IEEE Solid-States Circuits Magazine - Summer 2019 - 71

be more than 100-k gates. Their flexibility (including private-key operation)
comes at the cost of a higher energy
by two to four orders of magnitude
compared to low-energy private-key
accelerators without algorithmic flexibility. Figure  17(b) also shows the
substantial energy cost of basic operations used in public-key cryptography.
For example, elliptic-curve scalar multiplication entails an energy/bit from
tens of nanojoules to microjoules,
which is higher than lightweight private-key accelerators by three to six
orders of magnitude [15], [44].
Also as shown in Figure 17(b), stateof-the-art accelerators for the Datagram

Transport Layer Security protocol used
in Internet communications require an
energy of tens of microjoules, which is
more than 100,000× larger than the energy cost of AES encryption. Similar energy is consumed when executing the
widespread Elliptic-Curve Diffie-Hellman Ephemeral private key exchange
in MCUs, with an execution time on
the order of seconds [44]. An order of
magnitude lower energy and execution time is required for Elliptic Curve
Digital Signature Algorithms [44]. In
summary, public-key cryptography is
substantially more expensive than private key and should be used very judiciously, adopting alternative security

protocols that leverage less expensive
primitives, such as PUFs (e.g., for private key exchange).
Finally, hashing is another fundamental cryptographic function that
maps a message of arbitrary length
into a digest with fixed length [74].
Energy-efficient hashing has recently gained popularity among the
general public, as it is the building
block of blockchain mining. In practical applications, mining permits the
uncovering of new cryptocurrency
coins, and energy-efficient hashing
makes it financially more rewarding
because of the reduction in electricity cost [1]. As shown in Figure 17(b),

VLSI 2018
[113]

VLSI 2017
[54]

VLSI 2016
[102]

AES + SMS4
+ Camellia

Prince

AES

AES

Simon

Simon

Encryption (E)/Decryption (D)

E

E+D

E

E

E+D

E

Technology (nm)

14

28

40

65

14

40

Complexity (Gates)

19,000

15,000

2,200

10,000

1,080

1,200

Max. Throughput (Mb/s)

3,170

25,600

494

100

2,982

443

0.2-0.9

0.6-1.1

0.47-0.9

0.23-0.7

0.26-0.75

0.9

1.26

0.39

2.24

0.89

0.05

Algorithm

Voltage (V)
Min. Energy (pJ/b)

TVLSI 2015 ASSSC 2018
[101]
[34]

arXiv 2018
[84]
Multistandard

Down to k Gate

0.99 at 0.9 V Subpicojoule

(a)
ISSCC 2018
[15]

VLSI 2017
[110]

CHES 2015
[111]

WISTP 2011
[112]

DTLS

-

DHKE + Salsa20
Cipher + MAC

ECDSA (SHA-1) +
AES

Technology (nm)

65

40

130

350

Voltage (V)

0.8

0.7

1.2

65

Processor

RISC-V

ARM Cortex-M0

-

-

Complexity (Gates)

149,000

-

32,600

12,800

SRAM

6.75 KB

8 KB

0.28 KB

0.25 KB

16.2 (at 192 b)

-

223 (at 255 b)

7,411 (at 192 b)

AES Energy (pJ)

49 (at 128 b)

55 (at 128 b)

4,070 (at 128 b)

66,860 (at 128 b)

SHA Energy (pJ)

190 (at 128 b)

380 (at 128 b)

-

53,720 (at 128 b)

44.08-µJ
Handshake
(110 pJ/b)

-

-

-

Algorithm

ECSM Energy (nJ)

DTLS Energy

10-150-k Gates
Nanojoule to
Picojoule Range
Reconfiguration
Penalty: 50×
Comparable to
Reconfigurable AES

(b)
FIGURE 17: A summary of the recent state of the art in lightweight accelerators for (a) private-key encryption and (b) public-key encryption
and hashing. ECDSA: Elliptic Curve Digital Signature Algorithms; DTLS: Datagram Transport Layer Security; SHA: Secure Hash Algorithm; ECSM:
elliptic curve scalar multiplication.

IEEE SOLID-STATE CIRCUITS MAGAZINE

SU M M E R 2 0 19

71
IEEE Solid-States Circuits Magazine - Summer 2019

Table of Contents for the Digital Edition of IEEE Solid-States Circuits Magazine - Summer 2019
