Getting Started

The Arm CryptoCell-700 family is an embedded security platform for high performance SoCs. It offers a deep level of security for mobile, DTV and STB. It enables secure machine learning solutions such as face ID and object detection.  The CryptoCell-700 family can protect against a broad set of threats (including ones involving physical tampering with the device) while, at the same time, addressing the challenging requirements for increased system complexity, high performance, low power consumption and small footprint.

The multi-layered hardware and middleware architecture combines hardware accelerators, root-of-trust control hardware with a rich layer of security middleware and software tools for the IC and device production process. 

The CryptoCell-700 family takes cryptographic instructions from the System Control Processor (SCP) during boot, or from software applications – either trusted (running within the TEE) or normal - running on the main application processor(s). It processes the data and puts the results back into system or internal memory. 


Specifications

  CryptoCell-712 CryptoCell-703 CryptoCell-713
Platform security services (Secure Boot, Secure debug, etc.) Yes
Yes
FIPS 140-2 certifiable symmetric crypto (AES, DES, SHA) Yes
Yes
FIPS 140-2 certifiable asymmetric crypto (RSA, ECDSA, DH, ECDH) Yes
Yes
GM/T 0028-2014 certifiable crypto (SM2, SM3, SM4)
Yes Yes
Optional side channel attack countermeasures
Yes Yes 

Arm TrustZone CryptoCell-712 FIPS 140-2 Non-Proprietary Security Policy

CoreLink Interconnect Diagram.

CryptoCell-700 Performance

  28nm HPC
 16nm FFp
 Frequency  400MHz 500MHz
 Area  0.222mm2 
0.095mm2 
 AES Throughput  560MB/s  700MB/s


Crypto Acceleration

  • AES Engine (REE and TEE)
    • Confidentiality modes: ECB, CBC, CBC-CTS, OFB and CTR
    • Storage modes: ESSIV, BitLocker and XTS
    • Message Authentication Codes (MAC):  CBC-MAC, CMAC and XCBC-MAC
    • Authenticated Encryption with Associated Data (AEAD) modes:  CCM and GCM key sizes of 128, 192 and 256 bits
    • Software and Hardware introduced keys
    • Fast (20 SBOXes) core
  • DES/TDES Engine (REE and TEE)
    • DES: ECB and CBC modes
    • TDES: EDE and DED modes
  • HASH Engine (REE and TEE)
    • SHA-1, SHA-256, SHA-384, SHA-512 and MD5 modes, as well as HMAC
    • Automatic padding
  • PKA Engine (TEE Access only)
    • Public-key crypto based on the Discrete Logarithm problem, the Elliptic Curve Discrete Logarithm problem, and the Integer Factorization problem.
    • Supports integers in the range of 128 bits and 4K bits in size (in steps of 32 bits) 
  • KDF (TEE Access Only)
    • ASN.1 encoding (HASH based)
    • KDF1 (HASH based)
    • KDF2 (HASH based)
    • AES-CMAC-CTR based KDF

Security Resources

  • Security Lifecycle
    Enforcement of different security policies based on the affiliation of the SoC to “real world” entities (e.g.: Chip Manufacturer, OEM, etc.)
  • Roots of Trust Management
    Exclusive management of on-die Non-Volatile Memory, where the following items are stored:
    • A Device unique Secret Key
    • A Provisioning renewability secret
    • A Signature of the Public code distribution Key
    • Indexes  of the minimal Trusted and non-trusted SW versions
    • A Code-decryption key 
  • Secure Code Loading
    Code trustworthiness achieved by authenticity and integrity checks (certificates based) ran on the loaded software images. 
  • Secure Debug
    Debug trustworthiness achieved by authenticity checks of the debugging entity.
  • Random Number Generator
    A Random Number Generator comprised of a:
    • True Random Number Generator, providing some assured level of entropy (analyzed by Entropy Estimation logic).
    • Deterministic Random Bit Generator (DRBG) ‘seeded’ by the TRNG. 
  • Secure Timer
    A permanently powered hardware timer that provides the system the elapsed time in msec granularity. 
  • Secure Provisioning
    Secure the delivery of sensitive assets even when communicated over "hostile" environment (can be untrusted production/assembly floor or even the internet).
  • RPMB Key Management
    Per-Boot RPMB key derivation by a deterministic KDF (based on the Device unique Secret Key).
  • FIPS 140-2

Productization Tools

Get support

Arm support

Arm training courses and on-site system-design advisory services enable licensees to realize maximum system performance with lowest risk and fastest time-to-market.

Arm training courses  Open a support case

Want to know more about Security on Arm?

Learn more