Introduction:

Design Gateway’s TLS 1.3 IP portfolio just became even more versatile. Our latest update adds ECDSA-based certificates (secp256r1) to the already proven TLS10GC-IP (Client side) cores. With both ECDSA and RSA2048 in a single hardware engine, designers can now interoperate with more than 90 % of public web servers and a growing number of industrial/private PKIs. At the same time, the full protocol remains completely off-loaded from the host CPU, sustaining 9 Gbps+ encrypted throughput over 10 GbE while leaving system processors free for application logic.

Why ECDSA Support Matters:

• Mainstream adoption. ECDSA with P-256 is the certificate of choice for modern cloud providers, content-delivery networks, and most Linux software stacks.
• Smaller keys, faster handshakes. 256-bit elliptic-curve keys deliver the same security strength as 3072-bit RSA, reducing handshake bandwidth and latency.
• Long-term agility. Post-quantum transition paths (e.g., hybrid ECDSA+PQ signatures) build on an elliptic-curve foundation, protecting current designs from premature obsolescence. by hardware, eliminating the need for host CPU intervention.

Distribution of certificate types & key size:

Supports ECDSA with secp256r1 and RSA2048 signature algorithms, covering over 90% of servers* - ensuring broad TLS10GC compatibility.

Why Off-loading TLS 1.3 on the Edge FPGA:

• Deterministic real-time performance. Hardware state-machines eliminate OS jitter and ensure consistent low-latency processing — ideal for real-time applications.
• Lower BoM & power. Eliminates the need for high-end multi-core CPUs just to meet crypto throughput, cutting overall system power in half.
• Security isolation. Private keys never leave the FPGA; side-channel-resilient logic and tamper-proof key storage are built in.
• Ease of certification. Hardware root-of-trust helps simplify integration with industry standards such as IEC 62443, DO-356A, and ISO 21434 by providing secure key storage and cryptographic acceleration.

What’s New in DG TLS1.3 10G Client IP:

• Dual-algorithm handshake engine: ECDSA-P256 + RSA2048
• Automatic negotiation of signature algorithms (rsa_pss_rsae_sha256 with 2048-bit RSA public key and ecdsa_secp256r1_sha256) ensures broad TLS interoperability.
• Same resource footprint as previous release – no timing degradation
• Delivered as encrypted RTL, targeting advanced FPGA technologies including AMD UltraScale+

Application Examples: