An 8-bit AVR-Based Elliptic Curve Cryptographic RISC Processor for the Internet of Things

In recent years, a large body of research has been dedicated to the 'lightweight' implementation of Elliptic Curve Cryptography (ECC) for RFID tags, wireless sensor nodes, and other 'smart' devices that are supposed to become components of the Internet of Things (IoT). However, making ECC suitable for the IoT is far from trivial since many applications demand fast response times (i.e. high performance), but nonetheless call for small silicon area and low power consumption. We tackle this challenge through hardware/software co-design and introduce an 8-bit Application-Specific Instruction Set Processor (ASIP) that combines the efficiency of a dedicated hardware implementation with the flexibility and scalability of ECC software. Our ASIP is based on JAAVR ('Just Another AVR'), an ATmega128 clone into which we integrated a relatively small (32x4)-bit Multiply- Accumulate (MAC) unit optimized to speed up multi-precision arithmetic. To demonstrate the flexibility of our co-design, we implemented scalar multiplication over four families of elliptic curve, namely a Weierstrass curve, a twisted Edwards curve, a Montgomery curve, and a Gallant-Lambert-Vanstone curve. All curves use a 160-bit Optimal Prime Field (OPF) as underlying algebraic structure, which allows for particularly fast execution of the modular reduction on JAAVR. When using 'native' AVR instructions only, our fastest implementation of scalar multiplication reaches an execution time of less than 4M clock cycles on a conventional ATmega128 processor. Taking advantage of the MAC unit, the time for a full 160-bit scalar multiplication falls below 1M cycles, whereas a 'leakage-reducing' implementation that does not execute any security-critical conditional statements needs some 1.3M cycles. A low-memory variant of the extended JAAVR occupies an area of merely 21k gates, making it suitable for resource-constrained IoT devices like sensor nodes.