A cryptographic processor for low-resource devices: canning ECDSA and AES like sardines

Authors:
Michael Hutter;Martin Feldhofer;Johannes Wolkerstorfer
Affiliations:
Institute for Applied Information Processing and Communications, Graz University of Technology, Graz, Austria;Institute for Applied Information Processing and Communications, Graz University of Technology, Graz, Austria;xFace, Graz, Austria
Venue:
WISTP'11 Proceedings of the 5th IFIP WG 11.2 international conference on Information security theory and practice: security and privacy of mobile devices in wireless communication
Year:
2011

Citing 17
Cited 2

Checking Before Output May Not Be Enough Against Fault-Based Cryptanalysis

IEEE Transactions on Computers
The Montgomery Inverse and Its Applications

IEEE Transactions on Computers
Differential Power Analysis

CRYPTO '99 Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology
Improved Elliptic Curve Multiplication Methods Resistant against Side Channel Attacks

INDOCRYPT '02 Proceedings of the Third International Conference on Cryptology: Progress in Cryptology
Resistance against Differential Power Analysis for Elliptic Curve Cryptosystems

CHES '99 Proceedings of the First International Workshop on Cryptographic Hardware and Embedded Systems
Montgomery Exponentiation with no Final Subtractions: Improved Results

CHES '00 Proceedings of the Second International Workshop on Cryptographic Hardware and Embedded Systems
The Montgomery Powering Ladder

CHES '02 Revised Papers from the 4th International Workshop on Cryptographic Hardware and Embedded Systems
A Scalable Dual-Field Elliptic Curve Cryptographic Processor

IEEE Transactions on Computers
Guide to Elliptic Curve Cryptography

Guide to Elliptic Curve Cryptography
Design and Implementation of Low-Area and Low-Power AES Encryption Hardware Core

DSD '06 Proceedings of the 9th EUROMICRO Conference on Digital System Design
Power Analysis Attacks: Revealing the Secrets of Smart Cards (Advances in Information Security)

Power Analysis Attacks: Revealing the Secrets of Smart Cards (Advances in Information Security)
Elliptic-Curve-Based Security Processor for RFID

IEEE Transactions on Computers
ECC Is Ready for RFID --- A Proof in Silicon

Selected Areas in Cryptography
Securing the Elliptic Curve Montgomery Ladder against Fault Attacks

FDTC '09 Proceedings of the 2009 Workshop on Fault Diagnosis and Tolerance in Cryptography
An ECDSA pocessor for RFID athentication

RFIDSec'10 Proceedings of the 6th international conference on Radio frequency identification: security and privacy issues
Low-resource hardware design of an elliptic curve processor for contactless devices

WISA'10 Proceedings of the 11th international conference on Information security applications
Low-Cost elliptic curve cryptography for wireless sensor networks

ESAS'06 Proceedings of the Third European conference on Security and Privacy in Ad-Hoc and Sensor Networks

Fault attack to the elliptic curve digital signature algorithm with multiple bit faults

Proceedings of the 4th international conference on Security of information and networks
Attacking an AES-Enabled NFC tag: implications from design to a real-world scenario

COSADE'12 Proceedings of the Third international conference on Constructive Side-Channel Analysis and Secure Design

Quantified Score

Hi-index	0.00

Visualization

Abstract

The Elliptic Curve Digital Signature Algorithm (ECDSA) and the Advanced Encryption Standard (AES) are two of the most popular cryptographic algorithms used worldwide. In this paper, we present a hardware implementation of a low-resource cryptographic processor that provides both digital signature generation using ECDSA and encryption/ decryption services using AES. The implementation of ECDSA is based on the recommended Fp192 NIST elliptic curve and AES uses 128-bit keys. In order to meet the low-area requirements, we based our design on a sophisticated hardware architecture where a 16-bit datapath gets heavily reused by all algorithms and the memory is implemented as a dedicated RAM macro. The proposed processor has a total chip area of 21 502 GEs where AES needs only 2 387 GEs and SHA-1 requires 889 GEs.