Overview

The Arm CryptoCell-700 family is an embedded security platform for high performance SoCs. It offers an outstanding level of security, targeting a broad set of threats (including ones involving physical tampering with the device), while, at the same time, addressing the challenging requirements for increased system complexity, high performance, low power consumption and small footprint.

The multi-layered hardware and middleware architecture combines hardware accelerators, root-of-trust control hardware with a rich layer of security middleware and software tools for the IC and device production process. 

The CryptoCell-700 family takes cryptographic instructions from the System control Processor (SCP) during Boot, or from SW applications – either trusted (running within the TEE) or normal - running on the main application processor(s). It processes the data and puts the results back into system or internal memory. 

CryptoCell-700 Performance

  28nm HPC
 16nm FFp
 Frequency  400MHz 500MHz
 Area  0.222mm2 
0.095mm2 
 AES Throughput  560MB/s  700MB/s

Crypto Acceleration

  • AES Engine (REE and TEE)

    ·Confidentiality modes: ECB, CBC, CBC-CTS, OFB and CTR
    ·Storage modes: ESSIV, BitLocker and XTS
    ·Message Authentication Codes (MAC):  CBC-MAC, CMAC and XCBC-MAC
    ·Authenticated Encryption with Associated Data (AEAD) modes:  CCM and GCM key sizes of 128, 192 and 256 bits
    ·SW and HW introduced keys
    ·Fast (20 SBOXes) core

  • DES/TDES Engine (REE and TEE)
    ·DES: ECB and CBC modes
    ·TDES: EDE and DED modes

  • HASH Engine (REE and TEE)
    ·SHA-1, SHA-256, SHA-384, SHA-512 and MD5 modes, as well as HMAC
    ·Automatic padding

  • PKA Engine (TEE Access only)
    ·Public-key crypto based on the Discrete Logarithm problem, the Elliptic Curve Discrete Logarithm problem, and the Integer Factorization problem.
    ·Supports integers in the range of 128 bits and 4K bits in size (in steps of 32 bits) 
  • KDF (TEE Access Only)
    ·ASN.1 encoding (HASH based)
    ·KDF1 (HASH based)
    ·KDF2 (HASH based)
    ·AES-CMAC-CTR based KDF

Security Resources

  • Security Lifecycle
    ·Enforcement of different security policies based on the affiliation of the SoC to “real world” entities (e.g.: Chip Manufacturer, OEM, etc.)

  • Roots of Trust Management
    Exclusive management of on-die Non-Volatile Memory, where the following items are stored:
    ·A Device unique Secret Key
    ·A Provisioning renewability secret
    ·A Signature of the Public code distribution Key
    ·Indexes  of the minimal Trusted and non-trusted SW versions
    ·A Code-decryption key 

  • Secure Code Loading
    Code trustworthiness achieved by authenticity and integrity checks (certificates based) ran on the loaded SW images 

  • Secure Debug
    Debug trustworthiness achieved by authenticity checks of the debugging entity

  • Random Number Generator
    A Random Number Generator comprised of a:
    ·True Random Number Generator, providing some assured level of entropy (analyzed by Entropy Estimation logic)
    ·Deterministic Random Bit Generator (DRBG) ‘seeded’ by the TRNG. 

  • Secure Timer
    A permanently powered hardware timer that provides the system the elapsed time in msec granularity 

  • Secure Provisioning
    Secure the delivery of sensitive assets even when communicated over "hostile" environment (can be untrusted production/assembly floor or even the internet).
  • RPMB Key Management
    Per-Boot RPMB key derivation by a deterministic KDF (based on the Device unique Secret Key)

  • FIPS 140-2 L1
    A FIPS 140-2 L1 compliant mode of operation (for TEE and REE)
    Certification in progress (updated May 2016)

Productization Tools

Specifications

  CryptoCell-701  CryptoCell-710  CryptoCell-712 
Crypto Accelerators   Yes  Yes
 Yes
Security Resources    Yes
 Yes
Productization Tools  Yes
 Yes
 Yes
 Disk Encryption Enhancement      Yes


Want to know more about Security on Arm?

Learn more