Lightweight Cryptography: Designing Crypto for Low Energy and Low Power

Transcription

1 Lightweight Cryptography: Designing Crypto for Low Energy and Low Power Miroslav Knežević NXP Semiconductors September 12, 2015 WEEE 2015, Espoo, Finland

2 Cryptography The Art of Writing Codes Κρυπτός (kryptós) hidden, secret Γράφειν (graphein) writing 2.

3 Secure Communication Typical Set Up 3.

4 Caesar Cipher Julius Caesar (100 BC 44 BC) = 4 HELLO WORLD LIPPS ASVPH 4.

5 Enigma Machine ( ) 5.

6 Modern Block Ciphers (SPN) N-bit plaintext K-bit key S-BOX PERMUTATION 32 N K 256 Substitution Permutation Network N-bit ciphertext 6.

7 Conventional Crypto 7.

8 Lightweight Crypto 8.

9 Lightweight Crypto 9.

10 Trade-offs in Crypto HW Security Performance Silicon area 10.

11 Trade-offs in Crypto HW Security Performance Silicon area 11.

12 Designing Crypto for Low Energy and Low Power Energy Power 12.

13 Energy = 13.

14 Power = 14.

15 Passive RFID: Low Power Applications Reader RFID tag NETWORK INTERFACE RF RF CONTROL MEMORY CRYPTO 15.

16 Anything Battery Powered: Low Energy Applications 16.

17 Every mw matters! Total number of mobile devices in 2015 = 9.5 billion* Average (regular) power consumption of a smartphone = 160 mw** Total energy spent = 2.8 billion*** a year! * Mobile Statistics Report , The Radicati Group Inc. ** An Analysis of Power Consumption in a Smartphone, A Carroll, G Heiser, USENIX *** average electricity price in 2014 in EU was per kwh. 17.

18 Cisco estimates 50 billion* connected devices by 2020 * 18.

19 Intel says 200 billion* smart devices by 2020 * 19.

20 Moving Bits vs Moving People & Things * 20.

21 World s ICT Energy Consumption The ICT ecosystem uses about 1500 TWh of electricity annually and approaches 10% of world electricity generation! * 21.

22 What can Crypto do about it? Become Lightweight Crypto! 22.

23 Power Consumption in (Crypto) HW P tot = P switching + P leakage P switching P leakage P switching C eff V 2 DD f clk sw 23.

24 Energy Consumption in (Crypto) HW E = P t = P N f clk E C eff V 2 DD N sw 24.

25 Reducing Power and Energy Consumption P C eff V 2 DD sw f clk E C eff V 2 DD sw N Reduce circuit area (e.g. serializing): C eff, but N Reduce switching activity (e.g. clock gating): sw Move to smaller CMOS technologies: C eff, V DD, but P leakage Reduce the operating clock frequency: f clk Reduce the latency: N 25.

26 AREA (GE) History of Lightweight Crypto (Area) 3500 Lightweight Block Ciphers DES AES PRESENT 500 KATAN YEAR 26.

27 LATENCY (# CLOCK CYCLES) History of Lightweight Crypto (Latency) Lightweight Block Ciphers YEAR 27.

28 AREA * LATENCY History of Lightweight Crypto (Energy*) Lightweight Block Ciphers YEAR 28.

29 Trade-offs in Crypto HW Security Performance Silicon area 29.

30 Designing the Smallest Block Cipher Silicon area 30.

31 NAND gate Smallest logic gate with two inputs. GE (gate equivalence) = physical area of a single NAND gate. 31.

32 XOR gate 2-3 GE 32.

33 Modern Lightweight Ciphers < 1000 GE 33.

34 AES (128-bit key, ENC only) 2500 GE 34.

35 Block Cipher HW Perspective Minimize! Round function + Key schedule + Control logic Key size 80 bits Block size 32 bits Memory 35.

36 KATAN The Smallest Block Cipher KATAN32 = 462 GE 36.

37 KATAN The Smallest Block Cipher Only 508 bits of expanded key! KATAN32 = 315 GE bits of ROM 37.

38 KATAN vs Competition PRESENT UMC180 IHP250 AMIS350 Synopsys ~1kGE KATAN NXP90 Synopsys 460 GE LED 180nm Synopsys 700 GE Piccolo 130nm Synopsys 700 GE 38. SIMON IBM130 Synopsys 520 GE SPECK IBM130 Synopsys 580 GE KLEIN TSMC180 Synopsys 1.3 kge

39 Trade-offs in Crypto HW Security Performance Silicon area 39.

40 Designing the Fastest Block Cipher Performance 40.

41 Latency vs Throughput 12 Serial processing Latency = 15 s Throughput = beer/s 41.

42 Latency vs Throughput 12 Parallel processing! Latency = 15 s Throughput = 0.2 beer/s 42.

43 Latency vs Throughput 12 Pipelining! Latency = 15 s Throughput = 0.2 beer/s 43.

44 Latency vs Throughput 12 Unrolling! bottom-up! Latency = 5 s Throughput = 0.2 beer/s 44.

45 Latency of Existing Ciphers Is Lightweight = Light + Wait? BLOCK-SIZE KEY-SIZE S-BOX P-LAYER K-SCHEDULE AES NOEKOEN MINI-AES MCRYPTON MDS LIGHT BINARY NO MDS LIGHT 64 64, 96, BINARY LIGHT PRESENT 64 80, BIT PERMUTATION LIGHT KLEIN LED 64 64, 80, 96 4 MDS LIGHT 64 64, MDS NO 45.

46 Unrolled HW Architectures 46.

47 Results Latency (CMOS 90 nm) LATENCY [NS] 1-cycle 2-cycle 47.

48 Number of Rounds vs Key Size 48.

49 Results Area (CMOS 90 nm) AREA [KGE] 1-cycle 2-cycle 49.

50 Low Latency Encryption S-box Use small S-boxes (e.g. 5-bit, 4-bit, 3-bit) Almost everything follows the normal distribution. So does the S-box! choose me! 50. slide credit: Gregor Leander

51 Low Latency Encryption Number of Rounds Minimize! 51.

52 Low Latency Encryption Round Complexity Not too low complexity. Reduce the number of rounds at the cost of (slightly) heavier round. 52.

53 Low Latency Encryption Key Schedule Number of rounds should be independent of the key schedule. Use constant addition instead of a key schedule (if possible). 53.

54 Low Latency Encryption Encryption vs Decryption Use involution where possible: f f x = x. Make Encryption and Decryption procedures similar. BUT: think application oriented sometimes it is beneficial to have asymmetric constructions. 54.

55 Low Latency Encryption Meet PRINCE α-reflection property: 55.

56 Low Latency Encryption Meet PRINCE LATENCY [NS] 56.

57 Low Latency Encryption Meet PRINCE AREA [KGE] 57.

58 AREA * LATENCY Future of Lightweight Crypto (Energy*) Lightweight Block Ciphers YEAR 58.

59 AREA * LATENCY Future of LWC Future of Lightweight Crypto (Energy*) Lightweight Block Ciphers PRINCE YEAR 59.

60 THANK YOU! Thanks to the teams of KATAN, SPONGENT, PRINCE, FIDES 60.