Comparison of CRC and KECCAK Based Message Authentication for Resource-Constrained Devices

With the growth of Internet-of-Things (IoT), billions of low-end devices become connected to provide new services appealing to users. The value of the information to which these devices have access via network is increasing, too, making them an attractive target for cyberattacks. Low-end IoT devices typically have very limited computing, storage and energy resources. Therefore, it is not always possible to use conventional cryptographic algorithms for their protection. In this paper, we investigate whether a cryptographically secure Cyclic Redundancy Check (CRC)-based Message Authentication Code (CMAC) and a KECCAK-based Message Authentication Code (KMAC) satisfy limitations of resource-constrained IoT devices. We implement the 128-bits CMAC and the 128-bits KMAC in 65nm CMOS and compare their performance. To our best knowledge, no hardware implementations of CMAC and KMAC have been presented so far. Our evaluation shows that, for 1.2V operating voltage and clock frequencies above 1 MHz, the CMAC128 is at least 32 times more area-efficient and at least 21 times more power-efficient than the KMAC128.