Grain-128AEAD-Status Document

The provided reference implementation is, together with the specification document, primarily designed to give an easy to grasp overview of the cipher. No serious optimization attempts are included with the reference implementations. Instead, optimized software implementations are provided separately. The optimizations are discussed in detail in [2] and target the two most constrained architectures used in the FELICS-AEAD framework [1]. We refer to that document for details and provide only a very short summary here. The implementations have been included in the framework and the results are those delivered by FELICS-AEAD. The two processors used were the 8-bit AVR ATmega 128 and the 16-bit MSP430F1611. Both these architectures provided optimization challenges and we give four different implementations, one for each processor and targeting either fast execution or small code size. The implementations can be found in the FELICS-AEAD framework. There is often a tradeoff between execution time and code size, so we also provide results for a more balanced choice, where we use the product of the code size and execution time as a metric. The FELICS-AEAD framework includes different scenarios. The results in Table 1 gives our results for a balanced choice between size and speed, and for the scenario with authenticated encryption of 1224 bytes of payload and 40 bytes associated data. In