-
Low power AES implementations for RFIDDina Kamel, Francesco
Regazzoni, Cdric Hocquet, David Bol, Denis Flandre and
Franois-Xavier Standaert
BCRYPT 2010
-
OutlineOverview RFIDsWhy AES ?RFID Power budgetDesign of
S-boxTechnology selectionSupply voltageLogic styleSubthreshold AES
core*BCRYPT 2010
BCRYPT 2010
-
RFID*BCRYPT 2010General Constraints:1- Power few W2- Area few K
Gates3- Latency ms
BCRYPT 2010
-
Technology road map for memoriesBCRYPT 2010*Foundries used to
provide NVM down till 0.18 mIP vendors provide NVM down till 45 nm
targeting several foundries
BCRYPT 2010
-
Why AESNowadays RFID are at 180 nm and 130 nm mainly for memory
issuesThe technology trend is pushing for smaller technologies
(also for memories)Smaller technologies allow to implement complex
algorithms / enhanced functionality3-D stacking enables mixed
technologies e.g. 65 nm logic + 130 nm NVM
AES is the standardBCRYPT 2010*
BCRYPT 2010
-
Move to 65nm to overcome area problems
65nm will allow compact AES implementationWidespread use of
Low-Power technology flavorLow fabrication costs for high volume
production
BCRYPT 2010*
BCRYPT 2010
-
low power is still an issuePassive RFIDs are battery less
devicesPower constraints are still present at 65 nm (leakage)In
advanced technologies, such as 65 nm and below, two flavors are
developed:General purpose (GP)Low power (LP)BCRYPT 2010*
BCRYPT 2010
-
Power budgetBCRYPT 2010*Power Budget for: HF (13.56 MHz): 22.5
WUHF (900 MHz): 4 W[A.S.W. Man, RFID Eurasia07]Power: 4.7 WTech.:
TSMC 0.18 mVDD: 1.8 VSim. results using Power compiler
BCRYPT 2010
-
How the power is distributed in an 8bit Architecture AESBCRYPT
2010*[T. Good, TVLSI09]
BCRYPT 2010
Chart1
0.34
0.15
0.05
0.24
0.08
0.07
0.07
0
Power Budget
Sheet1
Power Budget
Memory34%
Clock Generation15%
Control5%
S-box24%
MixColumns8%
KeyExpansion7%
Remainder of datapath7%
To resize chart data range, drag lower right corner of
range.
-
S-box DesignThe optimized S-box given by [N. Mentens,05]It uses
the composite field GF(((22)2)2)Power and delay aspects in light of
different parameters:Technology selectionSupply voltageLogic
style
BCRYPT 2010*[D. Kamel, ISCAS09]
BCRYPT 2010
-
S-box design: Technology selection0.13 m main properties of
Standard VT (SVT) and High VT (HVT) NMOS transistors.BCRYPT 2010*+
90 mV23 xlower[D. Kamel, ISCAS09]
Tech. flavorDevice typeVDD VToxnmVtmVIonA/ mIoffnA/ mIgpA/
mGPSVT1.22247670469HVT1.22336537212
BCRYPT 2010
-
S-box design: Technology selection65 nm Main properties of Low
VT (LVT), Standard VT (SVT) and High VT (HVT) NMOS transistors in
GP and LP technology flavors.BCRYPT 2010*[D. Kamel, ISCAS09]3
orders of magnitude
Tech. flavorDevice typeVDD VToxnmLpolynmVtmVIonA/ mIoffnA/
mIgnA/ mGPSVT11.345475896628.97HVT11.3455557404.76.18
LPLVT1.21.85575078554.20.0114SVT1.21.85576457020.520.008HVT1.21.85577215010.0360.0054
BCRYPT 2010
-
Simulation resultsPower consumption at 100 kHzBCRYPT
2010*IoffIgate 8.7 W/MHz [P. Hamalainen, DSD06]*870 nW3.71 W90.6
nW10 times less than 870 nW7 times less than 630 nW reported by
[Feldhofer,05] using 0.35 m, 1.5 VPower1.8 times less than 166 nW
reported by [T. Good,TVLSI09] using 0.13 m, 0.75 V[D. Kamel,
ISCAS09]
BCRYPT 2010
-
Simulation resultsDelayBCRYPT 2010*130 nmSVTHVT65
nmGPSVTHVTLVTSVTHVT65 nmLP2.2 ns2.35 nsPower40[D. Kamel,
ISCAS09]
BCRYPT 2010
-
S-box design: Supply voltageSimulations are done using 65 nm LP
SVT devices at 100 kHz and at nominal conditions.BCRYPT 2010*[D.
Kamel, ISCAS09]* 166 nW [T. Good, TVLSI09] at 0.75 V5 times less
than 166 nW reported by [T. Good,TVLSI09] using 0.13 m, 0.75 VFine
for 100 KHz (large margin)Promising, but robustness ?
BCRYPT 2010
-
S-box Design: compare different logic familiesStandard Logic:
Static CMOS (S-CMOS)Dynamic Differential Logic: Dynamic
Differential Swing Limited Logic (DDSLL) Protected Logic
Why ?Security more resilient against power analysis attacks
BCRYPT 2010*
BCRYPT 2010
-
Static CMOS versus Dynamic Differential Swing Limited
logicBCRYPT 2010*SC XORDDSLL XORPPartNMOS TreeFeedBackCompletion
SignalCurrent Source[I. Hassoune, the VLSI Journal07]
ABOUT000011101110
BCRYPT 2010
-
DDSLL How does it work ?BCRYPT 2010*Pre-chargeEvaluation[I.
Hassoune, the VLSI Journal07]
BCRYPT 2010
-
BCRYPT 2010*DDSLL is too complex !
# trans for 1 XORSCDDSLLP transistors49N transistors412Total
transistors821
BCRYPT 2010
-
DDSLL Sharing principleBCRYPT 2010*[I. Hassoune, the VLSI
Journal07]
BCRYPT 2010
-
DDSLL Sharing principleBCRYPT 2010* The whole DDSLL AES S-box
consists of 13 stages The total number of DDSLL S-box transistors
is 1.2 times less that of S-CMOS S-boxTrans GF(28)
->GF(((22)2)2)Trans GF(((22)2)2) -> GF(28)+Affine Trans
# trans for S-boxS-CMOSDDSLLTotal transistors15301275
BCRYPT 2010
-
Measurement results of S-CMOS and DDSLL S-boxesBCRYPT 2010*46
m24 m46 m25 m83 nW127 nWAreaPowerDelay3 3.2 ns7.5 8.1 nsThanks to
lower voltage swing
S-CMOS S-boxDDSLL S-box
BCRYPT 2010
-
Full AES coreBase architecture [Feldhofer,05]:128 AES8 bit data
pathS-box GF(((22)2)2)
Design Target:sub-threshold 65nm100 kHzLow powerBCRYPT 2010*
BCRYPT 2010
-
Sub-threshold Design FlowBCRYPT
2010*HDLSynthP&RSynopsysDesigncompilerCadenceEncounter[C.
Hocquet, FTFC09]
BCRYPT 2010
-
Design of 65 nm subthreshold libraryStart point: 65nm library
with nominal voltage 1.2VKeep in the library only gates with
maximum stack of 2 MOSFETsRe-characterize the library at 0.4V
(lowest VDD for 100kHz)Final library: 73 cellsBCRYPT 2010*[C.
Hocquet, FTFC09]
BCRYPT 2010
-
ResultsBCRYPT 2010*1.2 V standard library1.2 V restricted
library0.4 V restricted library
BCRYPT 2010
-
Comparison with state of the artBCRYPT 2010*
ImplementationTechnologyArea[GEs]Max. freq.[MhZ]Power @ 100 kHz
[W]
Proposed1.2 V 65 nm35000.1 @ 0.4 V0.12 @ 0.4 V[Feldhofer,05]1.5
V 0.35 m3400804.5[Hamalainen, DSD06]1.2 V 0.13
m34001303[Good,TVLSI09]1.2 V 0.13 m550012.80.692 @ 0.75 V
BCRYPT 2010
-
ConclusionsThe S-box consumes the largest percentage of power.By
choosing the appropriate technology the S-box power can be reduced
by more than 1 order of magnitude from 3.71 W (0.13 m) to 90 nW (65
nm - LP) while maintaining same delayReducing the VDD of S-box from
1.2 V to 0.8 V decreases the power by 60 %, but increases the delay
x3The DDSLL logic reduces the power x1.5 than S-CMOSSubthreshold
AES is a good candidate for Ultra Low power RFID applications 120
nW @ 0.4 VBCRYPT 2010*
BCRYPT 2010
-
BCRYPT 2010*Thank you
BCRYPT 2010
*Speak about RFID / Power management*White background behind
text*Not Gate count - Area*Man: The Hong Kong University of Science
and Technology*numbers**Introduce graphs***Developed at UCL*Explain
fig*Meas - 65*Group UCL*
