CPUs Enhanced With Security

Now, the up-and-comers of the x86 market are trying to leapfrog the discrete chips and kickstart the market with security features integrated directly into their CPUs. For example, in the latest revision to its Crusoe processor (TM5800), Transmeta adds hardware acceleration for DES, DES-X and Triple-DES encryption algorithms. The chip will also be able to partition system memory to create a protected zone,potentially multiple megabytes in size,that can be used to store encryption keys and certificates inaccessible to the normal x86 instruction space, but accessible through new Transmeta routines.

Although Transmeta has not yet published benchmarks or provided proof-of-concept applications, company spokesman Walter Sun says the TM5800 will make full Triple-DES disk encryption possible without affecting performance. The company plans to release Windows DLLs and call on contacts from the open-source community to spread the word about the new Transmeta Security Extensions (TSX) x86 opcodes. Programmers will need to call them to exploit the new features on Transmeta-enabled computers and boards. TM5800 is in silicon and currently shipping to developers.

Then there's VIA Technologies, which merged the old chip-design efforts of the Cyrix and WinChip x86 compatibles into a new 1-GHz processor known as the C3. VIA was second to announce but first to launch a security-enhanced CPU. The Nehemiah revision of the C3 includes a technology dubbed PadLock, which attempts to use dedicated hardware to address the weakness of large-scale encryption that relies on random-key generation.

Software-based random numbers are typically generated from a seed value that is not truly random, which weakens protection. PadLock looks at quantum electrical behavior inside the chip itself to provide a more mathematically valid random number. The theory goes that poor random-number generation results in predictable keys, which results in significantly easier-to-break encryption than if the algorithm were being used effectively. "The fundamental building block of security is very good random numbers," says Glenn Henry, president of VIA unit Centaur Technology.

VIA's C3 continues to be a price leader, ringing in at considerably less than its counterparts from Intel and AMD. Like Transmeta's Crusoe, its lower speeds and performance are offset by cooler, lower-power operation. The company hoped to gain acceptance in VPN appliances and low-end PCs that spend the vast majority of their time in the data transmission of e-mail, Web pages and the like.

So far, real-world applications for PadLock are scarce, but VIA has internally developed a Linux device driver that replaces the operating system's software random-number generation routine with a version that uses PadLock. According to Henry, the PadLock unit generates 3,125 256-bit keys per second in high-quality mode. By sacrificing some randomness, keys can be generated as much as eight times faster.

Not Entirely Novel

But hardware random-number generation is not a novel concept. Intel flirted with including improved random-number generation back in its 810 chipset, but because that functionality was tied to the buried CPU ID concept, it died out. Other manufacturers sell chips or boards that serve the same function as PadLock, but at a higher overall price. "If you put it in the [CPU], it's always there, and it becomes free," Henry says.

Response from the heavy-hitters has so far been muted. The Trusted Computing Platform Alliance (TCPA), led by companies such as Hewlett-Packard, IBM, Intel and Microsoft, has defined a specification for a Trusted Platform Module chip that incorporates a variety of data-protection and security-acceleration functions, and companies such as Infineon already manufacture chips that claim to meet the TPM spec and other parts that include random-number generators, DES accelerators or both.

For its part, Intel's only announced security technology is LaGrande, but that is not so much a CPU improvement as a technology layer designed to reduce the amount of time data spends unencrypted within the desktop, making it harder to scan transactional data from, say, a keystroke reader.

One challenge to the hardware-accelerated security market is that most customers are not yet aware of differences in quality and speed when it comes to encryption, and know even less about the intricacies of "true" random-number generation or DES-aware chips. As a result, they are rarely inclined to inquire about hardware acceleration and strong encryption.

"Eighty to 85 percent of our customers don't ask that question. They take our word or our vendors' word that it does," says William Malone, director of technical operations for integrator Akibia, Westborough, Mass. He does see a future for the integrated components, even if they never reach end-user awareness. "The more [VPN] tunnels, the more it'll slow down a process, so being able to speed up encryption and decryption through those appliances is critical," he says.

Greg Stenstrom, CEO of Stenstrom Scientific, Sewell, N.J., believes support for the VIA and Transmeta initiatives will be slow to develop despite the lower cost of their hardware because of the need to expend time and resources recoding applications. "Look at the differentiation between price in the chips of $10, $15, $20, and compare that to the effort to keep the drivers up to date," he says. "It's good research, it's a good way to position, but I don't see an immediate need for it."

Peter Glaskowsky, editor in chief of Microprocessor Report, says VIA and Transmeta have the opportunity to win converts by being first to market and liberal with development and co-marketing support. "I think we're likely to see Microsoft blessing one, or possibly both, of these initiatives given its new attention to security," he says.

Both VIA and Transmeta say they have only released a small portion of their security-feature road maps. PadLock is currently being put through stress-testing by San Francisco-based R&D firm Cryptography Research, which has yet to publish its report on whether PadLock is truly an improvement over software-based random-number generation. Transmeta says it has, among other things, its own random-number generation hardware unit in the cards for a future revision.

As for the niche CPU makers, they appreciate that they have an uphill climb to win over the manufacturer and integrator communities, and are not worried about the lack of prerelease support.

"The reality is that nobody's going to spend a lot of money on a feature from us until it's real," VIA's Henry says. But he is convinced that the merits of integration will win over the skeptics. "For $30, you get the world's best random-number generator,and a 1-GHz processor."

Jason Compton (jcompton@xnet.com) is a freelance writer based in Evanston, Ill.