AES implementation on a grain of sand

101

The market for RFID technology has grown rapidly over the past few years. Going along with the proliferation of RFID technology is an increasing demand for secure and privacy-preserving applications. In this context, RFID tags need to be protected against physical attacks such as Differential Power Analysis (DPA) and fault attacks. The main obstacles towards secure RFID are the extreme constraints of passive tags in terms of power consumption and silicon area, which makes the integration of countermeasures against physical attacks even more difficult than for other types of embedded systems. In this paper we propose a fresh re-keying scheme that is especially suited for challenge-response protocols such as used to authenticate tags. We evaluate the resistance of our scheme against fault and side-channel analysis, and introduce a simple architecture for VLSI implementation on RFID tags. In addition, we estimate the cost of our scheme in terms of area and execution time for various sec... Abstract. The market for RFID technology has grown rapidly over the past few years. Going along with the proliferation of RFID technology is an increasing demand for secure and privacy-preserving applications. In this context, RFID tags need to be protected against physical attacks such as Differential Power Analysis (DPA) and fault attacks. The main obstacles towards secure RFID are the extreme constraints of passive tags in terms of power consumption and silicon area, which makes the integration of countermeasures against physical attacks even more difficult than for other types of embedded systems. In this paper we propose a fresh re-keying scheme that is especially suited for challenge-response protocols such as used to authenticate tags. We evaluate the resistance of our scheme against fault and side-channel analysis, and introduce a simple architecture for VLSI implementation on RFID tags. In addition, we estimate the cost of our scheme in terms of area and execution time for various security/performance trade-offs. Our experimental results show that the proposed re-keying scheme provides better security (and does so at less cost) than other state-of-the-art countermeasures.

Section: Unprotected Implementationmentioning

confidence: 99%

“…The total area (g + AES) needed to protect the AES core by Feldhofer et al. [5] using our fresh re-keying scheme, with the same parameters. We compared our design to the protected circuit presented by Feldhofer et al in [6].…”

Section: The Cost Of a Mac Unit In A Sca-resistant Logic-style (G-pmac)mentioning

confidence: 99%

Fresh Re-keying: Security against Side-Channel and Fault Attacks for Low-Cost Devices

Medwed

Standaert

Großschädl

et al. 2010

101

“…Our circuit processes one round encryption per one clock cycle, thus its data throughput is about 150.6 Mbps at a 80 MHz clock rate. This performance is much faster than those of recently proposed low-resource hardware implementations of AES [11,12].…”

Section: Introductionmentioning

confidence: 88%

“…In the case of 1/4 round design, we estimate the minimized circuit would require much less than 3000 gates on 0.25µm technology and its data throughput would be about 37.6 Mbps at a 80 MHz clock rate. Meanwhile the last hardware implementation result of AES-128 [12] requires about 3400 gates and its data throughput is about 9.9 Mbps under the same clock rate. …”

Section: Hardware Implementationmentioning

confidence: 99%

HIGHT: A New Block Cipher Suitable for Low-Resource Device

Hong

Sung

Hong

et al. 2006

494

316

Abstract. In this paper, we propose a new block cipher HIGHT with 64-bit block length and 128-bit key length. It provides low-resource hardware implementation, which is proper to ubiquitous computing device such as a sensor in USN or a RFID tag. HIGHT does not only consist of simple operations to be ultra-light but also has enough security as a good encryption algorithm. Our hardware implementation of HIGHT requires 3048 gates on 0.25 µm technology.

“…A better approach is to use a custom made RFID chip, which consists of a receiver circuit, a control unit 2 , some kind of volatile and/or non-volatile memory and a cryptographic primitive. In [FWR05], Feldhofer et al propose a very small AES implementation with 3400 gates, which draws a maximum current of 3.0μA @ 100kHz. Their AES design is based on a byte-per-byte serialization, which only requires the implementation of a single S-box [DR02] and achieves an encryption within 1032 clock cycles (= 10.32ms @ 100kHz).…”

Section: Introductionmentioning

confidence: 99%

New Lightweight DES Variants

Leander

Paar

Pöschmann

et al.

183

Abstract. In this paper we propose a new block cipher, DESL (DES Lightweight), which is based on the classical DES (Data Encryption Standard) design, but unlike DES it uses a single S-box repeated eight times. 1 On this account we adapt well-known DES S-box design criteria, such that they can be applied to the special case of a single S-box. Furthermore, we show that DESL is resistant against certain types of the most common attacks, i.e., linear and differential cryptanalyses, and the Davies-Murphy attack. Our hardware implementation results of DESL are very promising (1848 GE), therefore DESL is well suited for ultraconstrained devices such as RFID tags.