If you can't read please download the document
Upload
zuriel
View
31
Download
2
Embed Size (px)
DESCRIPTION
Low power AES implementations for RFID. Dina Kamel , Francesco Regazzoni, Cédric Hocquet, David Bol, Denis Flandre and François-Xavier Standaert. Outline. Overview RFIDs Why AES ? RFID Power budget Design of S-box Technology selection Supply voltage Logic style Subthreshold AES core. - PowerPoint PPT Presentation
Citation preview
Low power AES implementations for RFIDDina Kamel, Francesco Regazzoni, Cdric Hocquet, David Bol, Denis Flandre and Franois-Xavier Standaert
BCRYPT 2010
OutlineOverview RFIDsWhy AES ?RFID Power budgetDesign of S-boxTechnology selectionSupply voltageLogic styleSubthreshold AES core*BCRYPT 2010
BCRYPT 2010
RFID*BCRYPT 2010General Constraints:1- Power few W2- Area few K Gates3- Latency ms
BCRYPT 2010
Technology road map for memoriesBCRYPT 2010*Foundries used to provide NVM down till 0.18 mIP vendors provide NVM down till 45 nm targeting several foundries
BCRYPT 2010
Why AESNowadays RFID are at 180 nm and 130 nm mainly for memory issuesThe technology trend is pushing for smaller technologies (also for memories)Smaller technologies allow to implement complex algorithms / enhanced functionality3-D stacking enables mixed technologies e.g. 65 nm logic + 130 nm NVM
AES is the standardBCRYPT 2010*
BCRYPT 2010
Move to 65nm to overcome area problems
65nm will allow compact AES implementationWidespread use of Low-Power technology flavorLow fabrication costs for high volume production
BCRYPT 2010*
BCRYPT 2010
low power is still an issuePassive RFIDs are battery less devicesPower constraints are still present at 65 nm (leakage)In advanced technologies, such as 65 nm and below, two flavors are developed:General purpose (GP)Low power (LP)BCRYPT 2010*
BCRYPT 2010
Power budgetBCRYPT 2010*Power Budget for: HF (13.56 MHz): 22.5 WUHF (900 MHz): 4 W[A.S.W. Man, RFID Eurasia07]Power: 4.7 WTech.: TSMC 0.18 mVDD: 1.8 VSim. results using Power compiler
BCRYPT 2010
How the power is distributed in an 8bit Architecture AESBCRYPT 2010*[T. Good, TVLSI09]
BCRYPT 2010
Chart1
0.34
0.15
0.05
0.24
0.08
0.07
0.07
0
Power Budget
Sheet1
Power Budget
Memory34%
Clock Generation15%
Control5%
S-box24%
MixColumns8%
KeyExpansion7%
Remainder of datapath7%
To resize chart data range, drag lower right corner of range.
S-box DesignThe optimized S-box given by [N. Mentens,05]It uses the composite field GF(((22)2)2)Power and delay aspects in light of different parameters:Technology selectionSupply voltageLogic style
BCRYPT 2010*[D. Kamel, ISCAS09]
BCRYPT 2010
S-box design: Technology selection0.13 m main properties of Standard VT (SVT) and High VT (HVT) NMOS transistors.BCRYPT 2010*+ 90 mV23 xlower[D. Kamel, ISCAS09]
Tech. flavorDevice typeVDD VToxnmVtmVIonA/ mIoffnA/ mIgpA/ mGPSVT1.22247670469HVT1.22336537212
BCRYPT 2010
S-box design: Technology selection65 nm Main properties of Low VT (LVT), Standard VT (SVT) and High VT (HVT) NMOS transistors in GP and LP technology flavors.BCRYPT 2010*[D. Kamel, ISCAS09]3 orders of magnitude
Tech. flavorDevice typeVDD VToxnmLpolynmVtmVIonA/ mIoffnA/ mIgnA/ mGPSVT11.345475896628.97HVT11.3455557404.76.18
LPLVT1.21.85575078554.20.0114SVT1.21.85576457020.520.008HVT1.21.85577215010.0360.0054
BCRYPT 2010
Simulation resultsPower consumption at 100 kHzBCRYPT 2010*IoffIgate 8.7 W/MHz [P. Hamalainen, DSD06]*870 nW3.71 W90.6 nW10 times less than 870 nW7 times less than 630 nW reported by [Feldhofer,05] using 0.35 m, 1.5 VPower1.8 times less than 166 nW reported by [T. Good,TVLSI09] using 0.13 m, 0.75 V[D. Kamel, ISCAS09]
BCRYPT 2010
Simulation resultsDelayBCRYPT 2010*130 nmSVTHVT65 nmGPSVTHVTLVTSVTHVT65 nmLP2.2 ns2.35 nsPower40[D. Kamel, ISCAS09]
BCRYPT 2010
S-box design: Supply voltageSimulations are done using 65 nm LP SVT devices at 100 kHz and at nominal conditions.BCRYPT 2010*[D. Kamel, ISCAS09]* 166 nW [T. Good, TVLSI09] at 0.75 V5 times less than 166 nW reported by [T. Good,TVLSI09] using 0.13 m, 0.75 VFine for 100 KHz (large margin)Promising, but robustness ?
BCRYPT 2010
S-box Design: compare different logic familiesStandard Logic: Static CMOS (S-CMOS)Dynamic Differential Logic: Dynamic Differential Swing Limited Logic (DDSLL) Protected Logic
Why ?Security more resilient against power analysis attacks
BCRYPT 2010*
BCRYPT 2010
Static CMOS versus Dynamic Differential Swing Limited logicBCRYPT 2010*SC XORDDSLL XORPPartNMOS TreeFeedBackCompletion SignalCurrent Source[I. Hassoune, the VLSI Journal07]
ABOUT000011101110
BCRYPT 2010
DDSLL How does it work ?BCRYPT 2010*Pre-chargeEvaluation[I. Hassoune, the VLSI Journal07]
BCRYPT 2010
BCRYPT 2010*DDSLL is too complex !
# trans for 1 XORSCDDSLLP transistors49N transistors412Total transistors821
BCRYPT 2010
DDSLL Sharing principleBCRYPT 2010*[I. Hassoune, the VLSI Journal07]
BCRYPT 2010
DDSLL Sharing principleBCRYPT 2010* The whole DDSLL AES S-box consists of 13 stages The total number of DDSLL S-box transistors is 1.2 times less that of S-CMOS S-boxTrans GF(28) ->GF(((22)2)2)Trans GF(((22)2)2) -> GF(28)+Affine Trans
# trans for S-boxS-CMOSDDSLLTotal transistors15301275
BCRYPT 2010
Measurement results of S-CMOS and DDSLL S-boxesBCRYPT 2010*46 m24 m46 m25 m83 nW127 nWAreaPowerDelay3 3.2 ns7.5 8.1 nsThanks to lower voltage swing
S-CMOS S-boxDDSLL S-box
BCRYPT 2010
Full AES coreBase architecture [Feldhofer,05]:128 AES8 bit data pathS-box GF(((22)2)2)
Design Target:sub-threshold 65nm100 kHzLow powerBCRYPT 2010*
BCRYPT 2010
Sub-threshold Design FlowBCRYPT 2010*HDLSynthP&RSynopsysDesigncompilerCadenceEncounter[C. Hocquet, FTFC09]
BCRYPT 2010
Design of 65 nm subthreshold libraryStart point: 65nm library with nominal voltage 1.2VKeep in the library only gates with maximum stack of 2 MOSFETsRe-characterize the library at 0.4V (lowest VDD for 100kHz)Final library: 73 cellsBCRYPT 2010*[C. Hocquet, FTFC09]
BCRYPT 2010
ResultsBCRYPT 2010*1.2 V standard library1.2 V restricted library0.4 V restricted library
BCRYPT 2010
Comparison with state of the artBCRYPT 2010*
ImplementationTechnologyArea[GEs]Max. freq.[MhZ]Power @ 100 kHz [W]
Proposed1.2 V 65 nm35000.1 @ 0.4 V0.12 @ 0.4 V[Feldhofer,05]1.5 V 0.35 m3400804.5[Hamalainen, DSD06]1.2 V 0.13 m34001303[Good,TVLSI09]1.2 V 0.13 m550012.80.692 @ 0.75 V
BCRYPT 2010
ConclusionsThe S-box consumes the largest percentage of power.By choosing the appropriate technology the S-box power can be reduced by more than 1 order of magnitude from 3.71 W (0.13 m) to 90 nW (65 nm - LP) while maintaining same delayReducing the VDD of S-box from 1.2 V to 0.8 V decreases the power by 60 %, but increases the delay x3The DDSLL logic reduces the power x1.5 than S-CMOSSubthreshold AES is a good candidate for Ultra Low power RFID applications 120 nW @ 0.4 VBCRYPT 2010*
BCRYPT 2010
BCRYPT 2010*Thank you
BCRYPT 2010
*Speak about RFID / Power management*White background behind text*Not Gate count - Area*Man: The Hong Kong University of Science and Technology*numbers**Introduce graphs***Developed at UCL*Explain fig*Meas - 65*Group UCL*