A comparative analysis of VLSI trusted virtual sensors

Depósito de investigación de la Universidad de Sevilla https://idus.us.es/ “This is an Accepted Manuscript of an article published by Elsevier in: MICROPROCESSORS AND MICROSYSTEMS on 2018, available at: https://doi.org/10.1016/j.micpro.2018.05.016” A COMPARATIVE ANALYSIS OF VLSI TRUSTED VIRTUAL SENSORS m.c.mart´ inez-rodr´ iguez,p.brox,i.baturone Abstract This paper analyzes three cryptographic modules suitable for digital designs of trusted virtual sensors into integrated circuits, using 90-nm CMOS technology. One of them, based on the keyed-hash message authentication code (HMAC) standard employing a PHOTON-80/20/16 lightweight hash function, ensures integrity and authentication of the virtual measurement. The other two, based on CAESAR (the Competition for Authenticated Encryption: Security, Applicability, and Robustness) third-round candidates AEGIS-128 and ASCON-128, ensure also confidentiality. The cryptographic key required is not stored in the sensor but recovered in a configuration operation mode from non-sensitive data stored in the non-volatile memory of the sensor and from the start-up values of the sensor SRAM acting as a Physical Unclonable Function (PUF), thus ensuring that the sensor is not counterfeit. The start-up values of the SRAM are also employed in the configuration operation mode to generate the seed of the nonces that make sensor outputs different and, hence, resistant to replay attacks. The configuration operation mode is slower if using CAESAR candidates because the cryptographic key and nonce have 128 bits instead of the 60 bits of the key and 32 bits of the nonce in HMAC. Configuration takes 416.8microseconds working at 50 MHz using HMAC and 426.2microseconds using CAESAR candidates. In the other side, the trusted sensing mode is much faster with CAESAR candidates with similar power consumption. Trusted sensing takes 212.62 microseconds at 50 MHz using HMAC, 0.72 microseconds using ASCON, and 0.42 microseconds using AEGIS. AEGIS allows the fastest trusted measurements at the cost of more silicon area, 4.4times more area than HMAC and 5.4times more than ASCON. ASCON allows fast measurements with the smallest area occupation. The module implementing ASCON occupies 0.026 mm2 in a 90-nm CMOS technology. 1 introduction Virtual sensors estimate the value of a variable that is very difficult or costly to measure physically from others that can be measured easily with low-cost commercial sensors. The estimation usually makes use of models obtained with neural networks, fuzzy logic, or other types of approximation techniques such as piecewise affine (PWA) approaches. Among the latter, simplicial PWA (PWAS) functions were first employed for virtual sensors in [ 23 ] and, later, hyper-rectangular (PWAR) functions were used for their further simplicity in [ 15 ]. PWAR-based models partition the domain of the input variables (those easily measured) into hyper-rectangles and estimate the output (the virtual measurement) as an affine function whose parameters 1 04812 15 0 4 8 12 −5 −2.5 0 2.5 5 x1 x2 fP WAR Figure 1: Bi-dimensional example of a PWAR function and its hyper-rectangular partition depend on the hyper-rectangle which the inputs belong to [ 8 ]. Figure 1 shows an example of a PWAR model that partitions a bi-dimensional input domain into 12 hyper-rectangles. Since the early 1980s, the use of virtual sensors has increased continuously in a wide number of applications [ 13 , 17 ]. Many virtual sensors are implemented as software. However, taking into account the big size of the sensor market size, CMOS Integrated Circuit (IC) solutions are very adequate to achieve a minimum unitary cost as well as high performance in terms of area, power and response time. Another advantage of CMOS ICs that implement PWAR virtual sensors is that their SRAMs (Static Random Access Memories) can be programmed to be employed in different applications. An algorithm was presented in [ 15 ] to find the best values of the programmable parameters given a set of empirical or simulated input-output data. Nowadays, virtual sensors are usually part of ubiquitous and distributed networks such as critical infrastructures. Hence, sensor security is becoming very important [ 25 ]. The receiver of the sensing data must trust in the data originated from the sensor. The way is to confirm that data have not been tampered with, altered or changed. Not only data integrity but also sensor integrity must be ensured. The reliability of the data should be ensured by authentication of their origin. Message authentication codes (MACs) are the usual constructions employed to ensure data integrity [ 21 ]. The MAC construction that has become more popular over the last decade is the HMAC. HMAC, standardized in [ 26 ], is an approach to implement MAC using a two-pass hash-based MAC that avoids the weakness of previous constructions. The problem with many existent HMACs is that their primary targets are high transmission rates of data with long key spaces, but do not pay so much attention to area or power consumption. This makes them not suitable for resource constrained scenarios like sensors, which have limited computational and memory capabilities. Lightweight cryptographic primitives should be employed. Specific lightweight hash functions based on sponge constructions have been proposed, as is the case of SPONGENT [ 7 ], Quark [ 5 ], and Photon families [ 12 , 9 ]. The latter one has been selected for the trusted virtual sensor analyzed herein [14]. There is also a growing interest in the use of lightweight cryptographic protocols for sensors so as to ensure that data transmitted are confidential, which is required by applications using sensitive information [ 16 , 22 ]. In these cases, not only message authentication but also message encryption is required. CAESAR competition is evaluating different authenticated encryption schemes that are fast in software and efficient in hardware [ 3 ]. The idea is to combine encryption and authentication into a single algorithm, called Authenticated Encryption, so as to obtain smaller area and power consumption compared to two separate algorithms. Among the CAESAR 2 candidates, AEGIS [ 27 , 15 ] and ASCON [ 1 , 10 ] have been selected for the trusted virtual sensor analyzed herein. AEGIS is based on the AES encryption round function while ASCON is based on sponge constructions like PHOTON. The usual way to ensure the integrity of a device (in this case a sensor) is to check that the sensor knows a cryptographic key. However if the key is stored in the sensor memory, it can be attacked [ 24 ] and a counterfeit sensor can be fabricated. The problem of counterfeit chips is so significant that the Semiconductor Industry Association (SIA) maintains an anti-counterfeiting task force. A solution is the use of Physical Unclonable Functions inside the sensor hardware, which ensures that the sensor has a unique inherent identity given, in general, by the variability of its manufacturing process [ 11 ]. Among the wide number of PUFs proposed in the literature, SRAM-based PUFs are selected in this paper since the CMOS sensor requires SRAMs for its virtual sensing functionality. The start-up values of the SRAM cells are employed to generate the random seeds required by the cryptographic primitives as well as to recover the cryptographic key [ 6 ]. The key is not stored anywhere but recovered whenever needed by using a Helper Data Algorithm that employs non-sensitive data (known as Helper Data) and the response of the PUF (in this case the start-up values of SRAM cells) [ 11 ]. An impostor sensor is not able to provide a similar PUF response and, hence, is unable to recover the key while the genuine sensor is able to prove its authenticity against aging and variations of the operation conditions, namely, temperature and power supply voltage [15]. This paper analyzes three cryptographic modules suitable for trusted virtual sensors into CMOS integrated circuits. One of them, based on a lightweight HMAC construction, ensures integrity and authentication. The other two, based on CAESAR third-round candidates, ensure also confidentiality. To the best of authors’ knowledge, no other work has addressed the comparison of such trusted virtual sensors into ICs. The paper is organized as follows. Firstly, the three cryptographic modules are briefly described in Section 2. Their integration in a trusted virtual sensor is presented in Section 3, describing the architecture of the resulting sensor as well as its behavioral modes related to configuration and virtual sensing. Then, Section 4compares the three modules implemented in a 90-nm CMOS technology in terms of area and power consumption as well as sensor memory requirements and timing performance. Finally, conclusions are given in Section 5. 2 description of cryptographic modules A virtual sensor provides one output variable that is virtually measured. The inclusion of cryptographic primitives allows ensuring the integrity, authenticity, and confidentiality of the virtual measurement achieving a trusted virtual sensor. Several options have been evaluated to address this goal. In order to detect possible manipulations of measurements, a first approach includes a module to solve the problem of data integrity and authenticity based on MACs. The second approach to increase the level of security is the use of authenticated ciphers to ensure not only the integrity of the provided virtual measurement but also to encrypt it at the same time. Two authenticated encryption algorithms, which are third-round candidates of the CAESAR competition, have been considered. The three alternatives were implemented in a 90-nm CMOS technology, as part of a virtual sensor 3 integrated circuit, to compare their performance. Their features are briefly summarized in the following. 2.1 Hash-based Message Authentication Code (HMAC) based on the Photon hash function HMAC is a specific type of MAC involving a cryptographic hash function ( hash ) and a secret cryptographic key . Simultaneously, it verifies both the data integrity and the authentication of a message. The HMAC inputs are a cryptographic key and the message to be authenticated denoted as text . The HMAC provides an authentication code as follows: (1)HMAC(key,text) = hash Ko⊕opad|| hash Ko⊕ipadktext where: •key is the secret key •text is the message to be authenticated •hash is a cryptographic hash function •Ko is another secret key, derived from key , to have a multiple of the hash input block size •⊕denotes exclusive or (XOR) •ipad and opad are, respectively, the inner and outer pads given by the standard •|| denotes concatenation If the virtual sensor only provides one output variable ( y ), the input message of HMAC will be the virtual measurement ( y ) and a number called nonce, which is attached to y: (2)text =nonce || y The nonce is an arbitrary number that can only be used once. The use of nonce helps to improve the security since it ensures that old communications cannot be reused in replay attacks. This is specially important since the virtual measurement, y, can be the same for different messages. Hash functions, which implement compression functions, can process an arbitrary-length message and produce a fixed-length output. This is achieved by segmenting the input into a series of blocks of equal size that are processed sequentially. The hash value of the input message is then defined as the output of the last iteration of the compression function. There are two general types: dedicated and block cipher-based hash functions [ 21 ]. Dedicated hash functions are algorithms that have been custom designed such as MD4, MD5, RIPEMD and SHA family. The alternative is to construct hash functions using block cipher chaining techniques using the Matyas-Meyer-Oseas construction [21]. Among dedicated hash functions, sponge constructions are very popular since the winner of the SHA-3contest of the National Institute of Standards and Technology (NIST) uses them. The sponge construction has an internal state S of t bits, composed of the c -bit capacity and the r -bit bitrate ( t = c + r ). First, all the bits of the state are initialized to zero. The input message is 4 padded and cut into r -bit blocks. Then, it proceeds in two phases: the absorbing phase followed by the squeezing phase. In these phases the first r bits of the state and the remaining t-r bits or capacity c, are treated differently. During the absorbing phase, the message blocks ( m0 , m1 , ..., ma ) are XORed with the first r bits of the state, interleaved by applying the permutation P . Once all message blocks have been handled by this absorbing phase, the sponge construction switches to the squeezing phase. The sponge construction successively outputs the final hash value ( z0 , z1 , ..., zb ) by extracting r bits from the bitrate part of the internal state and then applying the permutation P on it. An extended version of the sponge framework allows a different number of r0 bits extracted during each iteration of the squeezing process. The sponge construction is illustrated in Figure 2. Specific lightweight hash functions based on sponge constructions have been proposed for hardware implementation into tiny devices, such as the PHOTON family [ 12 ]. The HMAC is implemented with a PHOTON- 80/20/16. The input block size of this hash function is 20 bits. Hence, the message to authenticate must be divided into blocks of 20 bits. During absorbing steps, each 20-bit input block is XORed with 20 bits of the internal state of the hash function. The 80-bit hash output is built by concatenating five successive outputs of 16 bits obtaining after each squeezing phase. PHOTON-80/20/16 has an internal state of 100 bits ( 80 out of these 100 bits are never affected by the input blocks and never output the function; they correspond to the capacity of the function). After absorbing a block, a permutation operation is performed to the internal state, represented as a 5×5 matrix of 4-bit cells. The permutation operation is composed of four operations, AddConstant, Sub-Cell, ShiftRows and MixColumnsSerial, which are repeated 12 times, changing the values of the 4-bit cells. In the designed HMAC, these operations are implemented serially, following the proposal in [12], so as to obtain a module with low area and power consumption. 2.2AEGIS Authenticated Cipher There are two main approaches to authenticate and encrypt a message. One approach is to apply the encryption and authentication separately. The plaintext is encrypted with a block cipher or stream cipher, and then, a MAC algorithm is used to authenticate the ciphertext. Another approach is an c!bits! r!bits! p! m0! p! m1! p!p! ma! !! STATE! ABSORBING) p! z0! p! c’!bits! r’!bits! SQUEEZING) zb! …! …! …! …! pad! Message& Figure 2: The sponge construction implemented by the hash function 5 authenticated encryption algorithm that shares the computation of both tasks authentication and encryption. There are three approaches to design an integrated authentication encryption algorithm. The first approach is to use a block cipher in a special mode, for instance, CCM [ 18 ] and GCM [ 19 ] are operation modes for authenticated encryption according to NIST recommendation. The second approach is to use a stream cipher dividing keystream into two parts, one part for encryption and another part for authentication. An example of this approach is Grain-128a [ 4 ]. The third approach is to design dedicated authenticated encryption algorithms. AEGIS is a dedicated authenticated algorithm that belongs to the third type of approaches [ 27 ]. It is constructed from the AES encryption round function, providing the advantage of a computational cost about half that of AES. If the nonce is not reused (which should be the case for a true nonce ), AEGIS provides a high security since the state and the key can only be recovered by exhaustive search. AEGIS algorithm takes the cryptographic key , a nonce , and a plaintex, in this case the virtual measurement, y , and provides a ciphertext, C , and an authentication tag. [C,tag] = AEGIS(key,nonce,y) (3) There are three variations of the algorithm. AEGIS-128 processes a 16- byte message block with five AES round functions in parallel. It consumes the least resources, but it is the slowest for large messages. AEGIS-128L processes a 32-byte message block with eight AES round functions in parallel. In terms of resource consumption, it is the biggest version, but it is also the fastest. Finally, AEGIS-256 processes a 32-byte message block with six AES round functions. Then, it offers an intermediate performance in terms of resource consumption and time response. Since the virtual measurement ( y ) is smaller or equal to 128-bits, only one 16-byte state has to be processed. Hence, AEGIS-128 is more adequate in this application, since it is as fast as AEGIS-128L, using less resources. AEGIS-128 uses a 128-bit key and a 128-bit nonce . The algorithm is based on the function StateUpdate(Si,mi) described in Algorithm 1where the function AESRound(A) is the AES encryption round function being A the state. The main operations in the AES round are SubBytes operation, ShiftRows and AES-MixColumns. The state update function of AEGIS is illustrated in Figure 3. AES Round Si,4 Si+1,4 AES Round Si,0 Si+1,0 AES Round Si,3 Si+1,3 AES Round Si,2 Si+1,2 AES Round Si,1 Si+1,1 mi Figure 3: The state Update function of AEGIS-128 6 Algorithm 1State Update function. 1:function StateUpdate(Si,mi) 2:Si+1,0 =AESRound(Si,4)⊕Si,0 ⊕mi 3:Si+1,1 =AESRound(Si,0)⊕Si,1 4:Si+1,2 =AESRound(Si,1)⊕Si,2 5:Si+1,3 =AESRound(Si,2)⊕Si,3 6:Si+1,4 =AESRound(Si,3)⊕Si,4 7:return Si+1 8:end function Algorithm 2Pseudo-code of AEGIS algorithm. Require: key, nonce, y 1:S−10,0 = key ⊕nonce 2:S−10,1 = constant1 3:S−10,2 = constant2 4:S−10,3 = key ⊕constant1 5:S−10,4 = key ⊕constant2 6:for i=−10 : −1do 7:if iis odd then 8:mi= key ⊕nonce 9:else 10:mi= key 11:end if 12:Si+1 =StateUpdate(Si,mi) 13:end for 14:Ct=y⊕S0,1 ⊕S0,4 ⊕(S0,2&S0,3) 15:S1=StateUpdate(S0,y) 16:tmp =S1,3 ⊕128 17:for i= 1 : 6 do 18:Si+1 =StateUpdate(Si,tmp) 19:end for 20:tag =S7,0 ⊕S7,1 ⊕S7,2 ⊕S7,3 ⊕S7,3 21:return Ct, tag The pseudo-code of the AEGIS-128 applied to the virtual measurement is described in Algorithm 2. The main steps of the algorithm are to initialize the state (line 2.1), process the nonce (line 2.6), process the measurement ( y ), and generate the ciphertext (line 2.14), and generate the authentication tag (line 2.20). constant1and constant2are two 128-bit constants fixed by the algorithm. The designed AEGIS followed the VHDL code provided in [2]. 7 2.3ASCON Authenticated Cipher ASCON is a family of authenticated encryption designs [ 1 ]. The inputs for the authenticated encryption procedure are the plaintext, that is, the virtual measurement ( y ) in this case, a secret key , and a nonce . The outputs are the authenticated ciphertext C, and an authentication tag: [C,tag] = ASCON(y,key,nonce) (4) The operation mode of ASCON is based on duplex sponge modes like MonkeyDuplex, but using a stronger keyed initialization and a keyed finalization function. During the initialization, the sponge state is obtained by concatenating an Initialization Vector (IV) , the key , and the nonce . The permutation functions ( pa , pb ) operate on the state with a rate of r bits and a capacity c . There is an initialization and finalization permutation ( pa ) with a rounds, and intermediate permutations ( pb ) with b rounds. Both permutations differ only in the number of rounds that are tunable security parameters. The permutations iteratively apply a Substitution-Permutation Network (SPN)-based round transformation. Plaintext is absorbing during intermediate rounds. The recommended parameters for ASCON are 128 bits for the key and nonce ,64 bits for the rate r ,320 bits for the state, and then, a capacity of c= 320 −r= 256 bits. The selected numbers for the rounds are 12 for permutation paand 6for permutation pb. Figure 4illustrates the encryption operation in ASCON. The 320-bit initial state of ASCON is formed by an IV specified by the algorithm, the key, and the nonce . In the initialization, 12 rounds of the permutation are applied to the initial state, followed by an XOR with the key . After initialization is finished, a single bit constant is XORed with the internal state. The padding process is applied to the plaintext (virtual measurement y ) since ASCON has a message block size of r bits. The padding process appends a single 1and the smallest number of 0s to the plaintext, obtaining a length of the padded plaintext that is a multiple of r bits and then, it is split into tblocks of rbits. During the encryption, each block of the virtual measurement ( y1 , y2 , ..., yt ) is XORed with the first r bits of the state, followed by the extraction of one ciphertext block Ci with ( i= 1, 2, ..., t ). For each block except the last one, the internal state is transformed by the permutation using 6rounds. In the finalization, the key is XORed with the state and then, it is transformed by r!bits! !! IV)))key)))nonce) pa! c!bits! INITIALIZATION) 0*&&key& pad! Plaintext&(y)& y1!yt01! C1) 0*!!1! …! …! Ct81) yt! Ct)key&&0*& key& tag& pb!pb!pa! FINALIZATION) r! c! Figure 4: Encryption operation in ASCON 8 Table 3shows the area and power consumption during trusted sensing mode of the different cryptographic modules provided by Design Vision tool from Synopsys. In terms of area, ASCON offers the most competitive result. The simulations estimate a similar power consumption working at a frequency of 50MHz. Table 3also shows the clock cycles required by each cryptographic module during trusted sensing module. In terms of speed, AEGIS offers the most competitive result. Table 3: Silicon area of cryptographic modules and their power consumption and required clock cycles during trusted sensing mode Area (mm2) Power (mW) @50MHz Nclk HMAC 0.032 0.69 10620 AEGIS 0.140 0.77 20 ASCON 0.026 0.92 35 5 conclusion The third-round candidates AEGIS-128 and ASCON-128 of the Competition for Authenticated Encryption: Security, Applicability, and Robustness (CAESAR) are very well suited to design trusted virtual sensors into CMOS integrated circuits. They make the sensor ensure integrity, authenticity and confidentiality of the measurements at very low cost in area occupation, power consumption and clock cycles of processing time. They offer much better performance than a solution based on the standard Keyed- Hash Message Authentication Code (HMAC) that uses the lightweight hash function PHOTON 20/80/16, which ensures integrity and authenticity but not confidentiality. Considering a 90-nm CMOS technology, ASCON-128 is the smallest module (it occupies 0.026 mm2 , HMAC occupies 0.032 mm2 , and AEGIS occupies 0.140 mm2 ). In terms of trusted measurement time, AEGIS-128 allows the fastest response (0.42 microseconds using AEGIS, 0.72 microseconds using ASCON, and 212.62 microseconds using HMAC, all considering an operation frequency of 50 MHz). Since the key and nonce required by these cryptographic modules can be provided by exploiting the uniqueness and randomness of the start-up values of the static random access memory (SRAM) inside the virtual sensor, the sensor is also ensured to be non-counterfeit. acknowledgment This work was supported in part by TEC2014-57971-R project from Ministerio de Econom ´ ıa, Industria y Competitividad of the Spanish Government (with support from the P.O. FEDER of European Union) and 201750E010 (HWSEEDS) project from CSIC. M.C. Mart ´ ınez-Rodr ´ ıguez was supported by FPI fellowship program for Students from Spanish Government. The work of P. Brox was supported by V Plan Propio de Investigaci ´ on through the University of Seville, Seville, Spain. references [1] ASCON: A family of authenticated encryption algorithms. 15 [2] Athena: Automated tools for hardware evaluation. [3] Cryptographic CAESAR competitions. [4] M. ˚ Agren, M. Hell, T. Johansson, and W. Meier. Grain-128a: A new version of grain-128 with optional authentication. International Journal of Wireless and Mobile Computing,5(1):48–59,2011. cited By 50. [5] J. P. Aumasson, L. Henzen, W. Meier, and M. Naya-Plasencia. Quark: A lightweight hash. Journal of Cryptology,26(2):313–339, Apr 2013. [6] I. Baturone, M. A. Prada-Delgado, and S. Eiroa. Improved generation of identifiers, secret keys, and random numbers from SRAMs. IEEE Transactions on Information Forensics and Security,10(12):2653–2668,12 2015. [7] Andrey Bogdanov, Miroslav Kne ˇ zevi ´ c, Gregor Leander, Deniz Toz, Kerem Varıcı, and Ingrid Verbauwhede. spongent: A lightweight hash function. In Bart Preneel and Tsuyoshi Takagi, editors, Cryptographic Hardware and Embedded Systems – CHES 2011, pages 312–325, Berlin, Heidelberg, 2011. Springer Berlin Heidelberg. [8] F. Comashi, B. A. G. Genuit, A. Oliveri, W. P. M. H. Heemels, and M. Storace. FPGA implementations of piecewise affine functions based on multi-resolution hyperrectangular partitions. IEEE Transactionis on Circuits and Systems I,59(12):2920–2933,12 2012. [9] S. Eiroa and I. Baturone. FPGA implementation and DPA resistance analysis of a lightweight HMAC construction based on PHOTON hash family. In 23rd International Conference on Field programmable Logic and Applications, pages 1–4,9 2013. [10] Hannes Gross, Erich Wenger, Christoph Dobraunig, and Christoph Ehrenh ¨ ofer. ASCON hardware implementations and side-channel evaluation. Microprocessors and Microsystems,52:470 –479,2017. [11] J. Guajardo, S. S. Kumar, G. Schrijen, and P. Tuyls. Fpga intrinsic pufs and their use for ip protection. In Pascal Paillier and Ingrid Verbauwhede, editors, Cryptographic Hardware and Embedded Systems - CHES 2007, pages 63–80, Berlin, Heidelberg, 2007. Springer Berlin Heidelberg. [12] J. Guo, T. Peyrin, and A. Poschmann. The PHOTON family of lightweight hash functions. In Advances in Cryptology-CRYPTO 2011, volume 6841 of Lecture Notes in Computer Science (LNCS), pages 229–239, 2011. [13] Haorong Li, Daihong Yu, and James E. Braun. A review of virtual sensing technology and application in building systems. HVAC&R Research,17(5):619–645,2011. [14] M. C. Mart ´ ınez-Rodr ´ ıguez, M.A. Prada-Delgado, P. Brox, and I. Baturone. CMOS digital design of a trusted virtual sensor. In NORCAS 2017,8 2017. [15] M.C. Mart ´ ınez-Rodr ´ ıguez, M.A. Prada-Delgado, P. Brox, and I. Baturone. VLSI design of trusted virtual sensors. Sensors (Switzerland),18(2), 2018. 16 [16] S. Meguerdichian and M. Potkonjak. Security primitives and protocols for ultra low power sensor systems. In 2011 IEEE SENSORS Proceedings, pages 1225–1227,10 2011. [17] J. E. Miranda-Vega, W. Flores-Fuentes, O. Sergiyenko, M. Rivas-L ´ opez, L. Lindner, J. C. Rodr ´ ıguez-Qui ˜ nonez, and D. Hern ´ andez-Balbuena. Optical cyber-physical system embedded on an FPGA for 3D measurement in structural health monitoring tasks. Microprocessors and Microsystems, 56:121 –133,2018. [18] National Institute of Standards and Technology. Recommendations for Block Cipher Modes of Operation:. The ccm mode for authentication and confidentiality. [19] National Institute of Standards and Technology. Recommendations for Block Cipher Modes of Operation:. Galois/counter mode (gcm) and gmac. [20] A. Oliveri, L. Cassottana, A. Laudani, F. Riganti Fulginei, G. Lozito, A. Salvini, and M. Storace. Two FPGA-oriented high speed irradiance virtual sensors for photovoltaic plants. IEEE Transactions on Industrial Informatics, PP(99):1–1,9 2015. [21] C. Paar and J. Pelzl. Understanding Cryptography: A Textbook for Students and Practitioners. Springer Berlin Heidelberg, 2009. [22] Olaf Pfeiffer. Implementing Scalable CAN Security with CANcrypt: Authentication and Encryption for CANopen, J1939 and other Controller Area Network or CAN FD Protocols. Embedded Systems Academy Inc., 2017. [23] T. Poggi, M. Rubagotti, A. Bemporad, and M. Storace. High-speed piecewise affine virtual sensors. IEEE Trans. on Industrial Electronics, 59(2):1228 –1237,2012. [24] D. Samyde, S. Skorobogatov, R. Anderson, and J. J. Quisquater. On a new way to read data from memory. In First International IEEE Security in Storage Workshop, 2002. Proceedings., pages 65–69, Dec 2002. [25] R. Santamarta. Go nuclear: Breaking radiation monitoring devices. In BlackHat USA 2017, Las Vegas,7 2017. [26] J. Turner. The keyed-hash message authentication code (HMAC), 2008. [27] Hongjun Wu and Bart Preneel. AEGIS: A fast authenticated encryption algorithm. In Tanja Lange, Kristin Lauter, and Petr Lison ˇ ek, editors, Selected Areas in Cryptography – SAC 2013:20th International Conference, Burnaby, BC, Canada, August 14-16,2013, Revised Selected Papers, pages 185–201, Berlin, Heidelberg, 2014. Springer Berlin Heidelberg. 17