SABLE: Minimalist Instruction-Level Authenticated Encryption for Constrained Confidential Computing

2026-07-18

AI Summary

This work addresses the vulnerability of conventional processors that expose code in plaintext during execution. We propose SABLE, a lightweight, microarchitecture-agnostic instruction-level authenticated encryption architecture that enables runtime instruction decryption and dual verification—spanning both instruction memory and the CPU frontend—within a RISC-V processor. SABLE integrates seamlessly with standard toolchains and requires only minimal post-processing of ELF binaries. Leveraging the ASCON-128a algorithm, we implement seven single- and multi-cycle microarchitectural variants on the NEORV32 SoC and validate them on a Xilinx Artix-7 FPGA. Experimental results demonstrate that, compared to a baseline, these configurations incur overheads of 1.6–9.3× in LUT usage, 4.1–10.0× in performance degradation, 1.5–8.0× in power consumption, and 10.4–80.0× in energy per instruction, thereby systematically revealing the trade-off space among area, performance, and energy efficiency for secure instruction execution.

Abstract

Conventional processor designs expose code and data as plaintext throughout execution, rendering them inherently vulnerable to attacks that recover intellectual property or modify security/safety checks. Instruction-level encryption (ILE) enables CPU-level decryption, execution, and optionally authentication of individual encrypted program instructions at runtime. However, existing proposals depend on specific micro-architectures, detect corrupted instructions after they have executed, rely on non-standard ciphers, or require complex analyses of program state. In this work, we introduce and present a design exploration of a RISC-V processor architecture (SABLE) that enables minimally invasive instruction-level authenticated encryption of programs. SABLE is agnostic to the underlying micro-architecture, remaining compatible with the standard RISC-V toolchain with minor changes to post-process compiled ELF binaries. We integrate a decrypt-and-verify stage at two points (the instruction-memory wrapper and the CPU frontend) and explore seven ILE micro-architectures from a single-cycle (combinational) design to six multi-cycle (sequential) variants. We implement and evaluate the designs using ASCON-128a on a Xilinx Artix-7 FPGA with the open-source NEORV32 system on chip. Relative to baseline performance, the configurations span LUT, performance, power, and energy-per-instruction overheads of 1.6-9.3$\times$, 4.1-10.0$\times$, 1.5-8.0$\times$, and 10.4-80.0$\times$, respectively, using the Dhrystone benchmarking suite. Finally, we discuss design trade-offs, highlighting area-, performance-, and energy-aware design points.

Problem

• instruction-level encryption
• confidential computing
• authenticated encryption
• RISC-V
• hardware security

Innovation

• instruction-level encryption
• authenticated encryption
• RISC-V
• confidential computing
• ASCON-128a