Its products include a hardware root-of-trust, which has already been licenced to a “a big Semiconductor company for a high-end MCU”, according to company co-founder and CEO Shahram Mossayebi (pictured).
Mossayebi should know about security: he has an MSc in information security and a PhD in post-quantum cryptography from the University of London.
The root-of-trust is a physically unclonable function (PUF) called QDID, and its other product is QuarkLink, a server-based IoT security programme that handles firmware and cryptographic key provisioning, over-the-air firmware updates, certification and key management. QDID and QuarkLink can be used together, or separately with third-party products.
A PUF is hardware intellectual property that can be fabricated into silicon to provide random, un-forgettable and inaccessible on-chip numbers that can be used to make security keys.
The numbers are not added to the chip during manufacture, but are rather created from something intrinsic about that particular semiconductor die at each power-up – they are never known outside that die, and cannot be read from outside.
Mossayebi’s PUF was created after a search for one that met his requirements did not uncover anything suitable.
“They all used existing components,” he said. “Engineers saw random-looking behaviours and thought: it’s random, so use it for cryptography.”
He takes SRAM-based PUFs as an example. “There are already a lot of side-channel attacks for memory. To me, there is no difference between memory-based PUF and injecting a key,” he said, adding that similar criticisms can be levelled at ring-oscillator PUFs: “There are so many papers discussing their flaws.”
On the subject of SRAM PUFs, Mossayebi claims they take up so much space on a die to create a relatively short number, that the same key has to be used for more than one duty. “I don’t believe SRAM gives the best entropy, and because quality of entropy is low, and reliability is not great, you need massive memory block and compression to make something reliable,” he said. “From a crypto point of view, if you use one key for encryption, you do not want to use the same one for authentication.”
So that is QDID?
It is a way to exploit a quantum phenomenon to create numbers – a mixed-signal on-die circuit for CMOS that gets its randomness from gate oxide tunnelling, is about all Mossayebi will say about the electronics.
Of its characteristics he claims: “It has been tested over process, voltage and temperature – over -40 to +125°C and, because it is quantum, it is inherently proof of side channel attacks. It is going through Common Criteria Framework attacks at a third party in France at moment, and they haven’t cracked it yet in over three months.”
It is compact enough to generate multiple independent keys, has so far been demonstrated on 65 and 55nm, and it is being ported to finer geometries.
It’s end-to-end service starts inside the silicon chip and ends at the end-user application which communicates with the server running QuarkLink.
It provides:
- Secure provisioning, including cryptographic keys and firmware
- Automated secure on-boarding to any platform and simultaneously to multiple platforms. AWS, Microsoft and Mosquito are supported, with more to follow
- Security monitoring, including firmware encryption, signing and secure over-the-air updates, and certificate and key renewal and revocation
“QuarkLink can be set up in minutes by engineers without specialist IoT security knowledge,” according to Crypto Quantique. “Thousands of end-point devices may then be connected to servers through cryptographic APIs, with just a few keystrokes that initiate an almost instantaneous, automated process.”
It can be run on Crypto Quantique servers, on customer servers or on end-user servers.
“If a customer does not want to be in charge of QuarkLink, we have the capability to run it on our secure infrastructure – it appears to them as on the cloud,” said Mossayebi. In the case of the Renesas partnership “Renesas customers can try out on our infrastructure, then they can use Renesas servers, our servers of their own.”
Mossayebi founded the company in 2016 with Dr Patrick Camilleri, an ex-Philips Semiconductors IC designer with parallel computer experience. “I am very proud of what we have built,” said Mossayebi.