Paper 2016/122

Simpira v2: A Family of Efficient Permutations Using the AES Round Function

Shay Gueron and Nicky Mouha


This paper introduces Simpira, a family of cryptographic permutations that supports inputs of $128 \times b$ bits, where $b$ is a positive integer. Its design goal is to achieve high throughput on virtually all modern 64-bit processors, that nowadays already have native instructions for AES. To achieve this goal, Simpira uses only one building block: the AES round function. For $b=1$, Simpira corresponds to 12-round AES with fixed round keys, whereas for $b\ge 2$, Simpira is a Generalized Feistel Structure (GFS) with an $F$-function that consists of two rounds of AES. We claim that there are no structural distinguishers for Simpira with a complexity below $2^{128}$, and analyze its security against a variety of attacks in this setting. The throughput of Simpira is close to the theoretical optimum, namely, the number of AES rounds in the construction. For example, on the Intel Skylake processor, Simpira has throughput below 1 cycle per byte for $b \le 4$ and $b=6$. For larger permutations, where moving data in memory has a more pronounced effect, Simpira with $b=32$ (512 byte inputs) evaluates 732 AES rounds, and performs at 824 cycles (1.61 cycles per byte), which is less than 13% off the theoretical optimum. If the data is stored in interleaved buffers, this overhead is reduced to less than 1%. The Simpira family offers an efficient solution when processing wide blocks, larger than 128 bits, is desired.

Available format(s)
Publication info
A minor revision of an IACR publication in ASIACRYPT 2016
Cryptographic permutationAES-NIGeneralized Feistel Structure (GFS)Beyond Birthday-Bound (BBB) securityhash functionLamport signaturewide-block encryptionEven-Mansour
Contact author(s)
nicky @ mouha be
2016-11-17: last of 4 revisions
2016-02-14: received
See all versions
Short URL
Creative Commons Attribution


      author = {Shay Gueron and Nicky Mouha},
      title = {Simpira v2: A Family of Efficient Permutations Using the AES Round Function},
      howpublished = {Cryptology ePrint Archive, Paper 2016/122},
      year = {2016},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.