Modern application-specific integrated circuits (ASICs) integrate greater and greater security and data protection functionality into the hardware (HW). The integrated functionality provides more reliable and more efficient hardware security for both conventional “Data At-Rest” and conventional “Data In-Flight” protection.
Data storage systems are moving to distributed storage models that are based on storage networking. The move has an impact for enterprise data protection: the distributed models increase the vulnerability of stored data (i.e., Data At-Rest) to various attacks, both external and internal and both malicious and accidental. For Internet traffic and other moving data (i.e., Data In-Flight), the move provides such protection as sender and recipient mutual authentication, key exchange, data confidentiality, authenticated encryption (which is a type of encryption/decryption that additionally providing a way to check data integrity and authenticity) and replay protection.
In contemporary applications, the speed/throughput of the traversing data is up to 10 Gb/s (gigabits per second) and beyond. For some storage applications, the speed/throughput of the traversing data is even 10× higher: up to 100 Gb/s and beyond. The high speeds alone make security support of the data in software (SW) almost infeasible as far as security transformations are usually incorporated into the main data path and appear as bottlenecks from efficiency and performance standpoints.
Many cryptographic protocols use an encryption process and message authentication and data integrity services independently with each process using an independent key. To speed up overall computations, new cryptographic modes that combine and provide both crypto services using a single “combined” mode were proposed and became accepted by both the National Institute of Standards and Technology (NIST) and the Institute of Electrical and Electronics Engineering (IEEE) and other technical professional organizations and committees working in network and data storage security areas.
To prevent data lost and breach, IEEE P1619 “Standard Architecture for Encrypted Shared Storage Media” suggests using the XTS-AES (Advanced Encryption Standard) (XOR-Encrypt-XOR (XEX)-based Tweaked Electronic Code Book (ECB) mode with Cipher Text Stealing (CTS)). The P1619.1 “Standard for Authenticated Encryption with Length Expansion for Storage Devices” uses the Galois/Counter mode (GCM), Counter mode (CTR) with Cipher-Block Chaining (CBC)-Message Authentication Code (MAC) (CCM) and other cryptographic processes. Both drafts are now accepted standards: IEEE Std. 1619-2007 and IEEE Std. 1619.1-2007.
Among the new AES-based modes is the NIST approved (see NIST Special Publication SP800-38D defining Galois/Counter Mode (GCM) and Galois Message Authentication Code (GMAC)) GCM mode and IEEE P1619 legacy mode Liskov, Rivest, and Wagner (LRW), that both use Galois Field multiplication for processing 128-bit blocks of data. Besides memory and storage applications, GCM-AES is becoming more widely used in various Internet security protocols and was suggested/submitted as an Internet-draft to the Internet Engineering Task Force (IEFT) to use in the Secure RTP (SRTP) protocol (see Internet-Draft for GCM in Secure RTP (SRTP)), MACsec (see IEEE 802.1AE), Internet Key exchange version 2 (IKEv2), and in the IPsec (see RFC 4106 and RFC 4543).
A feature of the GCM mode is that the message authentication is performed in parallel with encryption/decryption of the main data payload by applying multiplication in a Galois Field (GF). Multiplications in finite fields have been used for fast (i.e., insecure) message hash computations. To make such computed massage hash values secure, application of the GCM GHASH process adds a pseudorandom vector, a so called “whitening” vector, at the end. The pseudorandom vector is generated by encrypting a preset value (i.e., Initialization Vector IV) with a secret AES key (i.e., vector W). Use of the GF multiplier for Message Authentication Code (MAC) computation permits higher throughput than the authentication process for computing a conventional MAC. The conventional MAC processes use slower chaining modes, like AES-CBC, or use a separate stand-alone secure hash process from the Secure Hash Algorithm (SHA) family.