Encrypted Transaction with Triple DES Team W2 Yervant Dermenjian (W21) Taewan Kim (W22) Evan Mengstab (W23) Xiaochun Zhu (W24) Objective: To implement a secure credit card transaction using 3DES encryption using Kerberos-style authentication. Design Manager: Rebecca Miller Final Presentation April 28, 2004

Project Description Implement Triple DES Encryption/Decryption for both host and client ends using 0.18μ CMOS technology Use Kerberos-style authentication Encrypt User Information as data using CC# and Pin as Keys Transaction Authorizer decrypts using CC# and Pin (which they know) Credit Card Number and PIN are never transmitted, but are essential to authenticate Attain speeds appropriate for application in Automated Teller Machines (200MHz) Integrate Encryption/Decryption into ATM transaction 18-525 Group W2

Security In Making Purchases Point-of-sale terminals transmit your name, credit card number, and expiration dates ‘in the clear’ Identity theft is a growing problem Credit and charge card fraud costs cardholders and issuers hundreds of millions of dollars each year 18-525 Group W2

Triple Data Encryption Standard Difficult to decipher for large encryption keys Symmetric Key Cipher – encryption & decryption use same key Based on DES – a very trusted cipher MasterCard requires all ATMs be 3DES compliant by April 1, 2005 Accepted as the new standard for federal agencies in 1999 Finalist for the 2001 Advanced Encryption Standard 18-525 Group W2

Kerberos-style Authentication Provides authentication without transmitting sensitive information. Encrypt card expiration date using credit card number and secret PIN as encryption key. The data payload is arbitrary. Only the cardholder and card acquirer have the key. Using Kerberos-style authentication, we transmit encrypted information that can be verified by the card authorizer without actually containing sensitive information 18-525 Group W2

Unencrypted Card# + PIN System Integration Triple DES Compliant Unencrypted Card# + PIN Verified Verified OK! Encrypted Card# + PIN Encrypted Card# + PIN Sensitive information never transmitted Uses existing cards and phone network 18-525 Group W2

How It Works Transmit: name, merchant, price, encrypted expiration date Card company has CC# and PIN to decrypt packet If expiration date matches, purchase is approved CC# and PIN are never transmitted, but essential to authenticate 18-525 Group W2

The 3DES Algorithm Overview DES vs. 3DES Stages Block Cipher - acts on a 64-bit block of plaintext Converts it into a 64-bit block of cipher text using a 56-bit key Specified in FIPS Pub 46-3 Symmetric Key Cipher – encryption & decryption use same key DES vs. 3DES 3DES applies 3 stages of DES with a separate key for each stage Total key length in 3DES is 56 bits x 3 keys = 168 bits Stages Stage 1: Encrypt plaintext with Key 1 Stage 2: Decrypt cipher text from Stage 1 with Key 2 (produces new cipher text) Stage 2: Encrypt cipher text from Stage 2 with Key 3 18-525 Group W2

3DES Algorithm Flowchart (I) Encryption DES DES-1 Plain Text K3 Cipher Text K1 K2 DES-1 DES DES-1 Decryption 18-525 Group W2

3DES Algorithm Flowchart (II) 64 bit plain Text Extension 32 bit 48 bit Left Half Initial Permutation Sub key 48 Bit XOR 16 Rounds Encryption S Box 32 Bit XOR Final Permutation Right Half Single Round cipher Text 18-525 Group W2

3DES Algorithm Flowchart (III) Key Schedule 56bit Key Initial Permutation I=1 I=I+1 Left/Right Half 28 bits Left Barrel Shift N I=16? Final Permutation Y Ready 48 bit Sub-key [ I ] 18-525 Group W2

Design Process Verification of 3DES in C Verilog Verification Behavioral Verification Verilog Initial Architecture Key2 56 ’ b SRAM Barrel Shifter I: 0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0 PC - 2 (wiring) Key set Current and next keys 2 x 48 Register 48 32 1 XOR Expansion b 48 Plaintext 64 R[I] L[I] S box 8x4x16x4 ROM L[I 1] R[I b Register P Key1,3 b output b input demux 16 b ROM IP mux Verilog Verification Structural 18-525 Group W2

Architecture Development 1 st Architecture Revision KeySub 56 ’ b Register 32 b input demux Enc_ShiftL Dec_ShiftR IP - wiring PC 2 Wiring >48 Text 64 Expand S Box 512 x 4 P 48 >32 PC (wiring) Key Latch 2:1 mux R_L Sub_rnd e/d D1/D1 txt_in ready key_in Sh_d Sh_e “ R ” L > wr_en OUT Final Architecture KeyReg 56 ’ b Register 32 b input IP - 1 wiring PC 2 Wiring >48 Text 64 Expand S Box 512 x 4 P >32 PC (wiring) b Latch 2:1 mux Sub_rnd txt_in ready key_in “ R ” L 48 wr_en OUT 2:1mux Enc_ShiftL Dec_ShiftR Sh_d Sh_e Initial Architecture Key2 56 ’ b SRAM Barrel Shifter I: 0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0 PC - 2 (wiring) Key set Current and next keys 2 x 48 Register 48 32 1 XOR Expansion b 48 Plaintext 64 R[I] L[I] S box 8x4x16x4 ROM L[I 1] R[I b Register P Key1,3 b output b input demux 16 b ROM IP mux 2 nd Architecture Revision KeyReg 56 ’ b Register 32 b input Enc_ShiftL Dec_ShiftR IP - 1 wiring PC Wiring >48 Text 64 Expand S Box 512 x 4 P >32 PC (wiring) b Latch 2:1 mux Sub_rnd e/d txt_in ready key_in Sh_d Sh_e “ R ” L 48 wr_en OUT 2:1mux 18-525 Group W2

Floorplan Evolution 18-525 Group W2

Right Barrel Shifter 56’b Revised Floorplan Total Area: 111947 um2 = 0.112mm2 Transistor Density: 0.136 trans/ um2 269 um PC (wiring) 64 -> 56 64’b 2:1 demux 56’b Key Latch 56’b 2:1 mux KeySub 56’b Register Enc_ShiftL 32’b 2:1 demux 64’b 2:1 mux IP (wiring) Data Reg (L) 32’b IP-1 Wiring Expand 48’b XOR PC-2 wiring 56b -> 48b S-box 512 x 4’b P Wiring 32’b XOR Program Control (Instruction ROM) Input Output Dec_ShiftL Data Reg (R) 32’b 32’b 2:1 mux 415 um Almost Final Floorplan 32’b Latch PC1 Right Barrel Shifter 56’b Mux 56’b Key Reg PC2 IP IP-1 32’b Text Register (L) 32’b Text Register (R) 32’b Mux 32’b XOR Expand 48’b XOR P All large functional blocks use Metal 1 and Metal 2. M1 M2 M3 M4 Input Output Program Control clock 379μm 367μm Left Barrel Shifter 56’b Original Floorplan PC (wiring) 64 -> 56 64’b 2:1 demux 56’b Key Latch 56’b 2:1 mux KeySub 56’b Register Des_ShiftR Enc_ShiftL 32’b 2:1 demux 64’b 2:1 mux IP (wiring) Text 64’b Reg IP-1 Wiring Expand 48’b XOR PC-2 wiring 56b -> 48b S-box 512 x 4’b P Wiring 32’b XOR Program Control (Instruction ROM) Input Output 377.44 um 334.37 um 64’b 2:1 mux 125,534 um2 = .126 mm2 Density .09 Trans/um2 18-525 Group W2

Final Floorplan OUTPUT INPUT 18-525 Group W2

Encryption Transaction Verification Input : Credit Information Credit #: 2739 8201 4856 2389 Security code: 319 Input Pin # : 4510 key1: 0x32, 0x37, 0x33, 0x39, 0x38, 0x32, 0x30, 0x31 key2: 0x34, 0x38, 0x35, 0x36, 0x32, 0x33, 0x38, 0x39 key3: 0x33, 0x31, 0x39, 0x34, 0x35, 0x31, 0x30, 0xFF Expiration Date: 08/2008 Plain Text : 0x30, 0x38, 0x2F, 0x32, 0x30, 0x30, 0x38, 0xFF Output : Cipher Text 0x2F, 0x81, 0xA8, 0xBF, 0x3C, 0x6B, 0xDF, 0xB4 18-525 Group W2

Structural Verification Behavioral Verification Expected Output : 2f 81 a8 bf 3c 6b df b4 Verification Verify C Simulation Behavioral Structural C code Verification Structural Verification Behavioral Verification 18-525 Group W2

Schematic Verilog Verification Encryption 18-525 Group W2

Chip Spice Verification Encryption Propagation Time: 908ps 18-525 Group W2

Chip Spice Verification Encryption 18-525 Group W2

Schematic Verilog Verification Decryption 18-525 Group W2

Chip Spice Verification Decryption 18-525 Group W2

Layout All simple Components built to same height 6.48μm rail to rail height Transistors enlarged to capacity of cell height Simple components use Metals 1 and 2 Global routing over modules in Metals 3 and 4 Exclusive OR Enable / Reset asserted high D Flip Flop 18-525 Group W2

Layer Masks Metal 1 Metal 2 Metal 3 Metal 4 Poly/Active 18-525 Group W2

Full Chip Layout 13,697 Transistors 366.8μm x 378.8 μm Key Register Final Permutation Initial Permutation Inverse Permutation Text Register Expand Permutation P Permutation XOR SBOX ROM and Decoders Input Latch Barrel Shifters PC2 Permutation Program Control 18-525 Group W2

Left Barrel Shifter 392 Transistors 3696.1 um2 18-525 Group W2

Program Control 926 Transistors 9003.3 um2 0.10285 transistors/um2 18-525 Group W2

PC1 Permutation 240 Transistors 10825.03um2 0.02217 transistors/um2 18-525 Group W2

64’b Text Register 1536 Transistors 7864.56um2 0.1953 transistors/um2 18-525 Group W2

SBOX1 ROM and Decoder 592 Transistors 2357.3um2 18-525 Group W2

Layout Optimizations Compacting of Permutation Wiring Area Savings Switch to lower metal layers Chop wiring to minimal length Compact wire placement Area Savings 60% reduction in area for PC1 50 – 60% area reduction over all permutations 13.1um 31.5um PC1 Permutation 18-525 Group W2

Chip Pinouts Signal Direction Assert/ Width Description Control Signals CLK Input Rise Global Clock RST High Global Reset EN/DE Encryption Mode Low Decryption Mode Data I/O Din 32 Input Data/Key Dout Output Output Cipher Text RD Output Ready GK Get Next Key Power Signals Vdd Power Supply Gnd Ground 18-525 Group W2

Chip Specification (I) Required Inputs: 32 bits data input at pins 1 bit reset at pin 1 bit encryption/decryption mode control at pin 1 bit clock at pin 1 bit Vdd at pin 1 bit Gnd at pin Provided Output : 32 bits cipher data output at pins 1 bit ready at pin Total Pin Count : 71 1 bit get next key at pin 18-525 Group W2

Chip Specifications (II) Total Pin Count: 71 Chip Size: 366.8 μm x 378.8 μm Chip Area: 138943.8 μm2 Chip Aspect Ratio: 1:1.03 Transistor Count: 13,697 (PMOS: 4,324 NMOS: 9,373) Transistor Density: 0.09847 transistors/μm2 10.155 μm2/transistor 18-525 Group W2

Chip Specifications (III) Core Voltage: 1.8V Clock Speed: 300MHz Operation: 256’b Input 64’b Output Over 54 clock cycles Data Throughput: 343 Mbits / second 64bits / 54 clocks 300MHz = 343Mbps 343Mbits/sec > Current network connection speeds: 100Mbits/sec 18-525 Group W2

Module Specifications 18-525 Group W2

Module Transistors Latch (8%) 6 bit Adder (1%) Mux (10%) ROM (40%) Barrel Shifter (6%) Register (21%) XOR (5%) Permutation (9%) 18-525 Group W2

Module Areas Latch (3%) 6 bit Adder (1%) Mux (7%) ROM (18%) Barrel Shifter (6%) Register (12%) XOR (3%) Permutation (50%) 18-525 Group W2

Module Transistor Densities Adder Latch Mux Adder Barrel Shifter ROM ROM Permutation Register XOR Register Permutation XOR Barrel Shifter Mux Latch Module Transistor Densities Module Areas 18-525 Group W2

Issues Encountered Floorplan Spice Simulation (Not Trivial !!!) Interconnections between components back and forth due to complicated algorithm Spice Simulation (Not Trivial !!!) Simulation never fails at the critical path Vdd Strength drops along conductor wires Solutions Increase thickness of Vdd Add more Vdd connections Nwell contacts on Vdd! lines improved PCROM simulation Buffer weak ROM input signals Improve rise/fall times of 48-bit XOR and ROM Add M1_P to Ground contacts throughout ROMs 18-525 Group W2

Vdd! Degradation Control Signal ROM Actual lengths from top level design Simulation of Program Control and ROM using vdd! and gnd! wiring from top-level Outputs all very low (400mV) 400mV 18-525 Group W2

Vdd! Degradation Control Signal ROM Additional M1_P contacts added to ROM Simulation of Program Control and ROM using vdd! and gnd! wiring from top-level Outputs all very low (400mV) 400mV 18-525 Group W2

Vdd! Degradation Control Signal ROM Doubling the wiring should halve the resistance Simulation of Program Control and ROM using twice the wiring Output correct with maximum value of 1.5 volts 1.5 volts 18-525 Group W2

Conclusion Implementation of Triple DES Encryption/Decryption for both host and client ends using 0.18μ CMOS technology Maximum clock frequency of 300MHz with maximum throughput of 343Mbits / second Chip area of 366.8μm x 378.8μm with aspect ratio of 1:1.03 Attains speeds appropriate for application in Automated Teller Machines (200+ MHz) 18-525 Group W2