Difference between lightweight, online and low memory Authenticated Encryption schemes What is the basic difference between the following types of Authenticated Encryption (AE) schemes?


Lightweight Authenticated encryption
Online Authenticated Encryption
Authenticated Encryption for low memory devices


Are they all the same or is there a specific difference between them?
Thought I'd begin with some references for you that might be of interest. These terms are used as key 'selling points' for a number of schemes, including many of the CAESAR submissions. Some examples using the terms specifically are given below - most of which are from CAESER because I have the zoo in-front of me:


"Online": OCB, Ascon, CBA, APE, NORX
"memory-constrained devices": Ketje / Keyak / Spongewrap, 
"lightweight": PRESENT, JAMBO, APE, BLINKER (presented CT-RSA14)


Also, there was an eCrypt report on Lightweight crypto.



I can't provide a decent distinction between the 1 &amp; 3, since low memory footprint is a more specific sub-aim of lightweight. Both of these are types of schemes designed to be run in highly restricted environments, such as on embedded devices. These often have constraints that actually affect what operations you can/cannot run on them, such that more efficient algorithms than an AES-based mode may be preferred.

Online AE deals with something completely different. Let A be some associated data, $M=(M_1,\dots,M_n)$ a message, encrypting to $C=(C_0,\dots,C_n)$ and tag $T$. The scheme is online if $C_i$ can be calculated without knowledge of $M_j$ for any $j&gt;i$.

Often lightweight or small footprint ciphers are 'online'. This is because it allows them to process plaintext blocks as they come through. In contrast, an offline cipher would have to collect the complete plaintext before calculating the ciphertext, which means it must have enough memory to store $n$ blocks of data, which not all devices will do - especially for example a small industrial sensor reporting on large amounts of data. 

Recently there has been some controversy about the validity of an online decryption function, since they release unverified plaintext (for example, see the CAESER mailing list or this paper). For categorization of some schemes under development, see here.