The National Institute of Standards and Technology (NIST) announced on February 7, 2023, that it had selected the ASCON algorithm to become the standard for Lightweight Cryptography. In this whitepaper, we will explore what lightweight cryptography is and why it is worth considering for specific Internet of Things (IoT) use cases.
Search Results for: IoT
Rambus IP Solution Supports New NIST Lightweight Cryptography Algorithm
This month, the National Institute of Standards and Technology (NIST) announced the selection of a new family of cryptographic algorithms called ASCON, which have been developed for lightweight cryptography applications. Always ready to support our customers with the latest security standards, Rambus is pleased to announce the availability of the ASCON-IP-41 Crypto Engine IP core.
The ASCON cryptographic algorithms are designed to protect data created and transmitted by Internet of Things (IoT) devices. These devices require robust security, but their small size means that they have resource constraints. This is where lightweight cryptography comes in as it means that symmetric cryptography can be used to achieve the required level of security, all while ensuring the efficient use of a device’s resources. Check out our white paper for background information on Lightweight Cryptography, as well as a closer look at the ASCON algorithms.
The ASCON-IP-41 Crypto Engine supports the two primary algorithms proposed under the ASCON family: ASCON-128/HASH and ASCON-128A/HASHA, for both authenticated encryption with associated data (AEAD) and HASH modes of operation. With minimal area requirements, the ASCON-IP-41 crypto engine is extremely suitable for several low-cost and low-power applications.
Example use cases include:
- Lightweight secure boot for (battery operated) IoT devices
- Crypto foundation of small size root of trust implementations
- Vehicle-to-Vehicle communication
- Digital fingerprinting of messages
- RFID tag message counterfeiting protection
Download the ASCON-IP-41 product brief to get the full details on this new ASCON-compliant IP solution.
Wondering how you can use lightweight cryptography to reduce power AND keep the same level of security in your next IoT design? Contact our security IP team to kick off the discussion!
SafeZone Basic Crypto Module, non-FIPS certified version
Rambus Security Vulnerability Disclosure: SafeZone Basic Crypto Module, non-FIPS certified version
Publish Date: March 1, 2022
Rambus Vulnerability ID: RMBS-2021-01
Background
The SafeZone Crypto Libraries were developed by Inside Secure and were acquired by Rambus as part of an acquisition from Verimatrix. There were both FIPS-certified and non-FIPS-certified versions of the SafeZone crypto libraries. The standalone non-FIPS-certified offering had been discontinued for new licenses, but Rambus continues to support existing customers of this product.
A security vulnerability has been identified in the non-FIPS-certified version of the crypto library in SafeZone as described below. A patch which remediates the vulnerability is available and has been distributed to existing customers that are affected by the vulnerability.
“SafeZone” Product Status
| Product Name (Crypto Module) | Affected by Vulnerability | Affected Versions | Available for Licensing | Patch Available |
| SafeZone Crypto Libraries (Basic Crypto Module, non-FIPS certified) | Yes | 9.3.x, 10.0.x, 10.1.x, 10.2.x, 10.3.x | No | Yes, all versions; Also as part of SafeZone 10.4.0 |
| FIPS Security Toolkit* (FIPS 140-2 SW Crypto Module v1.2) | No | None | Yes | N/A |
| FIPS Security Toolkit* (FIPS 140-3 SW Crypto Module v2.0) | No | None | Yes | N/A |
*SafeZone FIPS-certified versions are now offered as “FIPS Security Toolkit” by Rambus
Figure 1. Only the SafeZone Basic Crypto Module is affected by the security vulnerability
Vulnerability Description
The speed-optimized, multi-threaded version of the RSA key generation function CLS_PK_KeyGenMT( ) used in the non-FIPS Basic Crypto Module may create weak RSA keys.
The vulnerability does not exist in the single-threaded version of the RSA key generation function CLS_PK_KeyGen_RSA( ).
Impact
The distance between the p and q values of the generated RSA key may not be sufficient which makes the key vulnerable to factorization attacks.
Affected Versions
SafeZone Crypto Libraries (Basic Crypto Module) versions: 9.3.x, 10.0.x, 10.1.x, 10.2.x, 10.3.x. the last update of version 10.3.x was June 2020.
Unaffected Versions
FIPS 140-2 and FIPS 140-3 SW Crypto Modules are unaffected.
SafeZone Crypto Libraries (Basic Crypto Module) versions: 10.4.0 is unaffected.
Remediation
Rambus provided a patch for all affected versions that modifies the CLS_PK_KeyGenMT( ) implementation in a way that ensures the distance between the p and q values is sufficient.
Action Taken
A customer notified Rambus of this issue on November 2, 2021. Rambus developed a patch and provided it to the affected customer within two weeks.
All other Rambus customers that may use the affected crypto library were provided with a patch on or before December 15, 2021.
More recently an ‘advisory message’ was provided to SafeZone customers with access to the Crypto Libraries to confirm that they are not affected by this vulnerability.
Acknowledgement
The vulnerability was found in a Rambus customer product. The vulnerability was reported to the customer by independent security researcher, Hanno Böck, who was referred to the Rambus Security IP team.
For any inquiries, please contact Rambus.
Boosting Data Center Performance to the Next Level with PCIe 6.0 & CXL 3.0
2022 has seen major updates to two standards critical to the future evolution of the data center: PCI Express® (PCIe®) and Compute Express Link™ (CXL™). The two are interwoven, and in this blog, we’ll look at their relationship and the impact of latest developments.
Like many standards in the computing world, PCIe has proliferated far beyond its original remit. Over the past two decades, it has become not just the de facto standard for computing connectivity, it has also expanded into new applications, such as IoT, automotive, government, and many more. With its most recent update to PCIe 6.0, it is poised to take data center performance to the next level.
PCIe 6.0 boosts signaling rates to 64 gigatransfers per second (GT/s), twice that of PCIe 5.0. Initial designs incorporating PCIe 6.0 will be where bandwidth demands are most intense right now: in the heart of the data center. For bandwidth-hungry, data-intensive workloads, the extra bandwidth offered by PCIe 6.0 will certainly be a game changer!
CXL, first introduced in 2019, adopted the ubiquitous PCIe standard for its physical layer protocol (CXL.io). At that time, PCIe 5.0 was the latest standard, and CXL 1.0, 1.1 and the subsequent 2.0 generation all used PCIe 5.0’s 32 GT/s signaling.
In August 2022, CXL 3.0 was released, adopting the PCIe 6.0 physical interface. This new version of the CXL specification introduced new features such that promise to increase data center performance and scalability, while reducing the total cost of ownership (TCO). CXL 3.0, like PCIe 6.0, uses PAM4 to boost signaling rates to 64 GT/s with no additional latency.
Beyond this, it offers multi-tiered switching and switch-based fabrics, along with improved memory sharing and pooling capabilities. Combined, these three key features enable new use models and increased flexibility in data center architectures. This facilitates the move to distributed, composable architectures and higher performance levels for AI/ML and other compute-intensive or memory-intensive workloads.
For SoC designers, the number of signal integrity and power integrity (SI/PI) issues compound as data rates rise. Designing for 64 GT/s operation can be exceedingly tricky. Rambus has over 30 years of renowned leadership in SI/PI and has helped chip makers successfully implement hundreds of PCIe and CXL designs. With today’s announcement of a PHY that supports both PCIe 6.0 and CXL 3.0, we offer an easy to integrate solution that will help you take your chip design to the next level of performance.
Certifications
Certifications
Rambus offers certified silicon IP solutions tailored to the specific needs of some of the world’s most demanding applications.
Contact
Explore Certifications
ISO 9001:2015
ISO 9001:2015 is an internationally recognized standard established by the International Organization for Standardization (ISO) that defines the requirements for an effective Quality Management System (QMS). Rambus has implemented and maintains a certified ISO 9001:2015 QMS to ensure consistent delivery of highquality products and services, to meet customer and regulatory requirements, and to demonstrate our ongoing commitment to operational excellence.
Our QMS undergoes regular audits by both external and internal auditors to validate compliance and drive continuous improvement. The ISO 9001:2015 framework also serves as the foundation for additional Rambus certifications, including ISO 26262 (automotive functional safety), ISO 21434 (automotive cybersecurity), FIPS, SESIP & PSA Certified.
Common Criteria
The Common Criteria for Information Technology Security Evaluation, known as Common Criteria or CC, is an international standard (ISO/IEC 15408) for computer security. Common Criteria provides an objective evaluation that validates whether a product or site satisfies a defined set of security requirements. Common Criteria operates using Evaluation Assurance Levels or EAL ranging from EAL1 to EAL7. EAL4 to EAL7 are the highest levels of certification. All Common Criteria certified solutions from Rambus can be found on the Common Criteria portal.| Rambus Product/Site | Certification Level | Certifying Body |
|---|---|---|
| Rambus HQ, San Jose, CA | EAL4+ | NSCIB |
| AES-ECB-32-DPA-FIA-CC Cryptographic Accelerator | EAL4+ | NSCIB |
| PKE-IP-85-DPA-FIA-CC Cryptographic Accelerator | EAL4+ | NSCIB |
SESIP & PSA
SESIP (Security Evaluation Standard for IoT Platforms) is a certification methodology optimized for IoT components and platforms. It has five levels – SESIP1 to SESIP5 – from self-declaration to CC AVA_VAN.5 security level. The SESIP standard enables the reuse of certification through composition and can be mapped to the functional security requirements of other schemes to reduce fragmentation in IoT security certification.
The PSA (Platform Security Architecture) certification program defines security requirements and evaluation methodology for IoT Root of Trust devices. The PSA Certified RoT Component program defines standards for the Root of Trust components. It recognizes SESIP and uses SESIP as the evaluation methodology for the program.
Related News:
FIPS 140
FIPS (Federal Information Processing Standards) are standards and guidelines developed by the US National Institute of Standards and Technology (NIST) to address statutory requirements for federal computing systems. State and local governments, as well as many private sector entities, voluntarily use these standards.
FIPS 140-3 (and the preceding 140-2) specifies the security requirements for cryptographic modules. The security requirements cover areas related to the secure design, implementation and operation of cryptographic modules. Rambus offers security products certified per Cryptographic Module Validation Program (CMVP) to meet the requirements of FIPS 140-3.
Rambus offers dedicated FIPS 140-3 support packages to its licensees that provide FIPS 140-3 related certification documentation, FIPS test scripts, and dedicated FIPS support.
ISO/SAE 21434
ISO/SAE 21434:2021, jointly developed by the International Organization for Standardization (ISO) and the Society of Automotive Engineers (SAE), is a pivotal framework that defines a comprehensive set of guidelines and standards designed to establish a cybersecurity management system in the automotive industry.
ISO 21434 is this standard recognized by the automotive industry as the reference for meeting UN R155 regulation requirements for new vehicles. Rambus supports OEMs in their UN R155 compliance journey with secure-by-design IP developed in an ISO/SAE 21434 compliant development environment.
| Rambus Product | Certification Level | Certifying Body |
|---|---|---|
| Rambus | ISO/SAE 21434 Compliant | SGS-TÜV Saar |
Related News:
ISO 26262
ISO 26262-1:2018 is the standard developed by the International Organization for Standardization (ISO) governing functional safety of electrical and/or electronic systems installed in road vehicles.
ISO 26262 establishes four Automotive Safety Integrity Levels (ASIL), from A the lowest to D the highest, representing the probability and severity of harm caused by a malfunction in an automotive system.
LPDDR5 Delivers High Bandwidth for a Growing Range of Applications
Initially designed for mobile phones and laptops, the bandwidth and low power characteristics of LPDDR make it an increasingly attractive choice of memory for applications in IoT, automotive, edge computing and the data center. Fifth-generation LPDDR5 raises data rates to 6.4 Gbps and bandwidth to 25.6 GB/s for a x32 DRAM device. In this session, Rambus and its partners OpenFive and Avery Design Systems will discuss their high-performance, high-quality, configurable LPDDR5 solution.
