IEEE TRANSACTIONS ON RELIABILITY, VOL. 68, NO. 4, DECEMBER 2019 1347 Reliable Architecture-Oblivious Error Detection Schemes for Secure Cryptographic GCM Structures Mehran Mozaffari Kermani , Senior Member, IEEE, and Reza Azarderakhsh , Member, IEEE Abstract—To augment the confidentiality property provided I. INTRODUCTION by block ciphers with authentication, the Galois Counter Mode (GCM) has been standardized by the National Institute of Stan- TANDARDIZED by the National Institute of Standards and dards and Technology. The GCM is used as an add-on to 128-bit S Technology, the GCM [1] is used in conjunction with block block ciphers, such as the Advanced Encryption Standard (AES), ciphers, such as the Advanced Encryption Standard (AES), SMS4, or Camellia, to verify the integrity of data. Prior works on Camellia, SMS4, and CLEFIA, through a hash function over the error detection of the GCM either use linear codes to protect the GCM architectures or are based on AES–GCM architectures, a binary finite field, to provide authentication, augmented to confining the mechanisms to the AES block cipher. Although such confidential data. structures are efficient, they are not only confined to specific ar- There have been previous proposed architectures for the GCM chitectures of the GCM but might also not fully take advantage in the literature. The FPGA bitstream encryption/authentication of the parallel architectures of the GCM. Moreover, linear codes through the GCM, bit-sliced implementations for 64-bit In- have been shown to be potentially ineffective with respect to biased faults. In this paper, we propose algorithm-oblivious constructions tel processors [2], and software-based implementations [3] are through recomputing with swapped ciphertext and additional au- among the early works adopting the GCM. Moreover, GCM thenticated blocks, which can be applied to the GCM architectures implementations, such as the ones in [4]–[9], provide the con- using different finite field multipliers in GF (2128). Such obliv- fidence to utilize the architectures for different secure applica- iousness for the proposed constructions used in the GCM gives tions. In addition, the algorithmic security of the GCM has been freedom to the designers. We present the results of error simula- tions and application-specific integrated circuit implementations scrutinized in recent studies [10], [11]. to demonstrate the utility of the presented schemes. Based on the The GCM provides authentication for encrypted/raw data; overhead/degradation tolerance for implementation/performance nevertheless, natural faults, e.g., through exposure to laser and metrics, one can fine-tune the proposed method to achieve more cosmic ray particles, such as alpha and gamma rays, and ma- reliable architectures for the GCM. licious faults undermine its reliability. Previous works on the Index Terms—Application-specific integrated circuit (ASIC), error detection of the GCM have either utilized linear codes, Galois Counter Mode (GCM), GF (2128) multiplier, reliability. e.g., parity and cyclic redundancy check (CRC) [7], or presented different combined AES–GCM error detection architectures by NOMENCLATURE carefully scrutinizing the implementation cycles [9]. In this paper, we present error detection schemes that are not ASIC Application-specific integrated circuit. confined to specific GCM architectures. We also verify the error FPGA Field-programmable gate array. coverage of the proposed approaches through error simulations GCM Galois Counter Mode. for both transient and permanent multiple and biased faults. Our GE Gate equivalent. schemes constitute algorithm-oblivious constructions through RESCAB Recomputing with swapped ciphertext and addi- RESCAB, which can be applied to the GCM architectures using tional authenticated blocks. different finite field multipliers in GF (2128); for example, in our experiments, we have used a quadratic and a subquadratic mul- tiplier to show the obliviousness of the proposed method. The obliviousness of our schemes comes from the fact they can be ap- Manuscript received November 20, 2017; revised March 12, 2018 and June 3, 2018; accepted September 1, 2018. Date of publication December 12, 2018; plied to different constructions (and are not confined to just one, date of current version November 26, 2019. The work of M. Mozaffari Kermani such as schemes that derive predicted signatures). For instance, and R. Azarderakhsh was supported by the National Institute of Standards and one can use different multipliers, different numbers of branches, Technology under the U.S. Federal Agency Award 60NANB16D245. Associate Editor: F. Belli. (Corresponding author: Mehran Mozaffari Kermani.) different finite fields, such as polynomial basis or normal ba- M. Mozaffari Kermani is with the Department of Computer Science and sis, and different modulo-2 addition trees. We benchmark the Engineering, University of South Florida, Tampa, FL 33620 USA (e-mail:, proposed architectures to assess their ability to detect transient [email protected]). R. Azarderakhsh is with the Department of Computer and Electrical Engi- and permanent faults by performing fault injection simulations. neering and Computer Science, Florida Atlantic University, Boca Raton, FL Moreover, we implement the proposed error detection architec- 33431 USA (e-mail:,[email protected]). tures on an ASIC platform using 65-nm standard-cell library. Color versions of one or more of the figures in this paper are available online at http://ieeexplore.ieee.org. This paper is organized as follows. In Section II, we present Digital Object Identifier 10.1109/TR.2018.2882484 the proposed error detection constructions for high-throughput 0018-9529 © 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications standards/publications/rights/index.html for more information. Authorized licensed use limited to: University of South Florida. Downloaded on February 16,2020 at 23:18:26 UTC from IEEE Xplore. Restrictions apply. 1348 IEEE TRANSACTIONS ON RELIABILITY, VOL. 68, NO. 4, DECEMBER 2019 Fig. 1. GCM architecture including GHASH. GCM. In this section, through case studies as well as through a the added output with the encrypted given input J0 ) is derived general formula, we propose our efficient error detection con- as shown in Fig. 1. The following example shows a simple struction. We, then, assess the proposed scheme on an ASIC, multiplication for GHASH in finite field. preceded by error injection simulations in Section III in order Example: Suppose we get the polynomial for the 128-bit hash to show the efficacy of the approach proposed in this paper. subkey (H) as H(x)=x27 + x25 + x20 + x4 + x +1. To find Finally, conclusions are presented in Section IV. the polynomial representing β(x)=(Xn−1 × H + Xn ) × H mod f(x), assuming the two 128-bit input blocks to GHASH as X x89 x23 x10 X x93 x24 x10 x II. PROPOSED ERROR DETECTION CONSTRUCTIONS n−1 = + + and n = + + + , one would need to perform a finite field multiplication followed by In the GCM, the encrypted blocks are asserted in conjunction reduction using the irreducible polynomial. We note that through with additional potential raw data, as shown in Fig. 1, to the the irreducible polynomial, we have x128 = x7 + x2 + x +1; Galois Hash (GHASH) function, which is constructed by finite thus, x129 = x8 + x3 + x2 + x, x130 = x9 + x4 + x3 + x2 , field multiplications with a fixed parameter [hash subkey (H)]. x131 = x10 + x5 + x4 + x3 , and the like. The final sim- A A In Fig. 1, 1 – m are additional authenticated data (ADD) (not plified answer for β(x)=(Xn− × H + Xn ) × H mod C C 1 encrypted) to be verified for integrity. Moreover, 1 – n−m −1 f(x) will have these powers of x: 120, 118, 113, 94, are the 128-bit ciphertext blocks derived through a given block 93, 91, 89, 77, 73, 64, 63, 60, 51, 50, 49, 44, 37, 35, cipher. Together with the ADD and an added 128-bit block for 31, 30, 26, 24, 23, 22, 21, 17, 16, 15, 14, 13, 8, 5, L n X specifying the length A,C , we get blocks of data, i.e., 1 – 3, i.e., β(x)=x120 + x118 + x113 + x94 + x93 + x91 + X n . The GCM can provide authentication assurance for addi- x89 + x77 + x73 + x64 + x63 + x60 + x51 + x50 + x49 + tional data (of practically unlimited length per invocation) that x44 + x37 + x35 + x31 + x30 + x26 + x24 + x23 + x22 + x21 are not encrypted. Such data are used to derive the authentica- + x17 + x16 + x15 + x14 + x13 + x8 + x5 + x3 . tion tag as part of the GCM. The plaintext and the additional authenticated data are the two categories of data that the GCM A. Motivation for the Proposed Approach protects. We note that the GCM protects the authenticity of the plaintext and the AAD. The GCM also protects the confiden- Error detection constructions of the GCM are important be- tiality of the plaintext, while the additional authenticated data cause if there are errors in the output of the GCM, the respective are protected in terms of authenticity. Such data might include tag would be calculated incorrectly and that would cause errors addresses, ports, sequence numbers, protocol version num- in providing authenticity. In other words, we note the following. bers, and other fields that indicate how the plaintext should be 1) If the block cipher output is faulty, the resulting tag would treated. be calculated based on that, causing an incorrect tag based n X The GHASH function calculates the following: i=1 i on the erroneous output. n−i+1 n n−1 2 H = X1 × H ⊕ X2 × H ⊕···⊕Xn−1 × H ⊕ 2) If the GHASH function is faulty, one would have a correct Xn × H. Note that we use the symbol ⊕ for XOR operation ciphertext with a wrong tag, which would cause failure in or modulo-2 addition and the symbol × for multiplication authenticity. in finite field. The hash subkey is generated by applying 3) If both these outputs are erroneous, not only do we get an the 128-bit block cipher to the “zero” input block, i.e., incorrect ciphertext but also an incorrect tag.