Their ubiquity and typically cost-driven design make platforms based on microcontroller units (MCUs) a preferred target for cyber attacks. While Hardware Roots of Trust (RoTs) aim to establish security services, such as confidentiality, integrity, and authentication, the abundance of mutually exclusive cryptographic algorithms taxes heavily on the MCUs’ limited resources. In the presented work, we leverage fundamental cryptographic implications to derive the necessary services from a single sponge-based algorithm’s engine coupled with a Physically Unclonable Function (PUF) for randomness. The proposed single engine can provide all required security services to build an HRoT. In particular, the sponge-based Ascon is chosen to realize Authenticated Encryption with Associated Data (AEAD) and hashing and, at the same time to establish all preconditions for required services like digital signatures or Message Authentication Codes (MACs). To demonstrate the practicality of our hardware RoT, we integrate it into a RISC-V-based System on Chip (SoC) as a memory-mapped peripheral. As proof of the concept, we implement the SoC on the AMD/Xilinx Artix-7 FPGA and synthesize it for the 130nm Open Source SkyWater PDK. The results show that our hardware RoT design adds 10.35% Look-Up Tables (LUTs) for the FPGA implementation and 0.76% area for the ASIC implementation. Our Ascon engine FPGA implementation incurs 2.33<InlineEquation ID="IEq1"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="13389_2025_381_Article_IEq1.gif" Format="GIF" Height="13" Rendition="HTML" Resolution="72" Type="Linedraw" Width="19" /> </InlineMediaObject> <EquationSource Format="TEX">$\times $</EquationSource> <EquationSource Format="MATHML"><math> <mo>×</mo> </math></EquationSource> </InlineEquation> less logic- and 4.48<InlineEquation ID="IEq2"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="13389_2025_381_Article_IEq1.gif" Format="GIF" Height="13" Rendition="HTML" Resolution="72" Type="Linedraw" Width="19" /> </InlineMediaObject> <EquationSource Format="TEX">$\times $</EquationSource> <EquationSource Format="MATHML"><math> <mo>×</mo> </math></EquationSource> </InlineEquation> less memory resources compared to the state-of-the-art. This hardware RoT integration hence enables cost-effective and efficient deployments for resource-constrained devices.

Single engine architecture for hardware root of trust

期刊论文
出版模式：

开放获取
发表日期：

2025年9月22日

查看全文

Daniel Najork,
Andrija Nešković,
Hsin-Kun Lin,
Christian Ewert,
Sven Dreier,
Mladen Berekovic,
Rainer Buchty,
Saleh Mulhem

摘要

Their ubiquity and typically cost-driven design make platforms based on microcontroller units (MCUs) a preferred target for cyber attacks. While Hardware Roots of Trust (RoTs) aim to establish security services, such as confidentiality, integrity, and authentication, the abundance of mutually exclusive cryptographic algorithms taxes heavily on the MCUs’ limited resources. In the presented work, we leverage fundamental cryptographic implications to derive the necessary services from a single sponge-based algorithm’s engine coupled with a Physically Unclonable Function (PUF) for randomness. The proposed single engine can provide all required security services to build an HRoT. In particular, the sponge-based Ascon is chosen to realize Authenticated Encryption with Associated Data (AEAD) and hashing and, at the same time to establish all preconditions for required services like digital signatures or Message Authentication Codes (MACs). To demonstrate the practicality of our hardware RoT, we integrate it into a RISC-V-based System on Chip (SoC) as a memory-mapped peripheral. As proof of the concept, we implement the SoC on the AMD/Xilinx Artix-7 FPGA and synthesize it for the 130nm Open Source SkyWater PDK. The results show that our hardware RoT design adds 10.35% Look-Up Tables (LUTs) for the FPGA implementation and 0.76% area for the ASIC implementation. Our Ascon engine FPGA implementation incurs 2.33 $\times $ $\times$ less logic- and 4.48 $\times $ $\times$ less memory resources compared to the state-of-the-art. This hardware RoT integration hence enables cost-effective and efficient deployments for resource-constrained devices.