CNSA 2.0 Compliant IP in One Family of Cores
The StealthCores CNSA 2.0 Security Suite provides CNSA 2.0 compliant encryption, hashing, key establishment and digital signatures for FPGAs and ASICs. The cores share common interfaces and one software library. StealthKey connects them with hardware key management. Optional ECDSA and ECDH support is available for systems in transition.
StealthKey delivers keys and random seeds to each core in hardware, so software manages keys by slot number and never reads one
| Function | Algorithm | Standard | StealthCores IP |
|---|---|---|---|
| CNSA 2.0 Algorithms | |||
| Symmetric Encryption | AES-256 | FIPS 197 | StealthAES |
| Hashing | SHA-384 and SHA-512 | FIPS 180-4 | StealthSHA |
| Key Establishment | ML-KEM-1024 | FIPS 203 | StealthPQ |
| Digital Signatures | ML-DSA-87 | FIPS 204 | StealthPQ |
| AES Modes of Operation | |||
| Authenticated Encryption | AES-GCM and GMAC | SP 800-38D | StealthAES |
| Storage Encryption | XTS-AES | SP 800-38E, IEEE 1619 | StealthAES |
| Confidentiality Modes | ECB, CBC, CFB, OFB and CTR (option) | SP 800-38A | StealthAES |
| Key Management and Random Bit Generation | |||
| Random Bit Generation | CTR_DRBG with AES-256 | SP 800-90A | StealthKey |
| Entropy Health Tests | On-chip entropy source | SP 800-90B | StealthKey |
| Key Derivation | Counter and feedback modes | SP 800-108 | StealthKey |
| Key Derivation | One-step and two-step KDF, HKDF | SP 800-56C, RFC 5869 | StealthKey |
| Key Wrap | KW and KWP | SP 800-38F | StealthKey |
| Message Authentication | CMAC-AES | SP 800-38B | StealthKey |
| Message Authentication | HMAC-SHA-256, -384 and -512 | FIPS 198-1 | StealthKey, StealthSHA |
| Optional Elliptic-Curve Cryptography | |||
| Digital Signatures | ECDSA key generation, signing and verification on P-384 and P-256 | FIPS 186-5 | StealthEC |
| Key Agreement | ECDH on P-384 and P-256 | SP 800-56A | StealthEC |
| Additional Parameter Sets and Algorithms | |||
| Key Establishment | ML-KEM-512 and ML-KEM-768 | FIPS 203 | StealthPQ |
| Digital Signatures | ML-DSA-44 and ML-DSA-65 | FIPS 204 | StealthPQ |
| Symmetric Encryption | AES-128 (option) | FIPS 197 | StealthAES |
| Hashing | SHA-224, SHA-256, SHA-512/224 and SHA-512/256 | FIPS 180-4 | StealthSHA |
| Hashing | SHA-3, SHAKE and cSHAKE | FIPS 202, SP 800-185 | StealthSHA |
| Message Authentication | KMAC | SP 800-185 | StealthSHA |
CNSA 2.0 designs use the algorithms in the first group. The other groups add AES modes, key management, elliptic-curve support for systems in transition, and additional parameter sets for other markets.
Every core in the suite is NIST ACVTS ready. Each algorithm has passed the test vectors of NIST's Automated Cryptographic Validation Testing System. For CAVP algorithm validation through an accredited laboratory, an ACVP harness with validation support is available as an option.
Algorithms alone do not stop side-channel and glitch attacks. Optional countermeasure configurations add that protection in the hardware. StealthAES's countermeasures are tested beyond 1 billion traces with TVLA.
The cores share interface conventions and the StealthAPI software library, so one team can bring up the whole subsystem.
Private keys stay in internal key slots. Working keys travel between cores on dedicated hardware ports.
The cores are available for AMD, Microchip and Altera FPGAs and for ASIC implementation, in Verilog or VHDL.
License the full suite, or only the cores that your design requires. Contact StealthCores to discuss the configuration that fits your design.