Hardware-based encryption
Hardware assists or replaces software in data encryption.
Hardware-based encryption uses computer hardware to handle data encryption, either by aiding software or taking over the job entirely. This is often built into the processor’s instruction set—for example, the AES encryption algorithm is supported by the AES instruction set on both x86 and ARM architectures. In other cases, the cryptography module is separate from the main processor, working as a coprocessor, such as a secure cryptoprocessor or cryptographic accelerator. The IBM 4758 and its successor, the IBM 4764, are examples of this approach. Hardware-based encryption tends to be faster and harder to exploit than software-only methods, and it can also include tamper protection.
Before computers handled cryptography, it was done through mechanical or electro-mechanical devices. The Spartan scytale is an early example, and the Enigma machine, used by Germany in World War II, was an electro-mechanical cipher system. After the war, purely electronic systems emerged. The ABYSS project, started in 1987, aimed to stop software piracy. Computers were first applied to cryptography in the 1940s at Bletchley Park, where the Colossus computer broke German High Command encryption. Using computers for encryption came later. Before the integrated circuit—first produced in 1960—computers were too bulky for practical encryption, unlike the portable Enigma machine. Only with the microcomputer did computer encryption become feasible outside niche uses. The World Wide Web’s growth, especially online shopping, pushed consumers to need encryption for security and speed, leading to key algorithms being built into processors.
On the x86 architecture, which is a CISC design, complex algorithms like AES are implemented in hardware. The AES instruction set supports the Advanced Encryption Standard, which can be used for Top Secret information by the NSA. The x86 architecture also includes Intel SHA extensions for SHA hashing algorithms, used for verification tasks like password checking. ARM processors, a RISC architecture, can optionally include Security Extensions, which are specified by ARM Holdings.
As a coprocessor, the IBM 4758 has its own processor, memory, and a random number generator. Its successor, the IBM 4764, is identical to the IBM 4765 except for the connection—PCI-X for the 4764 and PCI-e for the 4765. Both are peripheral devices that plug into the motherboard.
- Early mechanical example
- Scytale used by the Spartans
- Electro mechanical example
- Enigma machine used by Germans in World War II
- First integrated circuit year
- 1960
- Abyss project start year
- 1987
- Ibm 4758 predecessor to
- IBM 4764
- Ibm 4764 connection
- PCI-X
- Ibm 4765 connection
- PCI-e
- Amd aes support start
- 2011 Bulldozer processor iteration
Lore & Background
Prior to computer hardware, cryptography was performed through mechanical or electro-mechanical means, such as the Scytale used by the Spartans and the Enigma machine used by Germans in World War II. After World War II, purely electronic systems were developed. In 1987, the ABYSS project was initiated to protect against software piracy. The application of computers to cryptography dates back to the 1940s and Bletchley Park, where the Colossus computer broke German High Command encryption. However, until the development of the integrated circuit in 1960, computers were impractical for encryption due to their size. Only with the microcomputer did computer encryption become feasible outside niche applications. The development of the World Wide Web and online shopping led to consumer demand for encryption, focusing on security and speed, which drove inclusion of key algorithms into processors.
Implementations include the x86 architecture, which implements AES and SHA hashing algorithms in hardware, and ARM processors with optional Security Extensions. Coprocessor implementations include the IBM 4758, which has its own processor, memory, and random number generator, and its successors the IBM 4764 and IBM 4765, which differ only in connection type (PCI-X vs PCI-e). AMD processors have supported AES instructions since the 2011 Bulldozer iteration. Due to support from Intel, AMD, and ARM, encryption instructions are present on most modern computers, tablets, and smartphones.
Reader's Guide
Hardware-based encryption is significant because it dedicates part of the processor to encryption, leading to large increases in speed. Modern pipelined architectures can often perform other instructions concurrently with encryption instructions. Hardware can also protect data from software, so even if the operating system is compromised, data may remain secure, as seen with Software Guard Extensions. However, if the hardware implementation is compromised, major issues arise. Malicious software can retrieve data from supposedly secure hardware using methods like timing attacks. This is far more problematic to solve than a software bug; while operating systems receive regular security updates, hardware issues may only be fixable through microcode updates, hardware replacement, or workarounds that mitigate performance benefits, as in the Spectre exploit. The legacy of hardware-based encryption is its widespread adoption in consumer devices, driven by the need for both speed and security in online transactions, and its ongoing challenge of balancing performance with resilience against hardware-level attacks.
Did You Know?
- The IBM 4758 includes its own specialised processor, memory, and a random number generator.
- The IBM 4764 and IBM 4765 are identical except that the former uses PCI-X and the latter uses PCI-e.
- The ABYSS project, initiated in 1987, aimed to protect against software piracy.
More in PC Hardware 1-24
Spotted an error? Know more?
Reader corrections go straight into our review queue. Suggest an edit · How this site is sourced