Programmable IC DPA-Resistant Decryption via Asymmetric Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Programmable logic circuits face challenges in protecting designs from unauthorized copying and power analysis attacks, where attackers can discover decryption keys by monitoring power consumption or guessing authentication codes, leading to reverse engineering of designs.
Innovation Solution
Implementing a method that authenticates encrypted configuration data using asymmetric key cryptography before decryption, involving a public-private key algorithm to verify the authenticity of the data and store it securely, preventing side-channel attacks by not storing secret keys that can be recovered from power analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the decryption key is stored in nonvolatile memory of the programmable IC, then the encrypted bitstream can be decrypted within the programmable logic, but the attacker can still obtain the decryption key through power analysis attacks or trial-and-error attempts
Solution Approach 1:
The secret key is extracted from the programmable IC and stored externally in nonvolatile memory. Only the decryption algorithm (not the key itself) is implemented in the programmable logic, separating the key storage from the decryption operation to prevent power analysis attacks on the key material within the IC.
Solution Approach 2:
An intermediary authentication mechanism is introduced where a authentication code stored in the programmable IC verifies the integrity of configuration data without exposing the decryption key. This intermediary layer prevents direct access to the key while still enabling secure configuration verification.
2Reliability
If authentication codes are stored in the programmable IC to verify configuration data, then unauthorized configuration can be prevented, but the authentication codes themselves become targets for power analysis and trial-and-error attacks
Solution Approach 1:
Instead of storing sensitive authentication codes in the programmable IC, the patent uses a public key authentication code that can be freely distributed. The corresponding private key remains secure in external storage, allowing authentication without exposing sensitive materials in the programmable logic.
3Loss of information
If the configuration data is encrypted using symmetric encryption algorithms, then the design can be protected from unauthorized copying, but the encryption key must be protected from unauthorized discovery
Solution Approach 1:
The patent transitions from symmetric encryption to asymmetric (public-private key) encryption. The public key can be freely distributed for encrypting configuration data, while the private key remains secure in external storage. This asymmetry eliminates the need to protect the same key used for both encryption and decryption, significantly reducing key discovery vulnerability.
Data Source
AI summary
Approaches for configuring a programmable integrated circuit (IC) are disclosed. Encrypted configuration data is input to the programmable IC, and the encrypted configuration data is stored in configuration memory of the programmable IC. As the encrypted configuration data is input, a determination is made as to whether or not the encrypted configuration data is authentic. In response to the encrypted configuration data being authentic, the encrypted configuration data is read from the configuration memory and decrypted, and the decrypted configuration data is stored back in the configuration memory.