% Theory

@article{human-cryptanalysis,
	author = { Howard M.   Heys },
	title = {A TUTORIAL ON LINEAR AND DIFFERENTIAL CRYPTANALYSIS},
	journal = {Cryptologia},
	volume = {26},
	number = {3},
	pages = {189-221},
	year  = {2002},
	publisher = {Taylor & Francis},
	doi = {10.1080/0161-110291890885},
	
	URL = { 
	https://doi.org/10.1080/0161-110291890885
	
	},
	eprint = { 
	https://doi.org/10.1080/0161-110291890885
	
	}
}

@inproceedings{matsui1993linear,
	title={Linear cryptanalysis method for DES cipher},
	author={Matsui, Mitsuru},
	booktitle={Workshop on the Theory and Application of of Cryptographic Techniques},
	pages={386--397},
	year={1993},
	organization={Springer}
}

@ARTICLE{perfect-secrecy, 
	author={C. E. Shannon}, 
	journal={The Bell System Technical Journal}, 
	title={Communication theory of secrecy systems}, 
	year={1949}, 
	volume={28}, 
	number={4}, 
	pages={656-715}, 
	keywords={}, 
	doi={10.1002/j.1538-7305.1949.tb00928.x}, 
	ISSN={0005-8580}, 
	month={Oct},}

@InProceedings{matsuiAttack,
	author="Matsui, Mitsuru",
	editor="Desmedt, Yvo G.",
	title="The First Experimental Cryptanalysis of the Data Encryption Standard",
	booktitle="Advances in Cryptology --- CRYPTO '94",
	year="1994",
	publisher="Springer Berlin Heidelberg",
	address="Berlin, Heidelberg",
	pages="1--11",
	abstract="This paper describes an improved version of linear cryptanalysis and its application to the first successful computer experiment in breaking the full 16-round DES. The scenario is a known-plaintext attack based on two new linear approximate equations, each of which provides candidates for 13 secret key bits with negligible memory. Moreover, reliability of the key candidates is taken into consideration, which increases the success rate. As a result, the full 16-round DES is breakable with high success probability if 24.3 random plaintexts and their ciphertexts are available. The author carried out the first experimental attack using twelve computers to confirm this: he finally reached all of the 56 secret key bits in fifty days, out of which forty days were spent for generating plaintexts and their ciphertexts and only ten days were spent for the actual key search.",
	isbn="978-3-540-48658-9"
}



@techreport{junod2000linear,
	title={Linear cryptanalysis of DES},
	author={Junod, Pascal},
	year={2000}
}

@Article{Biham1991,
	author="Biham, Eli
	and Shamir, Adi",
	title="Differential cryptanalysis of DES-like cryptosystems",
	journal="Journal of Cryptology",
	year="1991",
	month="Jan",
	day="01",
	volume="4",
	number="1",
	pages="3--72",
	abstract="The Data Encryption Standard (DES) is the best known and most widely used cryptosystem for civilian applications. It was developed at IBM and adopted by the National Bureau of Standards in the mid 1970s, and has successfully withstood all the attacks published so far in the open literature. In this paper we develop a new type of cryptanalytic attack which can break the reduced variant of DES with eight rounds in a few minutes on a personal computer and can break any reduced variant of DES (with up to 15 rounds) using less than 256 operations and chosen plaintexts. The new attack can be applied to a variety of DES-like substitution/permutation cryptosystems, and demonstrates the crucial role of the (unpublished) design rules.",
	issn="1432-1378",
	doi="10.1007/BF00630563",
	url="https://doi.org/10.1007/BF00630563"
}

@phdthesis{krhovjak2009cryptographic,
	title={Cryptographic random and pseudorandom data generators},
	author={Krhovjak, Jan},
	year={2009},
	school={Masarykova univerzita, Fakulta informatiky}
}

@online{CryptoStreams,
    author = {Petr Švenda and Radka Cieslarová and Michal Hajas and Dušan Klinec and Karel Kubíček and Tamás Rózsa and Ondrej Dubovec and Jiří Novotný and Matěj Prišťák and Martin Ukrop and others},
    title = {CryptoStreams},
    subtitle = {Tool for generation of data from round-reduced cryptoprimitives},
    organization = {Centre for Research on Cryptography and Security, Masaryk University},
    year = {2017},
    doi = {10.5281/zenodo.1307318},
    url = {https://github.com/crocs-muni/CryptoStreams},
    urldate = {2018-08-20},
}

@online{EACirc,
	author = {Petr Švenda and Jiří Novotný and Michal Hajas and Dušan Klinec and Karel Kubíček and Ľubomír Obrátil and Martin Ukrop and Marek Sýs and others},
	title = {EACirc},
	subtitle = {Framework for automatic search for problem solving circuit via Evolutionary algorithms},
	organization = {Centre for Research on Cryptography and Security, Masaryk University},
	year = {2012},
	doi = {10.5281/zenodo.556524},
	url = {https://github.com/crocs-muni/eacirc},
	urldate = {2018-08-25},
}

@misc{FIPS-197,
	citeulike-article-id = {2470825},
	comment = {\url{http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf}},
	keywords = {bibtex-import},
	posted-at = {2008-03-05 09:38:14},
	priority = {2},
	title = {Federal Information Processing Standards Publication ({FIPS} 197). {Advanced Encryption Standard (AES)}},
	year = {2001}
}

@inproceedings{dinu2015felics,
	title={Felics--fair evaluation of lightweight cryptographic systems},
	author={Dinu, Daniel and Biryukov, Alex and Gro{\ss}sch{\"a}dl, Johann and Khovratovich, Dmitry and Corre, YL and Perrin, L{\'e}o},
	booktitle={NIST Workshop on Lightweight Cryptography},
	volume={128},
	year={2015}
}

@misc{Dubovec2012thesis,
	AUTHOR = "DUBOVEC, Ondrej",
	TITLE = "Automatické hledání závislostí u kandidátních hašovacích funkcí SHA-3 [online]",
	YEAR = "2012 [cit. 2018-12-10]",
	TYPE = "Bachelor's thesis",
	SCHOOL = "Masaryk University, Faculty of Informatics, Brno",
	SUPERVISOR = "Petr Švenda",
	URL = "https://is.muni.cz/th/qyej1/",
}

@MastersThesis{Pristak2012thesis,
	AUTHOR = "PRIŠŤÁK, Matej",
	TITLE = "Automatické hledání závislostí u proudových šifer projektu eStream [online]",
	YEAR = "2012 [cit. 2018-12-10]",
	TYPE = "Master's thesis",
	SCHOOL = "Masaryk University, Faculty of Informatics, Brno",
	SUPERVISOR = "Petr Švenda",
	URL = "https://is.muni.cz/th/mwbpn/",
}

@MastersThesis{Ukrop2016thesis,
	AUTHOR = "UKROP, Martin",
	TITLE = "Randomness analysis in authenticated encryption systems [online]",
	YEAR = "2016 [cit. 2018-12-10]",
	TYPE = "Master's thesis",
	SCHOOL = "Masaryk University, Faculty of Informatics, Brno",
	SUPERVISOR = "Petr Švenda",
	URL = "https://is.muni.cz/th/rcl3c/",
}

@misc{Rozsa2018thesis,
	AUTHOR = "RÓZSA, Tamás",
	TITLE = "Kvalita výstupu pseudonáhodných kryptografických funkcí [online]",
	YEAR = "2018 [cit. 2018-12-10]",
	TYPE = "Bachelor's thesis",
	SCHOOL = "Masaryk University, Faculty of Informatics, Brno",
	SUPERVISOR = "Petr Švenda",
	URL = "https://is.muni.cz/th/mdvro/",
}

@MastersThesis{Kubicek2017thesis,
	AUTHOR = "KUBÍČEK, Karel",
	TITLE = "Optimisation heuristics in randomness testing [online]",
	YEAR = "2017 [cit. 2018-12-10]",
	TYPE = "Master's thesis",
	SCHOOL = "Masaryk University, Faculty of Informatics, Brno",
	SUPERVISOR = "Petr Švenda",
	URL = "https://is.muni.cz/th/bhio1/",
}

@online{caesar-competition,
    author = {{CAESAR committee}},
    title = {CAESAR: Competition for Authenticated Encryption: Security, Applicability, and Robustness},
    year = {2013},
    url = {http://competitions.cr.yp.to/caesar-call.html},
    urldate = {2018-09-02},
}

@article{l2007testu01,
    author = {Pierre L'Ecuyer and Richard Simard},
    title = {TestU01: A C Library for Empirical Testing of Random Number Generators},
    journal = {ACM Transactions on Mathematical Software (TOMS)},
    issue_date = {August 2007},
    volume = {33},
    number = {4},
    month = aug,
    year = {2007},
    issn = {0098-3500},
    articleno = {22},
    doi = {10.1145/1268776.1268777},
    publisher = {ACM},
    address = {New York, NY, USA},
    %url = {http://doi.acm.org/10.1145/1268776.1268777},
    %urldate = {2017-05-20},
}

@MISC{LEcuyer07testu01,
    author = {Pierre L'Ecuyer and Richard Simard},
    title = {TestU01: A Software Library in ANSI C for Empirical Testing of Random Number Generators },
    year = {2007},
    url = {http://simul.iro.umontreal.ca/testu01/guideshorttestu01.pdf}
}

@online{CryptoStreams-wiki,
    author = {Karel Kubíček and others},
    title = {EACirc -- documentation wiki},
    subtitle = {Streams for data manipulation},
    organization = {Centre for Research on Cryptography and Security, Masaryk University},
    year = {2018},
    url = {https://github.com/crocs-muni/CryptoStreams/wiki/Streams},
    urldate = {2018-09-11},
}

@inproceedings{booltest-secrypt2017,
	author = {Marek Sýs and Dušan Klinec and Petr Švenda},
	title = {The Efficient Randomness Testing using Boolean Functions},
	booktitle = {14th International Conference on Security and Cryptography (Secrypt'2017)},
	year = {2017},
	pages = {92--103},
	isbn = {978-989-758-259-2},
	publisher = {SCITEPRESS}
}

@book{sheskin2003handbook,
	title={Handbook of parametric and nonparametric statistical procedures},
	author={Sheskin, David J},
	year={2003},
	publisher={crc Press}
}

@online{pcgGen,
    author = {M.E. O'Neill},
    year = {2015},
    title = {{PCG, A Family of Better Random Number Generators}},
    subtitle = {{PCG is a simple and fast statistically good PRNG}},
    url = {http://www.pcg-random.org/},
    urldate = {2018-09-16},
}

@article{daemen1999aes,
	title={AES proposal: Rijndael},
	author={Daemen, Joan and Rijmen, Vincent},
	year={1999}
}

@article{L-Ecuyer:LCG,
	author = {L'Ecuyer, Pierre},
	title = {Tables of Linear Congruential Generators of Different Sizes and Good Lattice Structure},
	journal = {Math. Comput.},
	issue_date = {Jan. 1999},
	volume = {68},
	number = {225},
	month = jan,
	year = {1999},
	issn = {0025-5718},
	pages = {249--260},
	numpages = {12},
	url = {http://dx.doi.org/10.1090/S0025-5718-99-00996-5},
	doi = {10.1090/S0025-5718-99-00996-5},
	acmid = {307102},
	publisher = {American Mathematical Society},
	address = {Boston, MA, USA},
	keywords = {lattice structure, linear congruential, random number generation, spectral test},
} 

@article{L_Ecuyer:MRG,
	author = {L'Ecuyer, Pierre and Blouin, Fran\c{c}ois and Couture, Raymond},
	title = {A Search for Good Multiple Recursive Random Number Generators},
	journal = {ACM Trans. Model. Comput. Simul.},
	issue_date = {April 1993},
	volume = {3},
	number = {2},
	month = apr,
	year = {1993},
	issn = {1049-3301},
	pages = {87--98},
	numpages = {12},
	url = {http://doi.acm.org/10.1145/169702.169698},
	doi = {10.1145/169702.169698},
	acmid = {169698},
	publisher = {ACM},
	address = {New York, NY, USA},
	keywords = {full period, lattice structure, linear congruential, multiple recursive generators, portable code, spectral test},
} 

@ARTICLE{RePEc:jss:jstsof:v:008:i14,
	title = {Xorshift RNGs},
	author = {Marsaglia, George},
	year = {2003},
	journal = {Journal of Statistical Software},
	volume = {008},
	number = {i14},
	abstract = { Description of a class of simple, extremely fast random number generators (RNGs) with periods 2k - 1 for k = 32, 64, 96, 128, 160,'2. These RNGs seem to pass tests of randomness very well.},
	url = {https://EconPapers.repec.org/RePEc:jss:jstsof:v:008:i14}
}

@misc{jakobsson2014theory,
	title={Theory, methods and tools for statistical testing of pseudo and quantum random number generators},
	author={Jakobsson, Krister Sune},
	year={2014}
}

@article{marsaglia1991,
	author = "Marsaglia, George and Zaman, Arif",
	doi = "10.1214/aoap/1177005878",
	fjournal = "The Annals of Applied Probability",
	journal = "Ann. Appl. Probab.",
	month = "08",
	number = "3",
	pages = "462--480",
	publisher = "The Institute of Mathematical Statistics",
	title = "A New Class of Random Number Generators",
	url = "https://doi.org/10.1214/aoap/1177005878",
	volume = "1",
	year = "1991"
}


@article{Matsumoto:1998:MTE:272991.272995,
	author = {Matsumoto, Makoto and Nishimura, Takuji},
	title = {Mersenne Twister: A 623-dimensionally Equidistributed Uniform Pseudo-random Number Generator},
	journal = {ACM Trans. Model. Comput. Simul.},
	issue_date = {Jan. 1998},
	volume = {8},
	number = {1},
	month = jan,
	year = {1998},
	issn = {1049-3301},
	pages = {3--30},
	numpages = {28},
	url = {http://doi.acm.org/10.1145/272991.272995},
	doi = {10.1145/272991.272995},
	acmid = {272995},
	publisher = {ACM},
	address = {New York, NY, USA},
	keywords = {k-distribution, m-sequences, GFSR, MT19937, Mersenne primes, Mersenne twister, TGFSR, finite fields, incomplete array, inversive-decimation method, multiple-recursive matrix method, primitive polynomials, random number generation, tempering},
} 

@article{matsumoto1992twisted,
	title={Twisted GFSR generators},
	author={Matsumoto, Makoto and Kurita, Yoshiharu},
	journal={ACM Transactions on Modeling and Computer Simulation (TOMACS)},
	volume={2},
	number={3},
	pages={179--194},
	year={1992},
	publisher={ACM}
}
@misc{schneier1996applied,
	title={Applied cryptography-protocols, algorithms, and source code in C},
	author={Schneier, Bruce and others},
	year={1996},
	publisher={Wiley New York}
}

@INPROCEEDINGS{Keller05nist-recommendedrandom,
	author = {Sharon S. Keller},
	title = {NIST-Recommended Random Number Generator Based on},
	booktitle = {ANSI X9.31. Appendix A.2.4 Using the 3-Key Triple DES and AES Algorithms},
	year = {2005}
}

@misc{ansi1985american,
	title={American National Standard for Financial Institution Key Management},
	author={ANSI X9. 17},
	year={1985},
	publisher={American Bankers Association New York}
}

@Inbook{Canteaut2005,
	author="Canteaut, Anne",
	editor="van Tilborg, Henk C. A.",
	title="Linear Feedback Shift Register",
	bookTitle="Encyclopedia of Cryptography and Security",
	year="2005",
	publisher="Springer US",
	address="Boston, MA",
	pages="355--358",
	isbn="978-0-387-23483-0",
	doi="10.1007/0-387-23483-7_235",
	url="https://doi.org/10.1007/0-387-23483-7_235"
}

@inproceedings{Petit:2008:BCB:1368310.1368322,
	author = {Petit, Christophe and Standaert, Fran\c{c}ois-Xavier and Pereira, Olivier and Malkin, Tal G. and Yung, Moti},
	title = {A Block Cipher Based Pseudo Random Number Generator Secure Against Side-channel Key Recovery},
	booktitle = {Proceedings of the 2008 ACM Symposium on Information, Computer and Communications Security},
	series = {ASIACCS '08},
	year = {2008},
	isbn = {978-1-59593-979-1},
	location = {Tokyo, Japan},
	pages = {56--65},
	numpages = {10},
	url = {http://doi.acm.org/10.1145/1368310.1368322},
	doi = {10.1145/1368310.1368322},
	acmid = {1368322},
	publisher = {ACM},
	address = {New York, NY, USA},
}

@inproceedings{Impagliazzo:1989:PGO:73007.73009,
	author = {Impagliazzo, R. and Levin, L. A. and Luby, M.},
	title = {Pseudo-random Generation from One-way Functions},
	booktitle = {Proceedings of the Twenty-first Annual ACM Symposium on Theory of Computing},
	series = {STOC '89},
	year = {1989},
	isbn = {0-89791-307-8},
	location = {Seattle, Washington, USA},
	pages = {12--24},
	numpages = {13},
	url = {http://doi.acm.org/10.1145/73007.73009},
	doi = {10.1145/73007.73009},
	acmid = {73009},
	publisher = {ACM},
	address = {New York, NY, USA},
}

@article{practical-cryptanalysis,
	author = {Schoenmakers, Berry and Sidorenko, Andrey},
	year = {2006},
	month = {01},
	pages = {190},
	title = {Cryptanalysis of the Dual Elliptic Curve Pseudorandom Generator.},
	volume = {2006},
	journal = {IACR Cryptology ePrint Archive}
}

@book{barker2007recommendation,
	title={Recommendation for random number generation using deterministic random bit generators (revised)},
	author={Barker, Elaine B and Kelsey, John Michael},
	year={2007},
	publisher={US Department of Commerce, Technology Administration, National Institute of Standards and Technology, Computer Security Division, Information Technology Laboratory}
}

@techreport{Dworkin:2001:SER:2206247,
	author = {Dworkin, Morris J.},
	title = {SP 800-38A 2001 Edition. Recommendation for Block Cipher Modes of Operation: Methods and Techniques},
	year = {2001},
	publisher = {National Institute of Standards \& Technology},
	address = {Gaithersburg, MD, United States},
}

@inproceedings{kelsey1998cryptanalytic,
	title={Cryptanalytic attacks on pseudorandom number generators},
	author={Kelsey, John and Schneier, Bruce and Wagner, David and Hall, Chris},
	booktitle={International Workshop on Fast Software Encryption},
	pages={168--188},
	year={1998},
	organization={Springer}
}

@misc{wiki:swc,
	author = "{Wikipedia contributors}",
	title = "Subtract with carry --- {Wikipedia}{,} The Free Encyclopedia",
	year = "2016",
	howpublished = "\url{https://en.wikipedia.org/w/index.php?title=Subtract_with_carry&oldid=719857744}",
	note = "[Online; accessed 28-September-2018]"
}

@online{dieharder,
	author = {Robert G. Brown},
	organization = {Duke University Physics Department},
	title = {Dieharder: A Random Number Test Suite},
	year = {2004},
	version = {3.31.1},
	url = {http://www.phy.duke.edu/~rgb/General/dieharder.php},
	urldate = {2018-10-07},
}

@online{diehard,
	author = {George Marsaglia},
	organization = {Floridan State University},
	title = {Diehard Battery of Tests of Randomness},
	year = {1995},
	url = {https://web.archive.org/web/20120102192622/www.stat.fsu.edu/pub/diehard/},
	urldate = {2018-10-07},
}

@online{nist-sts,
	author = {{National Institute for Standards and Technology}},
	title = {Statistical Test Suite},
	version = {2.1.1},
	year = {1997},
	url = {https://csrc.nist.gov/projects/random-bit-generation/documentation-and-software},
	urldate = {2017-05-19},
}

@techreport{nist-explanation,
	author = {Bassham,III, Lawrence E. and Rukhin, Andrew L. and Soto, Juan and Nechvatal, James R. and Smid, Miles E. and Barker, Elaine B. and Leigh, Stefan D. and Levenson, Mark and Vangel, Mark and Banks, David L. and Heckert, Nathanael Alan and Dray, James F. and Vo, San},
	title = {SP 800-22 Rev. 1a. A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications},
	year = {2010},
	publisher = {National Institute of Standards \& Technology},
	address = {Gaithersburg, MD, United States},
} 

@MISC{NIST140-2,
	title = {FIPS PUB 140-2, Security Requirements for Cryptographic Modules},
	note = {U.S.Department of Commerce/National Institute of Standards and Technology},
	year = {2002}
}

@MastersThesis{Obratil2017thesis,
	AUTHOR = "OBRÁTIL, Ľubomír",
	TITLE = "The automated testing of randomness with multiple statistical batteries [online]",
	YEAR = "2017 [cit. 2018-12-10]",
	TYPE = "Master's thesis",
	SCHOOL = "Masaryk University, Faculty of Informatics, Brno",
	SUPERVISOR = "Petr Švenda",
	URL = "https://is.muni.cz/th/uepbs/",
}

@article{Sys:2016:A9O:2988516.2988228,
	author = {Sýs, Marek and Říha, Zdeněk and Matyáš, Vashek},
	title = {Algorithm 970: Optimizing the NIST Statistical Test Suite and the Berlekamp-Massey Algorithm},
	journal = {ACM Trans. Math. Softw.},
	issue_date = {January 2017},
	volume = {43},
	number = {3},
	month = dec,
	year = {2016},
	issn = {0098-3500},
	pages = {27:1--27:11},
	articleno = {27},
	numpages = {11},
	url = {http://doi.acm.org/10.1145/2988228},
	doi = {10.1145/2988228},
	acmid = {2988228},
	publisher = {ACM},
	address = {New York, NY, USA},
	keywords = {Berlekamp-Massey algorithm, NIST STS, statistical randomness testing},
} 

% Lightweight crypto

@misc{cryptoeprint:2014:386,
	author = {Nicky Mouha and Bart Mennink and Anthony Van Herrewege and Dai Watanabe and Bart Preneel and Ingrid Verbauwhede},
	title = {Chaskey: An Efficient MAC Algorithm for 32-bit Microcontrollers},
	howpublished = {Cryptology ePrint Archive, Report 2014/386},
	year = {2014},
	note = {\url{https://eprint.iacr.org/2014/386}},
}

@inproceedings{grosso2014ls,
	title={LS-designs: Bitslice encryption for efficient masked software implementations},
	author={Grosso, Vincent and Leurent, Ga{\"e}tan and Standaert, Fran{\c{c}}ois-Xavier and Var{\i}c{\i}, Kerem},
	booktitle={International Workshop on Fast Software Encryption},
	pages={18--37},
	year={2014},
	organization={Springer}
}

@InProceedings{10.1007/11894063_4,
	author="Hong, Deukjo
	and Sung, Jaechul
	and Hong, Seokhie
	and Lim, Jongin
	and Lee, Sangjin
	and Koo, Bon-Seok
	and Lee, Changhoon
	and Chang, Donghoon
	and Lee, Jesang
	and Jeong, Kitae
	and Kim, Hyun
	and Kim, Jongsung
	and Chee, Seongtaek",
	editor="Goubin, Louis
	and Matsui, Mitsuru",
	title="HIGHT: A New Block Cipher Suitable for Low-Resource Device",
	booktitle="Cryptographic Hardware and Embedded Systems - CHES 2006",
	year="2006",
	publisher="Springer Berlin Heidelberg",
	address="Berlin, Heidelberg",
	pages="46--59",
	abstract="In this paper, we propose a new block cipher HIGHT with 64-bit block length and 128-bit key length. It provides low-resource hardware implementation, which is proper to ubiquitous computing device such as a sensor in USN or a RFID tag. HIGHT does not only consist of simple operations to be ultra-light but also has enough security as a good encryption algorithm. Our hardware implementation of HIGHT requires 3048 gates on 0.25 $\mu$m technology.",
	isbn="978-3-540-46561-4"
}

@InProceedings{10.1007/978-3-642-21554-4_19,
	author="Wu, Wenling
	and Zhang, Lei",
	editor="Lopez, Javier
	and Tsudik, Gene",
	title="LBlock: A Lightweight Block Cipher",
	booktitle="Applied Cryptography and Network Security",
	year="2011",
	publisher="Springer Berlin Heidelberg",
	address="Berlin, Heidelberg",
	pages="327--344",
	abstract="In this paper, we propose a new lightweight block cipher called LBlock. Similar to many other lightweight block ciphers, the block size of LBlock is 64-bit and the key size is 80-bit. Our security evaluation shows that LBlock can achieve enough security margin against known attacks, such as differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis and related-key attacks etc. Furthermore, LBlock can be implemented efficiently not only in hardware environments but also in software platforms such as 8-bit microcontroller. Our hardware implementation of LBlock requires about 1320 GE on 0.18 $\mu$m technology with a throughput of 200 Kbps at 100 KHz. The software implementation of LBlock on 8-bit microcontroller requires about 3955 clock cycles to encrypt a plaintext block.",
	isbn="978-3-642-21554-4"
}

@inproceedings{Hong2013LEAA1,
	title={LEA: A 128-Bit Block Cipher for Fast Encryption on Common Processors},
	author={Deukjo Hong and Jung-Keun Lee and Dong-Chan Kim and Daesung Kwon and Kwon Ho Ryu and Donggeon Lee},
	booktitle={WISA},
	year={2013}
}

@inproceedings{Guo:2011:LBC:2044928.2044958,
	author = {Guo, Jian and Peyrin, Thomas and Poschmann, Axel and Robshaw, Matt},
	title = {The LED Block Cipher},
	booktitle = {Proceedings of the 13th International Conference on Cryptographic Hardware and Embedded Systems},
	series = {CHES'11},
	year = {2011},
	isbn = {978-3-642-23950-2},
	location = {Nara, Japan},
	pages = {326--341},
	numpages = {16},
	url = {http://dl.acm.org/citation.cfm?id=2044928.2044958},
	acmid = {2044958},
	publisher = {Springer-Verlag},
	address = {Berlin, Heidelberg},
	keywords = {AES, RFID tag, block cipher, lightweight},
} 

@InProceedings{10.1007/978-3-642-23951-9_23,
	author="Shibutani, Kyoji
	and Isobe, Takanori
	and Hiwatari, Harunaga
	and Mitsuda, Atsushi
	and Akishita, Toru
	and Shirai, Taizo",
	editor="Preneel, Bart
	and Takagi, Tsuyoshi",
	title="Piccolo: An Ultra-Lightweight Blockcipher",
	booktitle="Cryptographic Hardware and Embedded Systems -- CHES 2011",
	year="2011",
	publisher="Springer Berlin Heidelberg",
	address="Berlin, Heidelberg",
	pages="342--357",
	abstract="We propose a new 64-bit blockcipher Piccolo supporting 80 and 128-bit keys. Adopting several novel design and implementation techniques, Piccolo achieves both high security and notably compact implementation in hardware. We show that Piccolo offers a sufficient security level against known analyses including recent related-key differential attacks and meet-in-the-middle attacks. In our smallest implementation, the hardware requirements for the 80 and the 128-bit key mode are only 683 and 758 gate equivalents, respectively. Moreover, Piccolo requires only 60 additional gate equivalents to support the decryption function due to its involution structure. Furthermore, its efficiency on the energy consumption which is evaluated by energy per bit is also remarkable. Thus, Piccolo is one of the competitive ultra-lightweight blockciphers which are suitable for extremely constrained environments such as RFID tags and sensor nodes.",
	isbn="978-3-642-23951-9"
}

@InProceedings{10.1007/978-3-662-44371-2_4,
	author="Albrecht, Martin R.
	and Driessen, Benedikt
	and Kavun, Elif Bilge
	and Leander, Gregor
	and Paar, Christof
	and Yal{\c{c}}{\i}n, Tolga",
	editor="Garay, Juan A.
	and Gennaro, Rosario",
	title="Block Ciphers -- Focus on the Linear Layer (feat. PRIDE)",
	booktitle="Advances in Cryptology -- CRYPTO 2014",
	year="2014",
	publisher="Springer Berlin Heidelberg",
	address="Berlin, Heidelberg",
	pages="57--76",
	abstract="The linear layer is a core component in any substitution-permutation network block cipher. Its design significantly influences both the security and the efficiency of the resulting block cipher. Surprisingly, not many general constructions are known that allow to choose trade-offs between security and efficiency. Especially, when compared to Sboxes, it seems that the linear layer is crucially understudied. In this paper, we propose a general methodology to construct good, sometimes optimal, linear layers allowing for a large variety of trade-offs. We give several instances of our construction and on top underline its value by presenting a new block cipher. PRIDE is optimized for 8-bit micro-controllers and significantly outperforms all academic solutions both in terms of code size and cycle count.",
	isbn="978-3-662-44371-2"
}


@InProceedings{10.1007/978-3-642-34961-4_14,
	author="Borghoff, Julia
	and Canteaut, Anne
	and G{\"u}neysu, Tim
	and Kavun, Elif Bilge
	and Knezevic, Miroslav
	and Knudsen, Lars R.
	and Leander, Gregor
	and Nikov, Ventzislav
	and Paar, Christof
	and Rechberger, Christian
	and Rombouts, Peter
	and Thomsen, S{\o}ren S.
	and Yal{\c{c}}{\i}n, Tolga",
	editor="Wang, Xiaoyun
	and Sako, Kazue",
	title="PRINCE -- A Low-Latency Block Cipher for Pervasive Computing Applications",
	booktitle="Advances in Cryptology -- ASIACRYPT 2012",
	year="2012",
	publisher="Springer Berlin Heidelberg",
	address="Berlin, Heidelberg",
	pages="208--225",
	abstract="This paper presents a block cipher that is optimized with respect to latency when implemented in hardware. Such ciphers are desirable for many future pervasive applications with real-time security needs. Our cipher, named PRINCE, allows encryption of data within one clock cycle with a very competitive chip area compared to known solutions. The fully unrolled fashion in which such algorithms need to be implemented calls for innovative design choices. The number of rounds must be moderate and rounds must have short delays in hardware. At the same time, the traditional need that a cipher has to be iterative with very similar round functions disappears, an observation that increases the design space for the algorithm. An important further requirement is that realizing decryption and encryption results in minimum additional costs. PRINCE is designed in such a way that the overhead for decryption on top of encryption is negligible. More precisely for our cipher it holds that decryption for one key corresponds to encryption with a related key. This property we refer to as $\alpha$-reflection is of independent interest and we prove its soundness against generic attacks.",
	isbn="978-3-642-34961-4"
}

@InProceedings{10.1007/3-540-60590-8_7,
	author="Rivest, Ronald L.",
	editor="Preneel, Bart",
	title="The RC5 encryption algorithm",
	booktitle="Fast Software Encryption",
	year="1995",
	publisher="Springer Berlin Heidelberg",
	address="Berlin, Heidelberg",
	pages="86--96",
	abstract="This document describes the RC5 encryption algorithm, a fast symmetric block cipher suitable for hardware or software implementations. A novel feature of RC5 is the heavy use of data-dependent rotations. RC5 has a variable word size, a variable number of rounds, and a variable-length secret key. The encryption and decryption algorithms are exceptionally simple.",
	isbn="978-3-540-47809-6"
}

@Article{Zhang2015,
	author="Zhang, WenTao
	and Bao, ZhenZhen
	and Lin, DongDai
	and Rijmen, Vincent
	and Yang, BoHan
	and Verbauwhede, Ingrid",
	title="RECTANGLE: a bit-slice lightweight block cipher suitable for multiple platforms",
	journal="Science China Information Sciences",
	year="2015",
	month="Dec",
	day="01",
	volume="58",
	number="12",
	pages="1--15",
	abstract="In this paper, we propose a new lightweight block cipher named RECTANGLE. The main idea of the design of RECTANGLE is to allow lightweight and fast implementations using bit-slice techniques. RECTANGLE uses an SP-network. The substitution layer consists of 16 4{\texttimes}4 S-boxes in parallel. The permutation layer is composed of 3 rotations. As shown in this paper, RECTANGLE offers great performance in both hardware and software environment, which provides enough flexibility for different application scenario. The following are 3 main advantages of RECTANGLE. First, RECTANGLE is extremely hardware-friendly. For the 80-bit key version, a one-cycle-per-round parallel implementation only needs 1600 gates for a throughput of 246 Kbits/s at 100 kHz clock and an energy efficiency of 3.0 pJ/bit. Second, RECTANGLE achieves a very competitive software speed among the existing lightweight block ciphers due to its bit-slice style. Using 128-bit SSE instructions, a bit-slice implementation of RECTANGLE reaches an average encryption speed of about 3.9 cycles/byte for messages around 3000 bytes. Last but not least, we propose new design criteria for the RECTANGLE S-box. Due to our careful selection of the S-box and the asymmetric design of the permutation layer, RECTANGLE achieves a very good security-performance tradeoff. Our extensive and deep security analysis shows that the highest number of rounds that we can attack, is 18 (out of 25).",
	issn="1869-1919",
	doi="10.1007/s11432-015-5459-7",
	url="https://doi.org/10.1007/s11432-015-5459-7"
}

@InProceedings{10.1007/978-3-319-29078-2_4,
	author="Baysal, Adnan
	and {\c{S}}ahin, S{\"u}hap",
	editor="G{\"u}neysu, Tim
	and Leander, Gregor
	and Moradi, Amir",
	title="RoadRunneR: A Small and Fast Bitslice Block Cipher for Low Cost 8-Bit Processors",
	booktitle="Lightweight Cryptography for Security and Privacy",
	year="2016",
	publisher="Springer International Publishing",
	address="Cham",
	pages="58--76",
	abstract="Designing block ciphers targeting resource constrained 8-bit CPUs is a challenging problem. There are many recent lightweight ciphers designed for better performance in hardware. On the other hand, most software efficient lightweight ciphers either lack a security proof or have a low security margin. To fill the gap, we present RoadRunneR which is an efficient block cipher in 8-bit software, and its security is provable against differential and linear attacks. RoadRunneR has lowest code size in Atmel's ATtiny45, except NSA's design SPECK, which has no security proof. Moreover, we propose a new metric for the fair comparison of block ciphers. This metric, called ST/A, is the first metric to use key length as a parameter to rank ciphers of different key length in a fair way. By using ST/A and other metrics in the literature, we show that RoadRunneR is competitive among existing ciphers on ATtiny45.",
	isbn="978-3-319-29078-2"
}

@InProceedings{10.1007/978-3-662-53887-6_18,
	author="Dinu, Daniel
	and Perrin, L{\'e}o
	and Udovenko, Aleksei
	and Velichkov, Vesselin
	and Gro{\ss}sch{\"a}dl, Johann
	and Biryukov, Alex",
	editor="Cheon, Jung Hee
	and Takagi, Tsuyoshi",
	title="Design Strategies for ARX with Provable Bounds: Sparx and LAX",
	booktitle="Advances in Cryptology -- ASIACRYPT 2016",
	year="2016",
	publisher="Springer Berlin Heidelberg",
	address="Berlin, Heidelberg",
	pages="484--513",
	abstract="We present, for the first time, a general strategy for designing ARX symmetric-key primitives with provable resistance against single-trail differential and linear cryptanalysis. The latter has been a long standing open problem in the area of ARX design. The wide-trail design strategy (WTS), that is at the basis of many S-box based ciphers, including the AES, is not suitable for ARX designs due to the lack of S-boxes in the latter. In this paper we address the mentioned limitation by proposing the long trail design strategy (LTS) -- a dual of the WTS that is applicable (but not limited) to ARX constructions. In contrast to the WTS, that prescribes the use of small and efficient S-boxes at the expense of heavy linear layers with strong mixing properties, the LTS advocates the use of large (ARX-based) S-Boxes together with sparse linear layers. With the help of the so-called long-trail argument, a designer can bound the maximum differential and linear probabilities for any number of rounds of a cipher built according to the LTS.",
	isbn="978-3-662-53887-6"
}

@article{twine,
	author = {Suzaki, T and Minematsu, K and Morioka, Sumio and Kobayashi, Eita},
	year = {2011},
	month = {01},
	pages = {},
	title = {TWINE: A Lightweight, Versatile Block Cipher},
	booktitle = {ECRYPT Workshop on Lightweight Cryptography}
}


% Lightweight crypto attacks

@misc{cryptoeprint:2015:968,
	author = {Gaëtan Leurent},
	title = {Improved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning},
	howpublished = {Cryptology ePrint Archive, Report 2015/968},
	year = {2015},
	note = {\url{https://eprint.iacr.org/2015/968}},
}

@InProceedings{pride-attack,
	author="Yang, Qianqian
	and Hu, Lei
	and Sun, Siwei
	and Qiao, Kexin
	and Song, Ling
	and Shan, Jinyong
	and Ma, Xiaoshuang",
	editor="Lopez, Javier
	and Wu, Yongdong",
	title="Improved Differential Analysis of Block Cipher PRIDE",
	booktitle="Information Security Practice and Experience",
	year="2015",
	publisher="Springer International Publishing",
	address="Cham",
	pages="209--219",
	abstract="In CRYPTO 2014 Albrecht et al. brought in a 20-round iterative lightweight block cipher PRIDE which is based on a good linear layer for achieving a tradeoff between security and efficiency. A recent analysis is presented by Zhao et al. Inspired by their work, we use an automatic search method to find out 56 iterative differential characteristics of PRIDE, containing 24 1-round iterative characteristics, based on three of them we construct a 15-round differential and perform a differential attack on the 19-round PRIDE, with data, time and memory complexity of 262, 263 and 271 respectively.",
	isbn="978-3-319-17533-1"
}

@InProceedings{led-attack,
	author="Mendel, Florian
	and Rijmen, Vincent
	and Toz, Deniz
	and Var{\i}c{\i}, Kerem",
	editor="Wang, Xiaoyun
	and Sako, Kazue",
	title="Differential Analysis of the LED Block Cipher",
	booktitle="Advances in Cryptology -- ASIACRYPT 2012",
	year="2012",
	publisher="Springer Berlin Heidelberg",
	address="Berlin, Heidelberg",
	pages="190--207",
	abstract="In this paper, we present a security analysis of the lightweight block cipher LED proposed by Guo et al. at CHES 2011. Since the design of LED is very similar to the Even-Mansour scheme, we first review existing attacks on this scheme and extend them to related-key and related-key-cipher settings before we apply them to LED. We obtain results for 12 and 16 rounds (out of 32) for LED-64 and 16 and 24 rounds (out of 48) for LED-128. Furthermore, we present an observation on full LED in the related-key-cipher setting. For all these attacks we need to find good differentials for one step (4 rounds) of LED. Therefore, we extend the study of plateau characteristics for AES-like structures from two rounds to four rounds when the key addition is replaced with a constant addition. We introduce an algorithm that can be used to find good differentials and right pairs for one step of LED. To be more precise, we can find more than 210 right pairs for one step of LED with complexity of 216 and memory requirement of 5 {\texttimes}217. Moreover, a similar algorithm can also be used to find iterative characteristics for the LED.",
	isbn="978-3-642-34961-4"
}

