Strong Crypto for Tiny RFID Tags Challenges and Design Issues 11-13 - - PowerPoint PPT Presentation

▶
strong crypto for tiny rfid tags
SMART_READER_LITE
LIVE PREVIEW

Strong Crypto for Tiny RFID Tags Challenges and Design Issues 11-13 - - PowerPoint PPT Presentation

Oct 03, 2022 433 likes •844 views

VLSI Institute for Applied Information Processing and Communications (IAIK) VLSI & Security Strong Crypto for Tiny RFID Tags Challenges and Design Issues 11-13 July 2007, Malaga, Spain Martin Feldhofer IAIK Graz University of

slide-1
SLIDE 1

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 1

TU Graz/Computer Science/IAIK/VLSI 2007

Martin Feldhofer

IAIK – Graz University of Technology Martin.Feldhofer@iaik.tugraz.at www.iaik.tugraz.at

VLSI

Strong Crypto for Tiny RFID Tags

11-13 July 2007, Malaga, Spain

Challenges and Design Issues

slide-2
SLIDE 2

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 2

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

About us

Graz University of Technology  Faculty of Computer Science  Institute for Applied Information Processing and Communications (IAIK) Research groups

  • Krypto group (hash functions and block ciphers) – Vincent Rijmen
  • EGIZ (e-government)
  • Trusted computing/Java security
  • Network security
  • VLSI group
  • Implementation of crypto algorithms
  • SCA/fault attacks and countermeasures
  • RFID security
slide-3
SLIDE 3

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 3

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

RFID security research projects

C@R: “Collaboration Rural” – IP in FP6; IAIK performs research towards asymmetric crypto in RFID. BRIDGE: “Building Radio frequency IDentification solutions for the Global Environment” – IP in FP6; IAIK is task leader for secure RFID tags – deals symmetric security in UHF technology (SCA attacks for attacks on UHF technology) PROACT: Local initiative (sponsored by NXP) to support research and education @ TU Graz SNAP: FIT-IT: Secure NFC Applications (national cooperation with NXP)

slide-4
SLIDE 4

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 4

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Outline

Motivation Requirements for RFID hardware Low-power design strategies Security algorithms in hardware Comparison of implementations Implementation security Conclusions

slide-5
SLIDE 5

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 5

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Questions

  • Will every passive RFID tag has security features in

a few years?

  • What are the difficulties in designing hardware for

passive RFID tags?

  • Which cryptographic algorithm should be used?
  • Why does the RFID industry not implement security

mechanisms now?

  • Are implementation attacks really a threat?
  • Is this work theoretical research or has it practical

relevance?

slide-6
SLIDE 6

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 6

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

RFIDSec02 to RFIDSec07

Changing view on RFID security

  • Sarma in 2002:

first paper about RFID security at CHES 2002

  • Sarma in 2003:

“…standard crypto too costly on tags…”, “…AES requires 20,000-30,000 gates…”

  • Weis in 2003:

“… strong crypto is not a realistic option …”

  • Weis in 2003:

“… only one-way hash function is required…”

  • Juels in 2003:

“…strong crypto on tags not possible…”

  • Molnar in 2004:

“… symmetric encryption, hash functions, or PRNGS are not possible on tags …”

  • IAIK in 2004:

“… AES possible on passive tags…”

  • IAIK in 2006:

“… AES much more suitable as hash functions …”

  • RFIDSec06:

proposals for ECC on tags

  • Juels in 2007:

“… integrate strong authentication into EPC standard …”

  • RFIDSec07:

many interesting proposals (GPS, …)

slide-7
SLIDE 7

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 7

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Why security for RFID systems?

Counterfeiting

Seven percent of world trade is counterfeited goods (ICC/2003)

  • 500 billion USD in 2004 (TECTEM/2004)
  • 5-10% of car parts (Commission EU/2004)
  • 5-8% of pharmaceuticals (WHO/2002)
  • 12% of toys in Europe (OECD/2000)

Problems

  • High losses
  • Decreases the value of brands
  • Threat against public health and safety

Source: TECTEM University of St. Gallen

slide-8
SLIDE 8

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 8

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Why security for RFID systems?

Privacy

Is “Big Brother” really watching you? Monitoring of communication is easy

  • Contact less, no clear line-of-sight, broadcast signal
  • Even tag-to-reader load modulation observable

in 4.5m distance

Activity tracking of persons via UID Leakage of personal belongings data Data protection is often referred to as showstopper  user acceptance is important

 It is useful to integrate security into RFID systems

slide-9
SLIDE 9

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 9

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Requirements for a secure RFID system

Security protocol

  • Challenge-response authentication

Strong cryptography

  • Appropriate key size (128 bits)

Cryptographic primitive

  • Hash function, block cipher, universal hash function, public key algorithm
  • “Lightweight” solution (HB, …)

Standardized algorithm

  • Analyzed by many crypto experts (see DST)
  • AES, SHA-1, SHA-256, MD5, Trivium, Grain

Goals: authentication and/or anonymity What about the implementation costs of an RFID tag?

Reader Key K Key K rR

S O F E O F

EK(rR)

S O F E O F

slide-10
SLIDE 10

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 10

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

RFID tag vs. contact-less smart card

Common properties

  • Passively powered (no active power supply)
  • Communication over air interface

RFID tag CL smart card

< 1.2 - 5m Reading range < 10 cm < 15µA (scarce) Power consumption ~ 10mA (enough) < 1 mm² Chip area 15 -20mm² minimal, 5-10 Cent Prize (€) some € LF, HF, UHF Frequency HF inventory (until now) Application authentication dedicated circuit Hardware microcontroller non/proprietary Security crypto coprocessor

slide-11
SLIDE 11

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 11

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Limitations of crypto hardware on passive tags

Chip area ~0.33 mm²

  • 0.35 µm CMOS: 6,000 GE
  • 0.18 µm CMOS: 25,000 GE
  • Die size is proportional to silicon costs

Power consumption ~25 µW

  • Supply voltage ~ 1.5 V
  • Mean current Iavg < 15 µA
  • 0.35 µm CMOS: ~15 D-FF @ 1MHz
  • Determines operating range
slide-12
SLIDE 12

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 12

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Optimization goals

Low die-size optimization

RF field RF field Vdd IIC ISupply VddMIN Vdd IIC ISupply VddMIN

Low-power optimization

  • Relevant for RFID tags
  • Energy consumption per cycle
  • Mean current consumption must not

exceed available energy in capacitor

  • Not relevant for RFID tags
  • Energy consumption per operation
  • Power consumption per operation

(encryption)

Optimization metric

  • (Area, Delay, Power)
  • Silicon area
  • Mean power

– or mean current Iavg

  • Clock cycles

– instead Tmin = #cycles / fmax

slide-13
SLIDE 13

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 13

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Optimization techniques – Algorithmic level

Focus on standardized challenge-response protocols Focus on standardized algorithms Types of algorithms

  • Symmetric encryption
  • Hash algorithms
  • Keyed hashes
  • Asymmetric algorithms

Not analyzed

  • Obviously too demanding algorithms
  • RSA
  • Doubtable algorithms
  • NTRU, XTR
  • Not yet: GPS, RSA variants

Selected algorithms

  • Block cipher
  • AES-128
  • TEA, XTEA
  • Stream cipher
  • Trivium
  • Grain
  • Hash
  • MD5
  • SHA-1
  • SHA-256
  • Asymmetric
  • ECC-192
slide-14
SLIDE 14

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 14

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Optimization techniques – Architecture level

Trade small size for speed

  • Word width reduction
  • Latency of reply
  • Serialize operations (use clock cycles)

Example of LFSR

slide-15
SLIDE 15

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 15

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

PTotal = PStatic + PSC + PDynamic

  • PDynamic = CL · VDD

2 · f

Lowering VDD

  • Limited by used technology (1.5V @ 0.35µm)

Use lowest possible clock frequency (<100 kHz)

  • Limited by data rate (protocol)

Avoiding glitching activity

  • Clock gating
  • Sleep-mode logic

Optimization techniques – Circuit level

slide-16
SLIDE 16

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 16

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Optimizations on circuit level

Clock gating

  • Reduces activity
  • Lowers circuit size

Sleep logic

  • Not selected path

consumes power

  • Input gates block

signal changes

FF

clk din Q dout D

8 8 8

enable

Latch

clk enable EN D Q

FF

din Q dout D

8 8

f g

input

  • utput

select_f

1 0

f g

input

  • utput

select_f val select_f

0 1

slide-17
SLIDE 17

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 17

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Optimum word width for clock gating

  • Current consumption is at first glance proportional to number of

clocked flip flops and latches

  • Imean ~ N/b + b

N…# flip flops in algorithm b…word width

  • Minimization gives optimal data path word width
  • boptimal = N

– NAES= 256  bopt = 16 – NSHA-1= 832  bopt = 28.8 – NSHA-256= 1024  bopt = 32 – NTrivium= 288  bopt = 17 – NGrain= 160  bopt = 12.6

slide-18
SLIDE 18

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 18

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Semi-custom design flow

Java Model HDL Code Synthesis Place & route Backend verification Fabrication

slide-19
SLIDE 19

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 19

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Power simulation – Synopsys Nanosim

Near-Spice level transistor simulation Accuracy 3%

slide-20
SLIDE 20

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 20

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Survey of implemented algorithms

Block cipher

  • AES-128
  • TEA
  • XTEA

Hash algorithm

  • SHA-1
  • SHA-256
  • MD5

Stream cipher

  • Trivium
  • Grain

Public key algorithm

  • ECC
slide-21
SLIDE 21

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 21

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

AES-128

Features

  • Encryption and decryption
  • Round-key generation

included

Architecture

  • 8-bit datapath
  • 1 S-box
  • ¼ MixColumns
  • 256 bit storage: RAM
  • 32 x 8-bit organization

Silicon implementation

  • On 0.35 µm CMOS
  • Proven suitability for RFID
  • 0,25 mm²
  • 3 µA @ 1.5 V, 106 kHz

Balance

  • Optimal relationship between flip

flops and computational costs

  • 256 bits memory and simple
  • perations

Difficulties

  • Area*delay metric rather bad
  • ~1000 cycles per encryption

AES-128 Controller RAM 32 x 8-bit Data Unit

start read finished data_out data_in reset enc

„Tina“: Tiny AES

slide-22
SLIDE 22

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 22

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Comparison of implementations

Algorithm Chip area

[GEs]

Imean

[µA @ 100kHz, 1.5V]

# Clock cycles AES-128 3,400 3.0 1,032

slide-23
SLIDE 23

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 23

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Hash algorithms

Algorithms

  • SHA-256, SHA-1, MD5

Architecture

  • 32-bit datapath
  • Flip-flop based RAM
  • Msg expansion, state,

chaining variables

  • Tables as combinational logic

Goodies

  • Clock gating of „RAM“
  • No ROM for constants

needed

  • Sleep logic for datapath

Difficulties

  • High HW complexity
  • Determined by storage effort

– > 1024 bits

SHA-256 datapath

Datapath

W-RAM

16x32-bit

State- RAM

8x32-bit

H-RAM

8x32-bit

1

1

SHA2 Const T1 T2

Ch Maj

32-bit Adder

dataout datain

A, B, C E, F, G A E

slide-24
SLIDE 24

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 24

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Comparison of implementations

Algorithm Chip area

[GEs]

Imean

[µA @ 100kHz, 1.5V]

# Clock cycles AES-128 3,400 3.0 1,032 SHA-256 10,868 5.83 1,128 SHA-1 8,120 3.93 1,274 MD5 8,001 3.16 712

slide-25
SLIDE 25

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 25

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Stream ciphers

Algorithms

  • Trivium, Grain

Architecture

  • 16-bit datapath
  • Flip-flop based RAM

Goodies

  • Distributed LFSR/NFSR
  • Pipelined memory access to

single 16-bit registers

  • Sleep logic for datapath

Stream data_out data_in Key

Grain datapath Trivium datapath

slide-26
SLIDE 26

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 26

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Comparison of implementations

Algorithm Chip area

[GEs]

Imean

[µA @ 100kHz, 1.5V]

# Clock cycles AES-128 3,400 3.0 1,032 SHA-256 10,868 5.83 1,128 SHA-1 8,120 3.93 1,274 MD5 8,001 3.16 712 Trivium 3,090 0.68 (1,603) + 176 Grain 3,360 0.80 (130) + 104

slide-27
SLIDE 27

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 27

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Elliptic-Curve Cryptography

Algorithms

  • ECC-192 (GF(p))

Architecture

  • Bit-serial multiplier
  • Redundant number representation
  • Dual-field capability
  • RAM
  • Flip-flop based
  • 8 x 196-bit organization

Goodies

  • Constants as combinational logic

Difficulties

  • Control
  • Long: 500.000 clock cycles
  • Complicated
  • Requires hierarchical approach

– State machine: field operations –

  • Progr. control: point operations
  • Circuit size: 23 kGE

ROM1 RAM ROM2

Arithmetic Unit

a(x) a p(x ) p

Carry-save Adder Carry-save Adder

a, a(x) p, p(x) s c b q neg

  • a

a 2c c 2s s p p/2 c c/2 s s/2 b/2 s c s s

Reg C Reg S Reg B

p1 c1 s1 c2 s2 a2 b2

Control

slide-28
SLIDE 28

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 28

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Comparison of implementations

Algorithm Chip area

[GEs]

Imean

[µA @ 100kHz, 1.5V]

# Clock cycles AES-128 3,400 3.0 1,032 SHA-256 10,868 5.83 1,128 SHA-1 8,120 3.93 1,274 MD5 8,001 3.16 712 Trivium 3,090 0.68 (1,603) + 176 Grain 3,360 0.80 (130) + 104 ECC-192 23,600 13.3 500,000 TEA 2,633 3.79 289

slide-29
SLIDE 29

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 29

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Comparison of algorithms

Comparison of hardware implementations

  • Implemented on same platform
  • Optimized using same methods

Result (128-bit crypto)

  • AES-128 vs. SHA-256
  • A:

AES 3-times smaller

  • A*t:

AES 4-times better

  • A*t*P: AES 7-times better
slide-30
SLIDE 30

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 30

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Implementation security

Traditional attacks on security systems

  • Cryptanalysis (mathematics)
  • Strength of keys and algorithms

But weakest link in system decides about security

  • Implementation security also very important

Active attacks

  • Fault analysis
  • Physical probing

Passive attacks

  • Side-channel analysis
  • Power consumption
  • Timing information
  • Electromagnetic radiation

Power Timing EM Side channel information

… …

Input Output

Secret key K

Cryptographic device Implementation

  • f algorithm

Challenge-response protocol AES-128

slide-31
SLIDE 31

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 31

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Differential power/EM analysis

  • Target of the attacks is an intermediate value that depends on the

secret key

Power/EM traces Cryptographic device Input data AES Power model Input data Statistical Methods (Correlation, Distance of means,..) Model 256 key hypotheses 256 correlation traces Highest absolute peak detected

slide-32
SLIDE 32

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 32

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Challenges of SCA-secure AES implementation

Power consumption

  • Determines operating range
  • Below 15µA mean current

consumption

  • Target: max. 5 times higher

Chip area

  • Die size equals silicon costs
  • Less than 20,000 gate

equivalents

  • Target: max. 5 times larger

AES-128 µP Interface Controller RAM 32 x 8-bit Data Unit

write select finished data_out data_in addr read

BUT

  • Very low data rates (26 kbps)  low clock frequency
  • High number of available clock cycles

Implementation bases on existing AES architecture

slide-33
SLIDE 33

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 33

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Implementation of countermeasures

„The goal of countermeasures against SCA attacks is to make the power consumption of the device independent of the intermediate values of the executed algorithm.“ [Mangard, Oswald, Popp; Power

Analysis Attacks – Revealing the Secrets of Smart Cards]

Implemented countermeasures

  • Hiding (randomization)
  • Remove data dependency of power consumption
  • Shuffling of operations
  • Execution of dummy cycles
  • Masking
  • Randomize intermediate values that are processed
  • Use an SCA-resistant logic style
slide-34
SLIDE 34

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 34

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Randomizing the AES

AES algorithm Shuffling of operations

a00 a01 a02 a03 a20 a21 a22 a23 a10 a11 a12 a13 a30 a31 a32 a33 a11 a21 a31 a01 a22 a32 a02 a12 a03 a13 a23 a33 a20 a30 a00 a10

The probability that a certain element is processed at a certain point of time is now 1/16.

Randomly choose a starting element (column & row) New sequence:

slide-35
SLIDE 35

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 35

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Increase randomization

Execution of dummy cycles

  • Add a certain amount of dummy blocks randomly at the

beginning and/or at the end

  • Probability that a certain element occurs at a certain point
  • f time is p = 1/(16 + n) (n … number of dummy cycles)
  • e.g. n=12: probability that a certain element occurs at a

certain point of time is 1/28

a11 a21 a31 a01 a22 a32 a02 a12 a03 a13 a23 a33 a20 a30 a00 a10 d d d d d d d d d d d d

slide-36
SLIDE 36

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 36

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

SCA-resistant logic style

Advantages of using logic styles

  • Counteract leakage

directly at the source

  • Independent of circuit

architecture

  • Automatic implementation
  • f secure circuits via a

semi-custom design process is possible

Modified design flow

High-level design capture Logic synthesis Floorplanning Placement and routing Tape-out Special constraints Logic style conversion Conversion rules SR cell library DRP cell library

slide-37
SLIDE 37

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 37

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Answers

  • Will every passive RFID tag has security features in a few years?
  • Hopefully, yes
  • What are the difficulties in designing hardware for passive RFID tags?
  • Power consumption and chip area
  • Which cryptographic algorithm should be used?
  • Challenge-response protocols with AES-128 (public-key

crypto perhaps possible in a few years)

  • Why does the RFID industry not implement security mechanisms now?
  • Too busy at the moment
  • Are implementation attacks really a threat?
  • If it is worth the effort, yes
  • Is this work theoretical research or has it practical relevance?
  • Yes, prototypes in real silicon show feasibility of strong

crypto on passive RFID tags

slide-38
SLIDE 38

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 38

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Conclusions

Strong cryptography required for RFID systems Design for low power consumption Implementation of algorithms

  • AES-128
  • SHA-1, SHA-256, MD5
  • Trivium, Grain
  • ECC
  • TEA, XTEA

Implementation security is important aspect  AES-128 is most suitable for passive RFID

slide-39
SLIDE 39

http://www.iaik.tugraz.at

Institute for Applied Information Processing and Communications (IAIK) – VLSI & Security 39

TU Graz/Computer Science/IAIK/VLSI/Feldhofer

VLSI

Contact information

Martin Feldhofer Institute for Applied Information Processing and Communications TU Graz - Austria Email: Martin.Feldhofer@iaik.tugraz.at

Acknowledgements: Johannes Wolkerstorfer Thomas Popp Michael Hutter Stefan Tillich Manfred Aigner Christian Rechberger FIT-IT Project SNAP sponsored by Austrian bm:vit see www.fit-it.at