Subject: [Ace] on signature verification times for sec192r1

From: Pascal Urien <[email-masked]>
Date: Sat, 23 Jul 2016 17:10:10 +0200

Hi All

J3A081M is a javacard device from NXP

The micocontroller should be the P5CD081V1A, which comprises a crypto
processor

The performances with the curve secp192r1 are the following (for ECDSA +
SHA1)

Sign    = 40ms +  nb_bloc_512bits x 3.5 ms
Verify  = 60ms  + nb_bloc_512bits x 3,5 ms

By the way this chip has enough crypto ressouces for processing TLS or DTLS

Rgs

Pascal

---

From: Pascal Urien <[email-masked]>
Date: Sat, 23 Jul 2016 17:43:16 +0200

P5CN081 EEPROM=80 KB  RAM= 7.5 KB, frequency < 72MHZ, CryptoCoprocessor

Sign    = 40ms +  nb_bloc_512bits x 2 ms
Verify  = 60ms  + nb_bloc_512bits x 2 ms

Rgs

Pascal

---

From: Michael StJohns <[email-masked]>
Date: Sat, 23 Jul 2016 17:59:15 -0400

> The micocontroller should be the P5CD081V1A, which comprises a crypto 

There's a number of these from a number of vendors.  I'd actually look 
at the A7xxx series of chips as they're designed to be embeddable.  I've 
become a big fan of javacard style solutions over the years.

In any event, the number of relatively inexpensive public key crypto 
accelerator chips (e.g. googl for "secure authentication chips") is 
greater than zero and continues to climb.  And for not a lot of money.  
Estimating what from prices on Digikey, I'd think something less than 
$.50 for Quantity large as of today and half that or less in 1-2 years 
as its gets bundled into the "Swiss Army Knife" style of process (e.g. 
support for wireless 900mhz plus ... plus ... plus ... plus security...) 
(google for iot module secure element 900mhz for example).

Later, Mike

>
> The performances with the curve secp192r1 are the following (for ECDSA 
> + SHA1)
>
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace

---

From: Pascal Urien <[email-masked]>
Date: Sun, 24 Jul 2016 11:50:31 +0200

I fully agree...

J3A081M  can be found at 10$ over the WEB

Futhermore this class of cheap device can process TLS or DTLS as
illustrated in

https://tools.ietf.org/html/draft-urien-uta-tls-dtls-security-module-00

They could be used for numerous applications in the IoT

Rgs

Pascal

2016-07-23 23:59 GMT+02:00 Michael StJohns <[email-masked]>:

> There's a number of these from a number of vendors.  I'd actually look at
> the A7xxx series of chips as they're designed to be embeddable.  I've
> accelerator chips (e.g. googl for "secure authentication chips") is greater
> than zero and continues to climb.  And for not a lot of money.  Estimating
> what from prices on Digikey, I'd think something less than $.50 for
> Quantity large as of today and half that or less in 1-2 years as its gets
> bundled into the "Swiss Army Knife" style of process (e.g. support for
> wireless 900mhz plus ... plus ... plus ... plus security...) (google for
> iot module secure element 900mhz for example).
>
> Later, Mike
>
>
>
>
> Ace mailing [email-masked]://www.ietf.org/mailman/listinfo/ace
>
>
>

---

From: Somaraju Abhinav <[email-masked]>
Date: Mon, 25 Jul 2016 10:04:19 +0000

Hi Pascal,

Thanks for the information. Could you please explain what is nb_bloc_512bits?

Regards,
Abhinav

From: Ace [mailto:[email-masked]] On Behalf Of Pascal Urien
Sent: Sonntag, 24. Juli 2016 11:51
To: Michael StJohns <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ace] on signature verification times for sec192r1

I fully agree...

Futhermore this class of cheap device can process TLS or DTLS as illustrated in

Rgs

Pascal

2016-07-23 23:59 GMT+02:00 Michael StJohns <[email-masked]<mailto:[email-masked]>>:
On 7/23/2016 11:10 AM, Pascal Urien wrote:
Hi All

The micocontroller should be the P5CD081V1A, which comprises a crypto processor

There's a number of these from a number of vendors.  I'd actually look at the A7xxx series of chips as they're designed to be embeddable.  I've become a big fan of javacard style solutions over the years.

In any event, the number of relatively inexpensive public key crypto accelerator chips (e.g. googl for "secure authentication chips") is greater than zero and continues to climb.  And for not a lot of money.  Estimating what from prices on Digikey, I'd think something less than $.50 for Quantity large as of today and half that or less in 1-2 years as its gets bundled into the "Swiss Army Knife" style of process (e.g. support for wireless 900mhz plus ... plus ... plus ... plus security...) (google for iot module secure element 900mhz for example).

Later, Mike

The performances with the curve secp192r1 are the following (for ECDSA + SHA1)

Rgs

Pascal

Ace mailing list

[email-masked]<mailto:[email-masked]>

_______________________________________________
Ace mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ace

________________________________________________________ The contents of this e-mail and any attachments are confidential to the intended recipient. They may not be disclosed to or used by or copied in any way by anyone other than the intended recipient. If this e-mail is received in error, please immediately notify the sender and delete the e-mail and attached documents. Please note that neither the sender nor the sender's company accept any responsibility for viruses and it is your responsibility to scan or otherwise check this e-mail and any attachments.

---

From: Pascal Urien <[email-masked]>
Date: Mon, 25 Jul 2016 12:28:36 +0200

Hi Abhinav

The extra time (2ms/bloc)  comes from the hash procedure (sha1 in the
example) that works with 64 bytes blocs

Rgs

Pascal

2016-07-25 12:04 GMT+02:00 Somaraju Abhinav <[email-masked]>:

> *From:* Ace [mailto:[email-masked]] *On Behalf Of *Pascal Urien
> *Sent:* Sonntag, 24. Juli 2016 11:51
> *To:* Michael StJohns <[email-masked]>
> *Cc:* [email-masked]
> *Subject:* Re: [Ace] on signature verification times for sec192r1
>
>
>
> I fully agree...
>
>
>
> ________________________________________________________ The contents of
> this e-mail and any attachments are confidential to the intended recipient.
> They may not be disclosed to or used by or copied in any way by anyone
> other than the intended recipient. If this e-mail is received in error,
> please immediately notify the sender and delete the e-mail and attached
> documents. Please note that neither the sender nor the sender's company
> accept any responsibility for viruses and it is your responsibility to scan
> or otherwise check this e-mail and any attachments.
>

---

From: Somaraju Abhinav <[email-masked]>
Date: Mon, 25 Jul 2016 11:40:22 +0000

Hi,

please find attached a report regarding computation times.

Abhinav

________________________________
From: Pascal Urien <[email-masked]>
Sent: Monday, July 25, 2016 12:28:36 PM
To: Somaraju Abhinav
Cc: Michael StJohns; [email-masked]
Subject: Re: [Ace] on signature verification times for sec192r1

Hi Abhinav

The extra time (2ms/bloc)  comes from the hash procedure (sha1 in the example) that works with 64 bytes blocs

Rgs

Pascal

2016-07-25 12:04 GMT+02:00 Somaraju Abhinav <[email-masked]<mailto:[email-masked]>>:
Hi Pascal,

Regards,
Abhinav

From: Ace [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Pascal Urien
Sent: Sonntag, 24. Juli 2016 11:51
To: Michael StJohns <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Ace] on signature verification times for sec192r1

I fully agree...

Rgs

Pascal

Later, Mike

Rgs

Pascal

Ace mailing list

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 25 Jul 2016 14:06:28 +0200

Hi Pascal,

there is no doubt that today's IoT hardware can run Internet security
protocols. This is why we worked on the DTLS profile in the DICE working
group, which has been finally published as an RFC a few days ago. Here
is the link:
https://tools.ietf.org/html/rfc7925

There are two separate issues that are being raised here in this
discussion, namely

* Low latency requirements (and Abhinav just sent a document around that
provides further details), and

* Security of the stored keying material.

During the meeting we had a discussion about the ability (or inability)
to use public key crypto on modern IoT hardware so that it hits the time
budget needed for the lighting domain.

I personally see the security of the stored keying material is an
orthogonal issue since additional security protection makes attacks
harder but of course not impossible.

Btw, when you mention prices of chips you also need to indicate what the
volume is. The price is very much dependent on the volume.

Furthermore, you mention some performance numbers below but they seem to
be incomplete since I don't really know what the constant
'nb_bloc_512bits' is. Could you please elaborate?

Ciao
Hannes

On 07/24/2016 11:50 AM, Pascal Urien wrote:
>     There's a number of these from a number of vendors.  I'd actually
>     look at the A7xxx series of chips as they're designed to be
>     embeddable.  I've become a big fan of javacard style solutions over
>     the years.
> 
>     greater than zero and continues to climb.  And for not a lot of
>     money.  Estimating what from prices on Digikey, I'd think something
>     less than $.50 for Quantity large as of today and half that or less
>     in 1-2 years as its gets bundled into the "Swiss Army Knife" style
>     of process (e.g. support for wireless 900mhz plus ... plus ... plus
>     ... plus security...) (google for iot module secure element 900mhz
>     for example).
> 
>     Later, Mike
> 
> 
> 
>>
>>     [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 25 Jul 2016 19:16:48 +0200

Hi Pascal,

I guess you are saying that the performance of the verify operation is
60ms + the hash needed over the actual message (which is 3.5 msec for a
64 byte block).

In another paper I have seen that some hardware crypto chips have a
fairly slow interface and that has to be taken into account as well. Is
this an issue with this smart card? What is your experience there?

Ciao
Hannes

On 07/25/2016 12:28 PM, Pascal Urien wrote:
> 2016-07-25 12:04 GMT+02:00 Somaraju Abhinav
> <[email-masked] <mailto:[email-masked]>>:
> 
>     Hi Pascal,____
> 
>     __ __
> 
>     Thanks for the information. Could you please explain what is
>     nb_bloc_512bits?____
> 
>     __ __
> 
>     Regards,____
> 
>     Abhinav____
> 
>     __ __
> 
>     *From:*Ace [mailto:[email-masked]
>     <mailto:[email-masked]>] *On Behalf Of *Pascal Urien
>     *To:* Michael StJohns <[email-masked]
>     <mailto:[email-masked]>>
>     *Cc:* [email-masked] <mailto:[email-masked]>
>     *Subject:* Re: [Ace] on signature verification times for sec192r1____
> 
>     __ __
> 
>     I fully agree...____
> 
>     __ __
> 
>     J3A081M  can be found at 10$ over the WEB____
> 
>     __ __
> 
>     illustrated in____
>     __ __
>     https://tools.ietf.org/html/draft-urien-uta-tls-dtls-security-module-00____
> 
>     __ __
> 
>     They could be used for numerous applications in the IoT____
> 
>     __ __
> 
>     Rgs____
> 
>     __ __
> 
>     Pascal____
> 
>     __ __
> 
>     __ __
> 
>     2016-07-23 23:59 GMT+02:00 Michael StJohns <[email-masked]
>     <mailto:[email-masked]>>:____
> 
>         On 7/23/2016 11:10 AM, Pascal Urien wrote:____
> 
>             Hi All____
> 
>             __ __
> 
>             J3A081M is a javacard device from NXP____
> 
>             __ __
> 
>             The micocontroller should be the P5CD081V1A, which comprises
>             a crypto processor____
> 
> 
>         There's a number of these from a number of vendors.  I'd
>         actually look at the A7xxx series of chips as they're designed
>         to be embeddable.  I've become a big fan of javacard style
>         solutions over the years.
> 
>         In any event, the number of relatively inexpensive public key
>         crypto accelerator chips (e.g. googl for "secure authentication
>         chips") is greater than zero and continues to climb.  And for
>         not a lot of money.  Estimating what from prices on Digikey, I'd
>         think something less than $.50 for Quantity large as of today
>         and half that or less in 1-2 years as its gets bundled into the
>         "Swiss Army Knife" style of process (e.g. support for wireless
>         900mhz plus ... plus ... plus ... plus security...) (google for
>         ____
>             __ __
>             The performances with the curve secp192r1 are the following
>             (for ECDSA + SHA1)____
> 
>             __ __
> 
>             Sign    = 40ms +  nb_bloc_512bits x 3.5 ms____
> 
>             Verify  = 60ms  + nb_bloc_512bits x 3,5 ms____
> 
>             __ __
> 
>             __ __
> 
>             By the way this chip has enough crypto ressouces for
>             processing TLS or DTLS____
> 
>             __ __
> 
>             Rgs____
> 
>             __ __
> 
>             Pascal____
> 
>             __ __
> 
>             ___________________________________________________
> 
>             Ace mailing list____
> 
>             [email-masked] <mailto:[email-masked]>____
> 
>             https://www.ietf.org/mailman/listinfo/ace____
> 
>         __ __
> 
> 
>         https://www.ietf.org/mailman/listinfo/ace____
> 
>     __ __
> 
>     ________________________________________________________ The
>     contents of this e-mail and any attachments are confidential to the
>     intended recipient. They may not be disclosed to or used by or
>     copied in any way by anyone other than the intended recipient. If
>     this e-mail is received in error, please immediately notify the
>     sender and delete the e-mail and attached documents. Please note
>     that neither the sender nor the sender's company accept any
>     responsibility for viruses and it is your responsibility to scan or
>     otherwise check this e-mail and any attachments.
> 
> 
> 
>

---

From: Pascal Urien <[email-masked]>
Date: Mon, 25 Jul 2016 20:45:06 +0200

Hi Hannes

> 60ms + the hash needed over the actual message (which is 3.5 msec for a
That 's right. A few ms per bloc is a common figure

> this an issue with this smart card? What is your experience there?

I have not a lot of data for ECC processing in smartcards, because of the
difficulty in finding this type of component with ECC support.

Neverless ECC is usually faster than RSA

An other issue is to estimate the cost of countermeasures; computing
performance is not always the first cobjective of crypto processors
according to the EAL evaluation needed

Let's say there is a balance between the sign/verify cost and the function
computing

Rgs

---

From: Pascal Urien <[email-masked]>
Date: Fri, 29 Jul 2016 15:42:39 +0200

This data sheet from NXP gives many figures for coprocessor processing
 performances (including ECC 192 bits)

http://www.nxp.com/documents/line_card/75016728.pdf

Rgs