhaustive search of possible variants CEs $\mathbf{F}_{2/4}$, satisfying the specified criteria, is large enough. Indeed, there are $2^{64}$ of different BF of six variables, therefore it is required to sort $2^{64}\cdot (2^{64}- 1) \approx 3,4\cdot10^{38}$ different pairs of BF. The number of cases can be significantly reduced taking into account the well known result that each output of the S-box operation is a balanced BF. Thus, it is sufficient to sort all possible pairs of the balanced BF. Number of Balanced BF of $n$ variables equals the number of combinations $C^{2^n}_{2^{n-1}}$, which for $n = 6$ is approximately equal to $1,83\cdot 10^{18}$. This gives $3,35 \cdot 10^{18}$ variants that are out of the practical possibility to perform their exhaustive search. 
\par
The minimum number of variants of sorting is achieved with the second approach, since in this case, the design of effective CEs $\mathbf{F}_{2/4}$  is reduced to the formal choice modifications of $F^{(0)}, F^{(1)}, F^{(2)}, ..., F^{(15)}$, each of which is a permutation of size $2\times2$. Number of substitutions having the size $n \times n$ is defined by $2^n!$, that for $n = 2$ gives $2^2! = 4! = 24$. Moreover there are $10$ variants of such substitutions (see Figure 2), satisfying the third criterion. Consequently, the visual design is reduced to the choice of pairs of such modifications and requires an analysis of $10^{16}$ variants. However, in this case the exhaustive search is applicable only while using large computational resources.
\par
For practical application of the CEs $\mathbf{F}_{2/4}$, it suffices to find a relatively small number of such elements that represent their main subclasses that satisfy the formulated criteria. Therefore we can apply an exhaustive search for a representative statistical sample of CEs $\mathbf{F}_{2/4}$, generating variants of elements $\mathbf{F}_{2/4}$ by the equiprobable random sample of $16$ modifications $F^{(i)}$, where $i = 0, 1, …, 15$.
\begin{figure}[h]
	\centering
	\includegraphics[scale=0.5]{Figure2}
	\caption{Schematic representation of the various existing transformations $(x_1,x_2)\rightarrow (y_1,y_2)$ that are involutions}
\end{figure}
\par
To analyze the properties of the CEs $\mathbf{F}_{2/4}$  defined by a set of the $\mathbf{F}^{(i)}$ modifications, where $i = 0, 1, \ldots, 15$, it is required to obtain the algebraic normal form of the BFs  $f_1$ and  $f_2$ describing the value of the first and second outputs of CEs $\mathbf{F}_{2/4}$. Boolean functions $f_1$ and  $f_2$ can be easily built for the set of sixteen ordered pairs of BF in two variables each of which describes one of sixteen modifications $\mathbf{F}^{(i)}$, where $i = 0, 1, \ldots, 15$, that define some variant of the element $\mathbf{F}_{2/4}$. There are $10$ various pairs of BF in two variables, which describe the elementary S-boxes that are involutions. Each of the possible $10$ pairs of BF in two variables describing the modification of $\mathbf{F}^{(i)}$  $(i = 0, 1, \ldots, 15)$, can be easily constructed using their schematic representation shown in 
figure 2. Let $\{f^1_1(x_1,x_2), f^1_2(x_1,x_2)\}$  be the pair of BFs describing some given modification 
$\mathbf{F}^{(0)}$  that corresponds to the value $V = (0,0,0,0)$. Let $\{f^2_1(x_1,x_2),f^2_2(x_1,x_2)\}, \{f^3_1(x_1,x_2),f^3_2(x_1,x_2)\}, \ldots, \{f^{16}_1(x_1,x_2),f^{16}_2(x_1,x_2)\}$ be the pairs of  BFs describing some given modifications $F^{(0)}, F^{(1)}, F^{(2)}, \ldots, F^{(15)}$ relating to the following values of the control vector $V = (0,0,0,1); V = (0,0,1,0); \ldots; V = (1,1,1,1)$, respectively. Then the concrete form of two BF realizing CEs $\mathbf{F}_{2/4}$, can be obtained from the following two formulas:
\begin{align}\label{(1)}
 {{y}_{1}}=&({{v}_{1}}\oplus 1)({{v}_{2}}\oplus 1)({{v}_{3}}\oplus 1)({{v}_{4}}\oplus 1)f_{1}^{1}({{x}_{1}},{{x}_{2}})\oplus ({{v}_{1}}\oplus 1)({{v}_{2}}\oplus 1)({{v}_{3}}\oplus 1){{v}_{4}}f_{1}^{2}({{x}_{1}},{{x}_{2}})\oplus \notag\\ 
& \oplus ({{v}_{1}}\oplus 1)({{v}_{2}}\oplus 1){{v}_{3}}({{v}_{4}}\oplus 1)f_{1}^{3}({{x}_{1}},{{x}_{2}})\oplus ({{v}_{1}}\oplus 1)({{v}_{2}}\oplus 1){{v}_{3}}{{v}_{4}}f_{1}^{4}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus ({{v}_{1}}\oplus 1){{v}_{2}}({{v}_{3}}\oplus 1)({{v}_{4}}\oplus 1)f_{1}^{5}({{x}_{1}},{{x}_{2}})\oplus ({{v}_{1}}\oplus 1){{v}_{2}}({{v}_{3}}\oplus 1){{v}_{4}}f_{1}^{6}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus ({{v}_{1}}\oplus 1){{v}_{2}}{{v}_{3}}({{v}_{4}}\oplus 1)f_{1}^{7}({{x}_{1}},{{x}_{2}})\oplus ({{v}_{1}}\oplus 1){{v}_{2}}{{v}_{3}}{{v}_{4}}f_{1}^{8}({{x}_{1}},{{x}_{2}})\oplus  \\ 
& \oplus {{v}_{1}}({{v}_{2}}\oplus 1)({{v}_{3}}\oplus 1)({{v}_{4}}\oplus 1)f_{1}^{9}({{x}_{1}},{{x}_{2}})\oplus {{v}_{1}}({{v}_{2}}\oplus 1)({{v}_{3}}\oplus 1){{v}_{4}}f_{1}^{10}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus {{v}_{1}}({{v}_{2}}\oplus 1){{v}_{3}}({{v}_{4}}\oplus 1)f_{1}^{11}({{x}_{1}},{{x}_{2}})\oplus {{v}_{1}}({{v}_{2}}\oplus 1){{v}_{3}}{{v}_{4}}f_{1}^{12}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus {{v}_{1}}{{v}_{2}}({{v}_{3}}\oplus 1)({{v}_{4}}\oplus 1)f_{1}^{13}({{x}_{1}},{{x}_{2}})\oplus {{v}_{1}}{{v}_{2}}({{v}_{3}}\oplus 1){{v}_{4}}f_{1}^{14}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus {{v}_{1}}{{v}_{2}}{{v}_{3}}({{v}_{4}}\oplus 1)f_{1}^{15}({{x}_{1}},{{x}_{2}})\oplus {{v}_{1}}{{v}_{2}}{{v}_{3}}{{v}_{4}}f_{1}^{16}({{x}_{1}},{{x}_{2}}) \notag\\ 
%%%%
{{y}_{2}}=&({{v}_{1}}\oplus 1)({{v}_{2}}\oplus 1)({{v}_{3}}\oplus 1)({{v}_{4}}\oplus 1)f_{2}^{1}({{x}_{1}},{{x}_{2}})\oplus ({{v}_{1}}\oplus 1)({{v}_{2}}\oplus 1)({{v}_{3}}\oplus 1){{v}_{4}}f_{2}^{2}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus ({{v}_{1}}\oplus 1)({{v}_{2}}\oplus 1){{v}_{3}}({{v}_{4}}\oplus 1)f_{2}^{3}({{x}_{1}},{{x}_{2}})\oplus ({{v}_{1}}\oplus 1)({{v}_{2}}\oplus 1){{v}_{3}}{{v}_{4}}f_{2}^{4}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus ({{v}_{1}}\oplus 1){{v}_{2}}({{v}_{3}}\oplus 1)({{v}_{4}}\oplus 1)f_{2}^{5}({{x}_{1}},{{x}_{2}})\oplus ({{v}_{1}}\oplus 1){{v}_{2}}({{v}_{3}}\oplus 1){{v}_{4}}f_{2}^{6}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus ({{v}_{1}}\oplus 1){{v}_{2}}{{v}_{3}}({{v}_{4}}\oplus 1)f_{2}^{7}({{x}_{1}},{{x}_{2}})\oplus ({{v}_{1}}\oplus 1){{v}_{2}}{{v}_{3}}{{v}_{4}}f_{2}^{8}({{x}_{1}},{{x}_{2}})\oplus  \\ 
& \oplus {{v}_{1}}({{v}_{2}}\oplus 1)({{v}_{3}}\oplus 1)({{v}_{4}}\oplus 1)f_{2}^{9}({{x}_{1}},{{x}_{2}})\oplus {{v}_{1}}({{v}_{2}}\oplus 1)({{v}_{3}}\oplus 1){{v}_{4}}f_{2}^{10}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus {{v}_{1}}({{v}_{2}}\oplus 1){{v}_{3}}({{v}_{4}}\oplus 1)f_{2}^{11}({{x}_{1}},{{x}_{2}})\oplus {{v}_{1}}({{v}_{2}}\oplus 1){{v}_{3}}{{v}_{4}}f_{2}^{12}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus {{v}_{1}}{{v}_{2}}({{v}_{3}}\oplus 1)({{v}_{4}}\oplus 1)f_{2}^{13}({{x}_{1}},{{x}_{2}})\oplus {{v}_{1}}{{v}_{2}}({{v}_{3}}\oplus 1){{v}_{4}}f_{2}^{14}({{x}_{1}},{{x}_{2}})\oplus  \notag\\ 
& \oplus {{v}_{1}}{{v}_{2}}{{v}_{3}}({{v}_{4}}\oplus 1)f_{2}^{15}({{x}_{1}},{{x}_{2}})\oplus {{v}_{1}}{{v}_{2}}{{v}_{3}}{{v}_{4}}f_{2}^{16}({{x}_{1}},{{x}_{2}}) \notag
\end{align}

\subsection{Basic cryptographic properties}
\label{}
Table $1$ shows examples of the sets of the $\mathbf{F}^{(i)}$ modifications, which satisfy the non-linearity criteria $1$ and $3$.
\begin{table}[h]
	\caption{The examples of the sets of the $\mathbf{F}^{(i)}$  modifications}
	\centering
	\begin{tabular}{ccc}
		\hline
		\textnumero & The value of  
		 & Set of modifications \\
		 & the non-linearity of  &					\\
		 & BF $NL(f_1)- NL(f_2)- NL(f_3)$ &			\\
		\hline
		1 & 22-22-22 & a/b/d/e/f/g/h/i/a/b/c/e/f/g/e/j \\
		2 & 22-24-22 & a/b/c/e/f/g/h/j/a/d/e/f/g/h/g/i \\
		3 & 24-22-22 & a/b/d/e/f/h/i/j/a/b/c/e/g/h/g/j \\
		4 & 22-22-24 & a/b/d/e/g/h/i/j/b/d/e/f/g/h/i/g \\
		\hline
	\end{tabular}
\end{table}
\par
It is of interest to study differential characteristics of the CEs $\mathbf{F}_{2/4}$  shown in Figure 2. Next Figure 3 shows the variants of all possible differences related to the CEs of the type $\mathbf{F}_{2/4}$.
\newpage
\begin{figure}[h]
	\centering
	\includegraphics[scale=0.6]{Figure3}
	\caption{Variants of the differences for the CEs $\mathbf{F}_{2/4}$}
\end{figure}
\par
Table 2 presents the results on the investigation of the differential characteristics for CEs $\mathbf{F}_{2/4}$, defined by a set of modifications of \textnumero $4$ in Table 1. 
\begin{table}[h]
	\centering
	\caption{Differential characteristics of CEs $\mathbf{F}_{2/4}$ }
	\begin{tabular}{ccclcccl}
		\hline
		i & j & k & Pr    & i & j & k & Pr     \\
		\hline
		0 & 0 & 0 & 1     & 2 & 1 & 2 & 0.242  \\
		0 & 0 & 1 & 0     & 2 & 2 & 0 & 0.291  \\
		0 & 0 & 2 & 0     & 2 & 2 & 1 & 0.484  \\
		0 & 1 & 0 & 0     & 2 & 2 & 2 & 0.225  \\
		0 & 1 & 1 & 0.75  & 3 & 0 & 0 & 0.273  \\
		0 & 1 & 2 & 0.25  & 3 & 0 & 1 & 0.438  \\
		0 & 2 & 0 & 0     & 3 & 0 & 2 & 0.289  \\
		0 & 2 & 1 & 0.5   & 3 & 1 & 0 & 0.219  \\
		0 & 2 & 2 & 0.5   & 3 & 1 & 1 & 0.563  \\
		1 & 0 & 0 & 0.211 & 3 & 1 & 2 & 0.219  \\
		1 & 0 & 1 & 0.563 & 3 & 2 & 0 & 0.289  \\
		1 & 0 & 2 & 0.227 & 3 & 2 & 1 & 0.438  \\
		1 & 1 & 0 & 0.281 & 3 & 2 & 2 & 0.273  \\
		1 & 1 & 1 & 0.5   & 4 & 0 & 0 & 0.281  \\
		1 & 1 & 2 & 0.219 & 4 & 0 & 1 & 0.5    \\
		1 & 2 & 0 & 0.227 & 4 & 0 & 2 & 0.219  \\
		1 & 2 & 1 & 0.438 & 4 & 1 & 0 & 0.25   \\
		1 & 2 & 2 & 0.336 & 4 & 1 & 1 & 0.5    \\
		2 & 0 & 0 & 0.224 & 4 & 1 & 2 & 0.25   \\
		2 & 0 & 1 & 0.5   & 4 & 2 & 0 & 0.219  \\
		2 & 0 & 2 & 0.276 & 4 & 2 & 1 & 0.5    \\
		2 & 1 & 0 & 0.253 & 4 & 2 & 2 & 0.281  \\
		2 & 1 & 1 & 0.505 &   &   &   &        \\
		\hline
	\end{tabular}
\end{table}

\section{128-BIT BLOCK CIPHER MM-128}
\subsection{Description of the cipher MM-128}
Found variants of the CEs $\mathbf{F}_{2/4}$  satisfying the non-linearity criteria can be used for building CSPNs oriented for the use in fast block ciphers. The CEs $\mathbf{F}_{2/4}$  relating to variant $4$ in table 1, for which non-linear and differential characteristics are presented in tables 1 and 2, have been used to design the block cipher MM-128 representing eight rounds iterative block cipher with 128-bit data blocks. This cipher uses 256-bit secret key $K = (K_1, K_2, K_3, K_4)$, where $K_1, K_2, K_3, K_4$ are 64-bit subkeys, which are used directly as operands of the transformation operations. The MM-128 uses no precomputing the round keys, therefore it saves high performance of the data encryption even in the case of frequent change of keys. Such property is important for solving some practical problems of information security. 
\par
The iterated structure of the MM-128 is shown in Figure 4a, and the structure of transformation rounds is presented in figure 4b.
\newpage
\begin{figure}%
	\centering
	\parbox{3.1in}{%
	\includegraphics[scale=0.5]{Figure4}
	\caption{Iterative structure of MM-128 (a) and design of procedure Crypt (b)}%
		\label{fig:2figsA}}%
	\qquad
	\begin{minipage}{3.1in}%
	\includegraphics[scale=0.5]{Figure5}
	\caption{Schematic representation of CSPNs $\mathbf{F}_{8/48}$(a) and $\mathbf{F}^{-1}_{8/48}$(b)}%
		\label{fig:2figsB}%
	\end{minipage}%
\end{figure}%

\par
In general, the encryption procedure of the MM-128 is described as follows: $Y = T^{(e)}(X, K)$, where $X = (A, B)$ is input data block (plaintext), $ Y $ is the ciphertext block, $X, Y \in \{0, 1\}^{128}; \mathbf{T}^{(e)}$  is the transformation function; $e \in {0, 1}$ is the parameter that determines the transformation mode: encryption $(e = 0)$ or decryption $(e = 1)$. The encryption process of MM-128 is described as follows:
\begin{enumerate}
	\item[1] For $j = 1$ to $7$ do: ${(L, R)\leftarrow Crypt^{(e)}(L, R, Q_j, U_j ); (L, R) \leftarrow (R, L)}$.
	\item[2] Perform transformation: $(L, R) \leftarrow  Crypt^{(e)}(L, R, Q_8, U_8 )$.
	\item[3] Perform final transformation: ${(L, R) \leftarrow (L \oplus Q_9, R \oplus U_9)}$.
\end{enumerate}
\par 
Final transformation is performed by performing the XORing the data subblocks with corresponding subkeys. Final transformation is required to provide the identity of encryption and decryption procedures, due to which the hardware implementation cost of the MM-128 is significantly reduced. 
\par 
In the left branch of this cipher there are used two CSPNs $\mathbf{F}_{32/192}$, $\mathbf{F}^{-1}_{32/192}$  operations, where the operation $\mathbf{F}_{32/192}$ is a cascade of four CSPNs $\mathbf{F}_{8/48}$ (see Figure 5), and the operation $\mathbf{F}^{-1}_{32/192}$ is a cascade of four CSPNs $\mathbf{F}^{-1}_{8/48}$ (see Figure 5). In the right branch of the cipher there are used two CSPNs $\mathbf{F}_{64/384}$ and $\mathbf{F}^{-1}_{64/384}$ operations, where the operation $\mathbf{F}_{64/384}$ is a cascade of eight CSPNs $\mathbf{F}_{8/48}$, and the operation $\mathbf{F}^{-1}_{64/384}$ is a cascade of eight CSPNs $\mathbf{F}^{-1}_{8/48}$.
\par 
The key schedule of the algorithm MM-128 is presented in Table 3. The extension box $\mathbf{E}$ is described as follows: $\mathbf{E}(X) = (X, X^{<<2}, X^{<<4}, X^{<<6}, X^{<<8}, X^{<<10})$, where $X^{<<b}$ denotes a cyclic rotation of the vector $X = (x_1, ..., x_{32})$ to the left by $ b $ bits.
\par
The permutation involution $\mathbf{I}_1$ is described as follows: 
\begin{center}
	$(1)(2,9)(3,17)(4,25)(5,33)(6,41)(7,49)(8,57)(10)(11,18)(12,26)(13,34)(14,42)$\\
	$(15,50)(16,58)(19)(20,27)(21,35)(22,43)(23,51)(24,59)(28)(29,36)(30,44)(31,52)$\\
	$(32,60)(37)(38,45)(39,53)(40,61)(46)(47,54)(48,62)(55)(56,63)(64).$
\end{center}
\begin{table}[h]
	\centering
	\caption{Key Scheduling in MM-128}
		\begin{tabular}{cccccccccc}
		\hline
		$j=$		  & $1$   & $2$   & $3$   & $4$   & $5$   & $6$   & $7$   & $8$   & $9$ \\
		\hline
		$Q^{(e=0)}_j$ & $K_1$ & $K_2$ & $K_3$ & $K_4$ & $K_4$ & $K_1$ & $K_3$ & $K_4$ & $K_1$ \\
		$U^{(e=0)}_j$ & $K_3$ & $K_4$ & $K_2$ & $K_1$ & $K_2$ & $K_3$ & $K_2$ & $K_3$ & $K_2$ \\
		$Q^{(e=1)}_j$ & $K_1$ & $K_3$ & $K_2$ & $K_3$ & $K_2$ & $K_1$ & $K_2$ & $K_4$ & $K_3$ \\
		$U^{(e=1)}_j$ & $K_2$ & $K_4$ & $K_3$ & $K_1$ & $K_4$ & $K_4$ & $K_3$ & $K_2$ & $K_1$ \\
		\hline
		\end{tabular}
\end{table}

\subsection{Security Estimation of MM-128}
\par
Differential analysis of the MM-128 has shown that the differential characteristics $[19]-[22]$,  [26], [27] with a small number of active bits have significantly higher probability compared with the characteristics, which include the differences having larger weight. The greatest probability from the investigated differential characteristics relates to the case of the difference $(\bigtriangleup^{L_1},0)$ passes through two rounds. Indicated difference passes two rounds of MM-128 with the probability $P(2)<2^{-44} $  (see figure 6). Experimental studies have shown that the probability of a difference with one active bit after two rounds is  $\approx 2^{-47}$.
\begin{figure}[h]
	\centering
	\includegraphics[scale=0.7]{Figure6}
	\caption{Formation of the two round iterative difference $(\bigtriangleup^{L_1}, \bigtriangleup^{R_0})$ with probability $P(2)\approx 2^{-44}$}
\end{figure}
\par
In accordance with the obtained results on investigating the differential characteristics of MM-128 one can concluded that after six rounds of the encryption the MM-128 cipher is indistinguishable from a random transformation with a differential analysis.

\subsection{FPGA synthesis results and comparisons}
\par
Cipher MM-128 has a high efficiency of the hardware implementation as compared with the  block cipher AES. We have implemented MM-128 using FPGA (Xilinx Virtex-5) and iterative looping architecture. This architecture was chosen for comparative estimation of the effectiveness of the implementation of other well-known ciphers because it is suitable for performing encryption in the cipher block chaining mode that is the most frequently used one. The transition from the electronic codebook mode to Cipher Block Chaining has no effect on the performance of the encryption process in the case of iterative looping architecture, while in the case of pipelined (or partially pipelined) architecture of such transition leads to a notable decrease of the encryption rate.
\par
For execution a comparative analysis of the effectiveness of the hardware implementation of the cipher MM-128, estimated in terms of ``performance/cost" [1] there was performed simulation modeling of the hardware implementation of MM-128 and well-known block cipher AES which is currently widely used for information security. From the results shown in Table 4 one can conclude that the developed cipher is much more efficient for the considered hardware implementation in comparison with the Advanced Encryption Standard (AES).
\begin{table}[]
	\begin{tabular}{ccccccc}
		\cline{1-7}
		 \textbf{Cipher}  & \textbf{Design} & \textbf{Frequency} &  \textbf{Area}  & \underline{\textit{\textbf{Data Rate}}} & \underline{\textit{\textbf{Integral efficiency}}} & \underline{\textit{\textbf{Integral efficiency}}} \\
		                  &                 &   (\textbf{MHz})   & (\textbf{CLBs}) &             (\textbf{Gbps})             &               \textbf{Mbps/\#CLBs}                &               \textbf{Mbps/\#CLBs}                \\ \cline{1-7}
		     MM-128       &   XC5VSX240T    &       420,2        &       95        &                  6,723                  &                       70,77                       &                      168,08                       \\
		   (proposed)     &                 &                    &                 &                                         &                                                   &                                                   \\
		Eagle-128 {[}3{]} &   XC5VSX240T    &         92         &       781       &                  1,177                  &                       1,51                        &                       16,4                        \\
		     AES [6]      &    XC5VLX50     &       339,87       &       200       &                  4,35                   &                       21,75                       &                       63,97                       \\
		    AES [13]      &   XC5VSX240T    &        233         &       750       &                  119,3                  &                      159,07                       &                      681,71                       \\
		    AES [14]      &   XC5VLX110T    &       202,26       &      4448       &                  25,89                  &                       5,82                        &                       29,1                        \\
		    AES [15]      &     Virtex7     &        456         &      1222       &                   5,3                   &                       4,34                        &                       9,51                        \\
		    AES [16]      &   XC6VLX240T    &       319,29       &      2964       &                  40,87                  &                       13,79                       &                       91,12                       \\
		    AES [17]      &   XC6VLX240T    &       323,73       &       168       &                  3,45                   &                       20,53                       &                       63,43                       \\
		    AES [18]      &   XC5VLX110T    &       232,30       &      1894       &                  29,73                  &                       15,70                       &                       62,24                       \\ \cline{1-7}
	\end{tabular}
\end{table}

\section{Conclusion}
\label{}
This work focuses on advancing the DDO-based approach to the block cipher design. A new class of the $\mathbf{F}_{2/4}$-type CEs have been introduced as cryptographic primitive suitable to the design of the FPGA efficient DDO boxes.
\par 
Using the CEs $\mathbf{F}_{2/4}$ as the main building block is very attractive for designing fast block ciphers suitable for efficient hardware implementation on the base of contemporary FPGA devices (Virtex-5, Virtex-6 and Virtex-7). Their use can substantially increase the efficiency index of the hardware implementation of block ciphers, which is estimated as the ratio “encryption speed per hardware implementation cost”. In our estimations the cost of the used hardware resources are measured in number of the required logic blocks of the FPGA devices. The results of the study of non-linearity, differential and linear characteristics of the proposed CE show that the CE has better cryptographic properties than the previously applied CEs  $\mathbf{F}_{2/1}$  and $\mathbf{F}_{2/2}$. Based on the CEs $\mathbf{F}_{2/4}$ there were built CSPNs used as transformation operations of new block cipher MM-128 which provides high performance and low cost of the hardware implementation. The performed differential analysis of this 8-round iterative cipher has show that $6$ rounds of encryption provide a pseudo-transformation of the input data block. Specifying two additional rounds provides a certain ``safety margin" for MM-128 cipher. 

\section*{Acknowledgement}
\label{}
\noindent
This research was funded by the Ministry of Science and Technology (MOST) under grant KC.01.22/16-20.
%% The Appendices part is started with the command \appendix;
%% appendix sections are then done as normal sections
%% \appendix

%% \section{}
%% \label{}

%% References
%%
%% Following citation commands can be used in the body text:
%% Usage of \cite is as follows:
%%   \cite{key}         ==>>  [#]
%%   \cite[chap. 2]{key} ==>> [#, chap. 2]
%%

%% References with BibTeX database:

\bibliographystyle{IEEEtran}
%\bibliography{<your-bib-database>}

%% Authors are advised to use a BibTeX database file for their reference list.
%% The provided style IEEEtran.bst formats references is generally used.

%% For references without a BibTeX database:

 \begin{thebibliography}{4}

%% \bibitem must have the following form:
%%   \bibitem{key}...
%%

\bibitem{Moldovyan} N.A. Moldovyan and A.A. Moldovyan, ``Data-driven ciphers for fast telecommunication systems," \textsl{Auerbach Publications}. Talor $\&$ Francis Group. New York, London, 2008.

\bibitem{Moldovyan}	N.A. Moldovyan, A.A. Moldovyan, M.A. Eremeev, ``A class of data-dependent operations," \textsl{International Journal of Network Security}. vol. 2, no. 3, pp. 187-204, 2006.

\bibitem{Moldovyan}	N.A. Moldovyan, A.A. Moldovyan, M.A. Eremeev, N. Sklavos, ``New class of Cryptographic Primitives and Cipher Design for Network Security," \textsl{International Journal of Network Security}, vol. 2, no. 2, pp. 114-125, 2006.

\bibitem{Moldovyan} N.A. Moldovyan, ``On Cipher Design Based on Switchable Controlled Operations," \textsl{International Journal of Network Security}, vol. 7, no 3, pp. 404-415, 2008.

\bibitem{} \url{http://www.xilinx.com/products/}, last accessed: July 2019.

\bibitem{Muhammad} H.R. Muhammad and M.Q. Syed, ``Efficient Hardware Realization of Advanced Encryption Standard Algorithm using Virtex-5 FPGA," \textsl{International Journal of Computer Science and Network Security}, vol. 9, no. 9, pp. 59-63, 2009.

\bibitem{Minh} N.H. Minh, H.N. Duy, L.H. Dung, ``Design and estimate of a new fast block cipher for wireless communication devices," in \textsl{Proceedings 2008 International Conference on Advanced Technologies for Communications}, pp. 409-412, 2008.

\bibitem{Minh} N.H. Minh, N.T. Luan, L.H. Dung, ``KT-64: A New Block Cipher Suitable to Efficient FPGA Implementation," \textsl{International Journal of Computer Science and Network Security}, vol. 10,  no. 1,  pp. 10-18, 2010.

\bibitem{Bac} D.T. Bac, N.H. Minh, H.N. Duy, ``An Effective and Secure Cipher Based on SDDO," \textsl{International Journal of Computer Network and Information Security}, vol. 11, pp. 1–10, 2012.

\bibitem{Minh}N.H. Minh, D.T. Bac, H.N. Duy, ``New SDDO-Based Block Cipher for Wireless Sensor Network Security," \textsl{International Journal of Computer Science and Network Security 10(3)}, pp. 54–60, 2010.

\bibitem{Bac} D.T. Bac and N.H. Minh, ``High-Speed Block Cipher Algorithm Based on Hybrid Method," in \textsl{Proceedings Ubiquitous Information Technologies and Applications, Lecture Notes in Electrical Engineering}, pp. 285-291, 2014.

\bibitem{Tuan} P.M. Tuan, D.T. Bac, N.H. Minh, D.T. Nam, ``New Block Ciphers for Wireless Moblile Netwoks," in \textsl{Proceedings Advances in Information and Communication Technology. ICTA 2016. Advances in Intelligent Systems and Computing}, vol 538, pp. 393-402, 2017.

\bibitem{Henzen}L. Henzen and W. Fichtner, ``FPGA parallel-pipelined AES-GCM core for 100G ethernet applications," in \textsl{Proceedings of ESSCIRC}, pp. 202-205, 2010.

\bibitem{Reddy} R.S.S.K. Reddy and P. Praneeth, ``VLSI implementation of AES crypto processor for high throughput," International Journal of Advances in \textsl{Engineering, Science and Technology}, 6, pp. 22-26, 2011.

\bibitem{Hussain} U. Hussain, H. Jamal, ``An efficient high throughput FPGA implementation of AES for multi-gigabit protocols," in \textsl{Proceedings 10th International Conference on Frontiers of Information Technology}, pp. 215-218, 2012.

\bibitem{Wang}	Y. Wang and Y. Ha, ``FPGA-based 40.9-gbits/s masked AES with area optimization for storage area network," \textsl{IEEE Transactions on Circuits and Systems II: Express Briefs}, 60, pp. 36-40, 2013.

\bibitem{Qiang}	L. Qiang, X. Zhenyu, Y. Yuan, ``High throughput and secure advanced encryption standard on field programmable gate array with fine pipelining and enhanced key expansion," \textsl{IET Computers \& Digital Techniques}, 9, pp. 175-184, 2015.

\bibitem{Zodpe}	Harshali Zodpe and Ashok Sapkal, ``An efficient AES implementation using FPGA with enhanced security features," \textsl{Journal of King Saud University - Engineering Sciences}, pp 1-8, 2018.

\bibitem{Biham}	E. Biham and A. Shamir, ``Differential Cryptanalysis of DES-like Cryptosystems," \textsl{Journal of Cryptology}, vol. 4, no. 1, pp. 3-72, 1991.

\bibitem{Biham}	E. Biham and A. Shamir, ``Differential Cryptanalysis of the Data Encryption Standard," Springer-Verlag Berlin, Heidelberg, 1993.

\bibitem{Knudsen}	L.R. Knudsen, ``Truncated and Higher Order Differentials," \textsl{Fast Software Encryption (Lecture Notes in Computer Science no. 1008)}, Springer-Verlag, pp. 196-211, 1995.

\bibitem{Chabaud}	F. Chabaud and S. Vaudenay, ``Links Between Differential and Linear Cryptanalysis," \textsl{Advances in Cryptology - EUROCRYPT ’94 (Lecture Notes in Computer Science no. 950)}, Springer-Verlag, pp. 356-365, 1995.

\bibitem{Moldovyan}	N. Moldovyan, A. Moldovyan, Sklavos, ``Controlled Elements for Designing Ciphers Suitable to Efficient VLSI Implementation," \textsl{Telecommunication Systems}, 32, 149–163, 2006. 

\bibitem{Moldovyan}	N.A. Moldovyan, ``On cipher design based on switchable controlled operations," in \textsl{Proceedings of the International workshop, Methods, Models, and Architectures for Network Security, Lecture Notes in Computer Science}. Berlin. Springer-Verlag, vol. 2776. pp. 316-327, 2003.

\bibitem{Moldovyan}	N. Moldovyan and A. Moldovyan, ``Innovative Cryptography," \textsl{Charles River Media}, 2 edition, 2006, 425 p.
\bibitem{Pei} Z. Pei and Z. Wenying, ``Differential Cryptanalysis on Block Cipher Skinny with MILP Program," \textsl{Security and Communication Networks, Special Issue: Machine Learning for Wireless Multimedia Data Security}, vol. 2018, 11 pages, 2018.
\bibitem{ElSheikh} M. ElSheikh and A.M. Youssef, ``Related-key Differential Cryptanalysis of Full Round CRAFT," \textsl{Cryptology ePrint Archive: Report 2019/932}, 2019.
\end{thebibliography}

\section*{BIOGRAPHY OF AUTHORS}

\begin{biography}[{\includegraphics[width=3cm,height=4cm,clip,keepaspectratio]{MinhNguyenHieu}}]
\textbf{Minh Nguyen Hieu}
%% Affiliation and educational background.
is a Lecturer with the Academy of Cryptography Techniques, Hanoi, Vietnam. He received his Ph.D. from the Saint Petersburg Electrical Engineering University (2006). His research interests include cryptography, communication and network security. He has authored or co-authored more than 85 scientific articles, books chapters, reports and patents, in the areas of his research.
\end{biography}

\begin{biography}[{\includegraphics[width=3cm,height=4cm,clip,keepaspectratio]{DuyHoNgoc}}]
\textbf{Duy Ho Ngoc}
%% Affiliation and educational background.
is an expert of Cyber Command 86, Vietnam Ministry of Defence, Danang, Vietnam. His research interests include cryptography, communication and network security. He received his Ph.D. from the Saint Petersburg Electrical Engineering University (2009).
\end{biography}

\begin{biography}[{\includegraphics[width=3cm,height=4cm,clip,keepaspectratio]{CanhHoangNgoc}}]
\textbf{Canh Hoang Ngoc}
%% Affiliation and educational background.
is a Lecturer at the Thuongmai University, Hanoi, Vietnam. He received his master-degree in information systems from Le Quy Don Technical University of Vietnam in 2012. His research interests include cryptography, database, machine learning. Currently, besides teaching, he works as a network administrator and database administrator at Thuongmai University.
\end{biography}

\begin{biography}[{\includegraphics[width=3cm,height=4cm,clip,keepaspectratio]{TrungDinhPhuong}}]
\textbf{Trung Dinh Phuong}
%% Affiliation and educational background.
is a Researcher at the Vietnam Government Information Security Committee (VGISC), Hanoi, Vietnam. His research interests include network security and cryptography.
\end{biography}

\begin{biography}[{\includegraphics[width=3cm,height=4cm,clip,keepaspectratio]{ManhTranCong}}]
\textbf{Manh Tran Cong}
%% Affiliation and educational background.
got his master-degree in computer science from Le Quy Don Technical University of Vietnam in 2007. In 2017 Manh got his PhD degree from Department of Computer Science, National Defense Academy, Japan. His current research interests include network traffic classification/analysis and anomaly/malicious detection. Currently, Dr. Manh works as a researcher in Le Quy Don Technical University, Hanoi, Vietnam.
\end{biography}

\end{document}

%%
%% End of file `iaesarticle2.tex'. 