The first contribution of our paper is that we propose a platform, a design strategy, and evaluation criteria for a fair and consistent hardware evaluation of the second-round SHA-3 candidates. Using a SASEBO-GII field-programmable gate array (FPGA) board as a common platform, combined with well defined hardware and software interfaces, we compare all 256-bit version candidates with respect to area, throughput, latency, power, and energy consumption. Our approach defines a standard testing harness for SHA-3 candidates, including the interface specification for the SHA-3 module on our testing platform. The second contribution is that we provide both FPGA and 90-nm CMOS application-specific integrated circuit (ASIC) synthesis results and thereby are able to compare the results. Our third contribution is that we release the source code of all the candidates and by using a common, fixed, publicly available platform, our claimed results become reproducible and open for a public verification.

This paper presents a systematic design approach to provide the optimized Rivest-Shamir-Adleman (RSA) processors based on high-radix Montgomery multipliers satisfying various user requirements, such as circuit area, operating time, and resistance against side-channel attacks. In order to involve the tradeoff between the performance and the resistance, we apply four types of exponentiation algorithms: two variants of the binary method with/without Chinese Remainder Theorem (CRT). We also introduces three multiplier-based datapath-architectures using different intermediate data forms: 1) single form, 2) semi carry-save form, and 3) carry-save form, and combined them with a wide variety of arithmetic components. Their radices are parameterized from 28to 2128. A total of 242 datapaths for 1024-bit RSA processors were obtained for each radix. The potential of the proposed approach is demonstrated through an experimental synthesis of all possible processors with a 90-nm CMOS standard cell library. As a result, the smallest design of 861 gates with 118.47 ms/RSA to the fastest design of 0.67 ms/RSA at 153\thinspace 862 gates were obtained. In addition, the use of the CRT technique reduced the RSA operation time of the fastest design to 0.24 ms. Even if we employed the exponentiation algorithm resistant to typical side-channel attacks, the fastest design can perform the RSA operation in less than 1.0 ms.

This paper proposes new chosen-message power-analysis attacks for public-key cryptosystems based on modular exponentiation, where specific input pairs are used to generate collisions between squaring operations at different locations in the two power traces. Unlike previous attacks of this kind, the new attack can be applied to all standard implementations of the exponentiation process, namely binary (left-to-right and right-to-left), m-ary, and sliding window methods. The proposed attack can also circumvent typical countermeasures, such as the Montgomery powering ladder and the double-add algorithm. The effectiveness of the attack is demonstrated in experiments with hardware and software implementations of RSA on an FPGA and a PowerPC processor, respectively. In addition to the new collision generation methods, a highly accurate waveform matching technique is introduced for detecting the collisions even when the recorded signals are noisy and there is a certain amount of clock jitter.

Simple power analysis attacks with chosen-message techniques were applied to an RSA processor implemented with standard CMOS technology on ASIC, and the different characteristics of power waveforms caused by two types of implementation (ASIC and FPGA) were investigated in detail. We also applied comparative power analysis an advanced power analysis attack in which a pair of input data was used to enhance the waveform pattern for modular exponentiation. The power dissipation of modular squaring in the difference waveform was greatly reduced when compared to modular multiplication, allowing all of the secret key bits to be successfully revealed.

Compact and high-speed hardware architectures for the 192-bit hash function Tiger are proposed and their gate counts and throughputs are evaluated using a 90-nm CMOS standard cell library. The implementations achieve practical performances of 22.5 K with 2.2 Gbps and 46.4 Kgates with 6.95 Gbps. These throughputs are 1.5-2 times higher than those of the SHA hash family SHA-256/-512, but the hardware efficiencies (defined as throughput per gate) of Tiger are lower than those of SHA and are half those of the Whirlpool hash function. Hardware performance is one of the most important features for hash functions to be selected as a next standard algorithm after SHA. Therefore, the requirements for hash functions to achieve flexible and high-performance circuits are also clarified through this study by analyzing the characteristics of structure and basic components of each algorithm from the viewpoint of hardware implementation.

Various high-performance hardware architectures for Galois counter mode (GCM) in conjunction with various advanced encryption standard (AES) circuits and multiplier-adders are proposed. A total of 17 GCM-AES circuits were synthesized by using a 130-nm CMOS standard cell library, and the trade-offs between speed and hardware resources were evaluated. Our flexible architectures achieved a wide variety of performances from compact (2.56 Gbps with 34.5 Kgates) to high speed (62.6 Gbps with 979.3 Kgates). All of our architectures support key sizes of 128, 192, and 256 bits, while only one previous approach does. Even with variable-length key support, our architecture also achieved the highest hardware efficiency (defined as throughput per gate) among the designs using the same generation of process technology.

A high-speed and secure dynamic partial reconfiguration (DPR) system is realized with AES-GCM that guarantees both confidentiality and authenticity of FPGA bitstreams. In DPR systems, bitstream authentication is essential for avoiding fatal damage caused by unintended bitstreams. An encryption-only system can prevent bitstream cloning and reverse engineering, but cannot prevent erroneous or malicious bitstreams from being configured. Authenticated encryption is a relatively new concept that provides both message encryption and authentication, and AES-GCM is one of the latest authenticated encryption algorithms suitable for hardware implementation. We implemented the AES-GCM-based DPR system targeting the Virtex-5 device on an off-the-shelf board, and evaluated its throughput and hardware resource utilization. For comparison, we also implemented AES-CBC and SHA-256 modules on the same device. The experimental results showed that the AES-GCM-based system achieved higher throughput with less resource utilization than the AES/SHA-based system. The AES-GCM-module achieved more than 1 Gbps throughput and the entire system achieved about 800 Mbps throughput with reasonable resource utilization. This paper clarifies the advantage of using AES-GCM for protecting DPR systems.

This paper presents SPA (Simple Power Analysis) attacks against public-key cryptosystems implemented on an FPGA platform. The SPA attack investigates a power waveform generated by a cryptographic module, and reveals a secret key in the module. We focus on chosen-message SPA attacks, which enhances the differences of operating waveforms between multiplication and squaring correlated to the secret key by using the input of particular messages. In particular, Yen showed a unique SPA attack against RSA cryptosystem, but no verification experiment using actual software or hardware was performed. In this paper, we implemented four-types of RSA processors on an FPGA platform in combination with two variants of the Montgomery multiplication algorithm and two different types of multipliers for SPA attacks experiments. Then we demonstrated effectiveness of various chosen-message attacks as well as Yen’s method, and investigated the characteristics of the attacks depending on the hardware architectures.

The present paper proposes a systematic design approach to provide the optimal high-radix Montgomery multipliers for an RSA processor satisfying user requirements. We introduces three multiplier-based architectures using different intermediate-data forms ((i) single form, (ii) semi carry-save form, and (iii) carry-save form), and combined them with a wide variety of arithmetic components. Their radices are also parameterized from 28to 264. A total of 202 designs for 1,024-bit RSA processors were obtained for each radix, and were synthesized using a 90-nm CMOS standard cell library. The smallest design of 0.9 Kgates with 137.8 ms/RSA to the fastest design of 1.8 ms/RSA at 74.7 Kgates were then obtained. In addition, the optimal design to meet the user requirements can be easily obtained from all the combinations. In addition to choosing the datapath architecture, the arithmetic component, and the radix parameters, the proposed systematic approach can also adopt other process technologies.

SPA (Simple Power Analysis) attacks against RSA cryptosystems are enhanced by using chosen-message scenarios. One of the most powerful chosen-message SPA attacks was proposed by Yen et. al. in 2005, which can be applied to various algorithms and architectures, and can defeat the most popular SPA countermeasure using dummy multiplication. Special input values of −1 and a pair of −X and X can be used to identify squaring operations performed depending on key bit stream. However, no experimental result on actual implementation was reported. In this paper, we implemented some RSA processors on an FPGA platform and demonstrated that Yen’s attack with a signal filtering technique clearly reveal the secret key information in the actual power waveforms.

Hardware architectures for the 512-bit hash function Whirlpool, which is one of the ISO/IEC 10118-3 standard algorithms, are proposed and the performances of the proposed architectures are evaluated using a 0.18-μm CMOS standard cell library. The fastest implementation achieved a throughput of 9.59 Gbps with a gate count of 167.4K, which is two times faster than the fastest conventional implementation on an FPGA platform. A compact implementation obtained 38.9 Kgates with 2.49 Gbps. The FIPS 180-2 standard hash functions SHA-256 and SHA-512, which are the most popular algorithms in practical use, were also synthesized using the same ASIC library for performance comparisons. The small and fast SHA-256 implementations achieved 11.0 Kgates with 726 Mbps and 30.7 Kgates with 1.97 Gbps, respectively. The gate count and throughput are both approximately 1/4 those of to Whirlpool, and thus the hardware efficiencies defined as the throughput/gate are almost the same for SHA-256/-512 and Whirlpool in the present implementations. However, Whirlpool is more flexible than SHA-256/-512 in terms of the variety of hardware architectures. The various architectures for the datapath and primitive function blocks are also described in the present paper.

In the present paper, we introduce high-performance hardware architectures for the 128-bit block cipher CLEFIA and evaluate their ASIC performances in comparison with the ISO/IEC 18033-3 standard block ciphers (AES, Camellia, SEED, CAST-128, MISTY1, and TDEA). We designed five types of hardware architectures for CLEFIA, combining two loop structures and three F-functions. These designs were synthesized with a 90-nm CMOS standard cell library, and size and speed performances were evaluated. The highest hardware efficiency (defined as throughput/gates) obtained was 400.96 Kbps/gates, which is 1.5 times higher than previously achieved efficiencies.

Simple power analysis (SPA) was applied to an RSA processor with a high-radix Montgomery multiplier on an FPGA platform, and the different characteristics of power waveforms caused by two types of multiplier (built-in and custom) were investigated in detail. The authors also applied an active attack where input data was set to a specific pattern to control the modular multiplication. The power dissipation for the multiplication was greatly reduced in comparison with modular squaring, resulting in success in revealing all of the secret key bits

We propose differential power analysis (DPA) with a phase-based waveform matching technique. Conventionally, a trigger signal and a system clock are used to capture the waveform traces, but the signals always contain jitter-related deviations, and this degrades the accuracy of the statistical analysis. Our method can adjust for this timing deviation with a higher resolution than the sampling rate by post-processing on the measured waveforms. Therefore, no modification of the measuring equipment is required. Our method can also defeat DPA countermeasures creating distorted waveforms with random delays or dummy cycles. We implemented Data Encryption Standard (DES) software with and without the countermeasure on a Z80 microprocessor, and demonstrated the advantages of our method in comparison with a conventional attack.

Parallel hardware architecture for an authenticated encryption mode GCM (Galois Counter Mode) capable of a throughput higher than 100 Gbps is proposed. In GCM, the CTR mode can encrypt multiple data blocks independently, but a hash function performs multiply-add operation with the cipher-text blocks sequentially. Therefore, a parallel multiply-adder was designed and integrated into the GCM hardware with a 14-stage pipelined AES circuit and two kinds of S-box, composite field and BDD (Binary Decision Tree) versions. Performance of a 4-parallel version was evaluated by using a 0.13-μm CMOS standard cell library, and very high throughputs of 102 Gbps with 600 Kgates and 162 Gbps with 979 Kgates were obtained by the composite and BDD S-boxes, respectively. Higher hardware efficiency (throughput/gate) in comparison with prior art was also achieved. The critical path of the design is the multiply-adder in each local processing block, and is not affected by the number of the parallel blocks. Therefore the proposed architecture has almost linear scalability in terms of hardware speed versus size.

The authors propose a compact hardware architecture for the 64-bit block cipher CAST-128, which is one of the ISO/IEC 18033-3 standard algorithms. Part of the complexity of CAST-128 is its use of various S-boxes in various sequences, and three types of f-function are switched depending on the round numbers. Therefore a large amount of hardware resources are required for a straight-forward implementation. In order to create compact CAST-128 hardware, the authors minimized the number of S-box components, and merged the three f-functions into one arithmetic component. The CAST-128 hardware based on the proposed architecture was synthesized using 0.13μm and 0.18-μm CMOS standard cell libraries and small, practical circuits of 26.4-39.5 Kgates and 189.9-614.7 Mbps were obtained.

We propose various high-speed hardware architectures for GCM (Galois counter mode) in conjunction with various AES (advanced encryption standard) hardware macros, and clarify the trade-offs between speed and hardware resources. The designs were evaluated by using a 0.13-mum CMOS standard cell library. The highest throughput of 42.7 Gbps with 297 Kgates was obtained from a sequential GCM architecture with a full-pipelined AES circuit where a 128-bit data block is processed on every clock, and the smallest size of 73 Kgates with 6.4 Gbps was achieved with pipelined-loop architecture. All of our architectures support key sizes of 128, 192, and 256 bits, while only one previous approach does. Even with variable-length key support, all of our designs showed higher performance than conventional designs

In this brief, we present a high-speed AES IP-core, which runs at 880 MHz on a 0.13-/spl mu/m CMOS standard cell library, and which achieves over 10-Gbps throughput in all encryption modes, including cipher block chaining (CBC) mode. Although the CBC mode is the most widely used and important, achieving such high throughput was difficult because pipelining and/or loop unrolling techniques cannot be applied. To reduce the propagation delays of the S-Box, the slowest function block, we developed a special circuit architecture that we call twisted-binary decision diagram (BDD), where the fanout of signals is distributed in the S-Box circuit. Our S-Box is 1.5 to 2 times faster than the conventional S-Box implementations. The T-Box algorithm, which merges the S-Box and another primitive function (MixColumns) into a single function, is also used for an additional speedup.

We propose an elliptic curve (EC) cryptographic processor architecture that can support Galois fields GF(p) and GF(2/sup n/) for arbitrary prime numbers and irreducible polynomials by introducing a dual field multiplier. A Montgomery multiplier with an optimized data bus and an on-the-fly redundant binary converter boost the throughput of the EC scalar multiplication. All popular cryptographic functions such as DSA, EC-DSA, RSA, CRT, and prime generation are also supported. All commands are organized in a hierarchical structure according to their complexity. Our processor has high scalability and flexibility between speed, hardware area, and operand size. In the hardware evaluation using a 0.13-/spl mu/m CMOS standard cell library, the high-speed design using 117.5 Kgates with a 64-bit multiplier achieved operation times of 1.21 ms and 0.19 ms for a 160-bit EC scalar multiplication in GF(p) and GF(2/sup n/), respectively. A compact version with an 8-bit multiplier requires only 28.3 K gates and executes the operations in 7.47 ms and 2.79 ms. Not only 160-bit operations, but any bit length can be supported by any hardware configuration so long as the memory capacity is sufficient.

In this paper, we present a high-speed AES IP-core, which runs at 780 MHz on a 0. 13 /spl mu/m CMOS standard cell library, and which achieves 10 Gbps throughput in all encryption modes, including CBC mode. Although the CBC mode is the most widely used and important, achieving such high throughput was difficult because pipelining techniques cannot be applied. To reduce the propagation delays of the S-Box, the most critical function block, we developed a special circuit architecture that we call twisted-BDD, where the fanout of signals is distributed in the S-Box circuit. Our S-Box is 1.5 to 2 times faster than the conventional S-Box implementations. The T-Box algorithm, which merges the S-Box and another primitive function (MixColumns) into a single function, is also used for an additional speedup.

This paper describes the design methodology and the implementation of a merged logic/DRAM multimedia chip. The design is based on 0.25 micron DRAM-based CMOS technology with 4-layers of metal with device performance enhancement. Details of the architecture and system design of the multi-media was described in Katayama et. al. (1996). The present chip consists of 64 Mb of synchronous DRAM which is organized in two banks of eight 8 Mb SDRAM macros, a gate-array memory control and bus control unit, a custom-designed 8/spl times/32-bit parallel graphic processor, a 64-bit parallel ports for data transfer to/from the host processor bus, a 32-bit serial port for video display, and on-chip PLL. The multi-media co-processor chip provides high-density unified memory, high bus bandwidth (4.3 GB/s peak) and 1+GB/s BITBLT processing functions for an external host processor. The current design, floorplan and layout are structured in a way that, we believe, will provide a general framework for other merged logic/DRAM, ASIC+DRAM design for system scale integration.