## 5 Case Study: Cryptographic Hardware Coprocessor for the Secure Subsystem of Rhea GPP
### Security Services  
In order to support both the secure boot routine and high-performance security functions at run-time, we embedded in the Crypto-Tile four independent and specialized cryptographic coprocessors, with each one for a different family of cryptographic operations. With reference to the architecture outline of the Crypto-Tile that is shown in Figure 7, our module embeds:  
* A coprocessor for symmetric-key cryptography based on the Advanced Encryption Standard (AES) algorithm [17]. This coprocessor offers:
* Confidentiality, through the AES modes operation Electronic CodeBook (ECB), Cipher Block Chaining (CBC), Cipher FeedBack (CFB), Output FeedBack (OFB), and CounTeR (CTR) [70];
* Authenticated Integrity, through the AES mode of operation Cipher-based Message Authentication Code (CMAC) [71];
* Authenticated Encryption, through the AES modes of operation Counter with CBC-MAC (CCM) [72] and Galois Counter Mode (GCM) [73; 74];
* Disk encryption, through the AES mode of operation XEX encryption mode with Tweak and ciphertext Stealing (XTS) [75]. For each of the listed modes of operation, the AES coprocessor supports both 128-bit and 256-bit keys, respectively providing a corresponding security level of 128 and 256 bits [43]. * A coprocessor for public-key cryptography based on Elliptic Curve Cryptography (ECC) [16]. This coprocessor offers:
* Acceleration of computationally intensive arithmetic operations over elliptic curves, such as Point Addition and Point Doubling;
* Generation of private keys, key pairs (both private and public), and derivation of corresponding public keys starting from private keys;
* Authentication and non-repudiation, through the Elliptic Curve Digital Signature Algorithm (ECDSA) [76]. Figure 6: Outline of Security Subsystem within Rhea GPP [14]. For each of the listed functions, the ECC coprocessor supports both 256-bit and 521-bit elliptic curves, in particular the NIST P-256 and the NIST P-521, that provide, respectively, a corresponding security strength of 128 and 256 bits [43]. * A coprocessor for hash functions based on the Secure Hash Algorithm (SHA) [18]. This coprocessor offers integrity through the algorithms SHA2 [77] and SHA-3 [78]. For both the SHA functions, the supported digest sizes are 224, 256, 384, and 512 bits, providing a corresponding security level of 128 (256-bit digest) and 256 (384-bit digest) bits [43]. * Generation of high-entropy key-related material and seeds, through a True Random Number Generator (TRNG) [19];
- Generation of key-related material, non-repeating values, and initialization vectors through a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) [79], which is seeded thanks to the TRNG. The ECC and SHA cryptoprocessors support the secure boot routine to verify, respectively, the authenticity and the integrity of the first bootloader stage. Indeed, at the boot, the Secure Element in Figure 6 loads the software code from the OTP into the SRAM of the Master Secure MCU, enables the corresponding hardware acceleration unit (Crypto-Tile), and uses it to verify the integrity and the authenticity of the software code. Upon the success of this step, consequently, the Master Secure MCU performs similar operations by enabling the other Security Domains (triplets of Secure MCU, SRAM, and Crypto-Tile). After this process, the Secure Subsystem of Rhea GPP is fully enabled and can provide  
Figure 7: High-level architecture of Crypto-Tile [14]. run-time security services that are accelerated in the hardware by the instances of the Crypto-Tile and all the embedded cryptoprocessors. All the implemented algorithms have been tested and verified at the functional level with the corresponding suite of test vectors provided by the NIST through the CAVP. The implemented cryptographic coprocessors were developed to find the best solution in terms of the trade-off between performance, resource consumption, and security strength.