Low power AES implementations for RFID

1. Low power AES implementations for RFID Dina Kamel, Francesco Regazzoni, Cédric Hocquet, David Bol, Denis Flandre and François-Xavier Standaert

2. Outline • Overview • RFIDs • Why AES ? • RFID Power budget • Design of S-box • Technology selection • Supply voltage • Logic style • Subthreshold AES core BCRYPT 2010

3. RFID General Constraints: 1- Power – few µW 2- Area – few K Gates 3- Latency – ms BCRYPT 2010

4. Technology road map for memories IP vendors provide NVM down till 45 nm targeting several foundries Foundries used to provide NVM down till 0.18 µm BCRYPT 2010

5. Why AES • Nowadays RFID are at 180 nm and 130 nm mainly for memory issues • The technology trend is pushing for smaller technologies (also for memories) • Smaller technologies allow to implement complex algorithms / enhanced functionality • 3-D stacking enables mixed technologies e.g. 65 nm logic + 130 nm NVM • AES is the standard BCRYPT 2010

6. Move to 65nm to overcome area problems… • 65nm will allow compact AES implementation • Widespread use of Low-Power technology flavor • Low fabrication costs for high volume production BCRYPT 2010

7. …low power is still an issue • Passive RFIDs are battery less devices • Power constraints are still present at 65 nm (leakage) • In advanced technologies, such as 65 nm and below, two flavors are developed: • General purpose (GP) • Low power (LP) BCRYPT 2010

8. Power budget [A.S.W. Man, RFID Eurasia’07] Power: 4.7 µW Tech.: TSMC 0.18 µm VDD: 1.8 V Sim. results using Power compiler Power Budget for: HF (13.56 MHz): 22.5 µW UHF (900 MHz): 4 µW BCRYPT 2010

9. How the power is distributed in an 8bit Architecture AES [T. Good, TVLSI’09] BCRYPT 2010

10. S-box Design • The optimized S-box given by [N. Mentens,05] • It uses the composite field GF(((22)2)2) • Power and delay aspects in light of different parameters: • Technology selection • Supply voltage • Logic style [D. Kamel, ISCAS’09] BCRYPT 2010

11. S-box design: Technology selection • 0.13 µm main properties of Standard VT (SVT) and High VT (HVT) NMOS transistors. 23 x lower + 90 mV [D. Kamel, ISCAS’09] BCRYPT 2010

12. S-box design: Technology selection • 65 nm Main properties of Low VT (LVT), Standard VT (SVT) and High VT (HVT) NMOS transistors in GP and LP technology flavors. 3 orders of magnitude [D. Kamel, ISCAS’09] BCRYPT 2010

13. Simulation resultsPower consumption at 100 kHz 8.7 μW/MHz [P. Hamalainen, DSD’06] 3.71 μW Power * 90.6 nW 870 nW 1.8 times less than 166 nW reported by [T. Good,TVLSI’09] using 0.13 μm, 0.75 V 10 times less than 870 nW 7 times less than 630 nW reported by [Feldhofer,05] using 0.35 μm, 1.5 V Igate Ioff [D. Kamel, ISCAS’09] BCRYPT 2010

14. Simulation resultsDelay SVT SVT 2.2 ns 65 nm GP 130 nm HVT Power↓40 LVT HVT SVT HVT 2.35 ns 65 nm LP [D. Kamel, ISCAS’09] BCRYPT 2010

15. S-box design: Supply voltage • Simulations are done using 65 nm LP SVT devices at 100 kHz and at nominal conditions. *166 nW [T. Good, TVLSI09] at 0.75 V 5 times less than 166 nW reported by [T. Good,TVLSI09] using 0.13 μm, 0.75 V Fine for 100 KHz (large margin) Promising, but robustness ? [D. Kamel, ISCAS’09] BCRYPT 2010

16. S-box Design: compare different logic families • Standard Logic: Static CMOS (S-CMOS) • Dynamic Differential Logic: Dynamic Differential Swing Limited Logic (DDSLL) – Protected Logic • Why ? • Security – more resilient against power analysis attacks BCRYPT 2010

17. Static CMOS versus Dynamic Differential Swing Limited logic DDSLL XOR PPart NMOS Tree SC XOR FeedBack Completion Signal Current Source [I. Hassoune, the VLSI Journal’07] BCRYPT 2010

18. DDSLL – How does it work ? Pre-charge Evaluation [I. Hassoune, the VLSI Journal’07] BCRYPT 2010

19. DDSLL is too complex ! BCRYPT 2010

20. DDSLL – Sharing principle [I. Hassoune, the VLSI Journal’07] BCRYPT 2010

21. DDSLL – Sharing principle 1 1 1 3 1 1 3 1 1 Trans GF(((22)2)2) -> GF(28) + Affine Trans Trans GF(28) -> GF(((22)2)2) • The whole DDSLL AES S-box consists of 13 stages • The total number of DDSLL S-box transistors is 1.2 times less that of S-CMOS S-box BCRYPT 2010

22. Measurement results of S-CMOS and DDSLL S-boxes Area 25 µm 24 µm PS-CMOS PDDSLL = 1.53 46 µm 46 µm Thanks to lower voltage swing 127 nW 83 nW Power 3 – 3.2 ns 7.5 – 8.1 ns Delay BCRYPT 2010

23. Full AES core • Base architecture [Feldhofer,05]: • 128 AES • 8 bit data path • S-box GF(((22)2)2) • Design Target: • sub-threshold 65nm • 100 kHz • Low power BCRYPT 2010

24. Sub-threshold Design Flow HDL Sub-threshold library Library Synopsys Designcompiler Synth Constraints Cadence Encounter P&R [C. Hocquet, FTFC’09] BCRYPT 2010

25. Design of 65 nm subthreshold library • Start point: 65nm library with nominal voltage 1.2V • Keep in the library only gates with maximum stack of 2 MOSFETs • Re-characterize the library at 0.4V (lowest VDD for 100kHz) • Final library: 73 cells [C. Hocquet, FTFC’09] BCRYPT 2010

26. Results 1.2 V standard library 1.2 V restricted library 0.4 V restricted library BCRYPT 2010

27. Comparison with state of the art BCRYPT 2010

28. Conclusions • The S-box consumes the largest percentage of power. • By choosing the appropriate technology the S-box power can be reduced by more than 1 order of magnitude – from 3.71 µW (0.13 µm) to 90 nW (65 nm - LP) while maintaining same delay • Reducing the VDD of S-box from 1.2 V to 0.8 V decreases the power by 60 %, but increases the delay x3 • The DDSLL logic reduces the power x1.5 than S-CMOS • Subthreshold AES is a good candidate for Ultra Low power RFID applications – 120 nW @ 0.4 V BCRYPT 2010

29. Thank you BCRYPT 2010