Penetration Test Report (Cryptography Research): Centaur AESstatement

P E R :
RELIMINARY VALUATION EPORT
C T C5P AES C
ENTAUR ECHNOLOGY ORE
OCTOBER 6, 2003
Cryptography Research performed an abbreviated design and implementation review of the AES
accelerator core in the Centaur Technology C5P processor.
Background Secure State and Process Separation
The Advanced Encryption Standard (AES) cipher is Developers must exercise caution when manipulating
used in numerous cryptographic protocols, including secrets in multi-processing environments, especially if
TLS (SSL), SSH, and IPSEC. AES is a NIST-ratified sensitive applications may co-exist with hostile code.
set of operating modes for the block cipher Rijndael The C5P’s key management capabilities are designed to
and is documented in FIPS-197. provide security equivalent to conventional software
AES implementations when the host operating system
follows some common conventions.
Operational Summary
The AES ciphertext, plaintext, and key are stored in
user memory and the C5P core operates on pointers in
The C5P AES core is accessed via an unprivileged
the EAX, EBX, ECX, EDX, ESI, and EDI registers,
instruction. Block encryption is supported for 128-bit
which are saved on the user stack during context
blocks in ECB, CBC, CFB, and OFB modes with 128,
switches. AES state (including expanded key) is stored
192, and 256 bit keys. Two modes of initialization are
in the core and invalidated when the microcode
supported: hardware-assisted (128 bit key only) and
recognizes a context switch, signified by a store to the
software-precalculated key expansion (required for 192
EFLAGS register. Most common OS context switch
and 256 bit keys). Cryptography Research tested all
paths save and restore EFLAGS.
supported modes and found the core to be compliant
with FIPS-197 reference implementations and test
Although the limited scope of this evaluation did not
vectors.
permit exhaustive testing of possible inter-process
interactions, our evaluation did not identify any
situations where the C5P would provide less security
Performance than a conventional software-only AES
implementation.
The core uses a round engine that performs a single
AES block round operation in two processor clock
cycles. Pipelined operation is supported for operations Conclusion
on independent blocks (such as ECB mode encryption),
The AES core in the Centaur C5P provides an easy to
yielding a net throughput of one round per clock.
use and substantially faster substitute for existing
Performance timings (including memory latency)
software AES implementations. The core contains
yielded sustained throughput in excess of 15 Gbits/sec
microcode support to protect key data and processing
(ECB) on a 1.2 GHz processor. This is substantially
intermediates in most anticipated multi-processing
faster than assembly-coded AES implementations on
environments. We expect availability of this high-
x86 platforms, which typically require at least 250
performance resource to improve deployment of high-
clock cycles per block.
speed encryption capabilities for network security, disk
encryption, and other applications.
Information in this summary is provided without guarantee or warranty of any kind. This review was performed for Centaur
Technology but reflects the opinions of Cryptography Research, Inc., and may or may not reflect the opinions of Centaur
Technology. Analysis was performed on preliminary silicon and documentation received from Centaur Technology.
Characteristics of the C5P may vary with design or implementation changes. Cryptography Research provided no C5P core
design assistance to Centaur Technology. Copyright © 2003 Cryptography Research, Inc. www.cryptography.com