Secure Elliptic Curve Crypto-Processor for Real-Time IoT Applications

Abstract

Cybersecurity is a critical issue for Real-Time IoT applications since high performance and low latencies are required, along with security requirements to protect the large number of attack surfaces to which IoT devices are exposed. Elliptic Curve Cryptography (ECC) is largely adopted in an IoT context to provide security services such as key-exchange and digital signature. For Real-Time IoT applications, hardware acceleration for ECC-based algorithms can be mandatory to meet low-latency and low-power/energy requirements. In this paper, we propose a fast and configurable hardware accelerator for NIST P-256/-521 elliptic curves, developed in the context of the European Processor Initiative. The proposed architecture supports the most used cryptography schemes based on ECC such as Elliptic Curve Digital Signature Algorithm (ECDSA), Elliptic Curve Integrated Encryption Scheme (ECIES), Elliptic Curve Diffie-Hellman (ECDH) and Elliptic Curve Menezes-Qu-Vanstone (ECMQV). A modified version of Double-And-Add-Always algorithm for Point Multiplication has been proposed, which allows the execution of Point Addition and Doubling operations concurrently and implements countermeasures against power and timing attacks. A simulated approach to extract power traces has been used to assess the effectiveness of the proposed algorithm compared to classical algorithms for Point Multiplication. A constant-time version of the Shamir’s Trick has been adopted to speed-up the Double-Point Multiplication and modular inversion is executed using Fermat’s Little Theorem, reusing the internal modular multipliers. The accelerator has been verified on a Xilinx ZCU106 development board and synthesized on both 45 nm and 7 nm Standard-Cell technologies.

Lightweight Architecture for Elliptic Curve Scalar Multiplication over Prime Field

“…On the other hand, the computation latency of the right-to-left binary method does not increase since it allows the cryptosystem to perform PA and PD operations simultaneously. Nevertheless, in a recent related study, Di Matteo et al [25] proposed that the double-and-add always right-to-left method is not entirely resistant to SPA because the presence between actual points and the infinity point of operations allows an attacker to decode part of the secret key k. Di Matteo proposed a modified version of the double-and-add always right-to-left method to address this vulnerability, which implements countermeasures against SPA by avoiding any point operation with an infinity point.…”

“…In [8], an FPGA-based ECC processor architecture for IoT applications combines various lightweight modular methods and a classic binary ECSM method to achieve the trade-offs between speed and area. In 2021, Di Matteo improved the double-and-add always method and proposed a higher security ECC processor for IoT applications [25].…”

Compact hardware accelerator for field multipliers suitable for use in ultra-low power IoT edge devices

“…In both prime fields GF p ð Þ and binary extension fields GF 2 n ð Þ, there is a large amount of work on finite field multiplication. Much of the reported multipliers exhibited large space and delay complexity, making them impractical for IoT edge devices with limited resources [13][14][15][16]. Numerous publications suggested word-serial finite field multipliers to overcome these constraints.…”

Optimized modular inversion algorithm over prime fields and hardware implementation

“…In 2010 and 2016, China successively released the ECC-based SM2 Elliptic Curve Public Key Cryptography Algorithm and SM9 Identification Cryptography Algorithm [3] . The whole protocol and process of data encryption and decryption in both SM2 and SM9 cryptographic algorithms are inseparable from the support of underlying modular operations, especially the modular inversion operation with the largest amount of computation and the longest time consumption [4] , which is the key to affect the execution efficiency of the entire cryptographic algorithm [5] . Rahman et al [1] used Jacobian coordinate transformation to compress the number of modular inversions required for point operations in ECC, but still could not avoid modular inversions.…”