Fully homomorphic encryption (FHE) is crucial for post-quantum privacy-preserving computing. Researchers have proposed various FHE schemes that excel at different encrypted computations, such as single-instruction multiple-data (SIMD) arithmetic or arbitrary single-data functions. Hybrid-scheme FHE, which exploits appropriate schemes for specific tasks, is essential for real-world applications requiring optimal performance and accuracy. However, existing FHE accelerators only adopt scheme-specific custom designs, leading to inefficiency or lack of capability to support applications in hybrid FHE settings. In this work, we propose a Unified FHE aCcelerator (UFC) that provides better performance and cost-efficiency than prior scheme-specific accelerators on hybrid FHE applications. Our design process involves a comprehensive analysis of processing flows to abstract the primitives covering all operations in hybrid FHE applications. The UFC architecture primarily comprises hardware function units for these primitives, diverging from the deeply pipelined units in previous designs. This approach enables high hardware utilization across different FHE schemes. Further-more, we propose several algorithm-hardware co-optimizations to minimize the hardware cost of supporting various data shuffling patterns in FHE. This enables high-throughput implementation of function units that provide good cost efficiency. We also propose several compiler-level optimizations to achieve high hardware utilization of the unified architecture for computing FHE data in various algorithmic parameter settings. We evaluate the performance of UFC on different FHE programs, including scheme-specific and hybrid-scheme workloads. Our experiments show that UFC provides up to 6.0 × speedup and 1.6 × delay-energy-area efficiency improvement over state-of-the-art FHE accelerators.

Cryptographic hardware accelerators and root-of-trust circuits like True-Random-Number-Generators (TRNG) and Physically-Unclonable-Functions (PUF) have become essential components of present-day secure platforms. These circuits provide an on-die boundary within which users are given assurances that data privacy and integrity is preserved during computations and transport between storage and compute elements. The focus of hardware security engineers over the past many years has been in improving performance while reducing area and power consumption of cryptographic circuits. This tidy scenario was disrupted by a spate of attacks on computing platforms reported in the past few years. These attacks employed techniques such as speculative side-channels, physical (power/electromagnetic) side-channels, voltage/clock glitching and fault-injection to extract embedded secrets such as encryption keys or access privileged sections of system memory.

This work presents a white-box modeling of the electromagnetic (EM) leakage from an integrated circuit (IC) to develop EM side-channel analysis (SCA)-aware design techniques. A new digital library cell layout design technique is proposed to minimize the EM leakage and is evaluated using a high-frequency structure simulator (HFSS)-based framework. Backed by our physics-based understanding of EM radiation, the proposed double-row power grid-based digital cell layout design shows$>5\times $reduction in the EM SCA leakage compared to the traditional digital logic gate layout design. Furthermore, exploiting the magneto-quasistatic (MQS) regime of operation of the EM leakage from the CMOS circuits, the HFSS-based framework is utilized to develop a pre-silicon (Si) EM SCA evaluation technique to assess the vulnerability of cryptographic implementations against such attacks during the design phase itself.

A 1028challenge-response strong-PUF circuit is fabricated in 14nm CMOS, demonstrating modeling attack resistance across 6-million training samples. Two-stage nonlinearly cascaded PUF array organization with adversarial challenge selection increases modeling complexity by 4×, limiting ML attack accuracy to ~50%. A configurable cross-coupled inverter-based entropy source with stability-aware challenge pruning enables 9.8× higher array density, linearly-scaling enrollment data and worst-case bit-error-rate of 0.26% measured across 650-850mV, 0-100°C operation.

This paper describes optimizations for the critical maximum exponent and alignment operations, with scalability for many-term fused floating-point dot-product units. The impact of these optimizations is quantified for up to 32-term BFloat16 weight/activation inputs with single-precision dot-product output, targeted for machine learning accelerators. Area and energy efficiency results are compared across performance targets, design parameters, and data statistics.

Low-area energy-efficient security primitives are key building blocks for enabling end-to-end content protection, user authentication in IoT platforms. This paper describes 3 designs that employ energy-efficient circuit techniques with optimal hardware-friendly arithmetic for seamless integration into area/battery constrained IoT systems: 1) A 2040-gate AES accelerator achieving 289Gbps/W efficiency in 22nm CMOS, 2) Hardened hybrid Physically Unclonable Function (PUF) circuit to generate a 100% stable encryption key. 3) All-digital TRNG to achieve >0.99 min-entropy with 3pJ/bit energy-efficiency.

The high-performance and energy-efficient encryption engines have emerged as a key component for modern System-On-Chip (SoC) in various platforms including servers, desktops, mobile, and IoT edge devices. A key bottleneck to secure operation of encryption engines is leakage of information through various side-channels. For example, an adversary can extract the secret key by performing statistical analysis on measured power and electromagnetic (EM) emission signatures generated by the hardware during encryption. Countermeasures to such side-channel attacks often come at high power, area, or performance overheads. Therefore, design of side-channel secure encryption engines is a critical challenge for high-performance and/or power-/energy efficient operations. This paper reviews that although low-power requirement imposes critical challenge for side-channel security, but circuit techniques traditionally developed for power management also present new opportunities for side-channel resistance. As a case study, we review the feasibility of using integrated voltage regulator and dynamic voltage frequency scaling normally used for efficient power management, for increasing power-side-channel resistance of AES engines. The hardware measurement results from test-chip fabricated in 130nm process are presented to demonstrate the impact of power management circuits on side-channel security.

Power attack is a critical challenge to security of encryption engines. Countermeasures to side-channel attacks often come at high power, area, or performance overhead. Therefore, design of side-channel secure encryption engines is a critical challenge for power-/resource-constrained platforms. This paper discusses that although low-power need imposes critical challenge for side-channel security, but circuit techniques traditionally developed for power management also present new opportunities for side-channel resistance. As a case-study, we show the feasibility of using integrated voltage regulator, normally used for efficient power management, for increasing side-channel resistance of AES engines.

Low-area energy-efficient security primitives are key building blocks for enabling end-to-end content protection, user authentication in IoT platforms. This paper describes 3 designs that employ energy-efficient circuit techniques with optimal hardware-friendly arithmetic for seamless integration into area/battery constrained IoT systems: 1) A 2040-gate AES accelerator achieving 289Gbps/W efficiency in 22nm CMOS, 2) Hardened hybrid Physically Unclonable Function (PUF) circuit to generate a 100% stable encryption key. 3) All-digital TRNG to achieve >0.99 min-entropy with 3pJ/bit energy-efficiency.

Low-area energy-efficient security primitives are key building blocks for enabling end-to-end content protection, user authentication and data security in IoT platforms. This talk describes the design of security circuit primitives that employ energy-efficient circuit techniques with optimal hardware-friendly arithmetic for seamless integration into area/battery-constrained IoT systems: 1) A 2040-gate AES accelerator achieving 289-Gbps/W efficiency in 22-nm CMOS, 2) Hardened hybrid physically unclonablef Function (PUF) circuit to generate a 100% stable encryption key. 3) All-digital TRNG to achieve >0.99-min-entropy with 3-pJ/bit energy efficiency. The talk will also discuss design issues related to side-channel leakage of key information, and how they may be addressed during design of encryption circuits. Finally, the talk will touch upon existing challenges of maintaining the integrity of security circuits, while still enabling testability and post-silicon validation.

This paper discusses the question of optimizing AES hardware designs, by using the composite field representation GF(24)2of the field GF(28), that underlies the definition of AES. Here, GF(24)2is the field extension of the ground field GF(24) with an extension polynomial of the form x2 + αx + β, where a and β are elements of field GF(24). Previous designs with such representations used α = 1, which seemingly leads to some obvious savings. By contrast, we seek the optimal designs among all the possibilities. Our designs are based on mapping the input, output, round keys, and the AES operations to and from any one of the 2880 possible representations of GF(28) as (24)2. For each representation, we also explore three options for the affine/invaffine constants, resulting in a total of 8640 possible designs. We identify the smallest area representations for AES encryption-only, decryption-only, and for unified encryptiondecryption. Surprisingly, the optimal representations in each case are different from each other. In addition, we identify six distinct representations that are optimal, based on operating-mode and AES pipeline depth. Among other results, we show here a set of high-bandwidth 16-byte AES datapaths with the extension polynomials of the form x2+ αx + β where α ≠ 1, showing that the a-priori obvious choice of using α = 1, does not necessarily lead to the best result. We provide the full details of all the designs possibilities, together with their respective area, based on 22nm CMOS implementation.

Low-area energy-efficient security primitives are key building blocks for enabling end-to-end content protection, user authentication, and consumer confidentiality in the IoT world that is estimated to surpass 50billion smart and connected devices by 2020. This paper describes design approaches that blend energy-efficient circuit techniques with optimal accelerator microarchitecture datapath, and hardware friendly arithmetic to achieve ultra-low energy consumption in security platforms for seamless adoption in area/battery constrained and self-powered systems. Industry leading energy-efficiency is demonstrated with three designs, fabricated and measured in advanced process technologies: 1) A 2040-gate arithmetically optimized composite-field Sbox based AES accelerator achieves 289Gbps/W peak energy-efficiency while offering 432Mbps throughput in 22nm tri-gate CMOS, 2) Hybrid Physically Unclonable Function (PUF) circuit leverages burn-in induced aging to reduce bit-error, followed by temporal-majority-voting, dark-bit masking, and error-correction conditioning techniques to generate a 100% stable full-entropy key with 190fJ/bit energy consumption in 22nm tri-gate CMOS. 3) A light-weight all digital TRNG uses in-line correlation suppressor and entropy-extractor circuits to achieve >0.99 min-entropy with 3pJ/bit measured energy-efficiency while operating down to 300mV in 14nm tri-gate CMOS.

This paper explores fully integrated inductive voltage regulators (FIVR) as a technique to improve the side channel resistance of encryption engines. We propose security aware design modes for low passive FIVR to improve robustness of an encryption-engine against statistical power attacks in time and frequency domain. A Correlation Power Analysis is used to attack a 128-bit AES engine synthesized in 130nm CMOS. The original design requires ~250 Measurements to Disclose (MTD) the 1st byte of key; but with security-aware FIVR, the CPA was unsuccessful even after 20,000 traces. We present a reversibility based threat model for the FIVR-based protection improvement and show the robustness of security aware FIVR against such threat.

Floating point multiply-accumulate (FPMAC) unitis the backbone of modern processors and is a key circuit determining the frequency, power and area of microprocessors. FPMAC unit is used extensively in contemporary client microprocessors, further proliferated with ISA support for instructions like AVX and SSE and also extensively used in server processors employed for engineering and scientific applications. Consequently design of FPMAC is of vital consideration since it dominates the power and performance tradeoff decisions in such systems. In this work we demonstrate a novel FPMAC design which focuses on optimal computations in the critical path and therefore making it the fastest FPMAC design as of today in literature. The design is based on the premise of isolating and optimizing the critical path computation in FPMAC operation. In this work we have three key innovations to create a novel double precision FPMAC with least ever gate stages in the timing critical path: a) Splitting near and far paths based on the exponent difference (d=Exy-Ez = {-2, -1, 0, 1} is near path and the rest is far path), b) Early injection of the accumulate add for near path into the Wallace tree for eliminating a 3:2compressor from near path critical logic, exploiting the small alignment shifts in near path and sparse Wallace tree for 53 bit mantissa multiplication, c) Combined round and accumulate add for eliminating the completion adder from multiplier giving both timing and power benefits. Our design by premise of splitting consumes lesser power for each operation where only the required logic for each case is switching. Splitting the paths also provides tremendous opportunities for clock or power gating the unused portion (nearly 15-20%) of the logic gates purely based on the exponent difference signals. We also demonstrate the support for all rounding modes to adhere to IEEE standard for double precision FPMAC which is critical for employment of this design in contemporary processor families. The demonstrated design outperforms the best known silicon implementation of IBM Power6 [6] by 14% in timing while having similar area and giving additional power benefits due to split handling. The design is also compared to best known timing design from Lang et al. [5] and outperforms it by 7% while being 30% smaller in area than it.

With technology scaling enabling integration of billions of transistors on a single processor core, deploying high-performance and energy-efficient encryption/decryption engines on-die has become a reality in the sub-45nm CMOS era. Not only does this enable increased security of processor platforms, but also achieves unprecedented improvements in power-performance through the adoption of specialized hardware accelerator engines for various compute-intensive cryptography algorithms. In this presentation, we describe novel arithmetic and data-path technologies to enable highspeed on-die AES encryption/decryption accelerators for processor security, Secure Hashing Algorithm (SHA) compute engines, Galois-Field multipliers for public-key cryptography acceleration and secure on-die key generation using fully-digital random number generators based on metastable state elements. Circuit and design optimizations to enable ultra-low voltage operation of these accelerators are discussed to achieve up to a 10X higher energy-efficiency and a wide dynamic operating voltage range that enables scalable AES encryption/decryption down to sub-10mW per round, enabling power-efficient security to permeate into future mobile/hand-held/wearable devices.

This paper describes an improved version of the Tenca-Koc unified scalable radix-2 Montgomery multiplier with half the latency for small and moderate precision operands and half the queue memory requirement. Like the Tenca-Koc multiplier, this design is reconfigurable to accept any input precision in either GF(p) or GF(2/sup n/) up to the size of the on-chip memory. An FPGA implementation can perform 1024-bit modular exponentiation in 16 ms using 5598 4-input lookup tables, making it the fastest unified scalable design yet reported.

In this paper, we motivate the concept of comparing very large scale integration adders based on their energy-delay characteristics and present results of our estimation technique. This stems from a need to make appropriate selection at the beginning of the design process. The estimation is quick, not requiring extensive simulation or use of computer-aided design tools, yet sufficiently accurate to provide guidance through various choices in the design process. We demonstrate the accuracy of the method by applying it to examples of high-performance 32- and 64-b adders in 100- and 130-nm CMOS technologies.

We motivate the concept of comparing VLSI adders based on their energy-delay trade-offs and present a technique for estimating the energy-delay space of various high-performance VLSI adder topologies. Further, we show that our estimates accurately represent tradeoffs in the energy-delay space for high-performance 32-bit and 64-bit processor adders in 0.13/spl mu/m and 0.10/spl mu/m CMOS technologies, with an accuracy of 8% in delay estimates and 20% in energy estimates, compared with simulated data.