Ultra-lightweight cryptography accelerator system
A cryptography accelerator system includes a direct memory access (DMA) controller circuit to read and write data directly to and from memory circuits and an on-the-fly hashing circuit to hash data read from a first memory circuit on-the-fly before writing the read data to a second memory circuit. The hashing circuit performs at least one of integrity protection and firmware/software (FW/SW) verification of the data prior to writing the data to the second memory circuit. The on-the-fly hashing circuit includes a bit repositioning circuit to designate an order of bits of a binary word in a register from a most significant bit (MSB) to a least significant bit (LSB) for performing computations without rotating bits in the register, and an on-the-fly round constant generator circuit to generate a round constant from a counter.
1. A cryptography accelerator system comprising:
a direct memory access (DMA) controller circuit to read and write data directly to and from memory circuits; and
an on-the-fly hashing circuit to hash data read from a first memory circuit and perform at least one of integrity protection and firmware/software (FW/SW) verification of the data prior to writing the data to a second memory circuit, the on-the-fly hashing circuit including:
a bit repositioning circuit to designate an order of bits of a binary word in a register from a most significant bit (MSB) to a least significant bit (LSB) for performing computations without rotating bits in the register; and
an on-the-fly round constant generator circuit to generate a round constant from a counter,
wherein at least one of the DMA controller circuit or on-the-fly hashing circuit includes a wake-on-demand circuit to set the respective DMA controller circuit or on-the-fly hashing circuit in a low-power sleep mode upon receiving a sleep signal until receiving a wake signal, and to set the respective DMA controller or on-the-fly hashing circuit in a normal operation mode upon receiving the wake signal until receiving the sleep signal.
2. The system of claim 1 , further comprising a block cipher encryption circuit to execute a block cipher encryption on the data to perform at least one of confidentiality protection and authentication of the data.
3. The system of claim 2 , wherein the block cipher encryption circuit includes a wake-on-demand circuit to set the block cipher encryption circuit in a low-power sleep mode upon receiving a sleep signal until receiving a wake signal, and to set the block cipher encryption circuit in a normal operation mode upon receiving the wake signal until receiving the sleep signal.
4. The system of claim 2 , wherein the block cipher encryption circuit includes a secure PRINCE block cipher circuit.
5. The system of claim 2 , wherein the block cipher encryption circuit includes a secure PRINCE block cipher circuit using a cipher block chaining message authentication code (CBC-MAC) technique to construct a message authentication code (MAC) by creating a chain of blocks where each block of the chain of blocks depends upon an encryption of the previous block in the chain of blocks.
6. The system of claim 2 , wherein the block cipher encryption circuit includes a secure PRINCE block cipher circuit that includes a substitution-box circuit and a diffusion operation circuit that do not use a look-up table and matrix multiplication.
7. The system of claim 2 , further comprising a random number generator (RNG) circuit to generate a random number, wherein at least one of the on-the-fly hashing circuit and the block cipher encryption circuit uses the random number.
8. The system of claim 7 , wherein the RNG circuit includes a wake-on-demand circuit to set the RNG circuit in a low-power sleep mode upon receiving a sleep signal until receiving a wake signal, and to set the RNG circuit in a normal operation mode upon receiving the wake signal until receiving the sleep signal.
9. The system of claim 1 , wherein the on-the-fly hashing circuit is configured to perform a Keccak hash compression function including sub-functions ρ and π using the bit repositioning circuit to designate an order of bits of a binary word in a register from an MSB to an LSB instead of performing a bit rotation.
10. The system of claim 1 , wherein the on-the-fly hashing circuit is configured to perform a Keccak hash compression function including a sub-function t using the on-the-fly round constant generator circuit to generate a round constant from a counter instead of retrieving a round constant from a storage.
11. The system of claim 1 , wherein the on-the-fly hashing circuit is configured to perform a Keccak hash compression function including a keyed hash operation.
12. A method of cryptography acceleration, the method comprising:
reading a data item, using a direct memory access (DMA) controller circuit, from a first memory circuit; and
hashing the read data item, using an on-the-fly hashing circuit, to perform at least one of integrity protection and firmware/software (FW/SW) verification of the data, wherein the hashing includes:
repositioning bits of a binary word, using a bit repositioning circuit, by designating an order of the bits in a register from a most significant bit (MSB) to a least significant bit (LSB) for performing computations without rotating bits in the register; and
generating a round constant on-the-fly from a counter, using an on-the-fly round constant generator circuit; and
writing the hashed read data item, using the DMA controller circuit, to a second memory circuit;
waking on-demand one or more of the DMA controller circuit and on-the-fly hashing circuit, using a wake-on-demand circuit, to set the respective DMA controller circuit or on-the-fly hashing circuit in a normal operation mode upon receiving the wake signal until receiving a sleep signal; and
sleeping on-demand one or more of the DMA controller circuit and on-the-fly hashing circuit, using the wake-on-demand circuit, to set the respective DMA controller circuit or on-the-fly hashing circuit in a low-power sleep mode upon receiving the sleep signal until receiving the wake signal.
13. The method of claim 12 , further comprising executing a block cipher encryption, by a block cipher encryption circuit, on the data to perform at least one of confidentiality protection and authentication of the data.
14. The method of claim 13 , further comprising:
waking on-demand the block cipher encryption circuit, using a wake-on-demand circuit, to set the block cipher encryption circuit in a normal operation mode upon receiving a wake signal until receiving a sleep signal; and
sleeping on-demand the block cipher encryption circuit, using the wake-on-demand circuit, to set the block cipher encryption circuit in a low-power sleep mode upon receiving the sleep signal until receiving the wake signal.
15. The method of claim 13 , wherein executing the block cipher encryption includes performing a secure PRINCE block cipher encryption.
16. The method of claim 13 , further comprising constructing a message authentication code (MAC), by a secure PRINCE block cipher circuit using a cipher block chaining message authentication code (CBC-MAC) technique, by creating a chain of blocks where each block of the chain of blocks depends upon an encryption of the previous block in the chain of blocks.
17. The method of claim 13 , wherein executing the block cipher encryption includes performing a secure PRINCE block cipher encryption, including performing a substitution-box operation by a substitution-box circuit and performing a diffusion operation by a diffusion operation circuit, without using a look-up table and matrix multiplication.
18. The method of claim 13 , further comprising generating a random number using a random number generator (RNG) circuit, wherein at least one of the hashing the read data item and the executing the block cipher encryption uses the random number.
19. The method of claim 18 , further comprising:
waking on-demand the RNG circuit, using a wake-on-demand circuit, to set the RNG circuit in a normal operation mode upon receiving a wake signal until receiving a sleep signal; and
sleeping on-demand the RNG circuit, using the wake-on-demand circuit, to set the RNG circuit in a low-power sleep mode upon receiving the sleep signal until receiving the wake signal.
20. The method of claim 12 , wherein hashing the read data item includes performing a Keccak hash compression function including sub-functions ρ and π using the bit repositioning circuit to designate an order of bits of a binary word in a register from an MSB to an LSB instead of performing a bit rotation.
21. The method of claim 12 , wherein hashing the read data item includes performing a Keccak hash compression function including a sub-function t using the on-the-fly round constant generator circuit to generate a round constant from a counter instead of retrieving a round constant from a storage.
22. At least one non-transitory machine-readable medium including instructions, which when executed by a machine, cause the machine to perform the following operations:
reading a data item, using a direct memory access (DMA) controller circuit, from a first memory circuit;
hashing the read data item, using an on-the-fly hashing circuit, to perform at least one of integrity protection and firmware/software (FW/SW) verification of the data, wherein the hashing includes:
repositioning bits of a binary word, using a bit repositioning circuit, by designating an order of the bits in a register from a most significant bit (MSB) to a least significant bit (LSB) for performing computations without rotating bits in the register, and
generating a round constant on-the-fly from a counter, using an on-the-fly round constant generator circuit; and
writing the hashed read data item, using the DMA controller circuit, to a second memory circuit;
waking on-demand one or more of the DMA controller circuit and on-the-fly hashing circuit, using a wake-on-demand circuit, to set the respective DMA controller circuit or on-the-fly hashing circuit in a normal operation mode upon receiving the wake signal until receiving a sleep signal; and
sleeping on-demand one or more of the DMA controller circuit and on-the-fly hashing circuit, using the wake-on-demand circuit, to set the respective DMA controller circuit or on-the-fly hashing circuit in a low-power sleep mode upon receiving the sleep signal until receiving the wake signal.
23. The at least one machine-readable medium of claim 22 , further including instructions, which when executed by a machine, cause the machine to execute a block cipher encryption on the data to perform at least one of confidentiality protection and authentication of the data.