Christof Paar

Cryptography is feasible on 4-Bit microcontrollers - A proof of concept

2009 IEEE International Conference on RFID, 2009

ABSTRACT The RFID technology in combination with cryptographic algorithms and protocols is discus... more ABSTRACT The RFID technology in combination with cryptographic algorithms and protocols is discussed widely as a promising solution against product counterfeiting. Usually the discussion is focussed on passive low-cost RFID-tags, which have harsh power constraints. 4-Bit microcontrollers have very low-power characteristics (5-60 muA) and are therefore an interesting platform for active and passive low-cost RFID-tags. To the best of our knowledge there are no implementations of cryptographic algorithms on a 4-bit microcontroller published so far. Therefore, the main contribution of this work is to demonstrate that cryptography is feasible on these ultra-constrained devices and to close this gap. We chose PRESENT as the cryptographic algorithm, because contrary to many other ciphers, PRESENT uses a 4times4 S-Box. Our implementation draws a current of 6:7 muA at a supply voltage of 1:8 V and a frequency of 500 KHz and requires less than 200 ms for the processing of one data block.

New Lightweight DES Variants

Lecture Notes in Computer Science, 2007

In this paper we propose a new block cipher, DESL (DES Lightweight), which is based on the classi... more In this paper we propose a new block cipher, DESL (DES Lightweight), which is based on the classical DES (Data Encryption Standard) design, but unlike DES it uses a single S-box repeated eight times. 1 On this account we adapt well-known DES S-box design criteria, such that they can be applied to the special case of a single S-box. Furthermore, we show that DESL is resistant against certain types of the most common attacks, i.e., linear and differential cryptanalyses, and the Davies-Murphy attack. Our hardware implementation results of DESL are very promising (1848 GE), therefore DESL is well suited for ultraconstrained devices such as RFID tags.

Download

Component Identiflcation: Enabler for Secure Networks of Complex Systems

Applied Cryptography and Network Security, 2000

The ad-hoc network technology matures and starts becoming of interest for several industries as e... more The ad-hoc network technology matures and starts becoming of interest for several industries as enabler for more safety, comfortability, and new business models. However, such network systems must not only fulflll the conventional security requirements like e‐ciency, robustness, and privacy, but they must be resistant to ma- nipulation by the system owners and further in- volved parties. For instance,

PRESENT: An Ultra-Lightweight Block Cipher

Lecture Notes in Computer Science, 2007

With the establishment of the AES the need for new block ciphers has been greatly diminished; for... more With the establishment of the AES the need for new block ciphers has been greatly diminished; for almost all block cipher applications the AES is an excellent and preferred choice. However, despite recent implementation advances, the AES is not suitable for extremely constrained environments such as RFID tags and sensor networks. In this paper we describe an ultra-lightweight block cipher, present. Both security and hardware efficiency have been equally important during the design of the cipher and at 1570 GE, the hardware requirements for present are competitive with today's leading compact stream ciphers.

Download

Lightweight Cryptography and RFID: Tackling the Hidden Overhead

The KSII Transactions on Internet and Information Systems, 2010

... University, Singapore aposchmann@ntu.edu.sg 2 Orange Labs, 38-40 rue du Général Leclerc, Issy... more

E-Passport: The Global Traceability Or How to Feel Like a UPS Package

Lecture Notes in Computer Science, 2007

Abstract. Since the introduction of RFID technology there have been public debates on security an... more

A New Class of Collision Attacks and Its Application to DES

Lecture Notes in Computer Science, 2003

Until now in cryptography the term collision was mainly associated with the surjective mapping of... more Until now in cryptography the term collision was mainly associated with the surjective mapping of different inputs to an equal output of a hash function. Previous collision attacks were only able to detect collisions at the output of a particular function. In this publication we introduce a new class of attacks which originates from Hans Dobbertin and is based on the fact that side channel analysis can be used to detect internal collisions. We applied our attack against the widely used Data Encryption Standard (DES). We exploit the fact that internal collisions can be caused in three adjacent S-Boxes of DES [DDQ84] in order to gain information about the secret key-bits. As result, we were able to exploit an internal collision with a minimum of 140 encryptions 1 yielding 10.2 key-bits. Moreover, we successfully applied the attack to a smart card processor.

Download

How Secure Are FPGAs in Cryptographic Applications?

Lecture Notes in Computer Science, 2003

The use of FPGAs for cryptographic applications is highly attractive for a variety of reasons but... more The use of FPGAs for cryptographic applications is highly attractive for a variety of reasons but at the same time there are many open issues related to the general security of FPGAs. This contribution attempts to provide a state-of-the-art description of this topic. First, the advantages of reconfigurable hardware for cryptographic applications are discussed from a systems perspective. Second, potential security problems of FPGAs are described in detail, followed by a proposal of a some countermeasure. Third, a list of open research problems is provided. Even though there have been many contributions dealing with the algorithmic aspects of cryptographic schemes implemented on FPGAs, this contribution appears to be the first comprehensive treatment of system and security aspects.

Download

Optimal tower fields for hyperelliptic curve cryptosystems

Conference Record of the Thirty-Eighth Asilomar Conference on Signals, Systems and Computers, 2004., 2004

... The authors in [22], [19], [20] provided results of relevant implementations on the ARMmicrop... more

E-passport: Cracking basic access control keys with copacobana

Since the introduction of the Machine Readable Travel Do- cument (MRTD) that is also known as e-p... more Since the introduction of the Machine Readable Travel Do- cument (MRTD) that is also known as e-passport for human identifi- cation at border control debates have been raised about security and privacy concerns. In this paper, we present the first hardware implemen- tation for cracking Basic Access Control (BAC) keys of the e-passport is- suing schemes in Germany and the

Reconfigurable trusted computing in hardware

Proceedings of the 2007 ACM workshop on Scalable trusted computing - STC '07, 2007

Trusted Computing (TC) is an emerging technology towards building trustworthy computing platforms... more Trusted Computing (TC) is an emerging technology towards building trustworthy computing platforms. The Trusted Computing Group (TCG) has proposed several specifications to implement TC functionalities by extensions to common computing platforms, particularly the underlying hardware with a Trusted Platform Module (TPM).

Download

Efficient Hash Collision Search Strategies on Special-Purpose Hardware

by Sven Schäge and Christof Paar

Lecture Notes in Computer Science, 2008

Hash functions play an important role in various cryptographic applications. Modern cryptography ... more Hash functions play an important role in various cryptographic applications. Modern cryptography relies on a few but supposedly well analyzed hash functions which are mostly members of the so-called MD4-family. This work shows whether it is possible, using special-purpose hardware, to significantly speedup collision search for MD4-family hash functions. A thorough analysis of the computational requirements for MD4-family hash functions and corresponding collision attacks reveals that a microprocessor based architecture is best suited for the implementation of collision search algorithms. Consequently, we designed and implemented a (concerning MD4-family hash-functions) general-purpose microprocessor with minimal area requirements and, based on this, a full collision search unit. Comparing the performance characteristics of both ASICs with standard PC processors and clusters, it turns out that our design, massively parallelized, is nearly four times more cost-efficient than parallelized standard PCs. With further optimizations, we believe that this factor can even be improved.

Download

Hyperelliptic Curve Cryptosystems: Closing the Performance Gap to Elliptic Curves

Lecture Notes in Computer Science, 2003

Abstract. For most of the time since they were proposed, it was widely believed that hyperellipti... more

Finding optimum parallel coprocessor design for genus 2 hyperelliptic curve cryptosystems

International Conference on Information Technology: Coding and Computing, 2004. Proceedings. ITCC 2004., 2004

Hardware accelerators are often used in cryptographic applications for speeding up the highly ari... more Hardware accelerators are often used in cryptographic applications for speeding up the highly arithmetic-intensive publickey primitives, e.g. in high-end smart cards. One of these emerging and very promising public-key scheme is based on HyperElliptic Curve Cryptosystems (HECC). In the open literature only a few considerations deal with hardware implementation issues of HECC.

Download

Efficient GF(p m) Arithmetic Architectures for Cryptographic Applications

Lecture Notes in Computer Science, 2003

Abstract. Recently, there has been a lot of interest on cryptographic applications based on field... more

Optimal Extension Fields (OEFs)

Encyclopedia of Cryptography and Security, 2005

Hash Functions and RFID Tags: Mind the Gap

Lecture Notes in Computer Science, 2008

... University Bochum, Germany 2 Orange Labs, Issy les Moulineaux, France leander@rub.de, {abogda... more

Evaluating Resistance of MCML Technology to Power Analysis Attacks Using a Simulation-Based Methodology

by Laura Pozzi and Christof Paar

Lecture Notes in Computer Science, 2009

This paper explores the resistance of MOS Current Mode Logic (MCML) against attacks based on the ... more

Download

Inversion in Finite Fields and Rings

Encyclopedia of Cryptography and Security, 2011

A Simulation-Based Methodology for Evaluating the DPA-Resistance of Cryptographic Functional Units with Application to CMOS and MCML Technologies

by Laura Pozzi and Christof Paar

2007 International Conference on Embedded Computer Systems: Architectures, Modeling and Simulation, 2007

1 ALaRI - University of Lugano, Lugano, Switzerland. E-mail: regazzoni@alari. ch 2 School of Engi... more

Download

Uploads

Papers by Christof Paar

Log In