Secure field-programmable gate array (FPGA) architecture
Method and systems using stateful encryption for non-bypassable FPGA configuration including receiving, at an FPGA, FPGA-configuration data comprising a cryptographic state to initialize a cryptographic state of the FPGA, and decrypting, at the FPGA, the FPGA-configuration data, wherein decrypting the FPGA-configuration data yields at least a second cryptographic state and decrypted FPGA-configuration data. Embodiments can include receiving, at the FPGA, a challenge message, processing, at the FPGA, the challenge message to yield at least a third cryptographic state and a response, and transmitting the response from the FPGA.
1. A method of using a stateful encryption algorithm for non-bypassable FPGA configuration, the method comprising:
before encrypting FPGA-configuration data, generating, by a cryptographic algorithm, a first message authentication code (MAC) value using the FPGA-configuration data and a first initial value, wherein the first MAC value indicates a cryptographic state of the FPGA-configuration data;
encrypting the FPGA-configuration data;
receiving, at an FPGA, the encrypted FPGA-configuration data and the first MAC value;
decrypting, at the FPGA, the encrypted FPGA-configuration data;
generating, by the cryptographic algorithm, a second MAC value using the decrypted FPGA-configuration data and the first initial value;
comparing the first MAC value with the second MAC value;
in response to the first MAC value being the same as the second MAC value, authenticating the decrypted FPGA-configuration data;
receiving, at the FPGA, a challenge message from an authentication device;
generating, by the cryptographic algorithm, a third MAC value using the challenge message and the second MAC value as a second initial value;
encrypting, at the FPGA, the challenge message to generate a response message, wherein the response message includes the third MAC value; and
transmitting the response message from the FPGA to the authentication device.
2. The method of claim 1 further comprising:
receiving the response message at the authentication device; and
comparing, at the authentication device, the response message to an expected response message.
3. The method of claim 2 further comprising:
decrypting the received response message;
generating a fourth MAC value based upon the decrypted response message and the second initial value; and
comparing the fourth MAC value generated the third MAC value recovered from the response message to determine authenticity of the FPGA-configuration data.
4. A field-programmable gate array (FPGA) comprising:
one or more interfaces-configured to:
receive encrypted FPGA-configuration data and a first message authentication code (MAC) value that is generated by a cryptographic algorithm using unencrypted FPGA-configuration data and a first initial value, wherein the first MAC value indicates a cryptographic state of the unencrypted FPGA-configuration data; and
receive a challenge message from an authentication device;
a state-encryption unit configured to:
decrypt the encrypted FPGA-configuration data;
generate, by the cryptographic algorithm, a second MAC value using the decrypted FPGA-configuration data and the first initial value;
compare the second MAC value with the first MAC;
in response to the first MAC value being the same as the second MAC value, authenticate the decrypted FPGA-configuration data;
generate, by the cryptographic algorithm, a third MAC value using the challenge message and the second MAC value as a second initial value;
encrypt the challenge message to generate a response message, wherein the response message includes the third MAC value; and the one or more interfaces are configured to transmit the response message to the authentication device; and
a programmable logic unit configured to:
receive the decrypted FPGA-configuration data.
5. A system comprising:
a field-programmable gate array (FPGA) configured to:
receive encrypted FPGA-configuration data and a first message authentication code (MAC) value that is generated by a cryptographic algorithm using unencrypted FPGA-configuration data and a first initial value, wherein the first MAC value indicates a cryptographic state of the unencrypted FPGA-configuration data;
decrypt the encrypted FPGA-configuration data;
compare the first MAC value with a second MAC value that is generated by the cryptographic algorithm using the decrypted FPGA-configuration data and the first initial value; and
in response to the first MAC value being the same as the second MAC value, authenticate the decrypted FPGA-configuration data and configure a programmable logic unit of the FPGA with the decrypted FPGA-configuration data; and
an authentication device configured to:
transmit a challenge message to the FPGA and receive a response message to the challenge message, wherein the response message is generated, at the FPGA, by encrypting the challenge message, wherein the response message includes a third MAC value generated by the cryptographic algorithm using the challenge message and the second MAC value as a second initial value; and
authenticate the response message by comparing the third MAC value to a fourth MAC value.
6. The system of claim 5 further comprising a memory arranged to store the FPGA-configuration data.