This study proposes a new adaptive template attack scheme for extracting secret keys in Montgomery-ladder-based elliptic curve cryptography (ECC) by effectively exploiting the leakage difference between key bits 1 and 0. To determine the key length and number of computation cycles per bit of the ECC to be attacked, the proposed adaptive attack employs an adaptive leakage-windowing technique and correlation analysis on the power trace obtained from an ECC module with a secret key. The point of interest (POI) is identified at the bit with the maximum difference in leakage between key bits 1 and 0 using the leakage window per bit. The trace from the victim ECC hardware with secret key is compared to those collected in prior templates with key bits 1 and 0 to recover the key. To validate the performance, a Xilinx Artix-7 FPGA chip was used to implement an Edward-curve digital signature algorithm (EdDSA) with Ed25519 and SHA-512 accelerators. The experimental results show a favorable key recovery rate of 100%. Further attack results are presented for the ECC modules with advanced countermeasures against side-channel attack, such as projective coordinate and/or scalar randomization It is validated that the proposed adaptive attack is able to exploit successfully 100% the keys of Montgomery-ladder-based ECC accelerators without and with countermeasures of projective coordinate or scalar randomization. Only a heavily resource-consumed ECC module with implemented projective coordinate, scalar randomization and a cryptographic secure random number generator is capable of defending the proposed attack.

Montgomery modular multiplication is widely used in public-key cryptosystems. This work shows how to relax the data dependency in conventional word-based algorithms to maximize the possibility of reusing the current words of variables. With the greatly relaxed data dependency, we then proposed a novel scheduling scheme to alleviate the number of memory access in the developed scalable architecture. Analytical results show that the memory bandwidth requirement of the proposed scalable architecture is almost $(1/(w-1))$ times that of conventional scalable architectures, where $(w)$ denotes word size. The proposed one also retains a latency of exactly one cycle between the operations of the same words in two consecutive iterations of the Montgomery modular multiplication algorithm when employing enough processing elements. Compared to the design in the related work, experimental results demonstrate that the proposed one achieves an almost 54 percent reduction in power consumption with no degradation in throughput. The reduced number of memory access not only leads to lower power consumption, but also facilitates the design of scalable architectures for any precision of operands.

This work presents a look-up table-based (LUT-based) algorithm for scanline-based rendering of OpenVG. The proposed method can deal with arbitrary number of scissoring rectangles. The rasterization and scissoring in the proposed architecture can be performed concurrently to reduce rendering time. The scanline-size buffers used as scissoring LUTs result in low area overhead. Moreover, a linked list structure of scissoring rectangles is proposed in order that only the scissoring rectangles interacted with the processing scanline are accessed to increase bus efficiency and reduce power consumption. Implementation results based on TSMC 0.13-μm CMOS technology show that the proposed rasterization design with LUT-based scissoring can operate at 200 MHz with 77K gate counts. The proposed design can render 16.8 tiger images with 392×483 resolution per second assuming ideal bus latency. Compared to existing works, the proposed design achieves a smaller area and more functionality for higher display resolution with comparable throughput.

Montgomery modular multiplication is widely applied to public key cryptosystems like Rivest-Sharmir-Adleman (RSA) and elliptic curve cryptography (ECC). This work presents a word-based Booth encoded radix-4 Montgomery modular multiplication algorithm for low-latency scalable architecture. The data dependency resulting from the inherent right shifting of the intermediate results in the conventional radix-4 Montgomery modular multiplication algorithm is alleviated; thus the latency between the neighboring process elements (PEs) is exactly one cycle. The number of the equivalent operands in the accumulation is not increased with operand reduction scheme. Implementation results based on the same technology show that compared to other Booth encoded radix-4 Montgomery modular multipliers, the proposed design achieves at least 23% time reduction for accomplishing one 1024-bit Montgomery modular multiplication.

In this paper, we reformulated the conventional iterative division algorithm by substituting the pre-defined variable and then updating its initial value accordingly. The reformulated division algorithm allows a restructuring of the divider architecture to further improve its operating speed without increasing latency and area cost. Using the proposed fast algorithm, we developed a high-speed bit-serial GF(2m) divider. Analytical results show that the cost of the initial value update and variable transformation in the reformulated algorithm is almost negligible in the hardware implementation. Our divider reduces the critical path delay. Compared with related divider designs, the proposed design has time and area advantages.

Modular multiplication is a crucial operation in public key cryptosystems like RSA and elliptic curve cryptography (ECC). This paper presents a new word-based Montgomery modular multiplication algorithm which can be used to achieve a low-latency scalable architecture for efficient hardware implementations. We show how to relax the data dependency in conventional word-based algorithms so that a latency of exactly one cycle can be obtained regardless of the chosen word size w (w > 1). With the presented operand reduction scheme, the proposed scalable architecture can operate at high speeds and suitable data paths can be chosen for specific applications. Complexity analysis shows that the proposed architecture has the lowest latency and area complexity compared to related scalable architectures. Experimental results demonstrate that our design has area, speed, and flexibility advantages over related schemes.

With rapid increases in communication and network applications, cryptography has become a crucial issue to ensure the security of transmitted data. In this paper, we propose a microcode-based architecture with a novel reconfigurable datapath which can perform either prime field GF(p) operations or binary extension field GF(2m) operations for arbitrary prime numbers, irreducible polynomials, and precision. Using these field arithmetic units, users are capable of programming cryptographic algorithms in microcode sequences for full compliance with a majority of public-key cryptographic algorithms such as Rivest-Shamir-Adleman (RSA) and elliptic curve cryptosystems. An algorithmic optimization or refinement can thus be made at a higher level based on the reconfigurable datapath. Experimental results show that the developed processor has full cryptography algorithm flexibility, high hardware utilization, and high performance.

Embedded processors are ubiquitous in today's system-on-chip design. In addition to designing digital signal processors (DSPs) for various applications, developing efficient test methods with little overhead and desired fault coverage for DSPs are also crucial and practical. Compared with the scan-based test methods, the software-based self-test (SBST) method does not suffer from area overhead and performance degradation, and can provide at-speed test for DSPs with the potential drawbacks of lower fault coverage and a larger amount of test vectors. This paper explores techniques to improve the fault coverage of SBST methods for the developed DSP core with instructions fully compatible with those of the TI TMS320C54x. Experimental results exhibit that applying the developed SBST test flow obtains more than 96% fault coverage for our DSP core, which is higher than the reported values in related works.

In cryptographic applications, private key algorithms usually aim at high-throughput data communication, while public key algorithms require much lower throughput for private key exchange and authentication. To increase hardware utilization and reduce area overhead, this paper presents a flexible divider design in GF(2m), which can be configured to operate in either SIMD or SISD mode. When applied to SIMD applications, the divider can perform multiple divisions in parallel and output results per cycle; thus, it is suitable for AES cryptosystems demanding high throughput. In SISD applications, the divider is scalable and can handle different sizes of operand such as those specified in ECC standards. A scalable design can also relax the potential problem of high fanout control signals. Complexity analysis shows the proposed divider, operated in SIMD mode, has lower area complexity and higher throughput in comparison with related work.

Modular exponentiation for public-key cryptosystems is usually accomplished by repeated modular multiplications on large integers. A high-speed design of modular multiplication is thus very crucial to speed up the decryption/encryption process. In this paper, we first explore how to relax the data dependency existing among the multiplication, quotient determination, and modular reduction in conventional Montgomery modular multiplication algorithm. Then we proposed a new modular reduction algorithm with a smaller critical path delay in hardware implementation. The speed improvement is achieved by reducing the critical path delay from the 4-to-2 to 3-to-2 carry-save addition, and the resulting time complexity of our development is decreased by simultaneously performing the multiplication and modular reduction processes. Experimental results show that our modular exponentiation can obtain both time and area-time (AT) advantages compared with existing work.

This paper presents a high-speed multiplier/squarer design over finite field GF(2m) for large m. We extended the look-up table (LUT) based multiplication algorithm introduced by Hasan to reduce the LUT generation time and then showed how to effectively add the squaring operation to the developed multiplier. The unified multiplication/squaring module is very suitable for applications like Elliptic Curve Cryptography (ECC) in which these two types of operations are operated alternately. Experimental results exhibit that using the proposed sub-group, multiple look-up tables (SG-MLUT) based scheme, up to 29% improvement in the total computation time of multiplication can be achieved in comparison with that using Hasan’s algorithm. When employing the unified multiplier/squarer module instead of Hasan’s design in ECC applications, we can gain further improvement in the scalar multiplication time because no LUT generation is needed using our design, and obtain about 24.5% reduction on the resulting area-time (AT) complexity.

Modular exponentiation with a large modulus, which is usually accomplished by repeated modular multiplications, has been widely used in public key cryptosystems for secured data communications. To speed up the computation, the Montgomery modular multiplication algorithm is used to relax the process of quotient determination, and the carry-save addition (CSA) is employed to reduce the critical path delay. In this paper, based on the inherent data dependency between the modular multiplication and square operations in the H-algorithm of modular exponentiation, we present a new modular exponentiation architecture with a unified modular multiplication/square module and show how to reduce the number of input operands for the CSA tree by mathematical manipulation. The developed architecture has the following advantages. 1) There is no need to convert the carry-save form of an operand into its binary representation at the end of each modular multiplication. In this way, except the final step to get the result of modular exponentiation, the time-consuming carry propagation can then be eliminated. 2) The number of input operands for the CSA tree is reduced in a very efficient way. 3) The hardware saving is achieved with very limited impact on the original critical path delay when designed with two distinct modular multiplication and square components. Experimental results show that our modular exponentiation design obtains the least hardware complexity compared with the existing work and outperforms them in terms of area-time (AT) complexity as well.

Modular exponentiation for RSA cryptosystem is usually accomplished by repeated modular multiplications on large integers, which is considerably time-consuming. To speed up the operation, the Montgomery modular multiplication algorithm is employed to eliminate the trial division, and the carry-save addition is used to alleviate the carry propagation delay. In this paper, we propose a unified Montgomery modular multiplication algorithm that can be applied to fulfil either the conventional modular multiplication or squaring operation in carry-save form so as to achieve area-efficient design of modular exponentiation. Meanwhile, we reduce the number of input operands for carry-save addition by mathematical manipulation to minimize the resulting critical path delay. Compared with the existing works, our modular exponentiation design obtains the least hardware complexity and outperforms them in terms of area-time (AT) complexity.