Systems and methods for providing secure communications using a protocol engine
Systems and methods for implementing confidential communications between nodes of a network provide reduced power consumption, require less memory, and provide improved security, relative to previously-known systems and method. Preferred embodiments implement protocol functions in hardware, as opposed to software, to yield some or all of the foregoing improvements. Some embodiments use a hashing circuit for multiple purposes, while maintaining its ability to compute successive intermediate hash values. Some embodiments improve security of systems using circuits configured to leverage a favorable data format.
1. A method of executing a handshake between a client and a server, the method comprising:
generating, at the client, a client hello message, and sending the client hello message to the server;
creating a first intermediate hash of the client hello message using a SHA2-256 hash circuit;
storing the first intermediate hash in the SHA2-256 hash circuit;
discarding the client hello message at the client;
receiving, at the client, a server hello message from the server; and
using the SHA2-256 circuit, after discarding the client hello message at the client, to create a second intermediate hash from the first intermediate hash and the server hello message.
2. The method of claim 1 , further comprising, after using the SHA2-256 circuit to create a second intermediate hash and before using the SHA2-256 circuit to generate a subsequent hash, discarding the server hello message at the client.
3. The method of claim 1 , further comprising, after creating the second intermediate hash, when the SHA2-256 circuit is in a given state:
performing a hash state write to a memory, the hash state write storing, in the memory, hash state data defining the given state of the SHA2-256 circuit; and subsequently
performing a secondary function using the SHA2-256 circuit, the secondary function being a function other than the hash function and leaving the SHA2-256 circuit in a second state different from the given state; and subsequently
performing a hash state read from the memory, by which the hash state read retrieves, from the memory, the hash state data; and subsequently
restoring the SHA2-256 circuit to the given state using the hash state data.
4. The method of claim 3 , wherein the secondary function using the SHA2-256 circuit comprises generating a client handshake key.
5. The method of claim 3 , wherein the secondary function using the SHA2-256 circuit comprises verifying a server certificate received from the server.
6. A computer system, comprising:
a processor; and
a memory storing instructions that when executed by the processor cause the computer system to execute a handshake between a client and a server, comprising:
generating, at the client, a client hello message, and sending the client hello message to the server;
creating a first intermediate hash of the client hello message using a SHA2-256 hash circuit;
storing the first intermediate hash in the SHA2-256 hash circuit;
discarding the client hello message at the client;
receiving, at the client, a server hello message from the server; and
using the SHA2-256 circuit, after discarding the client hello message at the client, to create a second intermediate hash from the first intermediate hash and the server hello message.
7. The computer system of claim 6 , wherein the instructions, when executed, comprise:
after using the SHA2-256 circuit to create a second intermediate hash and before using the SHA2-256 circuit to generate a subsequent hash, discarding the server hello message at the client.
8. The computer system of claim 6 , wherein the instructions, when executed, comprise:
after creating the second intermediate hash, when the SHA2-256 circuit is in a given state:
performing a hash state write to a memory, the hash state write storing, in the memory, hash state data defining the given state of the SHA2-256 circuit; and subsequently
performing a secondary function using the SHA2-256 circuit, the secondary function being a function other than the hash function and leaving the SHA2-256 circuit in a second state different from the given state; and subsequently
performing a hash state read from the memory, by which the hash state read retrieves, from the memory, the hash state data; and subsequently
restoring the SHA2-256 circuit to the given state using the hash state data.
9. The computer system of claim 8 , wherein the secondary function using the SHA2-256circuit comprises generating a client handshake key.
10. The computer system of claim 8 , wherein the secondary function using the SHA2-256circuit comprises verifying a server certificate received from the server.
11. The computer system of claim 6 , further comprising:
a protocol engine configured to execute a handshake between a client and a server.
12. The computer system of claim 11 , wherein the protocol engine comprises:
a cryptographic accelerator; and
a protocol controller.
13. The computer system of claim 12 , wherein the cryptographic accelerator comprises an energy-efficient elliptic curve cryptographic accelerator.
14. The computer system of claim 13 , wherein the energy-efficient elliptic curve cryptographic accelerator is configured to execute one or more elliptic curve cryptographic computations.
15. The computer system of claim 14 , wherein the one or more elliptic curve cryptographic computations comprises at least one of an elliptic curve Diffie-Hellman key exchange or an elliptic curve digital signature algorithm.
16. The computer system of claim 14 , wherein the elliptic curve cryptographic accelerator is configured to execute a pre-computation-based comb algorithm for elliptic curve scaler multiplication.
17. The computer system of claim 16 , wherein the elliptic curve cryptographic accelerator comprises:
a memory cache configured to store pre-computed comb data associated with the pre- computation-based comb algorithm;
a modular multiplier; and
a modular inverter.
18. The computer system of claim 11 , wherein the protocol engine is further configured to manage a datagram transport layer security protocol.
19. A non-transient computer readable medium storing instructions that, when executed by a computer system having a processor and a memory, cause the computer system to perform a method of executing a handshake between a client and a server, the method comprising:
generating, at the client, a client hello message, and sending the client hello message to the server;
creating a first intermediate hash of the client hello message using a SHA2-256 hash circuit;
storing the first intermediate hash in the SHA2-256 hash circuit;
discarding the client hello message at the client;
receiving, at the client, a server hello message from the server; and
using the SHA2-256 circuit, after discarding the client hello message at the client, to create a second intermediate hash from the first intermediate hash and the server hello message.
20. The non-transient computer readable medium of claim 19 , wherein the method further comprises:
after using the SHA2-256 circuit to create a second intermediate hash and before using the SHA2-256 circuit to generate a subsequent hash, discarding the server hello message at the client.
21. The non-transient computer readable medium of claim 19 , wherein the method further comprises:
after creating the second intermediate hash, when the SHA2-256 circuit is in a given state:
performing a hash state write to a memory, the hash state write storing, in the memory, hash state data defining the given state of the SHA2-256 circuit; and subsequently
performing a secondary function using the SHA2-256 circuit, the secondary function being a function other than the hash function and leaving the SHA2-256 circuit in a second state different from the given state; and subsequently
performing a hash state read from the memory, by which the hash state read retrieves, from the memory, the hash state data; and subsequently
restoring the SHA2-256 circuit to the given state using the hash state data.
22. The non-transient computer readable medium of claim 21 , wherein the secondary function using the SHA2-256 circuit comprises generating a client handshake key.
23. The non-transient computer readable medium of claim 21 , wherein the secondary function using the SHA2-256 circuit comprises verifying a server certificate received from the server.