IEEE Solid-States Circuits Magazine - Summer 2019 - 70

whitening. Apart from VN and LFSR/
NLSR entropy extractors, the aforementioned improvements come with a
throughput degradation of up to tens
of times compared to the raw TRNG.

consumption down to several tens of
nanowatts. Affordable even by low-end
devices, such as active radio-frequency
identification devices with microwatt
power budget, subpicojoule/bit operation enables ubiquitous and always-on
data security in sensor nodes.
Very area-efficient accelerator architectures (with few k gates) expectedly
have poorer energy efficiency, on the
order of various picojoules/bits [29],
[59], [102]. Compared to low-energy
accelerators, the AES software implementation and execution on microcontroller units (MCUs) lead to much worse
energy, i.e., hundreds of picojoules/
bits and throughput of kilobits per second, leading to submicrowatt power
consumption for 128-b AES. On the other end and at the gigabits-per-second
throughput range, the energy of general-purpose microprocessors for mobile
and desktop applications is in the nanojoule/bit range [89]. High-performance
AES accelerators can also achieve such
high throughput levels while improving the energy efficiency down to a
few picojoules/bits. Compared to
microprocessors, field-programmable
gate array implementations reduce
energy and throughput by an order of
magnitude (mostly due to their lower
clock frequency).

Cryptographic Modules
Most fundamental cryptographic
operations are based on a few primitives performing private- and publickey cryptography as well as hashing
[63]. As common property, such oneway functions are easy to evaluate in
one direction and computationally
infeasible in the opposite direction.
The following discussion summarizes state-of-the-art silicon demonstrations of such functions.

Efficient Primitives for
Private-Key Cryptography
The most popular private-key cryptographic algorithm is undoubtedly AES
[74], whose best-in-class implementations have a throughput target spanning a very wide range, from hundreds
of kilobits per second (e.g., for IoT
applications) to tens of gigabits per
second (e.g., for server applications),
as shown in Figure 16. Subpicojoule/
bit operation is now a reality in accelerators for sensor nodes with minimum energy [101], leading to power

MCU

1E - 08
1E - 09
IoT

m
W

[89]
9]

1

µW

[2
[29]
4
es
4-k gates

1E - 11

[VBR15]
[V
5]
[59]
[5
2-kk gates
g

ASIC

FPGA

11
0E

+

10
1.
0

0E

+

09

Throughput (b/s)

1.
0

0E

+

08
+

07
1.
0

0E

+

06
0E

0E

+

05
+
1.
0

1.
0

0E

+

04

1E - 13

[58]
300-k gates

[102]
2.2-k gates

[101]
10-k gates

1.
0

1E - 12

0E

m
W

[89]
9]

1E - 10

1.
0

Desktop
1

1.
0

Energy/Bit (J)

Mobile
1

CPU

FIGURE 16: The state of the art in AES encryption and energy-throughput tradeoff. FPGA:
field-programmable gate array.

70

SU M M E R 2 0 19

IEEE SOLID-STATE CIRCUITS MAGAZINE

The need for ubiquitous and always-on data security has led to a
widespread effort to improve energy
efficiency by exploring several privatekey crypto-algorithms that are inherently less complex than AES, such as
Camellia, Prince, Simon, and PRESENT.
As shown in Figure 17(a), the complexity of such accelerators for lightweight
cryptography ranges from k gates to
20-k gates. Expectedly, various accelerators with subpicojoule/bit energy
have been demonstrated for such simpler algorithms [34], [54], [84]. A new
breed of algorithms for lightweight
cryptography is currently being explored in the NIST "Lightweight Cryptography" project, where secure and
affordable solutions for IoT devices
are being selected with the ultimate
goal of creating a standard [45]. As
an emerging trend in accelerators for
lightweight cryptography, flexibility
is being introduced to enable the different algorithms adopted in different
geographical areas. This also enables
future upgradeability for security
patching and improvements along the
chip lifecycle, as needed in IoT devices
with a long lifetime.

Efficient Primitives for Public-Key
Cryptography and Hashing
Public-key cryptography is used in
many security tasks, such as private
key exchange and digital signature.
Public-key cr yptography is well
known to be vastly more computationally expensive than private key,
and this is reflected in the complexity and energy consumption of stateof-the-art designs [15], [110]-[112]. As
summarized in Figure 17(b), the flexibility of post-silicon geographical
differentiation and upgradeability
is also being explored for its use in
public-key cryptography. Flexibility
is enabled by managing the control
flow with a microcontroller or other
programmable logic, while performing the elementary functions in energy-efficient accelerators.
As seen in Figure 17(b), the area of
public-key cryptocores is higher than
those of lightweight private keys by at
least an order of magnitude and can
IEEE Solid-States Circuits Magazine - Summer 2019

Table of Contents for the Digital Edition of IEEE Solid-States Circuits Magazine - Summer 2019
