Contact Us

FIQ-BOX03B Crypto Box Toolset Secure Accelerator

Hybrid Crypto Box IP Core with Classical and Post-Quantum Cryptography for Embedded Systems

FortifyIQ’s Hybrid Crypto Box IP core is a comprehensive, high-efficiency cryptographic solution that combines RSA, ECC, AES, and SHA-2/HMAC with a built-in accelerator for post-quantum algorithms such as ML-KEM (Kyber) and ML-DSA (Dilithium). Designed for embedded systems with balanced resource constraints, it enables secure key exchange, digital signatures, authenticated encryption, and hashing, future-proofed for the quantum era. All critical components feature robust side-channel and fault injection protections, including RTL-level, implementation-agnostic countermeasures for AES and SHA-2/HMAC. Supporting secure boot, authenticated firmware updates, and FIPS 140-3/Common Criteria certification, this Crypto Box provides a unified and scalable foundation for long-lifecycle, security-critical applications.

Features

  • Full Elliptic Curve Support
  • RSA-2048, RSA-3072, RAS-4096
  • ML-KEM (Kyber) and ML-DSA (Dilithium)
  • AES-128, AES-192, AES-256
  • Efficient Performance
  • SCA/FIA Protections
  • Patented High-Performance Modulo Multiplication
  • Flexible Interfaces
  • RAM/ROM Firmware Support
  • Security Certification Readiness

Applications

  • IoT Devices
  • Automotive Systems
  • Embedded and Industrial Control
  • Authentication Tokens
  • Payment Systems
  • Secure Communications
  • Network Devices
Technical Overview

FortifyIQ’s Hybrid Crypto Box IP core is a unified, high-efficiency cryptographic engine that integrates classical asymmetric algorithms, symmetric cryptography, secure hashing, and post-quantum cryptographic accelerators in a compact and scalable hardware block. Designed for embedded systems requiring both long-term cryptographic agility and robust physical security, the IP enables secure key exchange, digital signatures, authenticated encryption, and data integrity in a single, certifiable package.

The classical cryptography module supports RSA-4096 and ECC operations (ECDH/ECDSA over NIST P-192 to P-521), enabling compatibility with existing PKI infrastructures. The symmetric engine provides AES-128/192/256 with support for ECB, CBC, CTR, and GCM modes. The hashing engine supports SHA-224, SHA-256, SHA-384, and SHA-512, along with HMAC for secure message authentication.

The Crypto Box also includes a dedicated post-quantum cryptography accelerator supporting: ML-KEM (Kyber) for key establishment(per FIPS 203), ML-DSA (Dilithium) for digital signatures (per FIPS 204). This enables hybrid or full-PQC deployments in secure boot, firmware authentication, and key exchange protocols. To protect against physical attacks, all sensitive blocks, such as AES, SHA-2/HMAC, ECC, RSA, ML-KEM, and ML-DSA, feature robust side-channel analysis (SCA) and fault injection (FI) countermeasures.

The Crypto Box supports secure boot and authenticated firmware updates of its internal firmware. FortifyIQ’s Hybrid Crypto Box IP core offers a future-ready security foundation for embedded systems in automotive, industrial, IoT, and edge computing applications engineered for compliance with FIPS 140-3, Common Criteria, and other high-assurance standards.

External Dependencies

  • Requires an external cryptographically secure random number generator (CSPRNG)

Deliverables

  • SystemVerilog source code or netlist
  • Testbench, input vectors, and expected results
  • Sample timing constraints, synthesis, and simulation scripts
  • Hardware Abstraction Layer (HAL) reference implementation
  • Integration, configuration, and usage manuals
  • Firmware code
  • Software library
  • Security documentation

Related Products

  • FIQ-PQC04B – Accelerator for Classical and Post-Quantum asymmetric cryptography
  • FIQ-BOX01C – Compact Crypto Box IP Core for Resource-Constrained Devices
  • FIQ-BOX02B – Versatile Crypto Box IP Core with Robust SCA/FI Protections for Balanced Embedded Systems
View All Products
Get in Touch
FortifyIQ AES Algorithm
AVA_VAN.5 Evaluation & Validation Summary
SGS Brightsight Common Criteria Laboratory
“Summary. The leakage analysis (Welch t-test) on over 30 million traces did not show statistically significant first- and second-order differences between trace sets with fixed and random inputs. The template-based DPA analysis, on the pseudo-random trace set for the profiling phase (15 million traces) and on a sub-set of 300k fix input traces for matching phase targeting the first-round S-box output, and template attack on ciphertext, did not indicate any potential information leakage.”
“The results for the soft IP presented in the report were obtained on the TOE which is the basic hardware implementation of the soft IP without additional levels of security (e.g. that are present in a secure silicon layout). Therefore the internal strength of the soft IP itself was evaluated. This indicates that the investigated features and parameters of the soft IP implementation should be robust against SCA and fault injection attacks in different implementations including ASIC. Nevertheless, according to the Common Criteria rules, the strength of the final composite product must be evaluated on its own”
Request Technical Details