Number Theoretical Transform (NTT) hardware accelerator becomes crucial building block in many cryptosystems like post-quantum cryptography. In this paper, we provide new insights into the construction of conflict-free memory mapping scheme (CFMMS) for multi-bank NTT architecture. Firstly, we offer parallel loop structure of arbitrary-radix NTT and propose two point-fetching modes. Afterwards, we transform the conflict-free mapping problem into conflict graph and develop novel heuristic to explore the design space of CFMMS, which turns out more efficient access scheme than classic works. To further verify the methodology, we design high-performance NTT/INTT kernels for Dilithium, whose area-time efficiency significantly outperforms state-of-the-art works on the similar FPGA platform.

Fully homomorphic encryption (FHE) is a novel encryption method that can perform operations on encrypted data. The performance of applications based on FHE is still low due to the high computational complexity of operations on the ciphertext. This article combines the characteristics of FHE and the redundant encoding method to achieve faster radix-2 arithmetic operations in BGV-like schemes. First, a ciphertext integer addition with multiplicative depth two, namely, redundant carry-free addition (RCFA), is proposed by applying the carry-free feature of the redundant encoding method. This addition is$7.207\times $faster and uses 15.0% of the occupied memory at 512 bits compared with the nonredundant method. After utilizing the single-instruction–multiple-data (SIMD) technique, RCFA with SIMD further improves the efficiency by$3903\times $at 512 bits compared with the nonredundant SIMD method. Its ciphertext size and occupied memory are only 34.59% and 1.6% those of the nonredundant SIMD method. Second, to achieve efficient ciphertext multiplications, redundant multiplication (RM) of dual SIMD data (RMDS) and RM of SIMD and non-SIMD data (RMSNS) methods are proposed; they obtain speedups of$65.6\times $and$631.0\times $, respectively, at 32 bits compared with the nonredundant implementations. Finally, SHA-256 is implemented to validate the efficiency of the proposed arithmetic operations. Compared with the nonredundant SIMD method, this article obtains a speedup of$4.34\times $.

Homomorphic encryption (HE) has broad application prospects in the cloud computing security field. Efficient homomorphic computations of primitive circuits are critical for the applications of HE. However, existing implementation methods over plaintext do not fit well with those over ciphertext. To address this issue, a concise evaluation model is proposed to compare different implementation methods, using weighted computational complexity (WCC). The number, depth, and distribution of homomorphic multiplications are considered together in the model for the first time. In addition, two primitive binary circuits on homomorphically encrypted data are optimized by using a unit called dot multiplication (DotMC). A novel comparison circuit based on DotMC is presented, and the number of homomorphic multiplications is reduced from O(n log n) to O(n) without increasing the multiplicative depth compared with the logarithm comparison, where n is the bit length of the operand. The WCC of comparison is reduced from O(n( log n)2) to O(n( log n)). The carry-lookahead adder is optimized by moving some DotMCs to levels with smaller weight, which reflects the effect of the distribution of homomorphic multiplications on performance. Finally, the proposed DotMC is accelerated with a single-instruction-multiple-data approach for even one operation; the number of homomorphic multiplication is reduced from O(n) to O( log n) compared with other comparison with the same strategy. Various circuits with the size from 4 to 2048 b are implemented with HElib to prove the optimization for comparison and addition, as well as the effectiveness of the proposed model.

Saber, the only module-learning with rounding-based algorithm in NIST's third round of post-quantum cryptography (PQC) standardization process, is characterized by simplicity and flexibility. However, energy-efficient implementation of Saber is still under investigation since the commonly used number theoretic transform can not be utilized directly. In this manuscript, an energy-efficient configurable crypto-processor supporting multi-security-level key encapsulation mechanism of Saber, is proposed. First, an 8-level hierarchical Karatsuba framework is utilized to reduce degree-256 polynomial multiplication to the coefficient-wise multiplication. Second, a hardware-efficient Karatsuba scheduling strategy and an optimized pre-/post-processing structure is designed to reduce the area overheads of scheduling strategy. Third, a task-rescheduling-based pipeline strategy and truncated multipliers are proposed to enable fine-grained processing. Moreover, multiple parameter sets are supported in LWRpro to enable configurability among various security scenarios. Enabled by these optimizations, LWRpro requires 1066, 1456 and 1701 clock cycles for key generation, encapsulation, and decapsulation of Saber768. The post-layout version of LWRpro is implemented with TSMC 40 nm CMOS process within 0.38 mm2. The throughput for Saber768 is up to 275k encapsulation operations per second and the energy efficiency is 0.15 uJ/encapsulation while operating at 400 MHz, achieving nearly 50× improvement and 31× improvement, respectively compared with current PQC hardware solutions.

Implantable medical devices (IMDs) typically rely on proprietary protocols to wirelessly communicate with external device programmers. In this paper, we fully reverse engineer the proprietary protocol between a device programmer and a widely used commercial neurostimulator from one of the leading IMD manufacturers. For the reverse engineering, we follow a black-box approach and use inexpensive hardware equipment. We document the message format and the protocol state-machine, and show that the transmissions sent over the air are neither encrypted nor authenticated. Furthermore, we conduct several software radio-based attacks that could compromise the safety and privacy of patients, and investigate the feasibility of performing these attacks in real scenarios.

True random number generators (TRNGs) are fundamental constituents of secure embedded cryptographic systems. In this paper, we introduce a general methodology for porting TRNG across different FPGA vendor families. In order to demonstrate our methodology, we applied it to the delay-chain based TRNG (DC-TRNG) on Intel Cyclone IV and Cyclone V FPGAs. We examine vendor-agnostic generality of the underlying DC-TRNG principle and propose modifications to address differences in structure of FPGAs. Implementation of the DC-TRNG on Cyclone IV uses 149 LEs (<;0.1% of available resources) and has a throughput of 5Mbps, while on Cyclone V it occupies 230 ALMs (<;1.5% of resources) with an output rate of 12.5 Mbps. The quality of the random bits produced by the DC-TRNG on Intel Cyclone IV and V is further confirmed by using NIST statistical test suite.

The objective of this paper is to provide insight on the design, evaluation and testing of modern True Random Number Generators (TRNGs) aimed towards certification. We discuss aspects related to each of these stages by means of two illustrative TRNG designs: PLL-TRNG and DC-TRNG. Topics covered in the paper include: the importance of formal security evaluations based on a stochastic model of the entropy source, the development of suitable and lightweight embedded tests to detect failures, the implementation and testing of TRNGs in dedicated FPGA platforms, and a robustness assessment to environmental and/or physical modifications.

Random number generation is a key function of today's secure devices. Commonly used for key generation, random number streams are more and more frequently used as the anchor of trust of several countermeasures such as masking. True Random Number Generators (TRNGs) thus become a relevant entry point for attacks that aim at lowering the security of integrated systems. Within this context, this paper investigates the robustness of TRNGs based on Ring Oscillators (focusing on the delay chain TRNG) against pulsed electromagnetic fault injection. Indeed, weaknesses in generating random bits for masking scheme degenerate the Side Channel resistance. Finally by exploiting fault results on delay chain TRNG some general guidelines to harden them are derived.

This paper presents a refined stochastic model of the delay-chain based true random number generator (DC-TRNG) and its application. DC-TRNG is a true random number generator for FPGAs that utilizes time-to-digital conversion (TDC) to accurately determine the position of the ring-oscillator jittery signal edge. Our stochastic model employs precise time characterization of the carry-chains that are used for TDC in the DC-TRNG. In order to determine lower bounds of the estimated min-entropy, the binary probabilities are calculated by applying the stochastic model. Based on these computed probabilities, we perform optimizations of the DC-TRNG parameters on two different FPGAs - Xilinx Spartan 6 and Intel Cyclone IV, in order to achieve the highest possible throughput of the DC-TRNG.

Physically unclonable functions are used for IP protection, hardware authentication and supply chain security. While many PUF constructions have been put forward in the past decade, only few of them are applicable to FPGA platforms. Strict constraints on the placement and routing are the main disadvantages of the existing PUFs on FPGAs, because they place a high effort on the designer. In this paper we propose a new delay-based PUF construction called Monte Carlo PUF, that does not require low-level placement and routing control. This construction relies on the on-chip Monte Carlo method that is applied for measuring the delays of logic elements in order to extract a unique device fingerprint. The proposed construction allows a trade-off between the evaluation time and the error rate. The Monte Carlo PUF is implemented and evaluated on Xilinx Spartan-6 FPGAs.

This paper analyses the security and privacy properties of a widely used insulin pump and its peripherals. We eavesdrop the wireless channel using Commercial Off-The-Shelf (COTS) software-based radios to intercept the messages sent between these devices; fully reverse-engineer the wireless communication protocol using a black-box approach; and document the message format and the protocol state-machine in use. The upshot is that no standard cryptographic mechanisms are applied and hence the system is shown to be completely vulnerable to replay and message injection attacks. Furthermore, sensitive patient health-related information is sent unencrypted over the wireless channel.

The semiconductor industry has been driving a major part of its growth through first the PC and more recently the mobile market. Unfortunately, the PC market is in decline and also the end of the growth curve for mobile products is in sight now that virtually everyone on the planet has a smartphone and/or tablet. Hence, the semiconductor industry is putting its bets on `Internet of Things' (IoT) as the next application wave that will allow them to sell a lot of silicon real estate. Although what exactly IoT encompasses is under definition and hence still volatile, the first emerging products depict an image which is quite different from the traditional microprocessors or smartphone SOCs: small but with ubiquitous presence, wirelessly connected, energy harvesting, equipped with smart sensors, secure, and low cost. All these aspects have a profound impact on the challenges, solutions, and associated trade-offs for testing IoT chips and provide rich grounds for research. This paper provides seven views from different angles.

True random number generators are essential components in cryptographic hardware. In this work, a novel entropy extraction method is used to improve throughput of jitter-based true random number generators on FPGA. By utilizing ultra-fast carry-logic primitives available on most commercial FPGAs, we have improved the efficiency of the entropy extraction, thereby increasing the throughput, while maintaining a compact implementation. Design steps and techniques are illustrated on an example of a ring-oscillator based true random number generator on Spartan-6 FPGA. In this design, the required accumulation time is reduced by 3 orders of magnitude compared to the most efficient oscillator-based TRNG on the same FPGA. The presented implementation occupies only 67 slices, achieves a throughput of 14.3 Mbps and it is provided with a formal evaluation of security.

Security is becoming ubiquitous in our society. However, the vulnerability of electronic devices that implement the needed cryptographic primitives has become a major issue. This paper starts by presenting a comprehensive overview of the existing attacks to cryptography implementations. Thereafter, the state-of-the-art on some of the most critical aspects of designing cryptographic co-processors are presented. This analysis starts by considering the design of asymmetrical and symmetrical cryptographic primitives, followed by the discussion on the design and online testing of True Random Number Generation. To conclude, techniques for the detection of Hardware Trojans are also discussed.

Hardware implementations of statistical tests are needed to detect failures and statistical weaknesses of entropy sources in True Random Number Generators on the fly. Current implementations of these tests work under the assumption that the entropy source produces independent, identically distributed (IID) numbers. However, some entropy sources produce non-IID data and rely on compression to provide the full entropy. Currently there are no embedded test implementations suitable for this type of entropy source. We provide the first FPGA implementation of embedded tests that estimate the generated min-Entropy and verify if it is within the expected boundaries.