Mystrium: Wide Block Encryption Efficient on Entry-Level Processors

We present a tweakable wide block cipher called \(\text {Mystrium} \) and show it as the fastest such primitive on low-end processors that lack dedicated AES or other cryptographic instructions, such as ARM Cortex-A7. \(\text {Mystrium} \) is based on the provably secure double-decker mode, that requires a doubly extendable cryptographic keyed (deck) function and a universal hash function. We build a new deck function called \(\text {Xymmer}\) that for its compression part uses Multimixer-128, the fastest universal hash for such processors, and for its expansion part uses a newly designed permutation, \(\mathcal {G}_{512}\) . Deck functions can also be used in modes to build encryption, authenticated encryption, and authentication schemes, and hence, \(\text {Xymmer}\) is of independent interest. The current state-of-the-art wide tweakable block cipher Adiantum-XChaCha12-AES encrypts 4096-byte messages at 11.5 cycles per byte on ARM Cortex-A7, while for \(\text {Mystrium} \) it is 6.8 cycles per byte while having a higher claimed security.