Programmable Logic DesignLine Blog

Draft of FIPS 140-3 released

Dylan McGrath

12/16/2009 2:39 PM EST

Last week, in his FPGA Gurus blog, Loring Wirbel had an excellent piece about cryptographic security in the world of FPGAs. As he points out, this is becoming an interesting area in light of the growing use of FPGAs in applications that adhere to the National Institute of Standards and Technology (NIST)'s FIPS 140 U.S. government computer security standards and an emerging understanding of the vulnerabilities to devices of attacks that make use of power analysis.

Like Loring, I recently spoke with Benjamin Jun, vice president of Cryptography Research Inc., which provides tools, technology and services to help customers secure their chips. Jun explained that he and his company are on a mission to educate users of FPGAs and other devices about the dangers associated with simple power analysis (SPA) and differential power analysis (DPA) attacks, particularly since the next revision of FIPS 140 will require resistance to these attacks.

Benjamin Jun
Cryptography Research
According to Cryptography Research, DPA is a form of attack that involves monitoring the fluctuating electrical power consumption of a target device and then using advanced statistical methods to derive cryptographic keys and other secrets. The company says it has a portfolio of more than 50 patents covering countermeasures to these types of attacks and says billions of chips incorporate its technologies in this and other security areas. Last month, the company announced that it licensed DPA countermeasure technology to STMicroelectronics for protecting the company's tamper-resistant chips against attacks.

Jun tipped me off that last week NIST released the second public draft of the FIPS 140-3 security requirements for tamper resistant devices, which will eventually supersede FIPS 140-2. Jun said the new draft requires SPA and DPA resistance at levels 3 and 4 of the specification. Under the FIPS 140-2 standard, last updated in 2002, SPA and DPA resistance was optional, but not required, Jun said. He said all other relevant standards worldwide have already added SPA and DPA resistance.

Jun said the publication of the second draft of FIPS 140-3 would be advantageous for companies making secure devices, providing them insight into the requirements and definitions to help them define their product roadmaps. The proposed standard will make the U.S. more up-to-date with other security standards worldwide, he said.

"I think Christmas came early for the U.S. security industry," Jun said.

According to NIST, the second draft of FIPS 140-3 contains several material differences from the previous draft. NIST is asking for public comments to the revised draft. Comments are due by March 11, 2010.



Please sign in to post comment

Navigate to related information

Datasheets.com Parts Search

185 million searchable parts
(please enter a part number or hit search to begin)
Jobs sponsored by

Feedback Form