Configurable Crypto Hardware Engine for Quantum-Resistant IoT Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current asymmetric cryptography implementations for signing and verifying messages are vulnerable to attacks from quantum computers, particularly in the context of IoT data security, where securing large volumes of data is critical.
Innovation Solution
A configurable crypto hardware engine is developed, incorporating hardware blocks for hashing, hash chain, private key, and public key generation, which are coupled to perform secure signature generation and verification, using lightweight hashing functions like Keccak-400 sponge hashing and supporting schemes like XMSS and WOTS, to withstand quantum computer attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional asymmetric cryptography (RSA, Elliptic Curve) is used for signing and verifying messages, then current security standards are met, but the system becomes vulnerable to quantum computer attacks
Solution Approach 1:
The cryptographic engine is divided into separate functional blocks: a hashing computation block for performing hash operations, a hash chain computation block for successive hashing, a private key generation block, and a public key generation block. Each block handles specific cryptographic operations independently, allowing the system to implement quantum-resistant algorithms while maintaining manageable complexity through modular architecture.
Solution Approach 2:
The configurable cryptographic engine is designed to support multiple quantum-resistant cryptographic schemes including XMSS (eXtended Merkle Signature Scheme) and WOTS (Winternitz One-Time Signature). The engine can be configured to perform different cryptographic operations through selective cooperation of its functional blocks, making it a universal solution for post-quantum cryptography rather than being limited to a single algorithm.
2Reliability
If hardware blocks are added to perform hashing and key generation computations, then cryptographic security is improved, but the device complexity increases
Solution Approach 1:
Multiple cryptographic functions are merged into a unified hardware engine where the hashing computation block and hash chain computation block can selectively cooperate with key generation blocks. This consolidation allows the system to provide comprehensive cryptographic security (signing, verification, key generation) while reducing overall device complexity compared to implementing separate hardware modules for each function.
3Productivity
If lightweight hashing functions like Keccak-400 are used, then computation efficiency is improved, but the cryptographic strength may be reduced
Solution Approach 1:
The engine implements Keccak-400 sponge hashing with specific parameter configurations (400-bit internal state) that balance computational efficiency with cryptographic strength. The hashing computation block is designed to perform these lightweight hash operations at high speed while the configurable nature of the engine allows adjustment of security parameters to meet different cryptographic strength requirements for various applications.
Data Source
AI summary
Apparatuses and methods associated with configurable crypto hardware engine are disclosed herein. In embodiments, an apparatus for signing or verifying a message may comprise: a hardware hashing computation block to perform hashing computations; a hardware hash chain computation block to perform successive hash chain computations; a hardware private key generator to generate private keys; and a hardware public key generator to generate public keys, including signature generations and signature verifications. The hardware hashing computation block, the hardware hash chain computation block, the hardware private key generator, and the hardware public key generator may be coupled to each other and selectively cooperate with each other to perform private key generation, public key generation, signature generation or signature verification at different points in time. Other embodiments may be disclosed or claimed.