Grover on Korean Block Ciphers

: The Grover search algorithm reduces the security level of symmetric key cryptography with n -bit security level to O ( 2 n /2 ) . In order to evaluate the Grover search algorithm, the target block cipher should be efﬁciently implemented in quantum circuits. Recently, many research works evaluated required quantum resources of AES block ciphers by optimizing the expensive substitute layer. However, few works were devoted to the lightweight block ciphers, even though it is an active research area, nowadays. In this paper, we present optimized implementations of every Korean made lightweight block ciphers for quantum computers, which include HIGHT, CHAM, and LEA, and NSA made lightweight block ciphers, namely SPECK. Primitive operations for block ciphers, including addition, rotation, and exclusive-or, are ﬁnely optimized to achieve the optimal quantum circuit, in terms of qubits, Toffoli gate, CNOT gate, and X gate. To the best of our knowledge, this is the ﬁrst implementation of ARX-based Korean lightweight block ciphers in quantum circuits.


Introduction
As the Internet of Things (IoT) technology gets developed, a number of wearable and smart devices are gradually spreading through people's life [1]. Between these IoT devices, abundant data, from simple sensor data to even sensitive personal data, are being exchanged and processed. In order to protect these sensitive data, the exchange process of the data must be secured properly. To achieve the security, cryptographic algorithms must be applied to the data. However, applying the cryptographic algorithm requires resources, including computational power and memory. Most of the IoT devices do not have enough resources in order to apply cryptographic algorithms of conventional computers since most of them are equipped with low computational power and small memory footprint.
In order to resolve this hard condition, lightweight cryptography has been actively studied [2]. Unlike classical cryptography, a lightweight cryptography is designed for low-end devices. Most lightweight cryptography focuses on using resources efficiently to operate in the resource-constrained devices. However, as a cryptography, it is still important to maintain security even from the potential attacks using not only conventional computers, but also the upcoming quantum computers.
The advent of quantum computers and quantum algorithms has dramatically changed the cryptography community. The most well-known modern public key cryptography, such as RSA and Elliptic Curve Cryptography (ECC), are based on the difficulties of factorization and discrete algebra problem [3]. However, Shor's algorithm can perform prime number factorization efficiently, making RSA and ECC vulnerable [4].
In the field of symmetric key cryptography, the impact of quantum computers is not as critical as the case of the public key cryptography. The Grover search algorithm can be used to find the n-bit are generated from the 128-bit key. HIGHT block cipher performs 8-bit wise ARX operations and the encryption/decryption operation consists of 32 rounds. In each round, a 64-bit round key is required, and, in total, 2048-bit of round keys are needed to process a 64-bit block. The parameters for the HIGHT block cipher are shown in Table 2.

Cipher Block Size (bits) Key Size (bits) Word Size (bits) Keywords Rounds
HIGHT 64 128 8 16 32 The key schedule of HIGHT uses the initial key words K to generate whitening keys WK and round keys RK. The whitening key is used for initial conversion of plain text and final conversion for cipher text. The whitening key is generated as follows: (1) The connection polynomial of LFSR h is x 7 + x 3 + 1. The initial internal state value of h is δ 0 = (s 6 , s 5 , s 4 , s 3 , s 2 , s 1 , s 0 ) = (1, 0, 1, 1, 0, 1, 0). For 1 ≤ i ≤ 127, δ i is generated as follows and used for round key generation: s i+6 = s i+2 ⊕ s i−1 δ i = (s i+6 , s i+5 , s i+4 , s i+3 , s i+2 , s i+1 , s i ) (2) Round key RK is generated as follows: for i = 0 to 7 : for j = 0 to 7 : RK[16 · i + j] = K[j − i mod 8] δ 16·i+j for j = 0 to 7 : Before performing the round function, the initial conversion of plaintext T using four whitening keys WK is performed in the encryption process, as follows: In the round function of HIGHT, auxiliary functions F 0 (X) and F 1 (X) using left rotation operation are used, and, for 1 ≤ i < 32, the round function is shown in Equation (6): In the last round i = 32, the F 1 (X) is also used, and the output positions of the input values are not changed as follows: After executing all round functions, the ciphertext C is generated by the final conversion using the whitening key, and the final conversion is shown in Equation (8):

CHAM
In ICISC'17, a family of lightweight block ciphers CHAM was announced by the Attached Institute of ETRI [12]. The family consists of three ciphers: including CHAM-64/128, CHAM-128/128, and CHAM-128/256. The CHAM block ciphers are of the generalized 4-branch Feistel structure based on ARX operations.
In ICISC'19, the revised version of CHAM block cipher was presented [13]. In order to prevent new related-key differential characteristics and differentials of CHAM using a SAT solver, the numbers of rounds of CHAM-64/128, CHAM-128/128, and CHAM-128/256 are increased from 80 to 88, 80 to 112, and 96 to 120, respectively. Table 3 shows the parameters of the block ciphers CHAM.
The key schedule is shown in Equation (9) below, where 0 ≤ i < m: If the round key RK is generated through key scheduling, the plaintext } is encrypted by repeating the round function in the following two cases.
If i from the i-th round for 0 ≤ i < r is odd, the upper function is called. If the i is even, then the lower function is called: In the rest of the cases, the following function applies: Key schedule and round function structure of CHAM are shown in Figures 2 and 3.

LEA
In WISA'13, a lightweight block cipher LEA was presented [14]. LEA is a 128-bit block cipher supporting three key lengths, i.e., 128-bit, 192-bit, and 256-bit. LEA-128, LEA-192, and LEA-256 require 24, 28, and 32 rounds, respectively. In each round, 192-bit round keys are required. The word size is 32-bit and primitive operations are 32-bit wise addition, rotation, and exclusive-or. The parameters for the LEA block cipher are shown in Table 4. The key schedule of the LEA uses constant value δ representing the ASCII codes of 'L,' 'E,' and 'A', and the key schedule is slightly different depending on the parameters. The key schedule of LEA-128 for 0 ≤ i < 24 is as follows: [2] = 0x79e27c8a, δ [3] = 0x78d f 30ec δ [4] = 0x715ea49e, δ [5] = 0xc785da0a δ [6] = 0xe04e f 22a, δ [7] = 0xe5c40957 (12) Unlike the key schedule, the round function is performed as follows for 0 ≤ i < r regardless of the parameter for the plaintext

SPECK
In 2013, NSA released two lightweight block ciphers, SPECK and SIMON, for the low-end devices [10]. SPECK has been implemented in order to perform efficiently in the software environment. The SIMON, on the other hand, has been implemented and optimized for hardware. Although these two ciphers are considered sisters, SIMON has already been designed as quantum circuit [9]. For this reason, this paper only covers quantum circuit implementation and optimization for SPECK.
SPECK takes the form of block cipher and is implemented with an ARX structure that consists of simple operations such as addition, rotation, and bit-wise exclusive operation. SPECK is also implemented in various parameters to provide different levels of security, which are shown in Table 5. A key schedule gets processed in order to generate a round key RK, which will be used in each round. The initial key words are K = {K[0], l[0], . . . , l[m − 2]}, and the following key schedule is performed for 0 ≤ i < r, and the new key value RK = {K[0], K[1], . . . , K[r − 1]} is used as the round key. α and β are 7 and 2 when the size of the block is 32-bit, respectively. For the rest of the block size, α and β are 8 and 3, respectively: During the round function of SPECK with the block size of 2n, for 0 ≤ i < r, a 2n-bit ciphertext word is generated using an n-bit round key for a 2n-bit (X[0], X[1]) input word: Key schedule and encryption of SPECK in case of m = 2 are shown in Figure 6. [0] [0] [0]

Quantum Gates
Quantum computers have several gates that can emulate the classical gates. The two most representative gates are CNOT and Toffoli gates. The CNOT gate performs a NOT gate operation on the second qubit when the first input qubit of the two input qubits is set as one. The NOT gate (i.e., X gate) inverts the state of the qubit. This gate performs the same role as the addition operation on the binary field. The circuit configuration is shown on the left side of Figure 7. The Toffoli gate takes three qubits as input. When the first and second qubits are set to one, the gate performs a NOT gate operation on the last qubit. This serves as an AND operation on the binary field. The circuit configuration for Toffoli gate is shown on the right side of Figure 7.
A lot of works have been done on the addition operation in quantum computers [15][16][17][18]. Among them, Cuccaro et al. suggested the riple-carry addition circuit to achieve the most optimal design by using only one ancillary qubit [15]. For n-bit addition operation, 2n + 2 qubits, 2n Toffoli gates, and 4n CNOT gates are used.

Grover Search Algorithm
The Grover search algorithm is a quantum algorithm that finds specific data for n unsorted data. The classic method requires O(2 n ) searches in brute force attack. However, this can be found within O(2 n/2 ) times with the Grover search algorithm. The Grover search algorithm consists of an oracle function and a diffusion operator, as shown in Figure 8. The oracle function f (x) returns 1 if input x is the solution to the search. Otherwise, it returns 0. When f (x) = 1, the sign of the state x is flipped. It then proceeds to the diffusion operator step, which increases the amplitude of the solution. The searching step is as follows: First, the average amplitude is calculated for all data. Second, the difference between the amplitude and the average amplitude of each data are calculated. If the answer to find in the 2-bit input is 10, the status after these two steps is as shown in Figure 9.
After performing the oracle function, the amplitude of the solution has a different sign from other amplitudes. The difference from the average amplitude increases and the difference between the non-answer amplitudes decreases. The Grover search algorithm increases the amplitude probability of the solution by repeating the oracle function and diffusion operators. The status after diffusion operations is given in Figure 10.

Previous Quantum Implementations
Advanced Encryption Standard (AES) is the international block cipher standard [19] and the block cipher is widely used in practice, such as database encryption and network security. For this reason, a number of works focused on quantum resource estimation for the AES block cipher.
Grassl et al. have presented first quantum circuits to implement an exhaustive key search for the AES and analyzed the quantum resources required to carry out such attacks [6]. All three variants of AES (key size 128, 192, and 256 bit) are implemented for the Grover's quantum algorithm with optimal operations for each layer.
Langenberg et al. presented new quantum circuits for all three AES key lengths. For AES-128, the number of Toffoli gates can be reduced by more than 88% compared to Grassl et al.'s estimates [6], while simultaneously reducing the number of qubits [20].
Previous works of AES have derived the full gate cost by analyzing quantum circuits for the cipher but focused on minimizing the number of qubits. In [8], they have studied the cost of quantum key search attacks under a depth restriction and introduced techniques that reduce the oracle depth, even if it requires more qubits. As part of this work, they released Q# implementations of the full Grover oracle for AES-128, AES-192, and AES-256, including unit tests and code to reproduce their quantum resource estimates.
In [9], the reversible implementation of SIMON block cipher was presented. This block cipher is hardware-oriented suggested by NSA. They have successfully implemented the Grover oracle and Grover diffusion for key search. They have estimated the resources in terms of CNOT, Toffoli, and X gates, which are required to carry out the quantum attack on the block cipher.

Proposed Method
In this chapter, we describe the optimized quantum circuit for applying the Grover's algorithm to HIGHT, CHAM, LEA, and SPECK block ciphers.
All block ciphers implemented in this paper are composed of modular addition, rotation, and XOR operations based on ARX. In the quantum circuit, the rotation operation can be designed without using any gates by changing the order of qubits. Given a = {a 0 , a 1 , a 2 , a 3 } and b = {b 0 , b 1 , b 2 , b 3 }, the operation a ≫ 1 is performed. Then, the XOR operation b = b ⊕ a is performed on the elements of b and the elements of a changed in order by rotation. In this case, since a is {a 1 , a 2 , a 3 , a 0 } after a ≫ 1, it is completed by performing CNOT(a 1 , b 0 ), CNOT(a 2 , b 1 ), CNOT(a 3 , b 2 ), and CNOT(a 0 , b 3 ). In this way, there is no cost for the rotation operation, and the XOR operation can be performed simply with a CNOT gate.
However, for addition operation, Toffoli gates are required, so a more complex circuit is needed than the previous two cases. We used the method of Cuccaro et. al's ripple carry addition [15]. In order to use the ripple-carry addition circuit, not only the qubits of the calculation target, but also two additional qubits for carry calculation are required. Since the addition of block cipher is the modular addition, the value of highest carry qubit can be ignored. Therefore, the addition operation can be performed only with the initial carry qubit of c 0 . Since this c 0 qubit is initialized to 0 after addition operation, it can be recycled at any time.
The block cipher is largely divided into two steps, including key schedule and round function. In order to reduce the required qubit, an on-the-fly approach is utilized.

HIGHT
In this section, we describe the proposed HIGHT block cipher in the quantum circuit to apply the Grover search algorithm.

Key Schedule
In order to reduce the use of qubits in HIGHT, rather than generating all the round keys in advance, the key schedule is performed simultaneously during the round. In the key schedule, the δ 0 = {s 6 , s 5 , s 4 , s 3 , s 2 , s 1 , s 0 } is used first, and then a new δ i must be generated for 1 ≤ i ≤ 127. At this time, the number of qubits can be saved by recycling the existing qubits. For example, when creating a δ 1 in Equation (2), a new s 7 is generated, and the s 0 is not included in new δ i . Therefore, we do not allocate a new qubit for s 7 , but operate on the existing s 0 and treat it as a new value. The detailed process for this is shown in Algorithm 1.

Round Function
In HIGHT, before proceeding to the round function, the plaintext T is initially converted using the whitening key as shown in Equation (4). The quantum circuit design for this is in Algorithm 3.

Algorithm 3 Initial conversion of HIGHT.
Input: T, K Output: X 0 We optimized the round function by properly specifying the operation target and order in the round function. The detailed process for this is described in Algorithm 4 and explained in detail.

Algorithm 4 Round function of HIGHT.
Input: Round i, X i−1 , RK Output: X i 1: First, operation: 2: 10: 15: 16: 17: 19: Fourth operation: 20: In particular, through the optimization of the auxiliary function F 0 and F 1 , no additional qubit was used, and the use of the CNOT gate was also reduced. First, since the RK must be used immediately after generation, and then returned to the initial K by a reverse operation, the operation of the round function proceeds in the order of generation of the RK.
Second, in order not to use additional qubits, the new X i must operate on the existing X i−1 . However, if you look at the first and third lines of Equation (6) and second line of Algorithm 4, you can see that the value of X (i−1) [0], which is first calculated in the round function, is used again. Thus, X i−1 [0] value should not be changed. However, X i−1 [1] is no longer used after calculation. Therefore, by calculating the value of X i [2] in X i−1 [1], no additional qubits were required. The rest of the round function follows the similar procedure. The specific process is presented in Algorithm 4.
The auxiliary functions F 0 and F 1 rotate the input value and then XOR-ing them all. Since input value is 8-bit, if qubits for the generated value are allocated and then XOR-ing the rotation value of input, this requires 8 × 3 = 24 CNOT gates and 8 new qubits. We efficiently optimized this auxiliary function. The desired output was generated by mixing the input values without allocating the qubits for the outputs of F 0 and F 1 . As a result, 21 CNOT gates in F 0 and 24 CNOT gates in F 1 were implemented without additional qubits. The detailed process for F 0 and F 1 functions is presented in Algorithms 5 and 6. In the round function, after using F 0 and F 1 , it should be returned to the original input value. For this, the F 0 _reverse and F 1 _reverse functions should be executed in reverse order of calculation of the F 0 and F 1 functions. In the last 32nd round, the round function from Equation (7) is performed. Compared to the previous round functions, shown in Algorithm 4, the biggest difference is that the last round uses auxiliary function, F 1 , while calculating. Therefore, we have omitted the quantum circuit design for the last round since the overall structure is almost identical.
After all the round functions have been performed, the final conversion from Equation (8) gets performed and encryption gets completed. The quantum circuit design for final conversion is also omitted because it is almost identical to the initial conversion from Algorithm 3. The overall quantum circuit for HIGHT is shown in Figure 11.

CHAM
In this section, we describe the proposed CHAM block cipher in the quantum circuit to apply the Grover search algorithm.

Key Schedule
The key schedule of CHAM has the same structure as the auxiliary functions F 0 and F 1 of HIGHT. It performs ROL 1 , ROL 8 or ROL 1 , ROL 11 operations on initial keywords K, and XOR-ing them all on the K. Therefore, the method of optimizing the auxiliary function of HIGHT was applied to the key schedule of CHAM. The CNOT gate is performed between the qubits storing K to generate an output in which both the K and rotation values of K are XOR-ed. In the key schedule from Equation (9), the first line operation is well optimized without any additional qubits. The detailed process of the first line in Equation (9) is described in Algorithm 7. Not as much as first line operation, the second line operation in Equation (9) has been optimized for using three temporary qubits. The detailed process of key schedule is described in Algorithm 8.
After performing Algorithms 7 or 8 to use RK generated from K, K is required again when generating another round key RK. Therefore, after using the round key, it is necessary to perform a reverse key schedule operation as done in HIGHT.

Round Function
In the second line of the round function from Equation (10), among the input X i values, the values of X i [1], X i [2], and X i [3] are used as new values of X i+1 , but X i [0] is not used after calculation. Therefore, the value of X i [0] in the second line can be used by computing X i+1 [3] to save the qubits for a new value.
In the second line of the round function, the constant i is XOR-ed to X i [0]. This is done by performing the X gate on the qubit according to the position where the bit of i is 1 in (1, 1, 0, 0, . . . , 0), X gate is performed on the qubits The round function of CHAM is expressed in Equations (10) and (11). The detailed circuit design process is shown in Algorithm 9, and the overall quantum circuit for CHAM-64/128 is shown in Figure 12.

Algorithm 9 Round function of CHAM.
Input: RK, X i , Round i Output: X i+1 1: if i is odd then 2: 13:

LEA
In this section, we describe the proposed LEA block cipher in the quantum circuit to apply the Grover search algorithm.

Key Schedule
In the LEA-128 key schedule from Equation (13), the first round key RK 0 is generated using the initial keywords K and a constant value δ. In addition, the next round key RK 1 generation requires RK 0 and δ. Therefore, in order not to use additional qubits in the key schedule of the LEA, the key schedule and the round function are performed simultaneously by using the round key in the corresponding round function and generating the next round key. The detailed process for this is in Algorithm 10.

SPECK
In this section, we describe the proposed SPECK block cipher in the quantum circuit to apply the Grover search algorithm.

Key Schedule
Looking at Equation (15) As a result, K[0] is used as a round key from start to finish. Qubits assigned to the initial keywords K, an element of the key schedule for updating the round key K[0], are reused to the end. By recycling the qubits in this way, all round functions can be completed with only the initial keyword qubits. If a round key is generated in K[0], the next round key must be generated after executing the round function. For 1 ≤ i < r, the detailed process for the key schedule is in Algorithm 12.

Round Function
Round function of SPECK from Equation (16) uses only input plaintext X and round key RK. It proceeds by updating the input X, and encryption is completed when all round functions are performed. The detailed process for this is described in Algorithm 13. The overall quantum circuit for SPECK-32/64 is shown in Figure 14.

Algorithm 13 Round function of SPECK.
Input: X, RK, Round i Output: X i+1

Evaluation
In order to evaluate quantum gates, we utilized the quantum computer emulator. We utilized the well-known IBM's ProjectQ framework for evaluation of the proposed method (https://github.com/ ProjectQ-Framework/ProjectQ). The framework provides quantum computer compiler and quantum resource estimator. This is useful for accurate evaluation. Proposed quantum gates are written in Python and follow the ProjectQ grammar.

Case 1: 64-Bit Plaintext & 128-Bit Key
First, we compared CHAM-64/128 and HIGHT-64/128 block ciphers in terms of quantum resources. The number of qubit, Toffoli gate, and CNOT gate for CHAM-64/128 is lower than HIGHT-64/128 by 5, 3872, and 8203, respectively. In CHAM-64/128, it is all about performing a 16-bit Addition operation once in the round function. However, in HIGHT, 8-bit addition operations are performed 14 times in the round function, including the reverse operation. As a result, the circuit complexity of HIGHT is higher, even though CHAM performs more round functions. Only the number of X gates for HIGHT-64/128 is lower than CHAM-64/128 by 236. This is because CHAM performs an operation that XOR-ing constant i.

Case 2: 128-Bit Plaintext & 128-Bit Key
Second, we compared CHAM-128/128 and LEA-128/128 block ciphers in terms of quantum resources. The number of qubit, Toffoli gate, and CNOT gate for CHAM-128/128 is lower than LEA-128/128 by 117, 5456, and 1120, respectively. From the qubit point of view, LEA adds the constant δ to the key value in the key schedule. If it was an XOR operation, it can be solved only by an X gate without an additional qubit like CHAM. However, because it is an addition operation, setting the value of δ requires 128 qubits, so LEA uses more qubits. As you can see intuitively, the key schedule and round function of the LEA consist mostly of addition. Therefore, LEA has the high complexity among the block ciphers in this paper. Only the number of X gates for LEA-128/128 is lower than CHAM-128/128 by 172. This is because, unlike CHAM, LEA does not use the X gate during the round function, but uses the X gate only when initially setting the δ value. The number of X gates is equal to the δ's hamming weight.

Case 3: 128-Bit Plaintext & 256-Bit Key
Third, we compared CHAM-128/256 and LEA-128/256 block ciphers. The number of qubit, Toffoli gate, and CNOT gate for CHAM-128/256 is lower than LEA-128/256 by 245, 11,904, and 13,152, respectively. Only the number of X gate for LEA-128/256 is lower than CHAM-128/256 by 174. This result also shows that, even in large-scale parameters, CHAM has lower complexity in quantum gates than LEA.

CASE 4: Addition of LEA and HIGHT
Lastly, we compared addition of LEA and HIGHT. LEA-128 performs addition operations four times in the key schedule, three times in the round function, a total of seven, whereas HIGHT performs addition operations four times in the key schedule, four times in the round function, a total of eight. Unlike a classic computer, on a quantum computer, initializing qubits to its previous value requires a reverse operation that iterates over what was done. Since the result of the addition operation of the LEA gets used continuously, the reverse operation is not required. On the other hand, in HIGHT, in order to minimize the usage of the qubit, it is necessary to perform the reverse operation after using the addition result. Therefore, a total of six reverse operations are added, resulting in increased circuit complexity.
Overall, the CHAM block cipher requires the lowest quantum resources. This result introduces the fact that classical security level is not directly related to quantum attack efforts. The lesson is that modern lightweight block ciphers are not good options against quantum computers.

Software-Oriented and Hardware-Oriented Block Ciphers
We also evaluated the quantum resources for software-oriented block cipher (i.e., SPECK) and hardware-oriented block cipher (i.e., SIMON). SPECK consists of addition, XOR, and rotation, while SIMON consists of logical-and, XOR, and rotation. The main difference is addition (i.e., SPECK) and logical-and operation (i.e., SIMON). In Table 7, the comparison between SPECK and SIMON in terms of quantum resources is given. The result shows that the number of qubit, toffoli gate, and CNOT gate for SIMON is lower than SPECK. Only the number of X gate for SPECK is lower than SIMON. For this reason, we can conclude that hardware oriented block cipher is more vulnerable than software-oriented block cipher in terms of Grover search algorithm.

SPN and ARX Based Block Ciphers
AES is based on SPN structure composed of AddRoundkey, ShiftRows, SubBytes, and MixColumn.
AddRoundkey is an operation that XOR-ing a key value to data, and can be implemented relatively simple by using only CNOT gates. ShiftRows is free because it uses only rotation operations.
On the other hand, MixColumn requires a (complicated) multiplication circuit, which uses more Toffoli gate than addition circuit, and generic n-bit multiplication requires at least an additional n qubits. Some multiplication works using the Karatsuba algorithm have been performed, which can reduce the number of Toffoli gates, but this requires extra qubits. SubBytes is an operation for substituting data in 8-bit units, and the actual operation is an operation for affine conversion after obtaining an inverse on GF(2 8 ) for one byte. For inversion operation, squaring and multiplication are performed together. Squaring can be performed with only 19 CNOT gates on an 8-bit basis without additional qubits, but, as mentioned earlier, inversion is a complex circuit because of multiplication. That is, in the SPN structure, the complexity of the circuit is greatly increased compared to the ARX structure due to SubBytes of substitution and MixCoulmn of permutation.
Several studies with quantum resource estimation required for AES block ciphers are presented in Table 8. The implementation of Langenberg et al. [7] is relatively well optimized because the S-box operation is optimized efficiently.

Conclusions
In this paper, we presented the optimized implementation of ARX-based Korean block ciphers in quantum gates. The proposed implementation achieved the optimal number of qubit and quantum gates by carefully designing the adder circuit and its reversible gates. This is the first implementation of Korean block ciphers in quantum gates. The result shows that the CHAM block cipher requires the lowest quantum resources, which means the CHAM block cipher is the most vulnerable towards the Grover search algorithm. We also evaluated the SPECK and SIMON on quantum gates. The result shows that hardware-oriented block cipher (i.e., SIMON) shows the lower quantum resources than SPECK.