Ideal for power and space-sensitive applications like IoT Server, Gateway and Edge Devices, the CC-71x Root of Trust offers the best balance of size and performance available on the market. .
Search Results for: iot
Rambus Expands Industry-Leading Security IP Portfolio with Arm CryptoCell and CryptoIsland IP
For over three decades, Rambus has been providing industry-leading Secure Silicon IP solutions to protect Data-at-Rest, Data-in-Use, and Data-in-Motion. Today, Rambus is excited to announce it will be offering the Arm® CryptoCell™ and CryptoIsland™ security IP portfolio. Going forward, semiconductor design teams will now be able to license this IP directly from Rambus.
The Rambus FIPS 140-certified RT-1xx series provide secure services and secure management to low-cost IoT clients, servers and gateways, while the Rambus DPA-resistant RT-2xx series secures micro controllers. Rambus’ FIPS 140-certified RT-6xx System Security Manager series targets secure designs for AI Edge, AI Data Center, Automotive grade eHSMs, and government, aerospace, and defense segments. The expansion of the Rambus Data-at-Rest product line with the Arm CryptoCell and CryptoIsland IP offers more choices to our customers building secure SoCs using certified Root of Trust designs.
The CryptoCell CC-312, CC-712 and CC-713 are lightweight cores without a processor or controller and offer Key Management and Crypto Services to Arm TrustZone™-enabled Arm Cortex™-M and Cortex-A powered SoC designs. TrustZone is Arm technology offering Normal and Secure World environments on a single CPU. The CryptoCell cores will be available alongside the RT-1xx Root of Trust cores for sensor, device, gateway and server applications in the IoT market.
The CryptoIsland CI-300 is a security enclave that can be used in isolation to the host processor. With its secure programmability, the CryptoIsland core will be offered alongside the Rambus RT-6xx Root of Trust series. The most common examples are Smart Cards, Mobile Application processors and 5G Modems.
“As a leading Security IP provider, we’re excited to be working with the Arm ecosystem on this mission critical initiative of continuing to enable secure Arm-based SoCs. Customers requiring root-of-trust functionality in their designs can benefit by adding one of our silicon proven and security certified IP cores, which now also includes CryptoCell and CryptoIsland, to their SoC designs. These can be combined with any of our Rambus secure protocol accelerator or inline memory encryption cores,” said Neeraj Paliwal, general manager of Security IP at Rambus. “The newly expanded Rambus portfolio is ideal for customers targeting certified security designs, comprising of ISO26262 and ISO21434 automotive certificates to NIST FIPS 140-2 and 140-3 CMVP certificates to PSA Certified and SESIP certification.”
While existing Arm customer licenses for this IP will remain as is, going forward CryptoCell and CryptoIsland IP can be licensed from Rambus.
“Securing the world’s data will be one of the greatest technology challenges over the next decade of compute – one that requires strong industry collaboration to protect individuals, business and the devices of tomorrow,” said Andy Rose, vice president of technology strategy and fellow, Architecture and Technology Group, Arm. “We continue to invest heavily in the key new architectural features required to build secure solutions on Arm, and in research, standards and certification, and open-source software initiatives to drive the industry forward. By making our CryptoCell and CryptoIsland product family available through Rambus, we’re ensuring their expertise and ongoing investment in delivering cost-effective and scalable security IP for cryptographic services across multiple markets.”
Please visit https://www.rambus.com/security/root-of-trust/ to learn all about Rambus newly extended Root-of-Trust portfolio and https://www.rambus.com/cryptocell-cryptoisland/ to learn more about the CryptoCell and CryptoIsland solutions.
Read more about this collaboration in Arm’s blog, “Innovation and Collaboration: Arm’s Continuous Commitment to Security”.
Lightweight Cryptography: An Introduction
Rambus IP Solution Supports New NIST Lightweight Cryptography Algorithm
This month, the National Institute of Standards and Technology (NIST) announced the selection of a new family of cryptographic algorithms called ASCON, which have been developed for lightweight cryptography applications. Always ready to support our customers with the latest security standards, Rambus is pleased to announce the availability of the ASCON-IP-41 Crypto Engine IP core.
The ASCON cryptographic algorithms are designed to protect data created and transmitted by Internet of Things (IoT) devices. These devices require robust security, but their small size means that they have resource constraints. This is where lightweight cryptography comes in as it means that symmetric cryptography can be used to achieve the required level of security, all while ensuring the efficient use of a device’s resources. Check out our white paper for background information on Lightweight Cryptography, as well as a closer look at the ASCON algorithms.
The ASCON-IP-41 Crypto Engine supports the two primary algorithms proposed under the ASCON family: ASCON-128/HASH and ASCON-128A/HASHA, for both authenticated encryption with associated data (AEAD) and HASH modes of operation. With minimal area requirements, the ASCON-IP-41 crypto engine is extremely suitable for several low-cost and low-power applications.
Example use cases include:
- Lightweight secure boot for (battery operated) IoT devices
- Crypto foundation of small size root of trust implementations
- Vehicle-to-Vehicle communication
- Digital fingerprinting of messages
- RFID tag message counterfeiting protection
Download the ASCON-IP-41 product brief to get the full details on this new ASCON-compliant IP solution.
Wondering how you can use lightweight cryptography to reduce power AND keep the same level of security in your next IoT design? Contact our security IP team to kick off the discussion!
SafeZone Basic Crypto Module, non-FIPS certified version
Rambus Security Vulnerability Disclosure: SafeZone Basic Crypto Module, non-FIPS certified version
Publish Date: March 1, 2022
Rambus Vulnerability ID: RMBS-2021-01
Background
The SafeZone Crypto Libraries were developed by Inside Secure and were acquired by Rambus as part of an acquisition from Verimatrix. There were both FIPS-certified and non-FIPS-certified versions of the SafeZone crypto libraries. The standalone non-FIPS-certified offering had been discontinued for new licenses, but Rambus continues to support existing customers of this product.
A security vulnerability has been identified in the non-FIPS-certified version of the crypto library in SafeZone as described below. A patch which remediates the vulnerability is available and has been distributed to existing customers that are affected by the vulnerability.
“SafeZone” Product Status
| Product Name (Crypto Module) | Affected by Vulnerability | Affected Versions | Available for Licensing | Patch Available |
| SafeZone Crypto Libraries (Basic Crypto Module, non-FIPS certified) | Yes | 9.3.x, 10.0.x, 10.1.x, 10.2.x, 10.3.x | No | Yes, all versions; Also as part of SafeZone 10.4.0 |
| FIPS Security Toolkit* (FIPS 140-2 SW Crypto Module v1.2) | No | None | Yes | N/A |
| FIPS Security Toolkit* (FIPS 140-3 SW Crypto Module v2.0) | No | None | Yes | N/A |
*SafeZone FIPS-certified versions are now offered as “FIPS Security Toolkit” by Rambus
Figure 1. Only the SafeZone Basic Crypto Module is affected by the security vulnerability
Vulnerability Description
The speed-optimized, multi-threaded version of the RSA key generation function CLS_PK_KeyGenMT( ) used in the non-FIPS Basic Crypto Module may create weak RSA keys.
The vulnerability does not exist in the single-threaded version of the RSA key generation function CLS_PK_KeyGen_RSA( ).
Impact
The distance between the p and q values of the generated RSA key may not be sufficient which makes the key vulnerable to factorization attacks.
Affected Versions
SafeZone Crypto Libraries (Basic Crypto Module) versions: 9.3.x, 10.0.x, 10.1.x, 10.2.x, 10.3.x. the last update of version 10.3.x was June 2020.
Unaffected Versions
FIPS 140-2 and FIPS 140-3 SW Crypto Modules are unaffected.
SafeZone Crypto Libraries (Basic Crypto Module) versions: 10.4.0 is unaffected.
Remediation
Rambus provided a patch for all affected versions that modifies the CLS_PK_KeyGenMT( ) implementation in a way that ensures the distance between the p and q values is sufficient.
Action Taken
A customer notified Rambus of this issue on November 2, 2021. Rambus developed a patch and provided it to the affected customer within two weeks.
All other Rambus customers that may use the affected crypto library were provided with a patch on or before December 15, 2021.
More recently an ‘advisory message’ was provided to SafeZone customers with access to the Crypto Libraries to confirm that they are not affected by this vulnerability.
Acknowledgement
The vulnerability was found in a Rambus customer product. The vulnerability was reported to the customer by independent security researcher, Hanno Böck, who was referred to the Rambus Security IP team.
For any inquiries, please contact Rambus.
Boosting Data Center Performance to the Next Level with PCIe 6.0 & CXL 3.0
2022 has seen major updates to two standards critical to the future evolution of the data center: PCI Express® (PCIe®) and Compute Express Link™ (CXL™). The two are interwoven, and in this blog, we’ll look at their relationship and the impact of latest developments.
Like many standards in the computing world, PCIe has proliferated far beyond its original remit. Over the past two decades, it has become not just the de facto standard for computing connectivity, it has also expanded into new applications, such as IoT, automotive, government, and many more. With its most recent update to PCIe 6.0, it is poised to take data center performance to the next level.
PCIe 6.0 boosts signaling rates to 64 gigatransfers per second (GT/s), twice that of PCIe 5.0. Initial designs incorporating PCIe 6.0 will be where bandwidth demands are most intense right now: in the heart of the data center. For bandwidth-hungry, data-intensive workloads, the extra bandwidth offered by PCIe 6.0 will certainly be a game changer!
CXL, first introduced in 2019, adopted the ubiquitous PCIe standard for its physical layer protocol (CXL.io). At that time, PCIe 5.0 was the latest standard, and CXL 1.0, 1.1 and the subsequent 2.0 generation all used PCIe 5.0’s 32 GT/s signaling.
In August 2022, CXL 3.0 was released, adopting the PCIe 6.0 physical interface. This new version of the CXL specification introduced new features such that promise to increase data center performance and scalability, while reducing the total cost of ownership (TCO). CXL 3.0, like PCIe 6.0, uses PAM4 to boost signaling rates to 64 GT/s with no additional latency.
Beyond this, it offers multi-tiered switching and switch-based fabrics, along with improved memory sharing and pooling capabilities. Combined, these three key features enable new use models and increased flexibility in data center architectures. This facilitates the move to distributed, composable architectures and higher performance levels for AI/ML and other compute-intensive or memory-intensive workloads.
For SoC designers, the number of signal integrity and power integrity (SI/PI) issues compound as data rates rise. Designing for 64 GT/s operation can be exceedingly tricky. Rambus has over 30 years of renowned leadership in SI/PI and has helped chip makers successfully implement hundreds of PCIe and CXL designs. With today’s announcement of a PHY that supports both PCIe 6.0 and CXL 3.0, we offer an easy to integrate solution that will help you take your chip design to the next level of performance.
