Car-to-car and car-to-infrastructure messages exchanged in intelligent transportation systems can reach reception rates over 1000 messages per second. As these messages contain elliptic curve digital signature algorithm (ECDSA) signatures, this puts a very heavy load onto the verification hardware. In fact, the load is so high that, currently, it can only be achieved by implementations running on high-end CPUs and field-programmable gate arrays. These implementations are far from cost-effective or energy efficient. In this paper, we present an application-specified integrated circuit implementation of a dedicated ECDSA verification engine that can reach verification rates of up to 27 000 verifications per second, which is by far the fastest implementation on a single core reported in the literature.

The design of secure yet efficiently implementable cryptographic algorithms is a fundamental problem of cryptography. Lately, lightweight cryptography--optimizing the algorithms to fit the most constrained environments--has received a great deal of attention, the recent research being mainly focused on building block ciphers. As opposed to that, the design of lightweight hash functions is still far from being well investigated with only few proposals in the public domain. In this paper, we aim to address this gap by exploring the design space of lightweight hash functions based on the sponge construction instantiated with present-type permutations. The resulting family of hash functions is called spongent. We propose 13 spongent variants--or different levels of collision and (second) preimage resistance as well as for various implementation constraints. For each of them, we provide several ASIC hardware implementations--ranging from the lowest area to the highest throughput. We make efforts to address the fairness of comparison with other designs in the field by providing an exhaustive hardware evaluation on various technologies, including an open core library. We also prove essential differential properties of spongent permutations, give a security analysis in terms of collision and preimage resistance, as well as study in detail dedicated linear distinguishers.

The first contribution of our paper is that we propose a platform, a design strategy, and evaluation criteria for a fair and consistent hardware evaluation of the second-round SHA-3 candidates. Using a SASEBO-GII field-programmable gate array (FPGA) board as a common platform, combined with well defined hardware and software interfaces, we compare all 256-bit version candidates with respect to area, throughput, latency, power, and energy consumption. Our approach defines a standard testing harness for SHA-3 candidates, including the interface specification for the SHA-3 module on our testing platform. The second contribution is that we provide both FPGA and 90-nm CMOS application-specific integrated circuit (ASIC) synthesis results and thereby are able to compare the results. Our third contribution is that we release the source code of all the candidates and by using a common, fixed, publicly available platform, our claimed results become reproducible and open for a public verification.

The testability of cryptographic cores brings an extra dimension to the process of digital circuits testing security. The benefits of the classical methods such as the scan-chain method introduce new vulnerabilities concerning the data protection. The Built-In Self-Test (BIST) is considered to be the most suitable countermeasure for this purpose. In this work we propose the use of a digit-serial multiplier over GF (2m), that is at the heart of many public-key cryptosystems, as a basic building block for the BIST circuitry. We show how the multiplier can be configuredto operate as a Test Pattern Generator and a Signature Analyzer. Furthermore, the multiplier becomes a fully self-testable design. All the additional features come at the cost of only a few extra gates. With a hardware overhead of 0.33 % this approach makes the multiplier perfectly suitable for low-end embedded devices.

IEEE Abstract—This paper proposes two improved interleaved modular multiplication algorithms based on Barrett and Montgomery modular reduction. The algorithms are simple and especially suitable for hardware implementations. Four large sets of moduli for which the proposed methods apply are given and analyzed from a security point of view. By considering state-of-the-art attacks on public-key cryptosystems, we show that the proposed sets are safe to use, in practice, for both elliptic curve cryptography and RSA cryptosystems. We propose a hardware architecture for the modular multiplier that is based on our methods. The results show that concerning the speed, our proposed architecture outperforms the modular multiplier based on standard modular multiplication by more than 50 percent. Additionally, our design consumes less area compared to the standard solutions. Index Terms—Modular multiplication, Barrett reduction, Montgomery reduction, public-key cryptography.

Testing of cryptographic chips or components has one extra dimension: physical security. The chip designers should improve the design if it leaks too much information through side-channels, such as timing, power consumption, electric-magnetic radiation, and so on. This requires an evaluation of the security level of the chip under different side-channel attacks before it is manufactured. This paper presents an FPGA-based testing strategy for cryptographic chips. Using a block-based architecture, a testing bus and a shadow FPGA, we are able to check information leakage of each block. We describe this strategy with an Elliptic Curve Cryptosystem (ECC) for RFID tags.

In this paper we show how modular reduction for integers with Barrett and Montgomery algorithms can be implemented efficiently without using a precomputational phase. We propose four distinct sets of moduli for which this method is applicable. The proposed modifications of existing algorithms are very suitable for fast software and hardware implementations of some public-key cryptosystems and in particular of Elliptic Curve Cryptography. Additionally, our results show substantial improvement when a small number of reductions with a single modulus is performed.

In this paper we present two new architectures of the RIPEMD-160 hash algorithm for high throughput implementations. The first architecture achieves the iteration bound of RIPEMD-160, i.e. it achieves a theoretical upper bound on throughput at the micro-architecture level. The second architecture is designed by performing a gate level optimization and achieves a better performance than the first one at the cost of a larger gate area. Throughputs of 3.122 Gbps and 624 Mbps are achieved, with and without pipelining, respectively.

We describe UV: a two-node system for unobservable voice communication on the Internet. UV provides unobservability of communication by hiding the fact that there is a conversation taking place. To achieve this, the system uses techniques such as encryption, constant traffic generation, equal packet sizes, and a fixed packet sending schedule. We evaluate the influence of the constant traffic generation on the general performance of UV with experiments on the Internet and in a wireless setting simulated with network simulator NS2. We conclude that although the requirements for privacy protection and usability are often mutually exclusive, they can still be combined in a way that they offer both reasonable performance and good privacy protection.