1. A 1.5 GHz AWP Elliptic Curve Crypto Chip O. Hauck, S. A. Huss ICSLAB TU Darmstadt A. Katoch Philips Research A 1.5 GHz AWP Elliptic Curve Crypto Chip O. Hauck, S. A. Huss ICSLAB TU Darmstadt A. Katoch Philips Research

2. 2 Outline n Current AWP projects n GATS-Chip n Elliptic Curve Chip AWPs compared to sync wave pipes SRCMOS circuits Crypto background Architecture and Implementation n Conclusion

3. 3 Status of AWP Projects n 2D-DCT: 0.6µm, being re-designed with self-resetting logic n SRT: currently on schematics only n 64b Giga-Hertz Adder Test Site: 0.6µm, almost complete, tape out in May n Crypto chip: 0.35µm, tape out in July targeted

4. 4 Giga-Hertz Adder Test Site n AMS 0.6µm 3M CMOS n 64b Brent-Kung adder n ~10k devices, ~1.3sqmm n latency ~2.5ns n cycle 1.0ns n on-chip test circuitry

5. 5 General Framework for Pipelines Logic Latch/Reg Data Clk

6. 6 Some Notations...

7. 7 General Relations

8. 8 Synchronous Wave Pipeline Wave Logic Latch/Reg Data Clk n Promise: higher throughput at reduced latency, clock load, area and power n Drawback: difficult tuning of logic and delay elements n Discrete, distinct valid frequency ranges n Low high narrow frequency range n not suitable for system design

9. 9 n Throughput determined by longest logic path + clock/register overhead n Fine-grain pipelining allows high throughput at the cost of increased clock/register overhead Synchronous Pipeline Logic Latch/Reg Data Clk

10. 10 Asynchronous Wave Pipeline (AWP) Wave Logic Wave Latch Data req_inreq_out matched delay n More than one data and request propagating coherently n One-sided cycle time constraint n Delay must track logic over PTV corners

11. 11 Example: 64-b Brent-Kung Parallel Adder pgPG G xorxor 0 1 2 3 4 Buffers provide for same depth on every logic path All gates in the same column must have the same delay

12. 12 Circuits n Logic style used has to minimize delay variation n Earlier work focused on bipolar logic (ECL, CML), but CMOS is mainstream n Static CMOS is not well suited for wave piping, fixing the problem results in more power and slower speed n Pass transistor logic gives slopy edges thereby introducing delay variation n Dynamic logic is attractive as only output high transition is data-dependant, output pulldown is done by precharge n What is needed is a dynamic logic family without precharge overhead: SRCMOS

13. 13 SRCMOS n Distinguishing property of our SRCMOS circuits: precharge feedback is fully local, and NMOS trees are delay balanced N inputs output

14. 14 Operation of a 2-AND

15. 15 CISCO Data Encryption Service Adapter [ Cisco Systems ]

16. 16 DES Key Exchange using Public-Key Cryptosystem based on Elliptic Curves

17. 17 n Security based upon DLP: in a finite Abelian group we can easily compute given n However, is hard to compute out of and n DLP extraordinarily hard for point group of elliptic curve: n Set of solutions of cubic equation over any field is an abelian group Why is this secure ?

18. 18 Elliptic Curve Mathematics and Algorithm n Two types - supersingular and non-supersingular n Non-supersingular have the highest security n EC equation:

19. 19 Adding Two Points Over Elliptic Curves

20. 20 Optimal Normal Basis

21. 21 Multiplication over ONBs

22. 22 The Final Formula

23. 23 Architecture of Multiplier delay abx 1 2 3 259 260 261 3_Xor 1 2 3 783 782 781 1 87 Wave latch 1 87 1 1 9 27 29 Pseudo NMOS SRCMOS request

24. 24 Dual-rail Circuits n Dual-rail cross-coupled SRCMOS circuit n NMOS trees are designed such that there is only one conducting path to ground

25. 25 Delay Variations at Various Stages

26. 26 Hierarchy of Control 260 0 always k x left shift Hamming weight = 40 EC double EC add If x=1 ADDMULLOAD/STORE 7 13 1 261 1 EC arithmetic R * 2347 MUL/s EC arithmetic R * 2347 MUL/s Finite field arithmetic R * 612567 bit/s Finite field arithmetic R * 612567 bit/s * 261 Double-and-Add Key generation rate R Double-and-Add Key generation rate R *(261*7+40*13)

27. 27 Control Unit Architecture n Request signals trigger the state transitions. n Autonomous state transitions are triggered by signal X X AWP Logic For static operation req1 reqn Req_out reset OUT IN1 IN2 R E G R E G R E G R E G

28. 28 High Level Control: Double-and-Add 1 8 3 4 6 5 7 Start/LoadX, ResetZ X=1 LoadY X=0 X=1 If K=0 Shift K If K=1 X=1 ShiftK, Double K=0,DoubleDone K=1,DoubleDone/Add X=1 AddDone X=1 X=0 If Stop=1/KP_Done 2 n Level-based control

29. 29 Middle Level Control: EC Point Doubling n Pulse-based control 0 X=0 1 X=1 2 3 4 X=0 5 X=1 X=0 X=1 63 62 61 60 59 58 Start OPAX OPBZ MULT MD OPAA Shift OPBA MULT MD

30. 30 Various States in a Pulsed Control

31. 31 Conclusion