Harvesting the potential of nano-CMOS for lightweight cryptography: an ultra-low-voltage 65 nm AES coprocessor for passive RFID tags

Abstract

An important challenge associated with the current massive deployment of Radio Frequency Identification solutions is to provide security to passive tags while meeting their micro Watt power budget. This can either be achieved by designing new lightweight ciphers, or by proposing advanced low-power implementations of standard ciphers. In this paper, we show that the AES algorithm can fit into this micro Watt power budget by combining ultralow-voltage implementations with a proper selection of the process flavor in a low-cost nanometer CMOS technology. Interestingly, this approach only requires slight modifications to the standard EDA tool flow, without incurring the engineering costs of architecture optimizations. In order to demonstrate this claim, we successfully designed and manufactured an AES coprocessor in a 65 nm low-power CMOS process. We prove with measurement results obtained from a set of 20 manufactured dies that the proposed coprocessor can be safely operated down to 0.32 V with an energy per 128-bit encryption/decryption at least 2.75× lower than in previously published low-power AES implementations.

Novel Self-Body-Biasing and Statistical Design for Near-Threshold Circuits With Ultra Energy-Efficient AES as Case Study

“…Regarding the silicon area, the proposed SFBB and SMA-SSTA help to reduce the gate size (i.e., total area) for a given performance target at design time. In our design, a 1.38× layout footprint reduction is achieved compared with [20] in the same technology node, despite of the 1.18× higher gate count due to the selected high-performance architecture. In other words, our approach would achieve a 1.63× area reduction if the same architecture (i.e., same gate count) was considered.…”

“…In unified-RAM architectures [18], [20], data and key are fetched, processed and stored in a single RAM block. These architectures suffer from low performance due to the large number of clock cycles required for round computation and key expansion.…”

“…As an alternative, the architecture in [21] uses a shift-register-based memory, which efficiently performs byte permutations in both round computation and key expansion. The presence of an additional S-BOX permits to simultaneously perform round computation II COMPARISON OF STATE-OF-THE-ART NORMALIZED S-BOX DESIGN and key expansion [21], thus improving the performance by 7.1× at only a 14.7% area penalty compared with unified-RAM architecture [20].…”

“…1, which summarizes the throughput-energy features of previously published AES prototypes. Previous work focuses either on high throughput [16], [17] or very low-cost designs [18]- [20]. Compared with low-cost designs, the energy/bit of the high-throughput designs can be significantly smaller (down to pico-Joules per bit or even lower) at the cost of larger area penalties.…”

Ultra-low power encryption engine for wireless implantable medical devices

“…The closest published result to this date [9] reports 210 nW for the standard AES block cipher at 30 kHz at V DD =0.35V in a 0.18 CMOS process. Since AES has 128-bit blocks and 10 rounds while PRESENT has 64-bit blocks and 32 rounds, to make a fair comparison, the amount of energy per encrypted bit for the two ciphers are compared: At 25 kHz operating frequency, PRESENT consumes 0.96 pJ/bit of energy (this paper) while the AES engine in [9] consumes roughly 4.8 pJ/bit.…”