Paper 2026/2693

Rotom: A Microcontroller-Oriented Tweakable Block Cipher Using Modular Multiplication

Abstract

We propose Rotom, a family of 128-bit tweakable block ciphers designed for efficient software implementation on 32-bit microcontrollers. The central design idea is to use modular multiplication as a compact and software-efficient source of strong nonlinearity. Rotom instantiates this idea with a fixed 16-bit S-box built from odd constant multiplication modulo $2^{16}$ interleaved with lightweight linear maps, and combines it with a software-friendly recursive linear layer over four 32-bit words, a compact tweakey schedule, and modular-addition boundary key mixing. In contrast to typical ARX-based ciphers, Rotom provides explicit differential and linear characteristic bounds by design. These bounds are obtained by exhaustively computing the local transition probabilities of its fixed 16-bit S-box and combining them with active-S-box bounds induced by its recursive linear layer. Implementation results on ARM Cortex-M3 and Cortex-M4 show that Rotom achieves cycle counts close to Speck, substantially lower than those of MSX, and faster than representative fixsliced AES implementations, while providing tweak support and cipher-level differential and linear bounds. Overall, Rotom combines the efficiency of software-oriented arithmetic instructions with the explicit security evaluation enabled by a fixed-S-box structure.