Lightweight Cryptography - Hardware Perspective - Miroslav Kne evi - PowerPoint PPT Presentation

Lightweight Cryptography - Hardware Perspective - Miroslav Kne ž evi ć NXP Semiconductors Thanks to the teams of KATAN, SPONGENT, PRINCE, FIDES Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 1 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Digital Continuum Hardware Perspective ~kb/s, μ W ~Gb/s, MW Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 2 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Typical T rade-offs in Crypto Hardware Perspective         Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 3 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Typical T rade-offs in Crypto Hardware Perspective      Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 3 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography A bit of History Hardware Perspective Block Ciphers 4500 4050 SEA 3600 3150 KASUMI Area (GE) HIGHT 2700 AES PUFFIN TEA DES mCrypton CLEFIA 2250 HUMMINGBIRD DESXL KLEIN 1800 DESL TWINE MIBS 1350 PICCOLO PRESENT GOST (FK) 900 LED LED (FK) KATAN PICCOLO (FK) 450 PRINTcipher KATAN (FK) 0 1970 1977 1984 1991 1998 2005 2012 Year Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 4 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography A bit of History Hardware Perspective Block Ciphers Stream Ciphers 4500 4050 SEA 3600 MICKEY 3150 KASUMI Area (GE) HIGHT 2700 TRIVIUM AES PUFFIN TEA DES mCrypton CLEFIA 2250 HUMMINGBIRD DESXL KLEIN 1800 DESL TWINE GRAIN MIBS 1350 PICCOLO PRESENT GOST (FK) 900 LED LED (FK) KATAN PICCOLO (FK) 450 PRINTcipher KATAN (FK) 0 1970 1977 1984 1991 1998 2005 2012 Year Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 4 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography A bit of History Hardware Perspective Block Ciphers Stream Ciphers Hash Functions 4500 4050 SEA 3600 MICKEY 3150 KASUMI Area (GE) HIGHT ARMADILLO 2700 TRIVIUM AES PUFFIN KECCAK TEA DES mCrypton H-PRESENT CLEFIA 2250 HUMMINGBIRD DESXL KLEIN 1800 DESL DM-PRESENT TWINE GRAIN MIBS 1350 QUARK PHOTON PICCOLO PRESENT GOST (FK) 900 LED SPONGENT LED (FK) KATAN PICCOLO (FK) 450 PRINTcipher KATAN (FK) 0 1970 1977 1984 1991 1998 2005 2012 Year Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 4 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Block Cipher - Hardware Perspective Hardware Perspective AES example: Round-Based Implementation Area: ~ 15,000 GE Latency: 10 cycles Control Block size Key size Memory 128-bits 128-bits Round function Key schedule Datapath Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 5 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Block Cipher - Hardware Perspective Hardware Perspective AES example: Serial Implementation Area: ~ 2,400 GE Latency: 226 cycles Control Block size Key size Memory 128-bits 128-bits Round Key function schedule Datapath Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 5 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Block Cipher - Hardware Perspective Hardware Perspective 90 - 95% Round function Key size ≥ 80 bits Key Memory schedule Control logic Block size ≥ 32 bits MINIMIZE! BALANCE! Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 6 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Block Cipher - Hardware Perspective Hardware Perspective Key size ≥ 80 bits Block size ≥ 32 bits Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 6 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Block Cipher - Hardware Perspective Hardware Perspective Key size ≥ 80 bits Block size ≥ 32 bits Block size ≥ 32 bits Arbitrary Key Fixed Key Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 6 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography KATAN - Minimalistic Design Hardware Perspective Round function and Control logic merged! 0 ! 7 ! 6 ! 4 ! 2 ! L 1 ! T ! x 5 ! x 4 ! x 3 ! x 2 ! x 1 ! IR ! k a ! IR ! k b ! y 1 ! y 2 ! y 3 ! y 4 ! y 5 ! y 6 ! 79 ! 78 ! 60 ! 59 ! 49 ! 48 ! 12 ! 11 ! 1 ! 0 ! L 2 ! key_reg ! k a ! k b ! 462 GE Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 7 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography KATAN - Minimalistic Design Hardware Perspective Round function and Control logic merged! Expanded Key stored in silicon! 0 ! 7 ! 6 ! 4 ! 2 ! L 1 ! T ! x 5 ! x 4 ! x 3 ! x 2 ! x 1 ! IR ! k a ! IR ! k b ! y 1 ! y 2 ! y 3 ! y 4 ! y 5 ! y 6 ! L 2 ! Only 508 bits of Expanded Key! Avoid a weak key schedule: KTANTAN! 315 GE + 508 bits of ROM Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 7 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography PRESENT - Small and Scalable Hardware Perspective PRESENT -like Permutation Round-based Implementation ~ 1500 GE Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 8 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography PRESENT - Small and Scalable Hardware Perspective PRESENT -like Permutation Serial Implementation ~ 1000 GE Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 8 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography A Battle for a Single Gate Hardware Perspective KATAN LED UMC130 180nm synopsys synopsys ≥ 450 GE ≥ 700 GE Piccolo 130nm synopsys PRESENT ≥ 700 GE UMC180 IHP250 AMIS350 QUARK synopsys UMC180 ~1kGE synopsys cadence ≥ 1.4 kGE SPONGENT PHOTON UMC130 UMC180 synopsys synopsys ≥ 750 GE ≥ 850 GE Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 11 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Fair Comparison - Mission (Im)possible? Hardware Perspective Spongent in 4 different techs NXP90 UMC130 UMC180 NANGATE45 U P T 3000 O 7 0 % D I F F E R E N C E ! 2250 2323 2071 2012 1950 1500 Area (GE) 1768 1728 1571 1256 1367 1329 1103 1060 868 738 1192 759 1340 918 737 750 521 88/80/8 128/128/8 0 160/160/16 224/224/16 256/256/16 Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 12 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Fair Comparison - Mission (Im)possible? Hardware Perspective < 5 GE/sFF 6.25 GE/sFF 6.67 GE/sFF 7.67 GE/sFF NXP90 UMC130 UMC180 NANGATE45 Open Core Library! 8 6 Area (GE) 4 2 0 scan FF Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 13 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Fair Comparison - Mission Possible? Hardware Perspective Fixed Benchmark: 45 nm Open Core NANGATE library, Cadence RTL Compiler, Original RTL Code. Spongent Photon Quark 4000 3000 3001 Area (GE) 2675 2000 2200 2323 2142 2070 1744 1741 1572 1394 1257 1067 869 1000 80/88 0 128 160 224 Hash Output 256 Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 14 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.

Lightweight Cryptography Typical T rade-offs in Crypto Hardware Perspective     Design and Security of Cryptographic Functions, Algorithms, and Devices, PAGE: 15 of 33 Summer School, Albena, Bulgaria, June 30-July 5, 2013.