1. 1 An Elliptic Curve Processor Suitable for RFID-Tags L. Batina 1, J. Guajardo 2, T. Kerins 2, N. Mentens 1, P. Tuyls 2 and I. Verbauwhede 1 Katholieke Universiteit Leuven, ESAT-SCD/COSIC 2 Philips Research, The Netherlands WISSec 2006 Antwerpen, Belgium November 8-9, 2006

2. 2 Outline  Introduction and Motivation  Related Work  Secure Identification Protocols  Elliptic Curve Cryptography (ECC)  Low-cost ECC processor  Results  Conclusions

3. 3 Motivation  Emerging new applications: wireless applications, sensor networks, RFIDs, car immobilizers, key chains... resource limited: area, memory, power, bandwidth resource limited: area, memory, power, bandwidth low-cost, low-power, low-energy low-cost, low-power, low-energy  Pure hardware solutions are energy and cost effective

4. 4 New challenging applications: RFID tags RFID applications:  Supply chain management  Access control  Payment systems  Product authentication  Vehicles tracking  Medical care  Key rings More recent applications: Anti-counterfeiting

5. 5

6. 6 Related Work   Juels: use RFIDs for anti-counterfeiting   [TB06]: EC-based solution could be possible   RFID workshop: several papers considering ECC processors for RFID tags   [McLR07]: limit number of authen.   Other embedded security applications

7. 7 In short   PKC would be quite useful   We would like to know Are existing protocols feasible on RFID tags? How small/cheap is the most compact solution?  If known solutions are too expensive we should think about new, light-weight protocols

8. 8 Our contributions  Feasibility of ECC on RFID TAGS Protocols of Schnorr and Okamoto evaluated Protocols of Schnorr and Okamoto evaluated Performance vs. area trade-off Performance vs. area trade-off  Our solution is based on identification schemes ECDSA is not necessary ECDSA is not necessary

9. 9 Authentication options Question: Can we perform ECC on RFID Tags? Cost? Options: ECDSA Signature one point multiplication + hash Identification Protocols: Schnorr or Okamoto one or two point multiplications

10. 10 Secure Identification Protocols Set-up: an elliptic curve E(GF(2 m )) a point P of order n and a commitment Z = aP to the secret a Protocol Anatomy Prover Verifier witness challenge response

11. 11 Schnorr Identification Protocol Tag ( a ) Reader (Z=aP) 1. request 2. Choose 3. Compute X = rP 4. X 5. Choose challenge 6. e 7. Compute y = ae + r mod n 7. y 8. If yP – eZ = X = rP (ae + r) P – e(aP) = X accept Else reject

12. 12 ECC over binary fields Arithmetic can be performed very efficiently (carry-free). An elliptic curve E over GF(2 n ) is defined by an equation of the form: where a, b  GF(2 n ), Points are (x, y) which satisfy the equation, where x, y  GF(2 n ). Exists a group operation i.e. addition such that for any 2 points, sum is a third point.

13. 13 ECC operations: Hierarchy ECC prot. Point multiplication: kP Group operation: point add/double Finite field arithmetic: multiplication, addition, subtraction, inversion, …

14. 14 Low-power design  Architectural decisions are important  Frequency as low as possible  Power consumption and energy efficiency are both crucial  ECC arithmetic should be revisited to optimize those parameters  The circuit size should be minimized  Flexibility can be sacrificed

15. 15 Parameter Choice (EC operations)  Use Montgomery representation  Use Lopez-Dahab projective coordinates  Minimize number of registers  Use only x -coordinate of point during protocol

16. 16 The Montgomery Ladder

17. 17 Point Operations

18. 18 EC Processor Architecture

19. 19 ALU Architecture

20. 20 Area-Time Product of Various Implementations

21. 21 Results SourceField size (bits) Area (gates) Technology (µm) FrequencyPerformance (msec) Östurk et al. CHES 2004 166 ( F p ) 303330.1320 MHz31.9 Gaubatz et al. PerSec 2005 100 ( F p ) 187200.13500 KHz410.45 Wolkerstorfer CRASH 2005 191 ( F p and ) 230000.3568.5 MHz6.67 Ours 2006 (Schnorr) 131 ( )141050.25175 KHz480 Ours 2006 (Okamoto) 131 ( ) 211790.25175 KHz830

22. 22 Conclusions   ECC suitable for certain RFID applications   More research on low cost protocols and low cost implementations   See also paper in ePrint Archive