Satellite communications are no longer as secure as assumed
Satellite links are often considered inherently secure due to their distance and specialized infrastructure. In reality, this assumption no longer holds.
Vendor:
Xiphera Ltd
Category:
IPsec / TLS
TLS 1.3 Client IP Core
XIP7131C is a compact 1 Intellectual Property (IP) core for TLS 1.3 client-side functionality.
Overview
XIP7131C is a compact 1 Intellectual Property (IP) core for TLS 1.3 client-side functionality. Transport Layer Security (TLS) is a cryptographic protocol, which provides communication security in computer networks and is used for securing a multitude of different applications ranging from casual Internet browsing to critical infrastructure communications. TLS 1.3 was published as RFC 8446 in August 2018, and it is the most recent version of the TLS standard and includes major modifications and security improvements compared to the earlier TLS versions.
XIP7131C provides a hardware-based security solution level required for mission-critical applications. XIP7131C is optimized for low-area footprint, and it is ideally suited for high-volume FPGA applications, for example industrial automation, energy distribution, and secure edge computing. While the IP core itself has been optimized for low FPGA resource usage, it is capable of encrypting and decrypting bulk transmission speeds in excess of 1 Gbps after the secure connection has been established. XIP7131C supports the TLS 1.3 handshakes for session establishment and the TLS 1.3 record protocol for bulk communication. The IP core implements all cryptographic computations and key management activities required for secure TLS connections with a server. Critical cryptographical computations and key management are both isolated inside the FPGA from the rest of the system, offering a very high level of protection from different types of attacks. All computations are performed in constant time, thus nullifying timing-based side-channel attacks and protecting also against various other types of side-channel attacks. Due to the need to optimize the resource requirements, the supported cryptographic algorithms were carefully selected. XIP7131C supports X25519, Ed25519, SHA-2, HMAC, HKDF, and AES-GCM with 128-bit keys. Internally, XIP7131C includesa True Random Number Generator (TRNG) for generating truly random numbers needed in the TLS protocol, for example, ephemeral [1] keys. The TLS 1.3 IP Core is available for all Intel ® FPGAs.
The functionality of XIP7131C complies with the TLS 1.3 protocol definition in RFC 8446, and it implements at hardware level the required functionality for TLS 1.3 client side operation. The TLS 1.3 client (the FPGA-based XIP7131C IP core) opens a TLS connection with a server by running the client side of the TLS 1.3 handshake protocol. First XIP7131C generates a ClientHello message including the client’s ephemeral X25519 public share and sends it to the server. The server responds with a ServerHello message which includes the server’s ephemeral X25519 public share, the server’s certificate, a signature over the exchanged messages. After XIP7131C has received the ServerHello message it computes the shared session secret from the received public share and its own private share, verifies the certificate and the digital signature, and derives the required keys from the shared session secret for securing the bulk communications.
XIP7131C provides a hardware-based security solution level required for mission-critical applications. XIP7131C is optimized for low-area footprint, and it is ideally suited for high-volume FPGA applications, for example industrial automation, energy distribution, and secure edge computing. While the IP core itself has been optimized for low FPGA resource usage, it is capable of encrypting and decrypting bulk transmission speeds in excess of 1 Gbps after the secure connection has been established. XIP7131C supports the TLS 1.3 handshakes for session establishment and the TLS 1.3 record protocol for bulk communication. The IP core implements all cryptographic computations and key management activities required for secure TLS connections with a server. Critical cryptographical computations and key management are both isolated inside the FPGA from the rest of the system, offering a very high level of protection from different types of attacks. All computations are performed in constant time, thus nullifying timing-based side-channel attacks and protecting also against various other types of side-channel attacks. Due to the need to optimize the resource requirements, the supported cryptographic algorithms were carefully selected. XIP7131C supports X25519, Ed25519, SHA-2, HMAC, HKDF, and AES-GCM with 128-bit keys. Internally, XIP7131C includesa True Random Number Generator (TRNG) for generating truly random numbers needed in the TLS protocol, for example, ephemeral [1] keys. The TLS 1.3 IP Core is available for all Intel ® FPGAs.
The functionality of XIP7131C complies with the TLS 1.3 protocol definition in RFC 8446, and it implements at hardware level the required functionality for TLS 1.3 client side operation. The TLS 1.3 client (the FPGA-based XIP7131C IP core) opens a TLS connection with a server by running the client side of the TLS 1.3 handshake protocol. First XIP7131C generates a ClientHello message including the client’s ephemeral X25519 public share and sends it to the server. The server responds with a ServerHello message which includes the server’s ephemeral X25519 public share, the server’s certificate, a signature over the exchanged messages. After XIP7131C has received the ServerHello message it computes the shared session secret from the received public share and its own private share, verifies the certificate and the digital signature, and derives the required keys from the shared session secret for securing the bulk communications.
Key features
- Optimized Resource Requirements: The entire XIP7131C requires less than 8500 ALMs (Adaptive Logic Modules) in Intel Cyclone V implementation.
- Short Session Establishment Time: The FPGA-dependant execution time of the TLS 1.3 handshake calculations is less than 100 ms at 100MHz clock, and the FPGA execution time is constant and does not depend on the key values, thus providing protection against timing-based side-channel attacks.
- Performance: Despite its small size, XIP7131C can support bulk traffic encryption and decryption speeds in excess of 1 Gbps.
- Follows RFC 8446: XIP7131C follows the latest TLS 1.3 standard defined in RFC 8446 with specifically selected ciphers to miminize area requirements.
- Hardware-based Security: The primary design goal of XIP7131C is to avoid the potential weaknesses in software-based security, including but not limited to dependence on operating system security, vulnerabilities in third party cryptographic software libraries, and bugs in underlying processor architectures.
- Hardware-based Cryptographic Operations: All the cryptographic mathematical operations are performed entirely in the FPGA, providing a substantial security and performance advantages compared to software-based TLS implementations..
- Hardware-based Key Management: All the cryptographic keys are stored in dedicated internal FPGA memory, which provides a substantial security advantage over software-based key management, and amongst other benefits is a requirement for IEC 62443 Security Level 3 designs.
Block Diagram
XIP7131C block diagram
Benefits
- Fully digital design
- Portable to any ASIC or FPGA technology
- Fully standard compliant
- Easy to integrate
- Several bus interfaces available
- IP core designed in-house at Xiphera
- Technical support by the original designers and cryptographic experts
What’s Included?
- Please contact Xiphera for pricing and your preferred delivery method.
- XIP7131C can be shipped in a number of formats, including netlist, source code, or encrypted source code.
- Additionally, synthesis scripts, a comprehensive testbench, and a detailed datasheet including an integration guide are included.
- Xiphera will also deliver an example C software program to facilitate the integration of XIP7131C with a host processor.
Specifications
Identity
Part Number
XIP7131C
Vendor
Xiphera Ltd
Type
Silicon IP
Provider
HQ:
Finland
Learn more about IPsec / TLS IP core
Bringing IPsec into the Quantum Safe Era
Over the next five years, all security protocols and public key cryptography will undergo a comprehensive overhaul to ensure quantum safety. This represents the most significant change in these domains since the advent of public key cryptography.
Why nonce reuse can break AES-GCM security in embedded systems
Explore key AES modes in embedded systems, their applications, and why selecting the right mode is crucial for security and efficiency in modern designs.
AES in embedded systems: Understanding the most important AES modes
Explore key AES modes in embedded systems, their applications, and why selecting the right mode is crucial for security and efficiency in modern designs.
Embedded Security explained: Cryptographic Hash Functions
Explore the significance of cryptographic hash functions in embedded security, their common algorithms, and practical choices for FPGA-based systems.
ML-KEM explained: Quantum-safe Key Exchange for secure embedded Hardware
KiviCore´s blog post discusses Quantum-safe key exchange with NIST FIPS 203 ML-KEM and how IP cores simplify PQC integration on FPGA and SoCs.
Frequently asked questions about IPsec / TLS IP cores
What is TLS 1.3 Client IP Core?
TLS 1.3 Client IP Core is a IPsec / TLS IP core from Xiphera Ltd listed on Semi IP Hub.
How should engineers evaluate this IPsec / TLS?
Engineers should review the overview, key features, supported foundries and nodes, maturity, deliverables, and provider information before shortlisting this IPsec / TLS IP.
Can this semiconductor IP be compared with similar products?
Yes. Buyers can compare this product with similar semiconductor IP cores or IP families based on category, provider, process options, and structured technical specifications.