Privacy is a key concern in Location Based Applications (LBAs), especially due to their intensive use resource constrained devices in which general purpose ciphers are dicult to deploy. In this paper, we address this issue by specifying a new, faster key-schedule algorithm for the Curupira block cipher. This special-purpose cipher follows the Wide Trail Strategy (such as AES) and is tailored for resource-constrained platforms, such as sensors and mobile devices. Furthermore, we present our benchmark results for both the Curupira-1 (which adopts the original key-schedule specication) and the Curupira-2 (which adopts the new one) in appropriate testbeds.
The continuous and widespread development of context-aware applications based on Wireless Sensor Networks (WSNs) shows their potential to allow a high level of integration between computers and the physical environment. LocationBased Applications (LBAs) play an important role in this scenario, automatically adapting their behaviors to the available geo-spatial location information and the nearby sensors and devices. This way, these systems are able to provide both novel and more eective services. However, due to the sensitive nature of the data involved (both location information and other data collected by the network nodes) the security of the communication in these applications is an important concern.
Battery-powered sensor nodes and other limited platforms normally
employed in LBAs impose several constraints over the cryptographic algorithms
that can be eectively deployed. For example, commercial motes usually have a
memory size of 8-12 KB for code and 512-4096 bytes of RAM, as well as 4-16 MHz
processors [
To date, many architectures have been proposed to provide security in WSNs.
One of the most popular is TinySec [
The literature includes numerous analyses of modern cryptographic
algorithms, aiming to identify those well-suited to WSNs both in terms of security
and performance. One of the most extensive is presented by [
An alternative to address these issues is the adoption of Curupira [
In this paper, we propose a new, faster key-schedule algorithm for the Curupira algorithm and analyze its security. We also present a benchmark comparing Skipjack, AES and Curupira in relevant platforms. In order to discern between the two versions of the Curupira cipher, we write ‘ Curupira-1" for the one adopting the original key-schedule and \ Curupira-2" for the new specication. We write simply \ Curupira" when the discussion applies to both.
This document is organized as follows. We introduce basic mathematical tools and notation in section 2. An overview of the Curupira-1, including its keyschedule algorithm, is given in section 3. The second version of the key-schedule is presented in section 4, which also discuss security, performance and implementation issues for the resultant Curupira-2 block cipher. Our benchmark results are presented in section 5. We conclude in section 6. 2
The nite eld GF(2 n) will be represented as GF(2)[ x]=pn(x), where pn(x) is a primitive pentanomial of degree n over GF(2), i.e. deg( pn(x)) n. This way, all multiplications over GF(2 8) are made modulo p8(x) = x8 + x6 + x3 + x2 + 1. This choice of p8(x) incurs in a simple form for the primitive cube root of unity, c(x) = x85 mod p8(x) = x4 + x3 + x2.
An element u = u7x7 +: : :+uixi +: : :+u0 of GF(28) where ui 2 GF(2) for all i = 0; : : : ; 7, will be denoted by the numerical value u7 27 + : : : + ui 2i + : : : + u0, written in hexadecimal notation. Thus, the polynomial c(x) is written 1C, while p8(x) is written 14D. The multiplication by the polynomials x and c(x) are denoted xtimes and ctimes, respectively.
The set of all 3 n matrices over GF(2 m) is denoted by Mn. Let D and E
denote the MDS matrices (see [
3 3 2 2 1+c(x) c(x) c(x) D = 4 4 5 4 5 ; E = 4 c(x) 1+c(x) c(x) 5 :
6 6 7 c(x) c(x) 1+c(x) 3
This section gives a brief description of the Curupira-1 original specication.
For further details, we refer to [
The Curupira is a block cipher specially tailored for constrained platforms.
It operates on 96-bit data blocks (organized as M4 matrices, mapped by columns
instead of by rows) and accepts 96-, 144- or 192-bit keys, with a variable number
of rounds. The cipher round structure is similar to the one in BKSQ [
S-Box, identical to that used in Anubis [
D (the one dened in section 2), which results in intra-columnar diusion; { Permutation Layer ( ): all the bytes in the second and third rows of the block are permuted according to the rule (a) = b , bi;j = ai;i j ; 0 6 i < 3; 0 6 j < n; { Key addition Layer ( ): the round key is XORed with the block.
These transforms only involve basic operations such as table lookups, XORs and byte shifts. Thus, they can be implemented in most platforms in a very ecient way. Nonetheless, when space is available, they can be further accelerated using pre-computed tables, operating over entire columns of the block instead of byte-to-byte. The Curupira-1 key-schedule algorithm is easily invertible and follows a structure closely related to the one dictated by the Wide Trail Strategy, which assures a high diusion speed. Also, it has the advantage of being cyclical, which means that the original key is recovered after a certain number of rounds, avoiding the need of storing any intermediary sub-key during both encryption and decryption.
In this rst construction, a 48 t-bit user key K, 2 6 t 6 4 is internally represented as a matrix K 2 M2t. To generate a sub-key Kn+1 from its predecessor Kn, the sub-keys pass through three dierent transformations (illustrated in Figure 2): { Constant Addition ( (q)): a set of nonlinear constants, incrementally taken from the S-Box, are XORed with the bytes in the rst row of the round key; this way, for a 48t-bit key, the rth round and the column j, the qj(r) constant is given by: qj(0) = 0 and qj(r) = S[2t(r 1) + j], 0 6 j 6 2t; { Cyclic Shift ( ): rotates the second row one position to the left, and rotates the third row one position to the right, keeping the rst row unchanged; { Linear Diusion ( ): the round-key is left-multiplied by the matrix E (dened in section 2).
Furthermore, the round keys (r) eectively combined with the data blocks are chosen by the Key Selection algorithm r, which applies the S-Box to the rst row of the sub-key Kr and truncates it to 96 bits (i.e., the size of the block). Thus, even if the Key Selection is not part of the key evolution, it adds nonlinearity to the key-schedule. The Curupira-1 key-schedule specication is quite conservative, aiming for a high security level against related-key attacks. Thus, it is reasonable to adopt a simpler yet secure key-schedule algorithm in order to improve the overall cipher performance. That is the approach of the Curupira-2 key-schedule, which will be described in the following sections. A 48t-bits long user key K (2 6 t 6 4) is internally represented as an element K belonging to the nite eld GF(2 48t) = GF(2)=p48t(x), where p48t(x) is a pentanomial in GF(2) chosen in such a way that x8 is a primitive root of p(x). An element u(x) in this eld can be seen as a byte vector, i.e. u = (U6t 1; : : : ; U0), where U0 indicates the lesser signicant byte. This way, the cryptographic key K is directly mapped to K, starting at its most signicant byte, K6t 1.
A pentanomial representation was chosen because primitive pentanomials are
available for all values of t used by the Curupira. In fact, the use of trinomials
would result in a better performance, but unfortunately they do not exist for
elds of type GF(2 n) when n is multiple of 8 [
For reasons that will become clearer in section 4.3, the pentanomials chosen for Curupira-2 are: { p96(x) = x96 + x16 + x13 + x11 + 1; { p144(x) = x144 + x56 + x53 + x51 + 1; { p192(x) = x192 + x43 + x41 + x40 + 1: 4.2
The schedule constants are denoted q(s), where the index (s) indicates the round in which they are applied. As in the Curupira-1, the constants are directly taken from the S-box and, thus, no extra storage is needed. This time, however, they are interpreted as elements of GF(2 48t) in such a way that q(0) = 0 and, for s > 0, q(s) = (S[s 1]; 0 : : : ; 0) i.e. a single S-box output is mapped to the most signicant byte of q(s). As shown in the next section, this is a strategic position that makes each constant aect exactly 3 bytes of the round key right after its addition. 4.3
s The sub-keys are updated during the cipher operation by means of two operations: a reversible transform, @ : GF(248t) ! GF(248t); and an auto-inverse transform : GF(248t) ! GF(248t). They are dened in such a way that @(u) u x8 and, for the polynomials u = (U6t 1; : : : ; U0) and v = (V6t 1; : : : ; V0) in GF(248t) : v = (u) ,
Vi = U11 i Vi = Ui
U12+i if 0 6 i < 6t otherwise: 12;
Together with the schedule constants, these transforms compose the key evolution function r : GF(248t) ! GF(248t), dened as r(u) @ (u q(r)), in such a way that K(0) K and K(r+1) = r(K(r)).
The transform is used to ensure a greater diusion to the schedule when keys greater than 96 bits are adopted, since it combines some of the least signicant bytes of the key with the most signicant ones. Without this operation, two 144-bit keys diering only at the byte K11 would generate sub-keys whose 12 least signicant bytes would be identical for the rst 6 rounds; also, for 192bit keys, this result would hold true for the rst 12 sub-keys. As these least signicant bytes are the ones actually selected in each round, the eect of the transform is essential to assure a higher diusion speed for 144- and 192-bit keys.
Also, the @ transform is particularly interesting due to its performance, specially on resource-constrained platforms, as stated in the following theorem: Theorem 1. Let p(x) = xn + xk3 + xk2 + xk1 + 1 be a primitive pentanomial of degree n = bw over GF(2) such that k3 > k2 > k1, k3 k1 6 w, and either k3 mod w = 0 or k1 mod w = 0. Then multiplication by xw in GF(2n) = GF(2)[x]=p(x) can be implemented with no more than 5 XORs and 4 shifts on w-bit words. Moreover, if 2 2w bytes of storage are available, the cost drops to no more than 2 XORs on w-bit words and 2 table lookups.
Proof. For u = Ldn=01 (udxd) 2 GF(2n), let Ui = uwi+w 1xw 1 + : : : + uwi where i = 0; : : : ; b 1, so that u = Ub 1xw(b 1) + Ub 2xw(b 2) + : : : + U0, which for brevity we write u = (Ub 1; : : : ; U0). Then one can compute u xw as: (Ub 1xw(b 1) + Ub 2xw(b 2) + : : : + U0) xw = Ub 1xn + Ub 2xw(b 1) + : : : + U0xw = Ub 2xw(b 1) + : : : + U0xw + Ub 1(xk3 + xk2 + xk1 + 1) = (Ub 2; : : : ; U0; Ub 1) Ub 1(xk3 + xk2 + xk1 ):
Assume that k3 = w(k + 1) for some k; the case k1 mod w = 0 is handled analogously. Thus: u xw = (Ub 2; : : : ; U0; Ub 1)
Ub 1(xw + xw k3+k2 + xw k3+k1 )xwk
Since deg(Ub 1) 6 w 1 and deg(xw + xw k3+k2 + xw k3+k1 ) = w, their product is a polynomial of degree not exceeding 2 w 1, and hence it ts two w-bit words for any value of Ub 1. Besides, multiplication of this value by xwk corresponds to simply displacing it k words to the left. We can dene: T1[U ]
U (U (w k3 + k2))) (U (w k3 + k1))); T0[U ] (U (k3 k2)) (U (k3 k1));
Thus, we can write u xw = (Ub 2; : : : ; Uk T1[Ub 1]; Uk 1 T0[Ub 1]; : : : ; U0; Ub 1). The values T1 and T0 can be either computed on demand or else pre-computed and stored in two 2w-entry tables. One easily sees by direct inspection that the computational cost is that stated by the theorem.
Applying this theorem for the polynomials adopted by the Curupira-2, we can evaluate the cost of the transforms @ and its inverse: p96(x) = x96 + x16 + x13 + x11 + 1 : @ : (U11; : : : ; U0) x8 = (U10; : : : ; U1 T1[U11]; U0 @ 1 : (U11; : : : ; U0) x 8 = (U0; U11; : : : ; U2 T1[U0]; U1 T0[U11]; U11);
T0[U0]); p144(x) = x144 + x56 + x53 + x51 + 1 : @ : (U17; : : : ; U0) x8 = (U16; : : : ; U6 T1[U17]; U5 @ 1 : (U17; : : : ; U0) x 8 = (U0; U17; : : : ; U7 T1[U0]; U6 p192(x) = x192 + x48 + x45 + x43 + 1 : @ : (U23; : : : ; U0) x8 = (U22; : : : ; U5 T1[U23]; U 4 @ 1 : (U23; : : : ; U0) x 8 = (U0; U23; : : : ; U6 T1[U0]; U5 T0[U17]; : : : ; U0; U17);
T0[U0]; : : : ; U1); T0[U23]; : : : ; U0; U23):
T0[U0]; : : : ; U1):
For all key sizes, we have T0 = U (U 5) (U 3) and T1 = (U 3) (U 5).
These equations show that both @ and @ 1 transforms have the same cost and, thus, it is also valid for r and its inverse, r 1(u) (@ 1 (u)) q(r). In contrast, when compared to the key-schedule of the Curupira-1, this second schedule algorithm has one disadvantage: there is no simple way to reinitialize the key after a reduced number of rounds. However, in many applications, its higher speed both during encryption and decryption can be a much more interesting feature, compensating its lack of cyclicity. The round keys (r) 2 Mn eectively used in each round are calculated by means of the key selection function r : GF(248t) ! Mn, dened in such a way that: (r) = r (K) , ( i(;rj) = S[Ki(+r)3j ] if i = 0; i(;rj) = Ki(+r)3j otherwise:
This way, only the 12 least signicant bytes are taken by r . Also, the S-box is
applied to the bytes that will be combined with the rst row of the block, adding
nonlinearity to the key-schedule, while the bytes for the other rows are taken
directly. The whole process involved in this second version of the key-schedule
algorithm is depicted in Figure 3.
Since, for both versions of our cipher, the round structure remains the same, most
of the Curupira-1 security analysis [6, section 4] also applies to the
Curupira2: the adoption of the Wide Trail Strategy in combination with a highly
nonlinear S-Box thwarts the most well known modalities of attacks, such as linear,
dierential and integral cryptanalysis. As a consequence, no attack faster than
exhaustive search was found for more than 7 rounds of the cipher. These results
were also conrmed by third party analysis [
Weak keys are keys that result in a block cipher mapping with detectable weaknesses, which normally occurs when the nonlinear operations depend on the actual key value. This is not the case for the Curupira, where keys are applied using XOR and all nonlinearity is xed in the S-box. Also, the nonlinear round constants considerably reduce the probability of xed points in the key-schedule process, making the existence of weak keys very unlikely.
Related-key attacks exploit a known relationship between dierent unknown
keys, leading to a predictable behavior for the sub-keys generated by the key
schedule. Some of the most widespread techniques involve key dierentials and
key rotations (cf. [
Furthermore, for key lengths that are larger than the length of one round key, the existence of sets of keys that produce identical values for at least one round key is inevitable. Thus, even if the transform adds diusion power to the key-schedule and prevents the existence of trivial sets with this property, they should be more easy to nd than in the Curupira-1. Even so, it remains unclear how such keys could possibly be successfully used in a related-key attack.
As a last remark, the Curupira structure involves only simple operations
such as XORs, shifts and table lookups. As long as the running times for these
transforms are not data-dependent on the target platform, the cipher
implementation can avoid many side-channel attacks (such as timing-attacks [
The Curupira-2 algorithm is very exible in terms of implementation, oering many memory/performance trade-os. It cannot only use the same techniques developed for the Curupira-1 round functions [6, section 5]. These include the usage of a few tables with pre-computed results, but its key-schedule also allow some useful optimizations depending on resources available.
The round keys can be either computed on-demand or fully pre-calculated and stored in a table for ready access. In the rst case, the cipher requires a reduced amount of RAM memory, since only one sub-key is stored at any given time. However, as the key-schedule of Curupira-2 is not cyclic, there is no easy way to compute the rst round key from the last one. An easy way to overcome this problem is to use two arrays ka and kb to store the rst and the last subkeys, respectively: when one wants to encrypt, it suces to copy ka into kb and reuses ka memory space to create the encryption sub-keys; in the end, ka will have the last key while kb will store the rst one, assuring that both sub-keys are always available. The decryption is handled analogously. In this case, the last sub-key could be computed during the cipher initialization. We note that this strategy is only possible because the key schedule is easily invertible.
For 6t-byte keys (2 6 t 6 4), the round sub-keys can be calculated in any direction at the cost of one circular permutation, 2+6(t-2) XORs and one computation of T0 and T1. Also, T0 and T1 can be either implemented using two 256-bit tables or calculated on-the-y, taking 1 XOR + 2 shifts and 2 XORs + 2 shifts, respectively. In fact, the circular permutation does not need to be eectively implemented: the same eect can be achieved if the index corresponding to the most signicant byte of the key is stored and used as the rst byte of the key for every calculation; this way, it suces to update this index after each invocation of the @ and @ 1 operations.
Reviewing the Curupira preliminary calculations [6, section 5.1], the cost of its round function is 3 R 1 XORs, 2(R 1)=3 xtimes operations and R S-box lookups per byte. When the key-schedule and key selection are taken into account, we add at most 1 =3 S-Box lookups, 1 =3 ctimes operations and 2 XORs per key byte and per round in the Curupira-1, while this cost drops to at most 5=12 S-Box lookups, 5 =8 XORs and 1=12 computations of T0 and T1 per key byte and per round in the Curupira-2. In comparison, Skipjack takes basically 48 XORs and 16 F-table lookups per encrypted byte. Thus, supposing that the cost of any of these basic operations are approximately the same and not counting auxiliary operations not directly related to the ciphers structures (such as counter increments and key index updates), Curupira-1 with 96-bit keys and 10 rounds is about (45 + 27) =64 112:5% as Skipjack when the round keys computed on demand. On the other hand, Curupira-2 with the same keysize corresponds to (45 + 7 :5)=64 82% of Skipjack computation in the same conditions. This result should be expected for similar implementations of both ciphers on byte-oriented platforms.
Furthermore, more powerful processors (32-bit servers, for example) could
implement the s transform in a more ecient way, operating over columns
instead of bytes. Also, the multiplication by x8 can be easily implemented using
a single table that calculates T0 and T1 at the same time, an approach similar
to those adopted in some very optimized versions of AES [
In this section, we present the results of our comparison between Curupira,
Skipjack and AES in terms of processing time and memory usage. As discussed
in section 1, the motivation behind the choice of Skipjack resides in the results
presented in [
For the 8-bit versions of Curupira and Skipjack, the same C-written implementations were analyzed in both the PIC18F84908 and the Avrora simulator. Furthermore, they adopt similar interfaces in each of these platforms, in order to assure a fair comparison. They also are more speed-oriented than memoryoriented, since the consumption of energy with processing is proportional to the number of operations performed by the algorithm, and this is normally considered the most critical resource in constrained platforms, particularly in WSNs.
For the implementation running on Avrora, as recommended by its documentation, we adopted avr-objdump and avr-gcc (both GNU utilities) as compilation tools, while MPLAB IDE v7.60 and MPLAB C18 compiler are used together with the PIC microcontroller. The speed-optimized versions of each cipher, resulting from the available compiler optimizations, are the ones considered in this document. It is important to notice that, even if both platforms include indirect addressing in their instruction sets, our tests showed that the compilers were not able to fully take advantage of these instructions, resulting in less than optimal machine codes when pointers and/or matrices were used. That is the reason why we decided to evaluate two dierent programming techniques: one that uses pointers and matrices and another that uses basic-type variables more intensively, avoiding indirect addressing. While the rst approach normally results in more exible code (where the size of the keys can be more easily changed, for example), the second allows more optimized implementations with xed-size keys (enabling loop unrolling with little loss of compactness)
The implementations running on the 8-bit platforms are detailed below: CURUPIRA (8 bits) using the proposed optimizations for constrained platforms, we elected two versions of the Curupira for each scheduling algorithm: 1. Curupirac-1: complete version (meaning that it accepts all key sizes) of the Curupira-1. It requires two 256-byte tables, one for the S-Box and another for the ctimes operation and uses many pointers and matrices 2. Curupirac-2: complete version of the Curupira-2, using two 256-byte tables for the S-Box and xtimes operations. Such as Curupirac-1, it is also based on indirect addressing instructions. 3. Curupirak96 -1: Curupira-1 restricted to 96-bit keys. It uses the same tables as the Curupirac-1, but relies on basic types instead of indirect addressing instructions. 4. Curupirak96 -2: Curupira-2 restricted to 96-bit keys, using the same tables as the Curupirac-2 but relying on basic-type variables.
Skipjack (8 bits) two versions were developed according to the specication: 1. Skipjackc: relies on indirect instructions just like Curupirac-1 and Curupirac-2, providing a useful source of comparison with these ciphers. It uses a single 256-byte F-table and calculates the round keys on demand. 2. Skipjackk: adopts programming strategies similar to those present in the Curupirak96 , strongly relying on operations over basic-type variables instead of matrices and pointers. Such as the Skipjack c, it also uses a 256-byte F-table and calculates the round keys on-the-y.
For the 32-bits platform, we decided to take advantage of some highly
optimized cipher implementations publicly available. The chosen algorithms, written
in Java, were compiled and run on Netbeans IDE 5.5, using the JDK 1.6. The
details of the implementations are given below:
AES (32 bits) we adopted the implementation of Barreto [
CURUPIRA (32 bits) the optimizations in the algorithm are similar to those present in AES, specially regarding the pre-computation of the round keys and the intensive use of tables, in the same number as AES.
Skipjack (32 bits) the cipher tested is a Java adaptation of Barreto’s
algorithm [
The ciphers memory usage, for both 8-bit platforms, is presented in Table 1. This table shows that all tested versions of the Curupira take more space in memory than Skipjack, an expected result considering the higher complexity of its round function and key-schedule algorithms. Despite this dierence, the tested ciphers are both compact enough to be easily deployed in most constrained platforms, taking less than 3KB as a whole.
Both Curupira and Skipjack do not need to pre-compute the round keys and, thus, they require a reduced amount of RAM. We were not able, however, to directly measure the RAM usage with the tools available for the tested platforms. Nevertheless, due to its greater block and key size, we speculate that Curupira takes a higher amount of RAM than Skipjack. For example, when using two arrays to store the rst and the last keys, Curupira-2 would take about twice ((96 + 2 96)=(64 + 80)) the amount of RAM needed by Skipjack. These numbers remain very tiny when compared to pre-computed keys storage, though.
For the PIC microcontroller, Figure 4 shows the number of CPU cycles, per byte encrypted, of both tested ciphers. The time measured corresponds to a single encryption of random blocks using dierent keys. Even if the Curupirac implementations allow three dierent key sizes, only the 96-bit keys are depicted in this graph. Also, we explicitly distinguish the processing time required for the key scheduling and the encryption itself (as Skipjack reuses the original key cyclically, we considered it part of the encryption instead of a \key-schedule"). The gure shows that Curupirac-1 and Curupirac-2 are respectively 20% and 45% faster than Skipjack c, with the round keys computed on demand. Despite this very positive result, it should be carefully considered since the measured number of cycles includes not only the operations directly involved in the encryption process but also a non-negligible number of auxiliary ones. The inuence of these secondary operations is less expressive on both Skipjack k and Curupirak96 and, as depicted in the right side of Figure 4, Curupirak96 -2 is still 18% faster than Skipjack, while Curupirak96 -1 is 12% slower. One can see that the cost of both Curupirak96 versions in this gure are approximately the ones theoretically calculated in Section 4.6.
The results on the Avrora Simulator were slightly dierent from those in the PIC18F8490, as depicted in Figure 5. Skipjack k speed was considerably improved by this platform change, running about 30% and 4% faster than Curupirak96 -1 and Curupirak96 -2, respectively. A further analysis of the assembly codes show that these results were caused by the inuence of the compiler, which were able to apply dierent optimizations to each algorithm. In contrast, this unexpected behavior was not observed with Curupirac and Skipjackc implementations, which sustained the relative performances presented on the PIC18F8490.
The encryption speed of each cipher on the 32-bits platform, with dierent key sizes (and, thus, number of rounds), is depicted in Figure 6. It is important to point out that, as all round keys are computed at cipher initialization, there is no dierence between the encryption speeds of Curupira-1 and Curupira-2.
We obtained similar results for AES and Curupira with the same number of rounds (note the additional graph entry where, for the sake of comparison, both ciphers were tested with the same number of rounds for each key size). This is an expected result since both ciphers adopt well-known optimizations for the Wide Trail Strategy family. On the other hand, the modest result of Skipjack (about 3 times slower than the other ciphers) may seem surprising at rst sight, since its performance usually is the main factor for its adoption on constrained platforms. However, this can be explained by its 16-bit oriented operations, very attractive on constrained processors but less adapted to fully take advantage of the higher number of bits available on powerful platforms. Both AES and Curupira, though, can easily be implemented to operate over 32- and 24-bit words (columns), respectively.
The processing time involved on the ciphers key-schedules was also measured. As depicted in Figure 7, while Curupira and AES presented similar speeds, Skipjack was about 10 times slower. As this operation has to be performed a single time (at initialization), the impact on the cipher overall operation is reduced on scenarios where the keys are not frequently changed. 6
We have described a new and faster key-schedule proposal for the Curupira block cipher. As a drawback, when compared to the original specication, it has a lower level of security against related-key attacks. However, according to our security analysis, both versions of the full cipher are secure against cryptanalysis.
We also presented a benchmark comparing Curupira, Skipjack and AES in terms of performance and memory occupation, both on constrained and powerful platforms. According to the results obtained, the proposed block cipher is fast and compact, especially when using the new key-schedule presented in this paper. While Skipjack is considered a good candidate for constrained scenarios, such as LBAs dependent on sensors and low-power mobile devices, Curupira is a suitable alternative to increase the security level and potentially improve performance, introducing a reduced impact in terms of memory usage. Also, when more powerful platforms are also available, the several optimizations allowed by the Curupira can be deployed to obtain an even higher performance in the whole network.
All together, these results show that the Curupira block cipher is a useful solution for providing data encryption at low cost, being recommended for constrained-resource devices and for applications based on such platforms, such as WSNs and LBAs. We are currently working on the deployment of Curupira on a real WSN in order to evaluate its impact (especially in terms of energy consumption) in some signicant scenarios. Also, we are developing a new MAC algorithm named Marvin, designed to provide a low-cost authenticated-encryption scheme on WSNs, particularly when used in conjunction with Curupira.
According to a Brazilian legend, the Curupira is a spirit of nature and protector of the forests. It assumes the form of a boy with red hair, whose feet are turned backwards. This way, when hunters think they are on the right trail to get it, they in fact are going to the wrong direction, getting confused and lost. This should also work against cryptanalysts :-).