IEEE Solid-State Circuits Magazine - Fall 2017 - 42

The implementation of cryptographic
algorithms and protocols must be compact
and energy efficient but resistant to physical
attacks and leakage of sensitive information.
This short article was motivated
by a recognition of the need for secu-
rity in embedded devices. It begins
with the attacker model, discusses
associated design and test methods,
and offers several illustrative ex-
amples. The main focus is on digital
hardware implementations for cryp-
tographic algorithms, protocols, and
security devices; the article does not
address hardware solutions to pro-
tect against software attacks.
It is difficult to measure security
as there are no commonly agreed
upon units for such measurement.
Therefore, security is based on an
attacker model and evaluated against
the assumptions made in this at-
tacker model. For typical digital cir-
cuit design, we distinguish among
the following broad categories: the
black box model (used mostly in the
past), the gray box model of current
designs, and the immersed model of
the future. Also, white box cryptog-
raphy exists.

Black Box Attacker Model: The Past
Modern cryptography began in the
1970s with the first U.S. standard
for symmetric key encryption, the
Data Encryption Standard (DES);
the invention of public key cryp-
tog raphy; and the development
of the public key Rivest-Shamir-

A d le man (RSA) algorithm. These
developments appeared in conjunc-
tion with novel electronic communi-
cation means and were spurred by
the electronics revolution.
The DES algorithm was developed
with efficient hardware implemen-
tation in mind. Indeed, it performs
poorly in software. Cryptography,
in this case, is applied to protect the
information flow between two com-
municating parties. For the attacker
model, we assume that the devices
owned by Alice and Bob (the two main
"characters" in every cryptographic
protocol) operate in black boxes, mean-
ing that only the cryptographic inputs
and outputs of the devices can be
observed by Eve, the attacker. This
is illustrated in Figure 1, where each
device has a root of trust, indicat-
ed by the green dots. Examples are
computers and servers in computer
rooms or offices.
Typical attacks are performed on
the network connections between
devices, e.g., a local area network, the
Internet, or any wireless link between
devices. In the black box model,
Eve collects input/output pairs (i.e.,
plaintext/ciphertext pairs), which
she uses to guess the secret key. She
is also allowed to modify input data
or adaptively supply her own input
data. The security strength in this

FIGURE 1: An illustration of the black box attacker model, with the green dots representing
the devices' roots of trust.

FA L L 2 0 17

IEEE SOLID-STATE CIRCUITS MAGAZINE

model is based purely on the compu-
tational complexity of the underly-
ing cryptographic algorithms. If Eve
succeeds in guessing the key more
quickly than brute force (i.e., faster
than trying all possible keys), then
the cryptographic community consid-
ers the algorithm broken.
In this context, Moore's law is im-
portant for the algorithm designer.
Indeed, Moore's law helps the attacker,
as it gives him/her more computa-
tional power for brute-forcing crypto-
graphic algorithms. The consequence
is that key lengths for cryptographic
algorithms keep growing. First, the
European network ECRYPT and later
the European Union Agency for Net-
work and Information Security pub-
lished documents regarding required
key lengths for near- and long-term
security [3]. For long-term security, the
suggested key lengths are 256 for
the symmetric key size, 512 for the
hash output size, 15,360 for the RSA
modulus size, and 512 for bit ellip-
tic curves.
As a result, the digital hardware
designer often has to design for very
large word lengths in combination with
unusual arithmetic. The most critical
component of secret key algorithms
such as DES or the Advanced Encryp-
tion Standard (AES) are the "substitu-
tion boxes," or Sboxes. Special effort
is expended to make these either com-
pact or very fast [11]. The most critical
components of public key algorithms
such as RSA or elliptic curve-based
cryptography rely on the implementa-
tion of finite-field arithmetic and, more
specifically exponentation algorithms
and finite-field multipliers. The focus
of digital hardware designers in the
black box context is thus efficiency:
small area, high throughput, low po-
wer, and low energy. In this sense,
the IC design process is no different
from optimizations in other fields,
such as image, video, or communica-
tions applications.
Testing of black box security cir-
cuits focuses, therefore, on functional
correctness, as well as on measur-
ing throughput, power, and energy.
Care must be taken to ensure that

Table of Contents for the Digital Edition of IEEE Solid-State Circuits Magazine - Fall 2017