<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><blockquote type="cite" class=""><span style="font-family: Helvetica; font-size: 12px;" class="">What would a modern cipher designed for efficient hardware</span><br class=""><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">implementation look like? Is it just DES with more rounds and a bigger</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">block size? How about mixing up different cipher principles in one</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">cipher? So start with a Feistel, then an S-box, then...</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote></div><br class=""><div class="">Look at Simon and Speck</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://eprint.iacr.org/2013/404.pdf" class="">https://eprint.iacr.org/2013/404.pdf</a></div></div></div></blockquote>Simon and Speck specifically deal with the question of *expensive* gates: They are for low-end, cheap devices. Just the opposite of what the OP brought up.</div><div><br class=""></div><div>Suppose we ignore those. The linked paper indicates that the smallest known AES implementations require about 2500 gates. Suppose you had a budget of a million gates and wanted to design a cipher that made full use of them. What would you do?</div><div><br class=""></div><div>One interesting issue this highlights is the difference between hardware and software implementation: Given that many gates, you can build a very large S-box in hardware. Software trying to implement such an algorithm would have significant problems avoiding various kinds of side-channel leaks via memory accesses.</div><div><br class=""></div><div><div> -- Jerry</div><div class=""><br class=""></div></div></body></html>