The digital signature scheme SPHINCS+is a candidate in the NIST post-quantum project, whose aim is to standardize cryptographic systems that are secure against attacks originating from both quantum and classical computers. We present an efficient and, to our knowledge, first hardware implementation for SPHINCS+. Our systematic approach of a performance-optimized FPGA architecture results in a 100x speed-up compared to the reference software-only implementation. Our investigation on a real-world implementation revealed a weakness regarding fault injection. The attack breaks the scheme completely. Collecting enough private information to forge a signature is a matter of seconds on our setup. We discuss possible countermeasures. A “sign-then-verify” operation unfortunately does not detect a faulty signature, but a full replication of the hardware might make a detection possible.

Elliptic curve cryptography (ECC) is widely used as an efficient mechanism to secure private data using public-key protocols. This paper focuses on ECC over prime fields (GF(p)). We present a novel hardware architecture that calculates the elliptic curve point multiplication (ECPM). Our processor supports arbitrary prime fields with sizes up to 1024 bits. Different standards, which use curves in short Weierstrass form are supported. A Xilinx Virtex-7 implementation of the proposed hardware architecture takes from 0.69 ms for a 192-bit point multiplication up to 9.7 ms for 512-bit. The implementation takes only 20 DSP slices and 6816 LUTs. To the authors knowledge, this is the best performance reported so far for ECC point multiplication for arbitrary prime field curves without the use of FPGA reconfiguration.

Power-analysis (PA) based side-channel attacks are effective methods to attack RSA encryption systems and elliptic-curve cryptography (ECC). In this paper, we describe PA-based side-channel attacks aiming to extract the (randomly chosen) private key for an ECC-based cryptosystem in detail. We assume that for the cryptosystem to be attacked the private key will not be available for more than one basic operation. Hence, statistical methods, commonly applied in differential power analysis attacks to enhance the signal-to-noise ratio (SNR), may not be applied. To reach the required SNR for a successful attack, we have extended the analysis by frequency-selective filtering followed by data fragmentation and correlation. We show that the implementation of a "double-and-add-always" scheme for ECC point multiplication, which according to literature has been considered safe against simple PA, will not resist our analytical attack method. We argue that memory accesses are the root cause for a successful attack, and propose an extension of the double-and-add-always scheme to harden ECC hardware implementations adequately.

Designers of VLSI circuits for cryptographic applications are faced with a severe dilemma: Concerns of security, requiring encapsulation of cryptographic applications, and testability, requiring access to all hardware subunits to check for their correct functionality, are basically contradictory. A further security requirement is the immediate detection of failure inside the encryption component. In this paper, an approach based on a compound system test strategy is introduced that reconciles the demands of security and testability. This system test strategy based upon built-in self-test on all levels of implementation allows off-line and concurrent checking without opening access to sensitive regions via test structures. The realization of the system test scheme is a new VLSI cipher implementation, VINCI, that fulfills all security demands for immediate failure detection and supports higher level system test strategies.>

The design of a modular standard basis inversion for Galois fields GF(2/sup m/) based on Euclid's algorithm for computing the greatest common divisor of two polynomials is presented. The asymptotic complexity is linear with m both in computation time and area requirement, thus resulting in an AT-complexity of O(m/sup 2/). This is a significant improvement over the best previous proposal which achieves AT-complexity of only O(m/sup 3/).>

The high speed architecture for a VLSI implementation of a new smart-key block cipher is presented. The chip performs data encryption and decryption in a single hardware unit. It runs with a maximum clock frequency of 33 MHz permitting a data conversion rate of more than 55 Mb/s. This high data rate, compared to currently available DES (data encryption standard) implementations, has been achieved by implementing a pipelined architecture and by using a sophisticated data scheduling scheme guaranteeing a continuously fully loaded pipeline.>