A 5.1μJ per point‐multiplication elliptic curve cryptographic processor

Abstract

Security features such as privacy and device authentication are required in wireless sensor networks, electronic IDs, Radio Frequency Identification tags, and many other applications. These features are provided using cryptography. Symmetric key cryptography, where the key is distributed between the communication parties prior to communication, does not provide adequate solution for large scalable systems such as sensor networks. In these cases, public-key cryptography should be used. However, public-key algorithms are typically more computationally intensive than their symmetric key counterparts, which creates difficulties in meeting the strict area, power, and energy requirements. Elliptic curve cryptography, because of relatively small operand sizes, can be used to answer the imposed challenges. In this paper, we present a processor for elliptic curve cryptography over GF (2 163 ). This processor can perform elliptic curve point multiplication as well as general modular operations. The processor is flexible enough to support multiple cryptographic protocols. The chip is fabricated using UMC .13 m 1P8M process, resulting in a core area of 0.54 mm 2 . The energy consumption to perform one elliptic curve point multiplication is 5.1 J. The design features lightweight countermeasures against side-channel attacks. A security evaluation shows the effectiveness of such countermeasures.The ECC processor presented in[1] uses a 16 × 16 bit multiplier and a 1 Kb random-access memory (RAM) to achieve small area. However, this approach resulted in a large execution time of 251 clock cycles for a field multiplication and 296K clock cycles per PM. The design presented in[2] uses a latch based memory unit and a digit-serial data path to achieve lower execution time. Neither of these two implementations can support the basic Schnorr protocol[3] as they lack instructions for modular arithmetic operations.In this paper, we present a processor for ECC based on the architecture presented by Lee et al.[4] We make the following extensions of the previous work:• The register file was modified to reduce the number of multiplexers. • Bit-sliced architecture of the register file and the modular arithmetic logic unit (MALU) was developed. An efficient placement and routing strategy was used to minimize the interconnect capacitive loads. ‡ Area and power associated with the interconnect are not included in this analysis. Frequency values are chosen in such way that the time needed to execute the complete protocol is less than 250 ms.

Efficient and Secure ECDSA Algorithm and its Applications: A Survey

“…They noted that using numeric computation with randomizers in x-coordinate (D&A) is faster and more secure than using Montgomery ladder algorithm in their scheme but original D&A is faster than their scheme. Countermeasures (randomness coordinate) were used to prevent implementation attacks [129,124,32,33,130]. A randomized Projective coordinate (RPC) was used as a countermeasure to prevent differential power analysis (DPA) and template based SPA attacks.…”

Energy/Area-Efficient Scalar Multiplication with Binary Edwards Curves for the IoT

“…Improving the performance of the system is one of the most common approaches for reducing the energy consumption [16,17,18,19,20,29,30,31,32,33,34]. In [35] it is shown that techniques like pipelining and parallelism can be used to reduce the power consumption.…”

“…As reviewed in the previous section, the relations between energy and performance are not clear-cut. The other strategies for achieving power reduction consider area minimization [21,22] and exploring area/performance tradeoffs [32,36].…”

“…From the perspective of security protocols, it can be concluded that low overheads in the number of packets [22,37,38,39,40] and the number of cryptographic operations [32,38,41,42,43] are key for low-energy PKC. These nodes are characterized by wireless transmissions, which require considerable amounts of energy to be performed, thus it is opportune to use protocols with low packet count requirements.…”

A novel SM4 cryptographic architecture against higher order power analysis attacks

“…10 Secret merchant-4 (SM4) [11][12][13][14][15][16][17][18][19][20] and advanced encryption standard (AES) cryptographic algorithms 5,6 are a type of symmetric block ciphers that are able to achieve fast encryption speeds and low hardware implementation costs. 4,[21][22][23][24][25] Unfortunately, both SM4 and AES cryptographic algorithms are pretty vulnerable to PAAs when they are implemented in hardware levels. 4,26 So as to reinforce the security levels of SM4 and AES cryptographic circuits against PAAs, a variety of countermeasures [27][28][29] have been proposed to break the critical correlation between the processed data and monitored power dissipation.…”