Efficient Implementation of Elliptic Curve Cryptography in Reconfigurable Hardware

Total Page:16

File Type:pdf, Size:1020Kb

Load more

EFFICIENT IMPLEMENTATION OF ELLIPTIC
CURVE CRYPTOGRAPHY IN
RECONFIGURABLE HARDWARE

by
E-JEN LIEN

Submitted in partial fulfillment of the requirements for the degree of Master of Science

Thesis Advisor: Dr. Swarup Bhunia
Department of Electrical Engineering and Computer Science
CASE WESTERN RESERVE UNIVERSITY

May, 2012

CASE WESTERN RESERVE UNIVERSITY
SCHOOL OF GRADUATE STUDIES

We hereby approve the thesis/dissertation of

E-Jen Lien

_____________________________________________________

Master of Science

candidate for the ______________________degree *.

Swarup Bhunia

(signed)_______________________________________________
(chair of the committee)

Christos Papachristou

________________________________________________

Frank Merat

________________________________________________ ________________________________________________ ________________________________________________ ________________________________________________

03/19/2012

(date) _______________________ *We also certify that written approval has been obtained for any proprietary material contained therein.

To my family

Contents

  • List of Tables
  • iii

  • v
  • List of Figures

Acknowledgements List of Abbreviations Abstract vi vii viii

  • 1 Introduction
  • 1

134
1.1 Research objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Thesis Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  • 2 Background and Motivation
  • 6

679
2.1 MBC Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Application Mapping to MBC . . . . . . . . . . . . . . . . . . . . . . 2.3 FPGA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 Mathematical Preliminary . . . . . . . . . . . . . . . . . . . . . . . . 10 2.5 Elliptic Curve Cryptography . . . . . . . . . . . . . . . . . . . . . . 10 2.6 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

i

  • 3 Design Principles and Methodology
  • 18

3.1 Curves over Prime Field . . . . . . . . . . . . . . . . . . . . . . . . . 18 3.2 Curves over Binary Field . . . . . . . . . . . . . . . . . . . . . . . . . 25 3.3 Software Code for ECC . . . . . . . . . . . . . . . . . . . . . . . . . . 31 3.4 RTL code for FPGA design . . . . . . . . . . . . . . . . . . . . . . . 31 3.5 Input Data Flow Graph (DFG) for MBC . . . . . . . . . . . . . . . . 31

  • 4 Implementation of ECC
  • 32

4.1 Software Implementation . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.1.1 Prime Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 4.1.2 Binary Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.2 Implementation in FPGA . . . . . . . . . . . . . . . . . . . . . . . . 35
4.2.1 Prime Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 4.2.2 Binary Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.3 Implementation in MBC . . . . . . . . . . . . . . . . . . . . . . . . . 44
4.3.1 Prime Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 4.3.2 Binary Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

  • 5 Test Results
  • 48

5.1 Test Patterns and Methodology . . . . . . . . . . . . . . . . . . . . . 49 5.2 Test Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

6 Conclusion and Future Work A Simulation Results
56 58

A.1 Prime field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 A.2 Binary field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

  • Bibliography
  • 61

ii

List of Tables

  • 2.1 Instruction set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
  • 8

5.1 Number of each operation from the data provided by NIST . . . . . . 50 5.2 Number of each operation in GF(p) from the data provided by NIST 50 5.3 Number of each operation in GF(2m) from the data provided by NIST 50 5.4 Power, Performance and Size Comparison . . . . . . . . . . . . . . . 50 5.5 The Comparison of 192 bit Point Multiplication in different Paper . . 54 5.6 The Comparison of 192 bit Scalar Multiplication in different Paper . 54 5.7 The Comparison of Point Multiplication in different Papers . . . . . . 55

iii

List of Figures

1.1 2011 ITRS ASIC Scaling trend prediction . . . . . . . . . . . . . . . . 2.1 Memory Logic Block Diagram . . . . . . . . . . . . . . . . . . . . . .
27
3.1 Squaring in Binary Field . . . . . . . . . . . . . . . . . . . . . . . . . 31 4.1 ECC hardware addition module . . . . . . . . . . . . . . . . . . . . . 36 4.2 ECC hardware subtraction module . . . . . . . . . . . . . . . . . . . 37 4.3 ECC hardware Montgomery module . . . . . . . . . . . . . . . . . . . 38 4.4 ECC hardware Inversion module . . . . . . . . . . . . . . . . . . . . . 39 4.5 ECC hardware Point Addition module . . . . . . . . . . . . . . . . . 40 4.6 ECC hardware Point Doubling module . . . . . . . . . . . . . . . . . 41 4.7 ECC hardware kp module . . . . . . . . . . . . . . . . . . . . . . . . 42 4.8 ECC hardware Right-to-left Shift-and-Add Multiply module . . . . . 42 4.9 Modified ECC hardware Right-to-left Shift-and-Add Multiply module 43 4.10 ECC hardware inversion module in GF(2m) . . . . . . . . . . . . . . 44 4.11 ECC hardware Itoh-Tsujii inversion module . . . . . . . . . . . . . . 44 4.12 ECC hardware Point Addition module in GF(2m) . . . . . . . . . . . 45 4.13 ECC hardware Point Doubling module in GF(2m) . . . . . . . . . . . 46

5.1 Energy comparison in prime field . . . . . . . . . . . . . . . . . . . . 51 5.2 Energy comparison in binary field . . . . . . . . . . . . . . . . . . . . 52 5.3 Energy comparison in all fields . . . . . . . . . . . . . . . . . . . . . . 52

iv
5.4 Performance comparison in prime field . . . . . . . . . . . . . . . . . 53 5.5 Performance comparison in binary field . . . . . . . . . . . . . . . . . 53 5.6 Performance comparison in all fields . . . . . . . . . . . . . . . . . . . 54

A.1 Functional simulation of ECC scalar multiplication in GF(p) . . . . . 58 A.2 Functional simulation of ECC scalar multiplication in GF(2m) . . . . 59 A.3 ECC scalar multiplication (with Itoh-Tsujii) in GF(2m) . . . . . . . . 60

v

Acknowledgements

There are so many people I have to express my thanks sincerely. First, I want to thank my family. My parents gave me a lot of support when I needed. My wife and daughter always cheered me up and boosted my confidence. My younger brother takes care of my parents and deals with a lot of things for me. Secondly, I want to express my sincere gratitude to my advisor - Dr. Swarup Bhunia. From my advisor, I learnt the passion of work and the attitude towards research. I also want to show my heartfelt appreciation to Professor Christos Papachristou and Professor Francis Merat for serving as my thesis committee members. Finally, I want to give my thanks to all members in the nanoscape laboratory whose advice continously helped me to improve my work.

vi

List of Abbreviations

ACP ANSI ASIC CPU DFG ECC FPGA FSM IC

Average CPU Power American National Standards Institute Application Specific Integrated Circuit Central Processing Unit Data Flow Graph Elliptic Curve Cryptography Field Programmable Gate Array Finite State Machine Integrated Circuit

ITRS LUT MBC MLB MSB NIST RSA TDP VLSI

International Technology Roadmap for Semiconductors Look-Up Table Memory Based Computing Memory Based Logic Block Most Significant Bit National Institute of Standards and Technology Rivest-Shamir-Adleman Thermal Design Power Very Large Scale Integration

vii

Efficient Implementation of Elliptic Curve Cryptography in
Reconfigurable Hardware

Abstract by
E-JEN LIEN

Elliptic curve cryptography (ECC) has emerged as a promising public-key cryptography approach for data protection. It is based on the algebraic structure of elliptic curves over finite fields. Although ECC provides high level of information security, it involves computationally intensive encryption/decryption process, which negatively affects its performance and energy-efficiency. Software implementation of ECC is often not amenable for resource-constrained embedded applications. Alternatively, hardware implementation of ECC has been investigated V in both application specific integrated circuit(ASIC) and field programmable gate array (FPGA) platforms V in order to achieve desired performance and energy efficiency. Hardware reconfigurable computing platforms such as FPGAs are particularly attractive platform for hardware acceleration of ECC for diverse applications, since they involve significantly less design cost and time than ASIC. In this work, we investigate efficient implementation of ECC in reconfigurable hardware platforms. In particular, we focus on implementing different ECC encryption algorithms in FPGA and a promising memory array based reconfigurable computing framework, referred to as MBC. MBC leverages the benefit of nanoscale memory, namely, high bandwidth, large density and small wire delay to drastically reduce the overhead of programmable interconnects. We evaluate the performance and energy efficiency of these platforms and compare those with a purely software implementation. We use the pseudo-random curve in the prime field and Koblitz curve in the binary field to do the ECC scalar multiplica-

viii tion operation. We perform functional validation with data that is recommended by NIST. Simulation results show that in general, MBC provides better energy efficiency than FPGA while FPGA provides better latency.

ix

Chapter 1 Introduction

In this chapter, we describe the research objectives, contribution of the thesis and outline of the thesis.

1.1 Research objectives

Energy efficiency during computation has emerged as a major design parameter in diverse applications and computing platforms [1][2][3][4][5][6][7][8]. According to the 2011 report from the International Technology Roadmap for Semiconductors (ITRS), the technology scaling trend for application specific integrated circuit (ASIC) can be depicted by Figure 1.1. It shows that although technology scaling provides consistent exponential improvement (following Moores law) in integration density, operating power is not scaling as desired. Consequently, addressing the power issue at circuit, architecture and application mapping level has been a major research area in the nanoscale technology regime. The energy issue can be more prominent for many compute-intensive tasks. Conventional software implementations of these tasks can be too power hungry or can be too slow to meet the requirements for many real-time and embedded applications. There is a growing trend to map these complex compute-intensive applications in

1reconfigurable hardware, such as field programmable gate array (FPGA). FPGA is an attractive computing platform since it can drastically reduce the hardware development/test cost and time. Alternative reconfigurable hardware platform such as memory based computing (MBC) platforms [9] [10] are also very promising at nanoscale technology. MBC platform relies on a dense two-dimensional memory array to perform computing in a spatio-temporal manner. Applications are decomposed into partitions, which can potentially be mapped as large look-up table (LUT) in the memory and a function can be evaluated by accessing the LUT contents over multiple cycles. Multiple MLB interacts in spatial manner to perform complex operation. The objective of the research presented in this thesis is to explore implementation of elliptic curve cryptography (ECC) algorithm in reconfigurable hardware and evaluate their performance and energy efficiency. In order to analyze potential benefit over traditional software-based implementation, we also compare these design parameters with an alternative implementation in software. We study different variants of ECC algorithms proposed in earlier works and analyze the relative merits and demerits of these algorithms in three alternative platforms.

Figure 1.1: 2011 ITRS ASIC Scaling trend prediction
2

1.2 Thesis Outline

From inception to completion, this thesis is dedicated in analyzing and evaluating the power, performance and resource usage (referred to as size) of Elliptic Curve Cryptography (ECC) among three different platforms, namely CPU, FPGA and MBC respectively.
In chapter one, we will describe the research objectives and contribution of our work.
The background and motivation will be mentioned in chapter two. Here we will introduce the hardware descriptions of the different platforms on which ECC is being mapped. It will describe in detail the programming techniques and the normal mode operation principle of the proposed MBC framework. Similar short descriptions on a commercially available FPGA and the underlying hardware is also described. Finally some mathematical background in field theorem, number theorem and ECC will also be introduced which will help the reader in understanding the actual algorithm which has to be mapped in the hardware framework.
Chapter three deals with the main algorithms that are namely sub-parts of Elliptic curve cryptography (ECC). The algorithms are listed and described in detail in this chapter. There are multiple variants of the same algorithm which can be mapped in the proposed framework. In this chapter, we have also described which algorithms are the most suitable choice in terms of resource usage and power consumption.
In chapter four, we will describe how to implement ECC in each platform. The details and structure of each design will be described. The detailed implementation results are also listed in chapter five. Detailed functional validation of the implemented design is also described in Chapter 4.
Finally in Chapter 5, we describe the conclusions and the future work which can potentially improve the already proposed work.

3

1.3 Contributions

The key contributions of the proposed work in this thesis are as follows:
1. In order to evaluate performance and energy efficiency of ECC implementation in reconfigurable hardware, we have mapped ECC algorithm in FPGA and MBC platforms. To compare with a traditional software implementation, we have also mapped it to software. The mapping is separately optimized in three platforms for performance.

2. We have implemented three different variants of the ECC algorithm on MBC platform, namely Prime Field, Binary Field (Binary Inversion) and Binary Field (Itoh-Tsujii Inversion). Our purpose is to show proposed MBC structure can deal with complex algorithms such as ECC and evaluate the ECC performance in MBC. The hardware resource of MBC is severely limited by its simple and regular structure. We adjust the input data flow graph representing ECC in the MBC mapping framework to improve performance and minimize resource requirements. All the three versions of ECC have also been mapped in software and FPGA.

3. We designed a novel fast ECC in GF(2m) on FPGA for Binary Field Binary
Inversion algorithm and optimized the design in terms of its performance. For all the implementations in software and hardware in the proposed work, the inversion step is applied and the coordinates are not pre-calculated. The applications which have been mapped in MBC and FPGA have been highly optimized so as to have competitive mapping performances in both frameworks.

4. After extensive functional validation of all the ECC implementations (three platforms and three different algorithm), we make a comparison of the performance, area and energy requirement of ECC in the three different platforms. We show that

4
MBC is superior in terms of performance and energy efficiency over software and in energy efficiency over a state-of-the-art commercially available FPGA device (Altera Stratix-IV).

5

Chapter 2 Background and Motivation

In this chapter, we will introduce some useful background knowledge relevant to this thesis. ECC is a very well-investigated topic. This chapter describes multiple existing implementations of ECC. Also, the background related to the MBC hardware and programming techniques of MBC are explained in this section, since it is useful to understand the structure of the hardware platform before writing the code to configure the hardware. We also introduce the FPGA structure so as to compare with the MBC hardware architecture. It is important to understand the distinctions between these two kinds of reconfigurable devices so that one can map ECC or any other application efficiently into the actual hardware.

2.1 MBC Architecture

The malleable hardware accelerator we used in this thesis was proposed by Dr. Somnath Paul and Professor Swarup Bhunia[9], [10]. The inner structure of the MBC and its operation principle is provided in Figure 2.1 by showing the basic process in initializing the MBC hardware. The configuration code is compiled and loaded into the memory, among which some memory will be used in storing data, others serve as Look-Up Tables (LUTs) to be configured to certain logic. Memory is accessed over

6multiple clock cycles to evaluate the complex functions. A sequence of operations are stored as microcodes in the schedule table. An application is mapped to an array of MLBs, which communicates in spatial manner.

Figure 2.1: Memory Logic Block Diagram

2.2 Application Mapping to MBC

The first thing that we have to do before programming on MBC is to understand the instruction sets that we have. In this case, there are thirteen basic instructions on MBC. We can use these instructions in our programs and combine them to do some complicated operations.
The instruction set is shown in Table ??. Consider the case where one executes an XOR operation on two 163-bit numbers.
Since the input bit-width of 163-bit exceeds the maximum computation bit-width supported by a single LUT, we must divide the operation into small pieces. For convenience and homogeneity, we always used 8-bit or 16-bit as our basic operation

7
Table 2.1: Instruction set

Type bitswC bitswC mult

  • Subtype
  • inputs

a0 b0 cin a1 b1 cin a2 b2
Outputs sum count diff borrow prod
2inadd 2insub rand delay shift rot

  • rand
  • a3

a4 # a3 delay a4 shift a5 rot left/right left/right rand a5 #

  • sel
  • a6 b6 c6 d6 sel

a7 b7 c7 addr out lut out loadVal complex load store rand
#width #width #width addr Val

  • PRaddr en
  • loadPR
  • loadVal

storePR #width PRaddr storeval en

unit. We first divide the 163-bit number into eleven 16-bit arrays. Then we write the program to store the data into memory. When the program is being executed, the data loaded from the memory depends on the memory address base. The memory address is incremented after each loading. We do the XOR operation between two arrays and store the results into the temporary register. For applications whose computations involve large numbers, such as AES, RSA or ECC, significant power and latency will be incurred in these load/store operations. However, if we can code the program cautiously and pre-compute the output memory address or variable, we can reduce the number of operation memory load/store significantly. A sample data flow graph (DFG) which can be run on the MBC hardware is as follows:

CDFG sample name: v0000 type: complex subtype: rand inputs: baa00 g00 outputs: addraa00 en aa00 bitwidth: 4 4 name: v0001 type: complex subtype: rand inputs: bbb00 g00 outputs: addrbb00 en bb00 bitwidth: 4 4 name: v0002 type: complex subtype: rand inputs: bpp00 g00 outputs: addrpp00 en pp00 bitwidth: 4 4 name: v0003 type: complex subtype: rand inputs: bcc00 g00 outputs: addrcc00 en cc00 bitwidth: 4 4 name: v0004 type: loadPR subtype: 16 inputs: addraa00 en aa00 outputs: aa00 in bitwidth: 4 1 name: v0005 type: loadPR subtype: 16 inputs: addrbb00 en bb00 outputs: bb00 in bitwidth: 4 1

8

name: v0006 type: loadPR subtype: 16 inputs: addrpp00 en pp00 outputs: pp00 in bitwidth: 4 1 name: v0007 type: bits subtype: xor inputs: aa00 in bb00 in pp00 in outputs: cc00 bitwidth: 16 16 16 name: v0008 type: storePR subtype: 16 inputs: addrcc00 cc00 en cc00 outputs: bitwidth: 4 16 1 name: v0009 type: bitswC subtype: 2inadd inputs: loop00 one zero outputs: loop01 uloop00 bitwidth: 4 1 1 name: v0010 type: delay subtype: rand inputs: loop01 outputs: loop00 bitwidth: 4 name: v0011 type: complex subtype: rand inputs: loop00 outputs: g00 bitwidth: 4 endCDFG

This is the standard file format of an application given as an input to the software, which maps the input application to the actual hardware depending on the mapping and routing resources available.

2.3 FPGA

FPGA is a widely used reconfigurable device [11]. It is composed of a sea of configurable logic blocks and programmable interconnects. It has many features as described in [12] and multiple advantages which are as listed below: 1. Build a prototype rapidly. 2. Easy to migrate the design to different IC process. 3. Integrated tools and design flow from coding to hardware implementation. 4. Powerful tools can be used in timing and power analysis.
FPGAs are widely used as hardware design and validation platform. We use
SRAM-based reconfigurable FPGAs in this work.
In this thesis, we use Xilinx and Altera FPGA as our platforms to be consistent with previous work so that we can compare our results with them. This also allows us to compare the results on all platforms at the same technology node. The FPGA that we choose to perform the power analysis on is the Stratix IV series. Since we develop the MBC model under 45nm technology node, we try to find the FPGA with a close

Recommended publications
  • A High-Speed Constant-Time Hardware Implementation of Ntruencrypt SVES

    A High-Speed Constant-Time Hardware Implementation of Ntruencrypt SVES

    A High-Speed Constant-Time Hardware Implementation of NTRUEncrypt SVES Farnoud Farahmand, Malik Umar Sharif, Kevin Briggs, Kris Gaj Department of Electrical and Computer Engineering, George Mason University, Fairfax, VA, U.S.A. fffarahma, msharif2, kbriggs2, [email protected] process a year later. Among the candidates, there are new, Abstract—In this paper, we present a high-speed constant- substantially modified versions of NTRUEncrypt. However, in time hardware implementation of NTRUEncrypt Short Vector an attempt to characterize an already standardized algorithm, Encryption Scheme (SVES), fully compliant with the IEEE 1363.1 Standard Specification for Public Key Cryptographic Techniques in this paper, we focus on the still unbroken version of the Based on Hard Problems over Lattices. Our implementation algorithm published in 2008. We are not aware of any previous follows an earlier proposed Post-Quantum Cryptography (PQC) high-speed hardware implementation of the entire NTRUEn- Hardware Application Programming Interface (API), which crypt SVES scheme reported in the scientific literature or facilitates its fair comparison with implementations of other available commercially. Our implementation is also unique in PQC schemes. The paper contains the detailed flow and block diagrams, timing analysis, as well as results in terms of latency (in that it is the first implementation of any PQC scheme following clock cycles), maximum clock frequency, and resource utilization our newly proposed PQC Hardware API [3]. As such, it in modern high-performance Field Programmable Gate Arrays provides a valuable reference for any future implementers of (FPGAs). Our design takes full advantage of the ability to paral- PQC schemes, which is very important in the context of the lelize the major operation of NTRU, polynomial multiplication, in ongoing NIST standard candidate evaluation process.
  • FIDO Technical Glossary

    FIDO Technical Glossary

    Client to Authenticator Protocol (CTAP) Implementation Draft, February 27, 2018 This version: https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id- 20180227.html Previous Versions: https://fidoalliance.org/specs/fido-v2.0-ps-20170927/ Issue Tracking: GitHub Editors: Christiaan Brand (Google) Alexei Czeskis (Google) Jakob Ehrensvärd (Yubico) Michael B. Jones (Microsoft) Akshay Kumar (Microsoft) Rolf Lindemann (Nok Nok Labs) Adam Powers (FIDO Alliance) Johan Verrept (VASCO Data Security) Former Editors: Matthieu Antoine (Gemalto) Vijay Bharadwaj (Microsoft) Mirko J. Ploch (SurePassID) Contributors: Jeff Hodges (PayPal) Copyright © 2018 FIDO Alliance. All Rights Reserved. Abstract This specification describes an application layer protocol for communication between a roaming authenticator and another client/platform, as well as bindings of this application protocol to a variety of transport protocols using different physical media. The application layer protocol defines requirements for such transport protocols. Each transport binding defines the details of how such transport layer connections should be set up, in a manner that meets the requirements of the application layer protocol. Table of Contents 1 Introduction 1.1 Relationship to Other Specifications 2 Conformance 3 Protocol Structure 4 Protocol Overview 5 Authenticator API 5.1 authenticatorMakeCredential (0x01) 5.2 authenticatorGetAssertion (0x02) 5.3 authenticatorGetNextAssertion (0x08) 5.3.1 Client Logic 5.4 authenticatorGetInfo (0x04)
  • White-Box Implementation of the Identity-Based Signature Scheme in the IEEE P1363 Standard for Public Key Cryptography

    White-Box Implementation of the Identity-Based Signature Scheme in the IEEE P1363 Standard for Public Key Cryptography

    IEICE TRANS. INF. & SYST., VOL.E103–D, NO.2 FEBRUARY 2020 188 INVITED PAPER Special Section on Security, Privacy, Anonymity and Trust in Cyberspace Computing and Communications White-Box Implementation of the Identity-Based Signature Scheme in the IEEE P1363 Standard for Public Key Cryptography Yudi ZHANG†,††, Debiao HE†,††a), Xinyi HUANG†††,††††, Ding WANG††,†††††, Kim-Kwang Raymond CHOO††††††, Nonmembers, and Jing WANG†,††, Student Member SUMMARY Unlike black-box cryptography, an adversary in a white- box security model has full access to the implementation of the crypto- graphic algorithm. Thus, white-box implementation of cryptographic algo- rithms is more practical. Nevertheless, in recent years, there is no white- box implementation for public key cryptography. In this paper, we propose Fig. 1 A typical DRM architecture the first white-box implementation of the identity-based signature scheme in the IEEE P1363 standard. Our main idea is to hide the private key to multiple lookup tables, so that the private key cannot be leaked during the algorithm executed in the untrusted environment. We prove its security in both black-box and white-box models. We also evaluate the performance gram. However, the adversary does not have the permis- of our white-box implementations, in order to demonstrate utility for real- sion to access the internal process of the program’s execu- world applications. tion. In practice, an adversary can also observe and mod- key words: white-box implementation, white-box security, IEEE P1363, ify the algorithm’s implementation to obtain the internal de- identity-based signature, key extraction tails, such as the secret key.
  • IEEE P1363.3 Standard Specifications for Public Key Cryptography

    IEEE P1363.3 Standard Specifications for Public Key Cryptography

    IEEE P1363.3 D1 IBKAS January 29, 2008 IEEE P1363.3 Standard Specifications for Public Key Cryptography: Identity Based Key Agreement Scheme (IBKAS) Abstract. This document specifies pairing based, identity based, and authenticated key agreement techniques. One of the advantages of Identity Based key agreement techniques is that there is no public key transmission and verification needed. Contents 1. DEFINITIONS ......................................................................................................................................... 2 2. TYPES OF CRYPTOGRAPHIC TECHNIQUES ................................................................................ 2 2.1 GENERAL MODEL .................................................................................................................................. 2 2.2 PRIMITIVES............................................................................................................................................ 2 2.3 SCHEMES ............................................................................................................................................... 3 2.4 ADDITIONAL METHODS ......................................................................................................................... 3 2.5 TABLE SUMMARY.................................................................................................................................. 3 3. PRIMITIVES FOR IDENTITY BASED KEY AGREEMENT PROBLEM...................................... 4 3.1 PRIMITIVES BORROWED FROM
  • IEEE P1363.2: Password-Based Cryptography

    IEEE P1363.2: Password-Based Cryptography

    IEEE P1363.2: Password-based Cryptography David Jablon CTO, Phoenix Technologies NIST PKI TWG - July 30, 2003 What is IEEE P1363.2? • “Standard Specification for Password-Based Public-Key Cryptographic Techniques” • Proposed standard • Companion to IEEE Std 1363-2000 • Product of P1363 Working Group • Open standards process PKI TWG July 2003 IEEE P1363.2: Password-based Cryptography 2 One of several IEEE 1363 standards • Std 1363-2000 • Sign, Encrypt, Key agreem’t, using IF, DL, & EC families • P1363a • Same goals & families as 1363-2000 • P1363.1: Lattice family • Same goals as 1363-2000, Different family • P1363.2: Password-based • Same families • More ambitious goals PKI TWG July 2003 IEEE P1363.2: Password-based Cryptography 3 Scope of P1363.2 • Modern “zero knowledge” password methods • Uses public key techniques • Uses two or more parties • Needs no other infrastructure • Authenticated key establishment • Resists attack on low-grade secrets • passwords, password-derived keys, PINs, ... PKI TWG July 2003 IEEE P1363.2: Password-based Cryptography 4 Rationale (1) • Why low-grade secrets? • People have trouble with high-grade keys • storage -- memorizing • input -- attention to detail • output -- typing • Passwords are ubiquitous • Easy for people to memorize, recognize, and type. • Reduce security/convenience tradeoffs. PKI TWG July 2003 IEEE P1363.2: Password-based Cryptography 5 Rationale (2) • Why use public-key techniques? • Symmetric methods can’t do it. • Why new methods? • Different than symmetric, hash, or other PK crypto. • AES, SHA-1, DH, and RSA can’t do it alone. PKI TWG July 2003 IEEE P1363.2: Password-based Cryptography 6 Chosen Password Quality Summarized from Distribution Morris & Thompson ‘79, Klein ‘90, Spafford ‘92 0 30 or so 60 or so Password Entropy (bits) History of protocols that fail to dictionary attack (or worse) • Clear text password π • Password as a key Eπ (verifiable text) • (e.g.
  • The Martini Synch

    The Martini Synch

    The Martini Synch Darko Kirovski, Michael Sinclair, and David Wilson Microsoft Research Contact: {darkok,sinclair,dbwilson}@microsoft.com Technical Report MSR-TR-2007-123 September 2007 Microsoft Research One Microsoft Way Redmond, WA 98052, USA http://research.microsoft.com The Martini Synch Darko Kirovski, Michael Sinclair, and David Wilson Microsoft Research Abstract. Device pairing is a significant problem for a large class of increasingly popular resource-constrained wireless protocols such as BlueTooth. The objective of pairing is to establish a secure wireless communication channel between two specific devices without a public-key infrastructure, a secure near-field communi- cation channel, or electrical contact. We use a surprising user-device interaction as a solution to this problem. By adding an accelerometer, a device can sense its motion in a Cartesian space relative to the inertial space. The idea is to have two devices in a fixed, relative position to each other. Then, the joint object is moved randomly in 3D for several seconds. The unique motion generates approximately the same distinct signal at the accelerometers. The difference between the signals in the two inertially conjoined sensors should be relatively small under normal motion induced manually. The objective is to derive a deterministic key at both sides with maximized entropy that will be used as a private key for symmetric encryption. Currently, our prototype produces between 10–15 bits of entropy per second of usual manual motion using off-the-shelf components. Keywords: device pairing, key exchange, fuzzy hashing, error correction. 1 INTRODUCTION Establishing a secure session is one of the least efficiently resolved problems with mod- ern low-cost wireless protocols such as BlueTooth [1].
  • A Low-Power Design for an Elliptic Curve Digital Signature Chip

    A Low-Power Design for an Elliptic Curve Digital Signature Chip

    A Low-Power Design for an Elliptic Curve Digital Signature Chip Richard Schroeppel, Cheryl Beaver, Rita Gonzales, Russell Miller, and Timothy Draelos Sandia National Laboratories Albuquerque, NM 87185-0785 {rschroe, cbeaver, ragonza, rdmille, tjdrael}@sandia.gov Abstract. We present a VHDL design that incorporates optimizations intended to provide digital signature generation with as little power, space, and time as possible. These three primary objectives of power, size, and speed must be balanced along with other important goals, including flexibility of the hardware and ease of use. The highest-level function offered by our hardware design is Elliptic Curve Optimal El Gamal digital signature generation. Our parameters are defined over the finite field GF (2178), which gives security that is roughly equivalent to that provided by 1500-bit RSA signatures. Our optimizations include using the point-halving algorithm for elliptic curves, field towers to speed up the finite field arithmetic in general, and further enhancements of basic finite field arithmetic operations. The result is a synthesized VHDL digital signature design (using a CMOS 0.5µm,5V ,25◦C library) of 191,000 gates that generates a signature in 4.4 ms at 20 MHz. Keywords: Digital Signature, Elliptic Curve, ECDSA, Optimal El Gamal, Characteristic 2, Field Towers, Trinomial Basis, Quadratic Equa- tion, Qsolve, Almost-Inverse Algorithm, Point Halving, Signed Sliding Window, GF(289), GF(2178), Hardware, VHDL, Low Power 1 Introduction While the value of elliptic curve arithmetic in enabling public-key cryptography to serve in resource-constrained environments is well accepted, efforts in cre- ative implementations continue to bear fruit.
  • FPGA Implementation of Post-Quantum Cryptography Recommended by NIST

    FPGA Implementation of Post-Quantum Cryptography Recommended by NIST

    University of Windsor Scholarship at UWindsor Electronic Theses and Dissertations Theses, Dissertations, and Major Papers 3-10-2021 FPGA Implementation of Post-Quantum Cryptography Recommended by NIST Xi Gao University of Windsor Follow this and additional works at: https://scholar.uwindsor.ca/etd Recommended Citation Gao, Xi, "FPGA Implementation of Post-Quantum Cryptography Recommended by NIST" (2021). Electronic Theses and Dissertations. 8556. https://scholar.uwindsor.ca/etd/8556 This online database contains the full-text of PhD dissertations and Masters’ theses of University of Windsor students from 1954 forward. These documents are made available for personal study and research purposes only, in accordance with the Canadian Copyright Act and the Creative Commons license—CC BY-NC-ND (Attribution, Non-Commercial, No Derivative Works). Under this license, works must always be attributed to the copyright holder (original author), cannot be used for any commercial purposes, and may not be altered. Any other use would require the permission of the copyright holder. Students may inquire about withdrawing their dissertation and/or thesis from this database. For additional inquiries, please contact the repository administrator via email ([email protected]) or by telephone at 519-253-3000ext. 3208. FPGA Implementation of Post-Quantum Cryptography Recommended by NIST by Xi Gao A Thesis Submitted to the Faculty of Graduate Studies through Electrical and Computer Engineering in Partial Fulfilment of the Requirements for the Degree of Master of Applied Science at the University of Windsor Windsor, Ontario, Canada 2021 © 2021, Xi Gao FPGA Implementation of Post-Quantum Cryptography Recommended by NIST by Xi Gao APPROVED BY: X.
  • Hardware Architectures of Elliptic Curve Based Cryptosystems Over Binary Fields

    Hardware Architectures of Elliptic Curve Based Cryptosystems Over Binary Fields

    Hardware Architectures of Elliptic Curve Based Cryptosystems over Binary Fields Chang Shu Doctoral Dissertation Defense Feb. 8, 2007 Advisor: Dr. Kris Gaj Dept. of Electrical & Computer Engineering George Mason University 1 Acknowledgements Dr. Kris Gaj (Dissertation Director) Dr. Soonhak Kwon (Dept. of Mathematics, Sungkyunkwan University, Korea) Dr. Shih-Chun Chang (Committee Member) Dr. Brian L. Mark (Committee Member) Dr. Ravi Sandu (Committer Member) Dr. Andre Manitius (Chair of ECE) Dr. Yariv Ephraim (Ph.D. Coordinator) Dr. Tarek El-Ghazawi (Dept. of ECE at The George Washington University) 2 Overview • Introduction – Elliptic Curve Cryptography – Tate Pairing Based Cryptography • Architectures for Finite Field Arithmetic – Polynomial basis multiplier – Normal basis multiplier – Composite field arithmetic • Architectures for Elliptic Curve Cryptosystems – Optimizations for a single FPGA device – Reconfigurable computing approach • Architectures for Tate Pairing Based Cryptosystems – Optimizations for a single FPGA device – Reconfigurable computing approach • Summary 3 Elliptic Curve Cryptosystems • Family of public key cryptosystems • Invented in 1985 by Miller and Koblitz independently • Used primarily for digital signatures & key exchange • Included in multiple industry, government, and banking standards, such as IEEE p1363, ANSI 9.62, and FIPS 186-2 • Part of standard security protocols, such as IPSec and SSL (proposed extension) 4 Why Elliptic Curve Cryptography ? – ECC vs. RSA Key size comparison: Security Level (bits) 80 112
  • Competency Models

    Competency Models

    SCIENCE, TECHNOLOGY, ENGINEERING & MATHEMATICS Architectural and Engineering Managers ACCCP Engineering and Technology Alabama Competency Model Architectural and Engineering Managers Code 1 Tier 1: Personal Effectiveness Competencies 1.1 Interpersonal Skills: Displaying the skills to work effectively with others from diverse backgrounds. 1.1.1 Demonstrating sensitivity/empathy 1.1.1.1 Show sincere interest in others and their concerns. 1.1.1.2 Demonstrate sensitivity to the needs and feelings of others. 1.1.1.3 Look for ways to help people and deliver assistance. 1.1.2 Demonstrating insight into behavior Recognize and accurately interpret the communications of others as expressed through various 1.1.2.1 formats (e.g., writing, speech, American Sign Language, computers, etc.). 1.1.2.2 Recognize when relationships with others are strained. 1.1.2.3 Show understanding of others’ behaviors and motives by demonstrating appropriate responses. 1.1.2.4 Demonstrate flexibility for change based on the ideas and actions of others. 1.1.3 Maintaining open relationships 1.1.3.1 Maintain open lines of communication with others. 1.1.3.2 Encourage others to share problems and successes. 1.1.3.3 Establish a high degree of trust and credibility with others. 1.1.4 Respecting diversity 1.1.4.1 Demonstrate respect for coworkers, colleagues, and customers. Interact respectfully and cooperatively with others who are of a different race, culture, or age, or 1.1.4.2 have different abilities, gender, or sexual orientation. Demonstrate sensitivity, flexibility, and open-mindedness when dealing with different values, 1.1.4.3 beliefs, perspectives, customs, or opinions.
  • White Blue and Lightnings

    White Blue and Lightnings

    Sirius Microtech LLC Innovative People Connectivity and Interoperability Of Embedded Systems Raja D. Singh http://www.siriusmicrotech.com [email protected] Sirius Microtech LLC Innovative People Little bit about me ● Curious about how things work ● Electronics and Communications Engineer ● Hardware Engineer ● Software, Firmware Architect ● Automation, Machine builder ● Senior Member of IEEE ● Vice Chair of IEEE Computer society, Foothills Section ● Chair of IEEE Consultants Network, Los Angeles ● Founder of Sirius Microtech LLC ● Attitude “Work is for fun” ● Currently working on IoT and LED Lighting applications Sirius Microtech LLC Innovative People Connectivity ● Ability to meaningful Communication ● Information exchange ● Possibility to correct errors ● Repeat reliably Sirius Microtech LLC Innovative People Why network? ● Connected computers serve content ● Contents consumed by other computers ● Consumption by users ● Place to buy my ‘Things’ ● Place of learn about ‘Things’ ● Place to socialize and do fun ‘Things’ ● Place to download ‘Things’ ● Market for personal computers – approximately 5! Sirius Microtech LLC Innovative People A networked device ● What is this ‘Thing’? ● A computing device ● Monitor and Control ● Collect ‘Information’ ● Work with other ‘Things’ ● Embedded system Sirius Microtech LLC Innovative People Embedded system ● Constrained ● Resource strapped ● Headless ● OS, Bare metal ● Battery or Mains powered ● Mostly low power ● Wearable or implantable ● Network connectible Sirius Microtech LLC Innovative
  • Copyrighted Material

    Copyrighted Material

    Chapter 1 Introduction 1.1 A HISTORICAL PERSPECTIVE OF INFORMATION AND NETWORK SECURITY 1.1.1 Hidden Messages Delivering messages in secrecy has been a serious concern since antiquity. Messages that conveyed personal, business, or state affairs were very critical for the well - being of a person, business or country, and as history has shown even in more recent times, the outcome of a war depended on the prompt and safe delivery of a critical message. The players involved in the transport of a secret message are the author and rightful sender, the courier or the transporting medium, the authorized receiver and the interceptor. Because the sender of the secret message was aware that there are those other than the authorized recipient who would attempt to gain knowledge of the content of the secret message, the sender used a coding method to encrypt the message and assure secrecy. The courier was initially a trusted person who at risk of life had to deliver the message to the authorized recipient. The interceptor, depending on sophistication and opportunistic factors, had several choices: attack and capture the message; attack and destroy the message; acquire knowledge of the message content but do not alter it; get hold of the message, alter it and send it to the recipient. The authorized recipient of the message should be able to decode the message, verify the authenticity of the received message and also detect if the message was intercepted and altered. The lessons learned over time forced senders to use more and more complex cryptographic methods to outsmart sophisticated and knowledgeable attackers.