The use of field programmable devices in security-critical applications is growing in popularity; in part, this can be attributed to their potential for balancing metrics such as efficiency and algorithm agility. However, in common with non-programmable alternatives, physical attack techniques such as fault and power analysis are a threat. We investigate a family of next-generation field programmable devices, specifically those based on the concept of time multiplexing, within this context: our results support the premise that extra, inherent flexibility in such devices can offer a range of possibilities for low-overhead, generic countermeasures against physical attack.

Resistance against side-channel analysis (SCA) attacks is an important requirement for many secure embedded systems. Microprocessors and microcontrollers which include suitable countermeasures can be a vital building block for such systems. In this paper, we present a detailed concept for building embedded processors with SCA countermeasures. Our concept is based on ideas for the secure implementation of cryptographic instruction set extensions. On the one hand, it draws from known SCA countermeasures like DPA-resistant logic styles. On the other hand, our protection scheme is geared towards use in modern embedded applications like PDAs and smart phones. It supports multitasking and a separation of secure system software and (potentially insecure) user applications. Furthermore, our concept affords support for a wide range of cryptographic algorithms. Based on this concept, embedded processor cores with support for a selected set of cryptographic algorithms can be built using a fully automated design flow.

Embedded systems can be used in versatile applications. At the same time, more and more functionality is demanded from these systems, which necessitates an increase in the size of program and data memory. Thus, an external chip providing additional memory can be added to the microcontroller, which is the system's core component. However, the connection between microcontroller chip and external memory is an easy target for an attacker. A small alteration in an external program memory can already lead to a radical change in the overall behavior of the embedded system. In security-related applications, such a change in behavior can result in potentially catastrophic consequences. Although there have been proposals for schemes to protect certain aspects of the use of external memories, none provides a comprehensive analysis of potential threats and respective countermeasures. Therefore, we propose a new scheme to detect all manipulations of data in the external memory as well as to prevent an adversary from learning potentially compromising information about the program running inside the microcontroller. Although our scheme entails a non-negligible overhead in terms of processing effort and memory, it is, to the best of our knowledge, the first to provide a practical, uniform and coherent protection for external memory.

Wireless sensor networks are a key technology for "ubiquitous computing" applications. The challenges of securing such networks are tremendous. On the one side, sensor nodes are commonly deployed in potentially hostile environments, which requires additional protection in comparison to traditional computing systems. On the other side, the capabilities of sensor nodes in terms of computing power, memory, and available energy are severely limited, which makes it hard to adapt existing security solutions. In this paper, we examine different options for providing confidentiality and message authentication to sensor network communication. More specifically, we examine four modern block cipher modes of operation regarding their applicability in sensor networks. These are the offset codebook mode (OCB), the counter cipher feedback with header mode (CCFB+H), the EAX mode, and the Galois/Counter mode (GCM). Our practical evaluation targets the MICAz sensor node and accounts for the typically small packet size of sensor network traffic. Our results indicate that the CCFB+H mode is the best choice for a large range of applications.

The importance of peer-to-peer (P2P) systems in real-world applications has grown significantly over the last years. Although P2P systems have found their way into many fields of application, the lack of an adequate general security concept, research for specific security mechanisms and implementati

Wireless sensor nodes generally face serious limitations in terms of computational power, energy supply, and network bandwidth. Therefore, the implementation of effective and secure techniques for setting up a shared secret key between sensor nodes is a challenging task. In this paper we analyze and compare the energy cost of two different protocols for authenticated key establishment. The first protocol employs a lightweight variant of the Kerberos key transport mechanism with 128-bit AES encryption. The second protocol is based on ECMQV, an authenticated version of the elliptic curve Diffie-Hellman key exchange, and uses a 256-bit prime field GF(p) as underlying algebraic structure. We evaluate the energy cost of both protocols on a Rockwell WINS node equipped with a 133 MHz Strong ARM processor and a 100 kbit/s radio module. The evaluation considers both the processor's energy consumption for calculating cryptographic primitives and the energy cost of radio communication for different transmit power levels. Our simulation results show that the ECMQV key exchange consumes up to twice as much energy as Kerberos-like key transport.

Many important algorithms for public-key cryptography rely on computation-intensive arithmetic operations like modular exponentiation on very long integers, typically in the range of 512 and 2048 bits. Modular exponentiation is generally realized through a sequence of modular multiplications and spends the majority of execution time in simple inner loops. Speeding up these performance-critical inner loop operations with custom instructions has, therefore, a significant impact on the total execution time of public-key cryptosystems. In this paper we analyze the performance of instruction set extensions for long integer arithmetic on a SPARC V8 processor. We discuss various implementation options and optimization opportunities for both modular multiplication and exponentiation. In particular, we introduce a partial loop unrolling (PLU) technique for modular multiplication which allows to achieve large performance gains at the cost of a moderate increase in code size, while maintaining the full flexibility of a "rolled-loop" implementation. In addition, we study window methods for modular exponentiation and analyze their impact on performance and memory requirements. Our experimental results, obtained with an FPGA prototype of the LEON-2 SPARC V8 core, show that a full 1024-bit modular exponentiation can be performed in about 12.5 ldr 106clock cycles, which is a reasonable value for embedded devices like smart cards or sensor nodes.

In recent years, processor customization has matured to become a trusted way of achieving high performance with limited cost/energy in embedded applications. In particular, instruction set extensions (ISEs) have been proven very effective in many cases. A large body of work exists today on creating tools that can select efficient ISEs given an application source code: ISE automation is crucial for increasing the productivity of design teams. In this paper, we show that an additional motivation for automating the ISE process is to facilitate algorithm exploration: the availability of ISE can have a dramatic impact on the performance of different algorithmic choices to implement identical or equivalent functionality. System designers need fast feedbacks on the ISE-ability of various algorithmic flavors. We use a case study in elliptic curve (EC) cryptography to exemplify the following contributions: (I) ISE can reverse the relative performance of different algorithms for one and the same operation, and (2) automatic ISE, even without predicting speed-ups as precisely as detailed simulation can, is able to show exactly the trends that the designer should follow