Hardware Architectures for Public Key Algorithms Requirements and Solutions for Today and Tomorrow

Transcription

1 Hardware Architectures for Public Key Algorithms Requirements and Solutions for Today and Tomorrow Cees J.A. Jansen Pijnenburg Securealink B.V. Vught, The Netherlands ISSE Conference, London 27 September, 2001

2 Outline Introduction Montgomery s Modular Multiplication The Computational Complexity of Multiplication Securealink s Systolic Array Architecture Performance Figures Conclusions 2

3 Introduction Public Key Algorithms (RSA, DSA, DH, ECC) applied: Client: Low cost design and operation Low power consumption & small footprint Moderate performance Many security threats (side channel, tamper) Server: High Performance (multiple sessions) Flexible Solutions 3

4 Dedicated Hardware vs Software Tamper protection Physical, Logical (CAPI), EFP protective layers (coating), embedding of memory, metal layers. frequency, voltage & temperature detection Physically secure storage of secret keys fast erasure inaccessible to hostile sw 4

5 Dedicated Hardware vs Software Intrinsic Security & Performance: Guaranteed integrity of security solution itself no simple modification or bypass Easier to counter sophisticated cryptanalytic attacks timing, (d)pa, emc / emi Optimized performance independent of CPU type or platform 5

6 Montgomery s Modular Mult A B C = AB mod N MMM(A,R 2 ) MMM(B,R 2 ) MMM(T,1) X = AR mod N Y = BR mod N MMM(X,Y) T = XYR -1 mod N = ABR mod N Montgomery transformations to and from the N-residue domain 6

7 Calculation of R 2 mod N Needed for transforming numbers to the N residue domain. Necessary: an r such that R = 2 r > N Better: R = 2 r > 4N avoids conditional subtraction of modulus improved resistance against side channel attacks Ref.: Walter [3] Compute 2 r+1 mod N using special RED hardware. This is 2R mod N, i.e. the Montgomery form of the number 2. Raise the above number to the power r using the EXP hardware. Result is 2 r R mod N = R 2 mod N. 7

8 Complexity of Multiplication For a n m bit hardware multiplier: constant time if length min(n,m) linear time if n length m quadratic time if length max(n,m) So NOT quadratic for all argument lengths as in text books! Keep in mind for performance tricks like CRT 8

9 Systolic Array Architecture r x 0 x 1 x k-1 0 Y PE PE T(-1) T(0) T(1) T(k-1) T(k) PE PE T α MMM iteration steps in a systolic array 9

10 Systolic Array Operation X is divided into digits of width (8 in ISES) Each PE processes one digit of X. Y and N are divided into digits of width (32 in ISES). Y, N and T (temporary result) digits travel though the pipeline from left to right. Each Y, N and T digit visits each PE and is therefore multiplied with each X digit. If there are more X digits than PE s, the number passes through the pipeline multiple times. All T digits are temporarily stored in a FIFO between passes. 10

11 Modular Exponentiation Unit B B ctrl X, Y, N, T ctrl X Exp Parse X Dig Functional Control Memory Access Control Y N T Y Dig V Dig N Dig Talpha RT Init Chain of PE's Term PE's 11

12 LNAU architecture Exp core Reduce Cntrl Clock Reset Memory T 6 Command Output Data Input Data Addr 12

13 Side Channel Attack Resistance Exponent recoding decreases the correlation between the exponent bits and computation time, power consumption Montgomery multiplication with R > 4N eliminates mod N reduction steps Hardware implementation with many PE s operating in parallel gives low correlation between power and function execution Multiple LNAUs combined with other functions in one device 13

14 Performance Behaviour LNAU performance divided into 2 regions. Quadratic for n N break Cubic for n > N break The actual performance jumps around trendlines due to ceiling functions CRT improvement-factor varies between 1 and 4 due to these facts 14

15 #cycles Performance Curves # passes trough the MMM is given by (n + α +2)/(α P) n 15

16 #cycles Performance Curves # passes trough the MMM is given by Y is divided into digits of β bits (n + α +2)/(α P) # Y digits is given by (n +1)/β n 16

17 #cycles Performance Curves # passes trough the MMM linear behavior and is jumps given by Y is divided around into a quadratic digits of β function bits (n + α +2)/(α P) # Y digits is given by (n +1)/β n 17

18 #cycles Performance Curves # passes linear trough behavior the MMM and jumps linear behavior and around is jumps given a by cubic function Y is divided around into a quadratic digits of β function bits (n + α +2)/(α P) # Y digits is given by (n +1)/β n 18

19 #cycles Performance curves (2) n n n n n n 19

20 #cycles Performance curves (3) n break n 20

21 improvement factor 7 CRT Improvement Factors n Normal/CRT Normal/MP3 CRT/MP

22 #(1024)encryptions/second Decryption Performance a 4a 5a 6a 7a 8a 9a option Norm CRT MP 22

23 #encryptions / Watt Comparing Power a 4a 5a 6a 7a 8a 9a option 1024 Norm 1024 CRT 1024 MP 23

24 Conclusions Dedicated Hardware for Montgomery Modular Exponentiation Systolic Array Architecture exhibiting very high encryption rate low power budget side channel attack resistance Futureproof solution for demanding server applications 24