Energy-efficient AES SubBytes transformation circuit using asynchronous circuits for ultra-low voltage operation

Transcription

1 LETTER IEICE Electronics Express, Vol.12, No.4, 1 10 Energy-efficient AES SubBytes transformation circuit using asynchronous circuits for ultra-low voltage operation Yuzuru Shizuku 1a), Tetsuya Hirose 1b), Nobutaka Kuroki 1, Masahiro Numa 1, and Mitsuji Okada 2 1 Department of Electrical and Electronic Engineering, Kobe University, 1 1 Rokkodai, Nada, Kobe , Japan 2 Research and Development Consultant a) shizuku@cas.eedept.kobe-u.ac.jp b) hirose@eedept.kobe-u.ac.jp Abstract: In this paper, we present an ultra-low voltage Advanced Encryption Standard (AES) SubBytes transformation (S-BOX) circuit. The S-BOX is widely used as a basic cryptographic primitive for the secure transaction in wireless sensor networks. We employ an asynchronous circuit design technique for low-voltage operations to achieve ultra-low power dissipation. In the proposed approach, we apply a quasi-delay-insensitive (QDI) design methodology to the asynchronous S-BOX circuit to reduce the spurious transitions in combinational logics and to increase robustness against PVT variations. Measurement results in 0.18-µm CMOS process demonstrated that our asynchronous S-BOX circuit consumes only 0.99-pJ at 330-mV, which is 12% less energy than that of synchronous one. QDI asynchronous circuits in the datapath are an effective solution in the near-threshold and sub-threshold regimes. Keywords: low power, low supply voltage, asynchronous circuit Classification: Integrated circuits References [1] M. Feldhofer, S. Dominikus and J. Wolkerstorfer: in Sixth Int. Workshop on Cryptographic Hardware and Embedded Systems, Boston, USA, August 2004, LNCS 3156, ed. M. Joye and J.-J. Quisquater (Springer, 2004) 357. [2] Y. M. Feldhofer, J. Wolkerstorfer and V. Rijmen: IEE Proc. in Information Security (2005). [3] B. Zhai, S. Hanson, D. Blaauw and D. Sylvester: Proc. Int. Symp. Low Power Electron. Design (2005) 20. DOI: /LPE [4] D. Kamel, C. Hocquet, O.-X. Standaert, D. Flandre and D. Bol: Proc. ESSCIRC (2010) 518. DOI: /ESSCIRC [5] R. D. Jorgenson, L. Sorensen, D. Leet, M. S. Hagedorn, D. R. Lamb, T. H. Friddell and W. P. Snapp: Proc. IEEE 98 (2010) 299. DOI: /JPROC. 1

2 [6] N. M. Duc and T. Sakurai: Design Automation Conference 2000, Proc. of the ASP-DAC2000 (2000) 475. DOI: /ASPDAC [7] Y. Osaki, T. Hirose, N. Kuroki and M. Numa: IEEE J. Solid-State Circuits 47 (2012) DOI: /JSSC [8] T. Good and M. Benaissa: IEEE Trans. Very Large Scale Integr. (VLSI) Syst. 18 (2010) DOI: /TVLSI [9] D. Kamel, O.-X. Standaert and D. Flandre: ISCAS (2009) DOI: / ISCAS [10] S. Morioka and A. Satoh: CHES (2002) 172. DOI: / _14 1 Introduction The Internet of Things (IoT) is a phrase that is becoming more and more popular in technological fields. In the IoT, a wireless network is indispensable because of the large number of things which include not only consumer electronics but also various sensor devices communicate with each other. Therefore, it is necessary to cipher the data exchanged between IoT devices in order to maintain secure communications. As a cryptographic primitive, Advanced Encryption Standard (AES) is utilized in IoT devices to ensure the secure transaction such as vital signals and personal information. Most battery-operated IoT devices are constrained to consume power only on the order of nano-watts in active mode. However, AES SubBytes transformation (S-BOX) circuits consume power on the order of microwatts [1, 2], we need to reduce the power consumption of them to satisfy the power constraint. The total power consumption in digital CMOS circuits consists of three major sources, which are summarized by P total ¼ t C L f CLK V 2 dd þ I SC V dd þ I leakage V dd : The first term represents the dynamic power, where C L is the loading capacitance, f CLK is the clock frequency, V dd is the supply voltage, and t is the provability that a transition occurs (activity ratio). The second term is due to the direct-path short circuit current I SC, which arises when both the PMOS and NMOS transistors are simultaneously active. The last term, leakage power consumption, primarily depends on the fabrication technology. As shown in Eq. (1), ultra low-power digital circuits require a voltage scaling technique to operate under extremely low voltages such as the near-threshold and sub-threshold regimes due to a quadratic relationship between power consumption and supply voltage. However, it is quite difficult to overcome the effect of process, voltage, and temperature (PVT) variations for fine-dimensioned CMOS processing in ultra-low voltage operation [3]. In order to achieve robust circuits, the adoption of asynchronous circuits, especially delay-insensitive (DI) or quasi-delay-insensitive (QDI), has been attracting attention for potential use in power-aware applications. Also of interest is reducing the spurious transitions in combinational logics. t is increased at low voltage due to glitch-induced variations [4]. ð1þ 2

3 In this work, we focus on 1) lowering the supply voltage (V dd ) to 0.5 Vor below from the nominal 1.8 V in 0.18-µm CMOS and 2) minimizing the transition per operation ( t ) with free hazard (no glitch). For supporting the low supply voltage simulation, we characterized a minimum set of 0.5-V cell libraries for both synchronous and asynchronous circuits. We then used these libraries to design S- BOX circuits under the same process technology. As a low power efficiency index, we use the power-delay product (PDP). However, this can be contradictory if the targeting performance is different. In this work, a longer battery life is considered more important than a high performance in other words, energy per operation is the key factor. Therefore, in this paper, we confirm energy consumption of the asynchronous S-BOX circuit is lower than that of the synchronous one. The rest of this paper is organized as follows. Section 2 briefly introduces some background information on asynchronous circuits. In Sect. 3, asynchronous S- BOX circuit design is explored with the newly developed cell libraries. Sections 4 and 5 show the simulation and experimental results, respectively. The main finding here is that our proposed circuit achieves a lower energy consumption than the other logic style. Finally, we conclude in Section 6 with a brief summary. 2 Asynchronous circuits There are numerous approaches to designing digital circuits without clocks, called clockless or asynchronous circuits. Asynchronous circuits have various pros and cons depending on the design style [5]. They are similar to synchronous circuits in the sense that both circuits have registers for storing the inputs or results of a calculation and computational elements for processing the data flow within a circuit. In asynchronous circuits, the handshaking from register to register is controlled by a desynchronization controller instead of a clock in synchronous circuits. In this work, we focus on the computational element designed by QDI design methodology. In QDI design, a completion of computation is detected by the encoded data, as in a dual-rail encoding, where each signal has two wires: true and false. The data value 0 is encoded as ð0; 1Þ and 1 is encoded as ð1; 0Þ. ð0; 0Þ is neutral and ð1; 1Þ is unused. QDI circuits need to be initialized before execution to detect the completion. This is called as a spacer shown in Fig. 1. Fig. 2 shows the QDI operation of Half-Adder (HA) as a concrete example. In Fig. 2, the output of a synchronous HA always changes when the CLK signal rises. On the other hand, in an asynchronous HA, the new data is inputted to HA after detecting the initialization by completion detected circuit and the HA calculates, and then the completion of calculate is detected, the spacer is inserted to HA in order to initialize the HA. Therefore, QDI circuits have to execute twice as many operations as synchronous circuits that is, the frequency f CLK is increased to 2X. On the other hand, activity ratio t is fixed at 1, as there is no hazard in the QDI circuits. In synchronous circuits, activity ratio t depends on the previous input data and state. The ratio is also affected by glitches, which are induced by the imbalance delay of combination circuits. In actually, asynchronous circuits are event-driven and the duration of the task and spacer is decided by the completion detection circuit. Therefore, the execution time is corresponded with the PVT variations. It also can easily detect a 3

4 (a) Synchronous operation (b) Asynchronous operation Fig. 1. Principle of asynchronous operation (QDI). (a) Synchronous Half-Adder (b) Asynchronous Half-Adder Fig. 2. Difference between synchronous and asynchronous Half-Adder operation. failure by using the encoding. In normally, the ð1; 1Þ is not occurred. If the circuits detect the ð1; 1Þ, it can retry the sequence after inserting the spacer, ð0; 0Þ. 3 Low voltage asynchronous circuit design 3.1 Asynchronous S-BOX circuit design Fig. 3 shows the architecture of asynchronous S-BOX circuit which supports circuit sharing between S-BOX and S-BOX 1. This circuit consists of a multiplicative inverse of a Galois field GF (2 8 ), an affine transformation for encryption, and an inverse affine transformation for decryption. To minimize the power consumption, we also implemented the operand isolation technique, which blocks the propagation of switching activity through the circuits. We implemented the composite field arithmetic of GF(ðð2 2 Þ 2 Þ 2 ) as the multiplicative inverse of GF(2 8 ) since it is the smallest size. It comprises two types of cells: i.e., AND and XOR. In Fig. 3, we used ¼f1100g 2 as the multiplicative inverse of GF(ðð2 2 Þ 2 Þ 2 ) and ¼f00g 2 as the multiplicative inverse of GF(ð2 2 Þ 2 ), which is depicted as x 1. Generally, we use a standard cell library (corresponding to V dd ¼ 1:8 V for 0.18-µm CMOS) provided by the fabrication manufacturer. Since the cell library is characterized on the basis of normal operating core voltage, we have to characterize it for the various voltages we use. In this work, we need a 0.5-V cell library to evaluate 4

5 Fig. 3. Architecture of circuit-shared asynchronous AES SubByte transformation circuit. the performance at low voltage. Therefore, we developed two types of 0.5-V cell libraries using commercially available cell characterization tools: one is for a synchronous circuit and the other is for an asynchronous circuit. We describe the asynchronous S-BOX circuit using Verilog-HDL. We use these cell libraries, which contain information on area, power, and slew rate in order to execute the synthesis, the gate level delayed simulation, and the analysis of power consumption by using Verilog-HDL design tools. Our asynchronous S-BOX circuit features a non-pipelined design and has an area of 12,476 µm 2 (312 in equivalent number of 2-input ASYNC_AND cell). Its critical path in the multiplicative inverse of GF (ðð2 2 Þ 2 Þ 2 ) has 24 cell gates. The synchronous S-BOX circuit using 0.5-V synchronous cell library is 6,019 µm 2 (457 in equivalent number of 2-input NAND cell). Table I provides a summary of the developed circuits. The detail of each developed circuit is explained in Sect. 5. Table I. Design summary of synthesis. No. Types Cell library Voltage (V) Area 1 (µm 2 ) c0 Synchronous Standard 1.8 3,809 c1 Synchronous 0.5-V sync ,019 c2 Asynchronous 0.5-V sync ,127 c3 Asynchronous 0.5-V async ,476 1 Area = pre-layout V synchronous cell library We have developed a minimum set of a 0.5-V synchronous cell library, shown in Table II. It contains just six cells. This compact library has the performance disadvantages in delay, area size, and power consumption [6]. The circuit structures of the 0.5-V synchronous cells are same as those of the standard cell library corresponding to 1.8-V. These libraries show different circuit performances because they have different supply voltages [6]. We use the 0.5-V library in order to evaluate low-voltage circuit performance by Verilog-HDL tools V asynchronous cell library The 0.5-V asynchronous cells can be composed with the 0.5-V synchronous cells. Fig. 4 shows asynchronous AND cell and asynchronous XOR cell by using 5

6 Table II. Specifications of synchronous cell library. (V dd ¼ 0:5 V) Cell. Delay (ns) Power (nw) Area (µm 2 ) INV NAND NOR XOR D-FF MUX Table III. Specifications of asynchronous cell library. (V dd ¼ 0:5 V) Cell. Delay (ns) Power (nw) Area (µm 2 ) ASYNC_AND ASYNC_XOR (a) ASYNC_AND (b) ASYNC_XOR Fig. 4. Asynchronous logic cells composed of synchronous cells. (a) ASYNC_AND (b) ASYNC_XOR Fig. 5. Circuit structures of proposed asynchronous cell library. synchronous cells. However, these cells take a large area and a high power consumption. Thus, we developed the 0.5-V asynchronous cell library shown in Table III. The circuit structures are shown in Fig. 5. An invert cell in dual-rail encoding can be realized by crossing the wires. This means it requires no additional transistors. 6

7 4 Simulation results The various structures of S-BOX circuit shown in Table I were simulated by using our developed cell libraries shown in Table II and Table III. Fig. 6 shows the simulation results of the synchronous S-BOX circuit (c0). The input data of the S-BOX circuit and the output data of the affine transformation are shown. There are many glitches caused in the imbalance delay of combination logics, and these glitches consume a lot of power. Fig. 7 shows the simulation results of the asynchronous S-BOX circuit (c3). The same input data points. Here, there were no glitches and therefore no unnecessary spurious transactions. Fig. 6. Simulated waveforms of synchronous S-BOX at standard cell library (V dd ¼ 1:8 V). Fig. 7. Simulated waveforms of asynchronous S-BOX at asynchronous cell library (V dd ¼ 0:5 V). Fig. 8 shows the results of power consumption. The top curve indicates the total power consumption, which contains switching, internal, and leakage powers. In the synchronous S-BOX circuit at 1.8 V with a standard cell library, power consumption was 155 µw. In contrast, the synchronous S-BOX circuit at 0.5 V with our developed cell library consumed just 8.94 µw, and when subjected to an ideal voltage scaling, it became X, i.e., µw if the static power is omitted. We also plot the results of the asynchronous S-BOX circuit at 0.5 V with our developed asynchronous cell library in Fig. 8. It consumed 7.57 µw. Compared with the synchronous one, this is 15.3% less. 7

8 Fig. 8. Simulation results of power consumption. 5 Experimental results Both synchronous and asynchronous S-BOX circuits were fabricated in a 0.18-µm CMOS technology. Four types of S-BOX circuits were implemented in the same chip. A chip microphotograph of the chip is shown in Fig. 9, where c0 is the synchronous S-BOX circuit using a 1.8-V standard cell library, c1 is the synchronous S-BOX circuit using a 0.5-V synchronous cell library, c2 is the asynchronous S-BOX circuit using a 0.5-V synchronous cell library, and c3 is the asynchronous S-BOX circuit using a 0.5-V asynchronous cell library. The areas of c0, c1, c2, and c3 were 5176 µm 2, 8150 µm 2, µm 2, and µm 2, respectively. In the measurement phase, we used our previously designed level shifters [7] as the mandatory circuit for confirming the output data, as conventional level shifters cannot convert extremely low-voltage inputs into high-voltage outputs. Fig. 9. Chip microphotograph. Fig. 10 shows the measured energy per operation as the supply voltage V dd was varied from 0.8 V down to 0.2 V. The results show that the energy dwindled along with the rules of voltage scaling in the near-threshold and sub-threshold regimes. The asynchronous S-BOX circuit (c3) was still functional at V dd ¼ 240 mv. However, the leakage power was dominant. Compared with the synchronous S- BOX circuit (c1), the energy of c3 was 12% less. Therefore, c3 achieved a minimum of 0.99 pj at V dd ¼ 330 mv with a frequency of khz. This means that reducing spurious transitions is very effective in combination circuits. 8

9 Fig. 10. Measured energy consumption. Solid line indicates energy at khz and dashed line indicates energy at khz. Table IV. Performance summary and comparison Reference [8] [9] Architecture Composite-Field Optimized Composite-Field Measurement Chip Simulation Process 0.13 µm FSG 0.13 µm GP/LL 65 nm LP/HVT Supply voltage 0.75 V 1.2 V 1.2 V Energy 1.66 pj 1.21 pj pj Leakage power nw 3.65 nw Circuit sharing S-BOX & S-BOX 1 S-BOX Reference [10] This work Architecture Composite-Field 3-stage PPRM Composite-Field Asynchronous Composite-Field Measurement Simulation Chip Process 0.13 µm 0.18 µm GP Supply voltage 1.5 V 310 mv 330 mv Energy 17.9 pj 7.9 pj 1.13 pj 0.99 pj Leakage power nw 13.6 nw Circuit sharing S-BOX & S-BOX 1 S-BOX & S-BOX 1 Table IV summarizes the performance of the synchronous and asynchronous S- BOX circuits in comparison with other designs [8, 9, 10]. Our proposed asynchronous S-BOX circuit achieved the lowest supply voltage using the largest process with efficient energy. 6 Conclusion In this paper, we presented an energy efficient asynchronous S-BOX circuit by employing a quasi-delay-insensitive design methodology. Our circuit is robust against PVT variations by the nature of asynchronous design and has a strong tamper resistance for side-channel attacks such as single power analysis and differential power analysis. Measurement results of our asynchronous S-BOX 9

10 circuit demonstrated that the circuit only consumes 0.99-pJ at 330-mV, which is 12% less energy than that of synchronous one, in 0.18-µm CMOS technology. QDI circuits in the datapath are an effective solution in the near-threshold and subthreshold regimes. Acknowledgments This work was partially supported by KAKENHI, the New Energy and Industrial Technology Development Organization (NEDO), and the VLSI Design and Education Center (VDEC), the University of Tokyo in collaboration with Cadence Design Systems, Inc and Mentor Graphics, Inc. 10