VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security An ECDSA Processor for RFID Authentication Michael Hutter, Martin Feldhofer, and Thomas Plos Workshop on RFID Security 2010 07. - 09.06.2010, Istanbul, Turkey Institute for Applied Information Processing and Communications (IAIK) Graz University of Technology TU Graz/Computer Science/IAIK/VLSI Michael Hutter 1
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Outline Motivation Implementation Requirements The ECDSA Processor The System Architecture Memory Unit and Datapath Microcontroller Instruction Set Extensions for ECDSA Synthesis Results Conclusion TU Graz/Computer Science/IAIK/VLSI Michael Hutter 2
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Motivation RFID is one key enabler for the “Internet of Things” Intelligent “smart things/tags” extend the Internet Tags are already integrated into many products There are still open issues in realizing a “secure Internet of things” TU Graz/Computer Science/IAIK/VLSI Michael Hutter 3
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Requirements Digital-signature service To provide a transferable proof of origin Message authentication, non-repudiation, data integrity Asymmetric cryptography Large scale deployment Integration in open-loop systems (Internet) Standardized algorithms ECDSA has been tested/proved over many years Existing PKI (X.509 certificates using ECDSA) Strong authentication Challenge-response protocol (e.g. ISO/IEC 9798-3) Low-resource HW design TU Graz/Computer Science/IAIK/VLSI Michael Hutter 4
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security What we did? Design of an ECDSA processor for RFID Based on NIST recommended elliptic curve GF(p192) TU Graz/Computer Science/IAIK/VLSI Michael Hutter 5
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Tag Authentication using ECDSA TU Graz/Computer Science/IAIK/VLSI Michael Hutter 6
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Memory Unit 16-bit dual ported interface Concurrently read/write from/to two ports RAM macro (128x16 bit) ROM ECC constants (e.g. base point P) IN_A IN_B EEPROM EEPROM Stores the private key addr addr Stores the certificate EEPROM ROM Port A Port B RAM RAM OUT_A OUT_B TU Graz/Computer Science/IAIK/VLSI Michael Hutter 7
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 16-bit Datapath Port A Port B 16x16-bit multiply 16 16 accumulate (MAC) unit 1 cycle 16-bit operations 1 0 FFFF Two 40-bit adders bitop logic mul 40 16 16 One 40-bit accumulator 20 16 0 16 16 1 16x16 Feedback of ACCU signal acc mux multiplier Logic operations for SHA1 20 40 adder1 XOR, AND, OR 40 32 Writing into memory using adder2 two 16-bit values ACC concurrently 40 Port A Port B TU Graz/Computer Science/IAIK/VLSI Michael Hutter 8
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 8-bit Microcontroller 32 instructions supported reg_in 4 ROM 8 8 Arithmetic operations (ADD, SUB,…) Program counter Register file Logical operations (OR, AND,…) 16 x 8-bit I/O 12 Address Control operations (GOTO, CALL,…) Data memory Prog. ROM Register file and program ROM 600 x 16-bit ECDSA Instruction decoder, ALU, PCH SHA-1 2 STATUS ACC Counter,… …... Instruction 16 Mux Two-stage pipeline (fetch and reg_out1 ROM reg_out2 8 8 8 16 execute) Instruction Status Call-stack support (3 recursive ALU decode unit subroutines possible) ALU out Self-written Java compiler TU Graz/Computer Science/IAIK/VLSI Michael Hutter 9
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Instruction Set Extensions 55 ISEs for ECDSA and SHA1 Can be executed by the microcontroller by a MICRO instruction Implemented in 8 ROM tables Area reduction through different table sizes Modular arithmetic Addition: 32 cycles Subtraction: 38 cycles Multiplication: 204 cycles NIST reduction applied (p 192 ≡ 2 192 –2 64 –1) Montgomery arithmetic Inversion: 20823 cycles Multiplication: 785 cycles SHA1: 3455 cycles TU Graz/Computer Science/IAIK/VLSI Michael Hutter 10
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Improving ECC Point Multiplication Montgomery Ladder Use of x-coordinate only formulas (Brier and Joye) Combined double-and-add (Izu, Möller, and Takagi) Common-Z coordinate representation (Meloni, Lee) Total: 12M + 4S + 9add + 7sub 7x192-bit RAM used TU Graz/Computer Science/IAIK/VLSI Michael Hutter 11
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Implementation Attack Countermeasures SPA Montgomery Ladder DPA Randomized Projective Coordinates (S. Coron) First-order blinding of the private-key multiplication instead of Fault Injections Check of curve equation after point multiplication (Ebeid and Lambert) Y recovery necessary TU Graz/Computer Science/IAIK/VLSI Michael Hutter 12
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Synthesis Results Cadence RTL Compiler (0.35 µm CMOS) Synopsys NanoSim for power simulation 387 µA mean current at 3.3 volt and 847 kHz Chip Area Power Consumption 43,17% RAM MCU 3,08% 23,78% R O M Prog. ROM Datapath 3,52% ISE 15,63% 7,04% 3,74% Clock TU Graz/Computer Science/IAIK/VLSI Michael Hutter 13
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Comparison with Related Work TU Graz/Computer Science/IAIK/VLSI Michael Hutter 14
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Conclusions Improved the state-of-the-art in designing a low- resource ECC hardware processor First ECDSA hardware implementation results Fully capable digital signature generating device Allows proof of origin to prevent product counterfeiting Sample implementation Processor will be integrated in an NFC-compliant HF tag Fabricated in summer 2010 TU Graz/Computer Science/IAIK/VLSI Michael Hutter 15
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Thanks for your attention! http://www.iaik.tugraz.at/content/research/implementation_attacks/ Michael Hutter IAIK – Graz University of Technology michael.hutter@iaik.tugraz.at www.iaik.tugraz.at TU Graz/Computer Science/IAIK/VLSI Michael Hutter 16
VLSI Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security Montgomery Ladder TU Graz/Computer Science/IAIK/VLSI Michael Hutter 17
Recommend
More recommend
