Efficient Hardware Architecture of SHA-256 Algorithm for Trusted Mobile Computing

We present a compact SHA-256 hardware architecture suitable for the Trusted Mobile Platform (TMP), which requires low-area and low-power characteristics. The built-in hardware engine to compute a hash algorithm in TMP is one of the most important circuit blocks and contributes the performance of the whole platform because it is used as key primitives supporting platform integrity and command authentication. Unlike personal computers, mobile platform have very stringent limitations with respect to available power, physical circuit area, and cost. Therefore, special architecture and design methods for a compact hash hardware module are required. Our SHA-256 hardware can compute 512-bit data block using 8,588 gates on a 0.25μm CMOS process. The highest operation frequency and throughput of the proposed architecture are 136MHz and 142Mbps, which satisfies processing requirement for the mobile application. 1 Background and Motivation The Trusted Mobile Platform(TMP) [1] guarantees the integrity of the mobile platform and is a preferred requirement in the evolutionary process where the mobile device changes into the open platform and value-based application technology. TMP improves the reliability and security of a device using Trusted Platform Module (TPM), which ensures that the device is running on the authorized software and hardware environment. The TPM is a microcontrollerbased security-engine based on an industry standard specification issued by the Trusted Computing Group (TCG). It protects encryption keys and digital signature keys to maintain data confidentiality and integrity. Especially important, TPM chip is specifically designed to protect a platform and user authentication information from software-based attacks. The built-in hardware engine for hash algorithm in TMP is one of the most important circuit blocks because it is used as a key primitive supporting integrity verification and used in the most of TPM-commands for authentication of the M. Yung, P. Liu, and D. Lin (Eds.): Inscrypt 2008, LNCS 5487, pp. 240–252, 2009. c © Springer-Verlag Berlin Heidelberg 2009 Efficient Hardware Architecture of SHA-256 Algorithm for TMP 241 platform. Current version of TMP [1] specification recommends to use the SHA-1 algorithm. However, recently, National Security Agency (NSA) announced Suite B Cryptography that specify encryption, signature and hash algorithms at the 2005 RSA Conference. According to the Suite B Cryptography, SHA-256 is a common mode for widespread interpretability and appropriate for protecting classified information up to the SECRET level. This cryptographic trend to move over Suite B is realized in the trusted mobile computing. Furthermore, TCG announced that TPM must support SHA-256 algorithm in the revised specification, TPM NEXT [2]. Integrating TCG’s security features into a mobile phone could be a challenge work. In reality, most mobile devices do not require a very high data processing speed. For example, when cellular wireless network technology migrates from 2.5G to 3G, only the data rate is increased from 144kbps to 2Mbps. Also, data rate of Bluetooth, which is one of the wireless Personal Area Network(PAN), is only 10Mbps maximum. However, when security function is added, considerable computing power is demanded to the microprocessor of a handheld device. For example, the processing requirements for AES and SHA at 10Mbps are 206.3 and 115.4 MIPS respectively [3]. In comparison, a state-of-the art handset processors, such as MPC860 and ARM7 are capable of delivering up to 106MIPS and 130MIPS, respectively [4, 5]. The above data indicates a clear disparity between security processing requirements and available processor capabilities, even when assuming that the handset processor is fully dedicated to security processing. In reality, the handset processor also needs to execute the operating system, and application software, which by themselves generate a significant processing workload. Another critical problem of security processing on a mobile platform is power consumption and battery capacity. Unlike personal computers, mobile devices have strict environment in power consumption, in battery life and in available circuit area. Among these limitations, the power consumption is the critical metric to be minimized in the design of cryptographic circuits for mobile platforms. For battery-powered systems, the energy drawn from the battery directly influences the systems battery life, and, consequently, the duration and extent of its mobility, and its overall utility. In general, battery-driven systems operate under stringent constraint especially in limited power. The power limitation gets more serious when the mobile device is subject to the demand of security operations. According to the estimation of [6], the execution of security applications on a battery-powered device can decrease battery life at least by half. Therefore, design methodologies at different abstraction levels, such as systems, architectures, logic design, basic cells, as well as layout, must take into account to design of a low-cost SHA-256 module for trusted mobile platform. In this paper, we introduce an efficient hardware architecture of low-cost SHA-256 algorithm for trusted mobile platforms. As a result, a compact SHA-256 hardware implementation capable of supporting the integrity check and command authentication of trusted mobile platforms could be developed and evaluated so far. The rest of this paper is constructed as follows. Section 2 describes a brief review of SHA-256 algorithm and a short summary of some previous works