A Flexible Gimli Hardware Implementation in FPGA and Its Application to RFID Authentication Protocols

Abstract

Radio Frequency Identification (RFID) systems have bestowed numerous conveniences in a multitude of applications, but the underlying wireless communications architecture makes it vulnerable to several security threats. To mitigate these issues, various authentication protocols have been proposed. The literature accommodates comprehensive proposals and analysis of authentication protocols, but not many of them provide hardware implementations. In addition, there is diverse demand for hardware area and throughput (TP) requirements from RFID system components (tags, readers, database servers), which demand a flexible implementation strategy. This paper proposes a flexible implementation strategy for the lightweight authenticated encryption (AE) and hash function called Gimli, and applies it to a state-of-theart authentication protocol. This allows the authentication protocol to be implemented efficiently, wherein the area and TP can be adjusted flexibly according to the RFID system requirements. This implementation strategy is generic; it can be used to implement any other AE and hash functions. This strategy can also be applied to other authentication protocols that heavily use AE and hash functions. To provide a detailed analysis, the hardware are optimization techniques in each component of the RFID system for a state-ofthe-art authentication protocol are analyzed. When implemented with the most area-optimized versions, we achieve TP of 740 Mbps and 420 Mbps for Gimli hash and Gimli AE, respectively, and for throughputoriented implementation, the results are 3.08 Gbps and 1.43 Gbps, respectively. This shows that the proposed implementation strategies allow us to implement authentication protocols in a flexible manner to meet the differing requirements in TP and area for RFID applications.

A Coprocessor Architecture for 80/112-bit Security Related Applications

“…The SQR unit in Fig. 2 is implemented by putting a '0' bit after every successive data bit, as implemented in hardware accelerators of [11,13,19].…”

“…The polynomial multiplication computation specifies the performance of the PM architecture [2,11,[17][18][19]21,27,28,[30][31][32]. For multiplying two m-bit polynomial multiplications, several architectures have been presented in the literature [11,[17][18][19]21,27,28,30]. These includes (i) bit-serial, (ii) bit-parallel, (iii) digit-serial and (iv) digit-parallel approaches.…”

“…The reason to select a 24-bits digit size is to obtain an optimal computational cost with minimum hardware resource utilization. The longer digit length reduces clock cycles requirement but utilizes more hardware resources and consumes more power which is not feasible for wireless sensor nodes and RFID applications [19,21]. With this compliance, we have employed a 24-bit digit size in our multiplication architecture of Fig.…”

“…More specifically, in the case of digitalization, automation requires higher security, e.g., key authentication or key agreement. For example, for radio-frequency-identificationnetwork (RFID) applications, key authentication is essential when scanning the bar codes on different products in shopping malls [18][19][20][21][22]. Automotive mobile vehicles are another application where authentication is critical to start secure communication [23].…”

Secured Authentication of RFID Devices Using Lightweight Block Ciphers on FPGA Platforms

“…It analyzes the different attacks and communication costs, computational costs, and storage space costs using the AVISPA tool. The gimli-based hash and authentication encryption (AE) implementation for RFID devices is used in [18]. The chip area, frequency, latency, and throughput parameters on hardware is evaluated experimentally.…”