Universit de Provence

Design and development of a

reconfigurable cryptographic
co-processor
Daniele Fronte

Directeur de thse : Annie Prez Superviseur industriel : Eric Payrat

Soutenance de thse
Marseille, 8 Juillet 2008
 Daniele Fronte

Sommaire
1) Introduction
Cahier des charges et objectifs
Choix des algorithmes
2) Coprocesseur
Architecture
Excution de micro-instructions
3) Rsultats
Validation FPGA
Synthse ASIC
4) Conclusions
 Daniele Fronte

Cahier des charges du Coprocesseur

1) Cryptographie

2) Multi-algorithmes

3) Systmes embarqus

4) Scurit

5) Cellules standards dAtmel

6) Puces - Lecteurs de cartes puce

 Daniele Fronte

Choix
1) Cryptographie
Cl secrte?
Cl publique?

2) Multi-algorithmes
Algorithmes standards/propritaires
Multi-algorithmes
Quel degr de reconfigurabilit?
FPGA ou pas de FPGA?

3) Systmes embarqus
Taille
Performances

4) Scurit
Attaques latrales de canal: SPA, DPA
 Daniele Fronte

DES, AES
Cryptographie cl secrte

Alice Bob

DES DES-1
 Daniele Fronte

DES Message en clair

L 32 32 R
IP
L0 R0
F
Taille du bloc donnes : 64 bits
Taille initiale de la cl : 56 bits F

16 boucles
1. Permutation Initiale
F
2. 16 boucles :
Fonction F
F
Ou exclusif L16 32 32 R16
FP
3. Permutation finale
Message encrypt
 Daniele Fronte

Dtails de DES

R Cl
Fonction F : 32 48

1. Expansion E E

2. Ou exclusif 48

3. Sbox
4. Permutation P
S1 S2 S3 S4 S5 S6 S7 S8

32

32
 Daniele Fronte

AES

Taille du blocs donnes : 128 bits

Taille initiale de la cl : 128, 192, 256 bits

10 boucles, dont 8 avec :

1. Sbox
2. ShiftRows
3. MixColumns
4. AddRoundKeys
 Daniele Fronte

Dtails de AES

Transformations :
1. Sbox
2. ShiftRows
3. MixColumns
4. AddRoundKeys
 Daniele Fronte

Dtails de AES

Transformations :
1. Sbox
2. ShiftRows
3. MixColumns
4. AddRoundKeys
 Daniele Fronte

Dtails de AES

Transformations :
1. Sbox
2. ShiftRows
3. MixColumns
4. AddRoundKeys
 Daniele Fronte

Dtails de AES

Transformations :
1. Sbox
2. ShiftRows
3. MixColumns
4. AddRoundKeys
 Daniele Fronte

SHA
Fonction de Hachage

input 000 001 010

SHA SHA SHA

8AEFB06C 426E07A0 E193A01E CF8D30AD 47AB9979 443FB7ED

Hash sum A671A1E2 588B4858 0AFFEFD3 32CE934E 1C193D06 773333BA
D694A730 32FFCE72 7876094F
 Daniele Fronte

Utilisation de SHA

517F3AB6
Alice
Condens
Message SHA

Si oui, le
message est
Message, condens
=? authentique et
intgre

517F3AB6
Bob
Message SHA Condens
 Daniele Fronte

Dtails de SHA-256
Taille du blocs donnes : (multiple de) 512 bits
Taille du condens : 256 bits
Wt
64 boucles :
8 variables: A, B, , H Ch Kt

4 Fonctions: Ch, Maj, 0, 1 1

64 valeurs temporaires Wt
Maj
Ou exclusif
0
 Daniele Fronte

Oprations requises
Sbox Look up table 8 bits
Shift Rows Rotation droite 8 bits
AES Mix Columns xtime, Ou exclusif 8 bits
Add Round Key Ou exclusif 8 bits

Ou exclusif Ou exclusif 32 bits

Rotation Rotation 1 bit
DES IP, IP-1, PC1, PC2, E Permutations Bit bit
SBox Look up table Bit bit

Ou exclusif Ou exclusif 32 bits

Addition Addition 32 bits
SHA Dcalage Dcalage 32 bits
Rotation Rotation 32 bits
 Daniele Fronte

Coprocesseur Cryptographique Reconfigurable

= Celator
krypton, encrypt, crypto etc. dj utiliss !

Cryptographie en grecque :
Kripts = cacher
Grfo = crire
Cryptographie en latin
Celare = cacher
 Daniele Fronte

Architecture de Celator
 Daniele Fronte

Rseaux systoliques de processeurs

Input data streams
Processing Elements :
Grain fin
Grain gros
PE PE PE PE 1D, 2D, 3D
Input data streams

Input data streams

PE PE PE PE

PE PE PE PE

PE PE PE PE

Input data streams

 Daniele Fronte

Construisons un Processing Element array

Data matrix Systolic Processor Network

1 2 3 4

5 6 7 8

9 10 11 12

13 14 15 16
 Daniele Fronte

PE Array, Controller

PE PE PE PE
Control Data
Bus Bus
PE PE PE PE

PE PE PE PE
Processing
Element
PE PE PE PE

Controller
 Daniele Fronte

PE Array, Controller, CRAM

Controller Reconfigurabilit donne par :

Rseau systolique de
Processing Elements
CRAM
PE
CRAM
Array
 Daniele Fronte

Vue gnrale du systme

Celator

AHB
CRAM
PE
ARM 7
Array
TDMI
Programs

IF Controller and

Data

Main
Memory
Other
Peripherals
 Daniele Fronte

Interface Advanced High-performance Bus (AHB)

HSEL_RAM
HWRITE Split Address reg
Data/controls
HWDATA [31:0]
From/to CRAM
HRDATA [31:0]
HSEL_REG Control reg
Data/controls
HADDR [ 11: 0]
From/to Controller
Status reg
interrupt

CPU_clock Celator_clock
 Daniele Fronte

PE array northern data I/O
PE array 32-bits
MUX_N
PE array western data I/O

PE array eastern data I/O

PE00 PE01 PE02 PE03

PE10 PE11 PE12 PE13

32-bits 32-bits

PE20 PE21 PE22 PE23

PE30 PE31 PE32 PE33

MUX_W MUX_E

MUX_S
32-bits
PE array southern data I/O
 Daniele Fronte

Exemple dexcution

Remplissage de la CRAM
Lecture des micro-instructions
AES Shift Rows
 Systme

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

27
 Remplissage de la CRAM

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

28
 Remplissage de la CRAM

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA AES-1

Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

29
 Remplissage de la CRAM

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
AES-2
32 HRDATA AES-1

Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

30
 Remplissage de la CRAM

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface AES-3 Controller
AES-2
32 HRDATA AES-1

Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

31
 Remplissage de la CRAM

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface AES-4
AES-3 Controller
AES-2
32 HRDATA AES-1

Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

32
 Remplissage de la CRAM

Di Controller
Di CPU

32 32
Split Address reg DATA-3

HADDR 32 DATA-2
DATA-1 12
Address CPU 12
CRAM
AES-7
AES-6
AES-5 Address
CPU interface CRAM AES-4
AES-3 Controller
AES-2
32 HRDATA AES-1

Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

33
 Dmarrage de Celator

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

34
 Lecture des micro-instructions

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA AES-1

Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

35
 Chargement des donnes dans le PE array

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12 Data 1

CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

36
 Chargement des donnes dans le PE array

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32 Data 2 12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

37
 Chargement des donnes dans le PE array

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32 Data 3
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

38
 Chargement des donnes dans le PE array

Di Controller
Di CPU

32 32
Split Address reg Data 4

HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

39
AES Shift Rows

40
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

41
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

42
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

43
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

44
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

45
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

46
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

47
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

48
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

49
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6

PE
Control out
status out

Control in

Array
Status in

PE out 32

Reg Y Controller Reg X

50
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

51
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

52
 AES Shift Rows

Di Controller
Di CPU

32 32
Split Address reg
HADDR 32
12
Address CPU 12
CRAM Address
CPU interface Controller
32 HRDATA
Do CPU 32
32
Control reg Do
HWDATA 32 Controller
PE in 32

Status reg
32

6 6 6 6
Control out
status out

Control in
Status in

PE out 32

Reg Y Controller Reg X

53
 Daniele Fronte

FPGA Validation
 Daniele Fronte

FPGA Validation
Celator a t :
Ecrit en RTL Verilog HDL
Simul par Mentor Modelsim
Synthtis (FPGA) par Mentor Precision RTL
Plac et rout par Xilinx ISE
Tlcharg dans une carte FPGA Xilinx Virtex II

Les tests sur FPGA ont t faits laide de la suite

ARM developper
 Daniele Fronte

FPGA Validation
jpg file ppm file dcd file Celator (FPGA)
0123 DCD 0x0123 AES 0x9267
4567 DCD 0x4567 DES 0x2301
8901 DCD 0x8901 SHA 0x4805

jpg file ppm file

9267
2301
4805

0x45D5BA3

jpg file ppm file dcd file Celator (FPGA)

0123 DCD 0x0123
4567 DCD 0x4567 AES-1
8901 DCD 0x8901 DES-1
 Daniele Fronte

AES (ECB et CBC modes) : Lena

AES
128 128

ECB mode

AES-1
128 128

AES
128 128

CBC mode

AES-1
128 128
 Daniele Fronte

DES (ECB et CBC modes) : Lena

DES
64 64

ECB mode

DES-1
64 64

DES
64 64

CBC mode

DES-1
64 64
 Daniele Fronte

Lena originale
SHA

Condens :
D0E309A7 88BE2E1B 255BEE42 B18B0675
174E1E05 69063F30 D748EEF4 F236D21D

Lena: un pixel a t modifi

Condens :
38F26C9A B2DC15A3 845E6AAD 6B94495C
9747FE14 86E513D1 D2FD2CE7 BDA331C3
 Daniele Fronte

Rsultats ASIC
 Daniele Fronte

Rsultats de synthse ASIC

Celator a t :
Ecrit en RTL Verilog HDL
Simul par Mentor Modelsim
Synthtis (ASIC) par Synopsys Design Compiler
Plac et rout par Cadence Encounter
 Daniele Fronte

Algorithmes excuts par Celator

 Daniele Fronte

DES

0% reconf. x% reconf. FPGA 100% reconfigurable (HW sbox)

 Daniele Fronte

SHA

0% reconf. 0% reconf. 0% reconf. x% reconf.

 Daniele Fronte

Tailles et performances (pour AES)

0% reconf. x% reconf. 100% reconf. 100% reconf.

Technologie 130nm
(*) Les mmoires ne
sont pas comptes
 Daniele Fronte

Conclusions sur Celator

1) Coprocesseur multi-algorithmes
2) Algorithmes Standards excuts : AES, DES, SHA
3) Possibilit dimplmenter des algorithmes propritaires
4) Performances : Amliorations rcentes :
AES 47 Mbps AES + 20%
DES 24 Mbps DES + 20%
SHA 5 Mbps SHA + 40%
Taille totale estime : + 5%
 Daniele Fronte

Prvision court terme

1) Intgration dans la nouvelle gnration de
lecteurs de cartes puces

2) March cible : tl la demande

3) Certification de scurit (EAL5+)
4) Excution dautres algorithmes
 Daniele Fronte

Celator Team
Annie PEREZ Eric PAYRAT
Atmel
IM2NP

Daniele FRONTE
Atmel & IM2NP

Celine HUYNH VAN THIENG Vincent MOLLET

PolytechMarseille PolytechMarseille
 Daniele Fronte

Merci pour votre attention