 | |
 | |
 | |
 | |
 | |
 | |
 | |
 | |
 | |
 | |
 | |
 |
Bistream management in FPGA based secure applicationsBenoit Badrignans |
|
|---|---|
| Nowadays FPGAs are often used in secure applications, for instance the French company Bull proposes a device called Globull [1] based on a FPGA device [2]. This device is a PIN-protected hard-disk that provides also cryptographic services through a PKCS#11 library. It can generate symmetric and asymmetric keys and can protect them with a PIN code. It can also encrypt and decrypt data using AES or RSA algorithms. FPGAs are interesting for secure applications since those applications are generally dedicated to small and medium markets, therefore NRE cost of an ASIC development are not justified. Moreover they can be reprogrammed in case of discovery of potential security hole.
If FPGAs provide good performances and are suitable for low-volume applications, they are not perfect regarding security concerns. During this talk we will especially consider threats over configuration bitstream. We show that secure applications must use strong bitstream integrity protection and should be able to store sensitive cryptographic keys inside their configuration data. This talk will be organize in four main parts. First we analyse integrity checking mechanisms and key management features provided by mains FPGA vendors. Next we expose currently applicable solutions to protect bistream integrity upon multiple bitstream update, and solutions to hide keys inside configuration stream. Then we present a practical implementation of those solutions that were done in the context of a secure FPGA based platform developed by the French company Netheos. Finally we will conclude with a discussion about features that FPGA vendors should implement to increase the attractiveness of FPGAs for secure applications. [1] : http://www.myglobull.fr/ [2] : http://pro.01net.com/editorial/380542/se-deplacer-avec-son-poste-de-travail-en-toute-securite/ |
|