BipBipCache: Pipeline-Aware Integration of Low-Latency Tweakable Encryption in an Embedded Cache Controller

Technical Summary: BipBipCache – Pipeline-Aware Integration of Low-Latency Tweakable Encryption in an Embedded Cache Controller

Problem Statement
Consumer and embedded processors frequently store sensitive data (credentials, personal data, firmware secrets) in on-chip SRAM caches. Unlike main memory, these cache contents are typically unencrypted in commercial microarchitectures, leaving them vulnerable to cold-boot attacks, direct SRAM probing, and offline observation of memory buses. While software protections exist, they often impose unacceptable overhead for low-cost embedded platforms. Existing hardware countermeasures, such as ScatterCache and SCARF, address microarchitectural side channels (e.g., Prime+Probe) via cache randomization but do not provide confidentiality against physical readout. There is a need for a transparent, low-latency hardware solution that encrypts cache data and tags to protect against physical and bus-level attacks without incurring prohibitive performance penalties.

Methodology
The authors propose BipBipCache, a direct-mapped cache controller that integrates the BipBip tweakable block cipher (TBC) to encrypt both cache data and tags in real time. The design relies on three core methodological components:

1. Cryptographic Mapping (C3-Style Decomposition): BipBip operates on 24-bit blocks with 40-bit tweaks, which does not natively align with standard 64-bit cache words. The authors adopt a decomposition strategy inspired by Cryptographic Capability Computing (C3). Each 64-bit cache word is split into a 24-bit plaintext segment and a 40-bit tweak context derived from the remaining bits. The 24-bit segment is encrypted, while the 40-bit tweak bits pass through unchanged, binding the ciphertext to the specific memory address or context without expanding the word size.
2. Reverse-Engineered Pipelined Encryptor: The official BipBip specification provides a 3-cycle decryptor but lacks a hardware-optimized encryptor. The authors reverse-engineered the decryptor-centric round functions to construct the first pipelined BipBip encryptor in VHDL. This encryptor operates with a 6-cycle latency, compared to the 3-cycle latency of the decryptor.
3. Pipeline-Aware Controller Design: To mitigate the 6-cycle encryption latency during write operations, the controller exploits the asymmetry between encryption and decryption. The write path buffers the plaintext while the tag path simultaneously performs hit detection using the 3-cycle tag decryptor. The first three cycles of the encryption process overlap with tag verification and hit detection. Consequently, the write enable signal is asserted only after hit confirmation (cycle 3), meaning the encryption process is already underway. This results in an effective write penalty of only 3 additional cycles after hit verification, rather than a full 6-cycle stall.

Key Contributions
The paper details four primary contributions:

• First Hardware BipBip Encryptor: The reconstruction of a 6-cycle pipelined encryptor in VHDL, verified against the official C++ reference implementation.
• Encrypted Cache Prototype: A direct-mapped cache controller integrating three BipBip instances (data encryption, data decryption, and tag decryption) with a documented 64-bit-to-(24+40) mapping scheme.
• Pipeline Overlap Analysis: A demonstration that tag-path decryption can synchronize with the encryptor to hide part of the write latency, reducing the effective write commitment to 3 cycles post-hit.
• FPGA Evaluation: Comprehensive synthesis and implementation results on Xilinx Artix-7 devices, including resource utilization metrics and board-level functional verification.

Results
The design was implemented and verified using AMD Vivado 2025.2 and tested on Xilinx Artix-7 FPGAs (specifically the Nexys A7 board).

• Correctness: Both the encryptor and decryptor testbenches matched the official BipBip C++ reference on five verification vectors.
• Latency: The pipelined tests confirmed the expected 6-cycle encryption and 3-cycle decryption latencies.
• Resource Utilization: On an Artix-7 (xc7a35tcpg236-1), the design utilized 3,356 Slice LUTs (16.1% of the device), with cryptographic logic accounting for approximately 79% of the LUT usage. The design operates at 100 MHz in simulation and on hardware.
• End-to-End Verification: Board-level tests confirmed successful round-trip encryption and decryption of cache words and tags, with decrypted outputs matching the original plaintext inputs.

Significance and Claims
The authors position BipBipCache as a feasibility study demonstrating that ultra-low-latency tweakable block ciphers can be integrated into embedded cache controllers with bounded pipeline overhead. The work highlights that while BipBip's small block size (24 bits) requires careful mapping for full cache words, the resulting architecture successfully protects cache-resident contents against cold-boot and physical readout attacks.

The paper explicitly states its limitations:

• Security Scope: It protects confidentiality against physical readout but does not mitigate microarchitectural side channels (which require randomized caches).
• Integrity: The system provides tamper-evident metadata (encrypted tags) but does not offer strong authentication or MACs against active adversaries.
• Cryptographic Margin: The authors acknowledge that BipBip's theoretical security margin is tight following full-round cryptanalysis, and only 24 bits per word are strongly permuted.
• Future Work: The authors suggest future directions include substituting primitives (e.g., QARMA, MANTIS), protecting set indices, conducting formal side-channel analysis, and integrating the design into full SoC workloads.

The significance of the work lies in its practical demonstration of a "confidentiality-first" cache architecture that balances the constraints of low-latency embedded systems with the need for hardware-based data protection.