Alexis Perea

Moulay T Sougrati

Costana M Ionica-Bousquet

Bernard Fraisse

Cécile Tessier

Laurent Aldon

Jean-Claude Jumas

Operando 57 Fe Mössbauer and XRD investigation of Li x Mn y Fe 1-y PO 4 /C composites (y = 0.50; 0.75)

LiMn 0.50 Fe 0.50 PO 4 and LiMn 0.75 Fe 0.25 PO 4 powders have been synthesized by ceramic route. A comparative investigation of their electrochemical behaviour using operando 57 Fe Mössbauer and Xray diffraction is reported. The complementarity of operando techniques used in this study allows the monitoring of changes of the local electronic environment and the lattice modifications that are directly linked to the redox reaction mechanisms. During the charge, LiMn 0.50 Fe 0.50 PO 4 has been found to undergo three well defined and reversible reactions via an intermediate phase containing simultaneously Fe II and Fe III cations. LiMn 0.75 Fe 0.25 PO 4 undergoes a two reactions mechanism. Fe III Mössbauer signature has been found to be sensitive to the oxidation of Mn II since this oxidation is accompanied with a significant increase of the iron quadrupole splitting. This study summarizes the different mechanisms observed for compositions with different manganese content.

Introduction

Since the work on the Fe 3+ /Fe 2+ redox couple in phospho olivines was first reported in 1997, LiFePO 4 has been intensively studied as a promising cathode material [START_REF] Perea | Operando 57Fe Mossbauer and XRD investigation of LixMnyFe1-yPO4/C composites (y = 0; 0.25)[END_REF][START_REF] Delacourt | One-step low-temperature route for the preparation of electrochemically active LiMnPO4 powders[END_REF][START_REF] Padhi | Phospho-olivines as positive-electrode materials for rechargeable lithium batteries[END_REF][START_REF] Delacourt | Toward understanding of electrical limitations (electronic, ionic) in LiMPO4 (M = Fe, Mn) electrode materials[END_REF] for the next generation of lithium-ion batteries because of its low cost, safety and environmental compatibility. Numerous studies have attempted to improve the electrochemical performances of the material and to get deeper insight in the lithium electrochemical mechanism [START_REF] Delmas | Lithium deintercalation in LiFePO4 nanoparticles via a domino-cascade model[END_REF][START_REF] Dedryvere | X-Ray Photoelectron Spectroscopy Investigations of Carbon-Coated LixFePO4 Materials[END_REF][START_REF] Delacourt | Crystal chemistry of the olivinetype LixFePO4 system (0 <= x <= 1) between 25 and 370 degrees[END_REF][START_REF] Yamada | Phase change in LixFePO4[END_REF][START_REF] Aldon | Determination of the Lamb-Mossbauer factors of LiFePO4 and FePO4 for electrochemical in situ and operando measurements in Li-ion batteries[END_REF] . On the other hand, attempts have been made to enhance the potential of olivine cathode materials by using manganese phosphate instead of iron phosphate [START_REF] Padhi | Phospho-olivines as positive-electrode materials for rechargeable lithium batteries[END_REF][START_REF] Zhou | The electronic structure and band gap of LiFePO4 and LiMnPO4[END_REF] .

Despite the recent advances in cycling insulating materials, thanks to nano-coating techniques and new preparation routes [START_REF] Li | LiMnPO4 as the cathode for lithium batteries[END_REF][START_REF] Kwon | Enhanced electrochemical performance of mesoparticulate LiMnPO4 for lithium ion batteries[END_REF] and even though some authors have reported promising results [START_REF] Li | LiMnPO4 as the cathode for lithium batteries[END_REF][START_REF] Kwon | Enhanced electrochemical performance of mesoparticulate LiMnPO4 for lithium ion batteries[END_REF][START_REF] Wang | Enhanced capacity retention of Co and Li doubly doped LiMn2O4[END_REF] , LiMnPO 4 is not used as active material in lithium battery. This is due to the fact that it shows much lower effective energy density than the lithium iron phosphate owing to the low practical capacity evidenced. In addition, LiMnPO 4 requires very slow charge and discharge rates [START_REF] Delacourt | One-step low-temperature route for the preparation of electrochemically active LiMnPO4 powders[END_REF][START_REF] Yonemura | Comparative kinetic study of olivine LixMPO4 (M = Fe, Mn)[END_REF][START_REF] Yamada | Reaction mechanism of the olivine-type Li-x(Mn0.6Fe0.4)PO4 (0 <= x <= 1)[END_REF][START_REF] Yang | Synthesis and characterization of carbon-coated lithium transition metal phosphates LiMPO4 (M = Fe, Mn, Co, Ni) prepared via a nonaqueous sol-gel route[END_REF] . The main reason on that is the large kinetic barrier at the mismatched interface of MnPO 4 /LiMnPO 4 4 . It is also worth noticing that during the charge, LiMnPO 4 exhibits higher volume change than LiFePO 4 2, 15, 17 .

A good compromise between LiFePO 4 and LiMnPO 4 is the partially substituted phases LiMn y Fe 1-y PO 4 3, 15, 18 , that would introduce the advantage of combining good electrochemical performances of LiFePO 4 with a higher potential for manganese (~ 4.1 V compared with ~ 3.4 V vs. Li + /Li for iron) in order to enhance the energy density.

It is however not yet clear which composition has to be preferred for practical application. Yamada et al. suggested that LiMn 0.6 Fe 0.4 PO 4 composition exhibits the best electrochemical performances [START_REF] Yamada | Reaction mechanism of the olivine-type Li-x(Mn0.6Fe0.4)PO4 (0 <= x <= 1)[END_REF] .

LiMn 0.4 Fe 0.6 PO 4 has also been reported to give good specific capacity after 100 cycles [START_REF] Shin | Li(Mn0.4Fe0.6)PO4 cathode active material: Synthesis and electrochemical performance evaluation[END_REF] . Chang et al.

have reported that LiMn 0.3 Fe 0.7 PO 4 shows the excellent cycling performances [START_REF] Xu | Direct-hydrothermal synthesis of LiFe1-x Mn (x) PO4 cathode materials[END_REF] , whereas Xu et al.

found that LiMn 0.1 Fe 0.9 PO 4 shows the best cycling performances [START_REF] Chang | Synthesis and performance of LiMn0.7Fe0.3PO4 cathode material for lithium ion batteries[END_REF] . Despite increasing interest in the Mn substituted phases, their electrochemical mechanisms are not yet well understood. It is for example not clear why the Fe 3+ /Fe 2+ and Mn 3+ /Mn 2+ redox potentials are shifted (vs. Mn content) and why the polarizations related to these two couples show an opposite behaviour [START_REF] Kobayashi | Shift of redox potential and kinetics in Li-x(MnyFe1-y)PO4[END_REF] .

Operando techniques are increasingly employed for the investigation of the batteries electrochemical behaviour. Few analyses of LiMn y Fe 1-y PO 4 have been reported using XRD and X-ray absorption spectroscopy (XAS) [START_REF] Nam | The phase transition behaviors of Li1-xMn0.5Fe0.5PO4 during lithium extraction studied by in situ X-ray absorption and diffraction techniques[END_REF][START_REF] Nedoseykina | In situ X-ray absorption spectroscopic study for the electrochemical delithiation of a cathode LiFe0 4Mn0 6PO4 material[END_REF][START_REF] Chen | In-situ synchrotron X-ray absorption studies of LiMn0.25Fe0.75PO4 as a cathode material for lithium ion batteries[END_REF] .

We have recently reported an operando study of Li x Mn y Fe 1-y PO 4 /C composites (y = 0; 0.25) [START_REF] Perea | Operando 57Fe Mossbauer and XRD investigation of LixMnyFe1-yPO4/C composites (y = 0; 0.25)[END_REF][START_REF] Aldon | 2D-correlation analysis applied to in situ and operando Mossbauer spectroscopy[END_REF]

Experimental section

RSC Advances Accepted Manuscript

Characterization of Materials

After preparation, the compounds were crushed in an agate mortar and powder XRD (PHILIPS X'Pert MPD θ-2θ diffractometer equipped with the X'celerator detector) patterns were recorded using Cu Kα radiation (λ = 1.5418 Å) and a nickel filter.

The residual carbon content was evaluated by a Flash EA 1112 analyser based on the Dynamic Flash 5

Combustion which produced complete combustion of the sample followed by an accurate and precise determination of the elemental gases produced. 57 Fe Mössbauer spectra were recorded in the constant acceleration mode and in transmission geometry on a standard Mössbauer spectrometer composed of electronic devices from Ortec and Wissel. A 57 Co(Rh) source with a nominal activity of 370 MBq was used. The source and the absorber were always kept at RT. All the isomer shifts are given relative to α-Fe at RT.

Electrochemical behaviour

Electrodes containing 80 wt. % sample and 20 wt. % carbon black were prepared for cycling tests.

Standard Swagelok cells Li|1 M LiPF 6 (propylenecarbonate (PC): ethylene carbonate (EC):dimethyl carbonate (DMC)) 1:1:3, v/v)| LiMn y Fe 1-y PO 4 were assembled in an argon-filled glove box and tested using a VMP system.

To identify the electrochemical reaction mechanisms, we carried out operando XRD and 57 Fe Mössbauer spectroscopy measurements for both LiMn y Fe 1-y PO 4 (y = 0.5; 0.75) electrodes using an electrochemical cell designed especially for this aim [START_REF] Leriche | An Electrochemical Cell for Operando Study of Lithium Batteries Using Synchrotron Radiation[END_REF] .

To preserve beryllium window from the oxidation due to high working voltage, it was covered by a 2 µm thick foil of pure aluminium (Goodfellow). Here, the cells were charged and discharged using a C/40 rate, at room temperature in the voltage ranges 2.75-4.6 V. Each operando XRD scan was recorded during 1h in which Li extraction/insertion was performed and the results correspond to a change of composition of ∆x = 0.025 Li (where x is in Li x Mn y Fe 1-y PO 4 /C (y = 0.5; 0.75). A 2 hours acquisition time was used for the operando Mössbauer measurement. Each spectrum corresponds to ∆x = 0.05 extracted/inserted Li. For y = 0.75.The spectra presented are obtained in situ but not operando due to the low amount of iron in the electrode.

Results and discussion

XRD patterns of the obtained powders are given in Figure 1a. As it can be seen, the powder are free of any crystalline impurity.

All the diffraction peaks can be indexed in the orthorhombic Pnma space group. Lebail method [START_REF] Rodríguez-Carvajal | Recent advances in magnetic structure determination by neutron powder diffraction[END_REF] has been used to estimate the lattice parameters respectively a = 10.368( [START_REF] Padhi | Phospho-olivines as positive-electrode materials for rechargeable lithium batteries[END_REF] . Average crystallite sizes of 120 nm have been obtained using the Scherrer formula [START_REF] Eberhart | Méthodes physiques d'étude des minéraux et des matériaux solides[END_REF] . The residual carbon content was evaluated at 4.89 % and 4.82% for LiMn y Fe 1-y PO 4 (y = 0.5; 0.75) respectively.

Figure 1b give the variation of a, b and c for the olivine phases. All, the lattice parameters increase linearly with manganese content. The main effect of the substitution of iron-manganese in LiMn y Fe 1- y PO 4 is the expansion of the network that can be explained simply by the difference between the ionic radii of high spin Mn 2+ (0.97 Å) and Fe 2+ high spin (0.92 Å). The redox potentials have been obtained from the derivative curves (Figure 4). These potentials associated with the redox couples Fe 3+ /Fe 2+ and Mn 3+ /Mn 2+ undergo an increase with the manganese content. Kobayashi et al. [START_REF] Kobayashi | Shift of redox potential and kinetics in Lix(MnyFe1-y)PO4[END_REF] explain this with an expansion of the volume of all compositions. These variations are sufficient to increase the average potential of the couple Fe 3+ /Fe 2+ from 3.45 V to 3.56 V vs. Li + /Li 0 respectively for y = 0 and y = 0.75. This variation in potential of 0.11 V may appear negligible in the case of a battery with one cell, however it can be important in the case of batteries 5 with many cells mounted in parallel that can be used for example for electrical vehicles.

To better understand the reaction mechanisms, operando analyses have been performed.

For y = 0.50 the Mössbauer spectra corresponding to the first cycle and the parameters associated with the first charge are represented respectively in Figure 5a ሺwhere 0 α 0.2ሻ

In the third region (~ 0.16 ≤ x < 0.5, shown in red in Figure 6a, the two-phase character is more evident. A new phase appears from x = 0.50 (Li 0.50 Mn III 0.50 Fe III 0.50 PO 4 ) with diffraction peaks located at angles higher than the initial phase:

Li .ହ Mn .ହ ୍୍ Fe .ହ ୍୍୍ PO ସ ↔ βMn .ହ ୍୍୍ Fe .ହ ୍୍୍ PO ସ ሺ1 െ βሻLi .ହ Mn .ହ ୍୍ Fe .ହ ୍୍୍ PO ସ 0.50βLi ା 0.50βe ି ሺwhere 0 < β 1ሻ
All the Fe 2+ was oxidized into Fe 3+ at the end of the second region, however, the Mössbauer spectra continue to evolve (Figure 7), indicating that the environment of iron is affected by the oxidation of Mn 2+ in Mn 3+ as already observed for the phase LiMn 0.25 Fe 0.75 PO 4 [START_REF] Perea | Operando 57Fe Mossbauer and XRD investigation of LixMnyFe1-yPO4/C composites (y = 0; 0.25)[END_REF] .

From x ≤ 0.50 the spectra (Figure 7) are refined by adding a new Fe 3+ doublet shown in magenta. The new doublet corresponding to Fe 3+ phase Mn ,ହ ୍୍୍ Fe ,ହ ୍୍୍ PO ସ exhibits a quadrupole splitting of 1.65 mm/s, which is higher than 1.55 mm/s observed for Mn .ଶହ ୍୍୍ Fe .ହ ୍୍୍ PO ସ , and this further confirms that the Fe 3+ is very sensitive to the oxidation state of Mn since an increase of the amount of Mn 3+ around the Fe 3+ site lead to a significant increase of the quadrupole splitting [START_REF] Liu | Quadrupole splitting distributions in purpurite and related minerals[END_REF] The electrochemical mechanism corresponding to the richest manganese phase LiMn 0.75 Fe 0.25 PO 4 /C was also studied. The diffractograms corresponding to the first cycle with the galvanostatic curves are shown in Figure 6b. The three 57 Fe Mössbauer spectra (Figure 8) do not match the operando mode indeed the low iron content of this phase would not have sufficient quality for data processing. They 5 were however recorded in situ with the battery paused at key points.

From x = 0.95 the diffraction line corresponding to the plane (020) phase LiMn 0.75 Fe 0.25 PO 4 /C (29.2° (2θ)) shifts to higher angles up to x = 0.75 (black area of Figure 6b). The reaction corresponding to the oxidation of iron is single phase in this area (0.45 ≤ x < 0.75) for the charge and discharge:

Li ଵ. Mn .ହ ୍୍ Fe .ଶହ ୍୍ PO ସ ↔ Li ଵି Mn .ହ ୍୍ Fe .ଶହା ୍୍ Fe ୍୍୍ PO ସ αLi ା αe ି ሺwhere 0 < α 0.25ሻ After x = 0 .75, the Mössbauer spectra show clearly that all the Fe 2+ has been oxidized to Fe 3+ (Figure 8).

From x = 0.75, the potential is 4.15 V, an olivine-type phase appeared, the main diffraction peak (2θ ~ 30.2 °) corresponding to this new phase is shown Figure 6b. The coexistence of two phases in charge and discharge is established for the oxidation-reduction of Mn 3+ /Mn 2+ in the area shown in red. The electrochemical reaction in (0.45 ≤ x < 0.75) can be written:

Li .ହ Mn .ହ ୍୍ Fe .ଶହ ୍୍୍ PO ସ ↔ βMn .ହ ୍୍୍ Fe .ଶହ ୍୍୍ PO ସ ሺ1 െ βሻ Li .ହ Mn .ହ ୍୍ Fe .ଶହ ୍୍୍ PO ସ 0.25βLi ା 0.25βe ି ሺwhere 0 < β 1ሻ

Mössbauer spectra shown in Figure 8 (where x = 0.60 and 0.45) correspond to the spectra of Fe 3+ on the "plateau" of redox reaction Mn 3+ /Mn 2+ . Indeed, it was interesting to see the indirect effect of Mn 3+ on the environment of Fe 3+ as in previous phases with less manganese. The spectra cannot be refined with a single component in this area, we must add a second doublet for a correct refinement.

Mössbauer parameters for the two Fe 3+ components (Li In conclusion, the electrochemical mechanism of phase Li x Mn 0.75 Fe 0.25 PO 4 /C differs from the three previously studied compositions. The first part corresponding to the domain (0.75 ≤ x < 0.95) is singlephase, the phase LiMn 0.75 Fe 0.25 PO 4 evolves to the composition Li 0.75 Mn 0.75 Fe 0.25 PO 4 . The second area (0.45 ≤ x < 0.75) which is located at the "plateau" of the reaction Mn 3+ /Mn 2+ is biphasic between the two compositions Li 0.75 Mn 0.75 Fe 0.25 PO 4 and Mn 0.75 Fe 0.25 PO 4 for the charge and discharge.

To summarize, all the mechanisms observed for these substituted phases LiMn y Fe 1-y PO 4 /C in charge are respectively represented in Figure 9. Other compositions LiMn y Fe 1-y PO 4 /C (y = 0.4, 0.6, 0.67) prepared under the same conditions have also been studied and can complete the graph of Figure 9.

The regions corresponding to different types of mechanism are shown as a function of lithium content:

-The beginning of the charge corresponding to the reaction Fe 2+ →Fe 3+ is biphasic for all compositions, except LiMn 0.75 Fe 0.25 PO 4 /C where the reaction is a single-phase.

-A domain of solid solution is also observed for all compositions, except LiMn 0.75 Fe 0.25 PO 4 /C between the two "plateaus" corresponding to the two redox reactions, this domain decreases with the manganese content.

-The end of the charge where the potential is around 4.2 V corresponding to the Mn 3+ /Mn 2+ reaction is biphasic for all the compositions.

An inductive effect has already been established in some intercalation compounds polyanionic lithium [START_REF] Padhi | Effect of structure on the Fe3+/Fe2+ redox couple in iron phosphates[END_REF] , it can result in changes in potential more than 1 V. In the case of compounds LiMn y Fe 1- y PO 4 /C, the ionicity or covalent bonds (Fe, Mn-O) is controlled by the size of the network ( the length of these bonds). It was therefore interesting to compare the values of the isomer shifts of phases LiMn y Fe 1-y PO 4 /C with the values of potentials associated with the couple Fe 3+ /Fe 2+ (Figure 10).

Indeed, there is a correlation between the inductive effect and value of the isomer shift as demonstrated Menil 36 . The representation of values of δ and potentials in Figure 10 clearly shows a very similar tendency of the two parameters. This interesting result suggests that it is possible to predict the reaction potential from iron Mössbauer data as reported by Naille et al. for tin compounds [START_REF] Naille | 119Sn MÃ ¶ssbauer parameters as predictive tool for future Sn-based negative electrode materials[END_REF] .

Finally we observed an excellent capacity retention over 100 cycles for all the studies compositions (see Add. Data). Although the substitution of iron with manganese does not improve the capacity (since it decreases with the manganese content), the possibility of tuning the working voltage may be useful for some applications as electric hybrid cars.

Conclusion

In this paper we report a comparative operando study for LiMn y Fe 1-y PO 4 /C for y = 0.50 and y = 0.75 combining XRD and 57 Fe Mössbauer spectroscopy. The electrochemical mechanisms have been

  LiMn y Fe 1-y PO 4 /C (y = 0.50; 0.75) spectra (Figure2) consist of sharp doublets with an isomer shift of δ = 1.235(2) and a quadrupole splitting of ∆ = 2.947(3) mm/s for y = 0.5 and an isomer shift of δ = 1.239(1) and a quadrupole splitting of ∆ = 2.942(2) mm/s for y = 0.75 as discussed previously[START_REF] Perea | Operando 57Fe Mossbauer and XRD investigation of LixMnyFe1-yPO4/C composites (y = 0; 0.25)[END_REF] .The voltage profiles of LiMn y Fe 1-y PO 4 are shown in Figure3a. For LiFePO 4 , a flat plateau is observed at 3.4 V as previously reported. For the substituted phases, two pseudo plateaus are observed in agreement with the two redox reactions Fe 3+ /Fe 2+ and Mn 3+ /Mn 2+ . The length of the Mn plateau is proportional to manganese content.Calculated capacities with the cycle rate for Li x Mn y Fe 1-y PO 4 /C (y = 0.25, 0.50, 0.60, 0.75) are summarized in Figure3b. This representation allows direct visualization of the reversible capacity of the material depending on the rate of cycling. The capacity is found to be a function of both cycling rate and Mn content. For our synthesis conditions, the material with the best performance is the composition LiMn 0.25 Fe 0.75 PO 4 /C. The loss of capacity between C/10 and C is 12% and 62% respectively for the compositions LiMn 0.50 Fe 0.50 PO 4 /C and LiMn 0.75 Fe 0.25 PO 4 /C. The electrochemical performance decreases with the manganese content: for the phase LiMn 0.75 Fe 0.25 PO 4 /C the reversible capacity calculated for a cycle rate of C/10 is 56 mAh.g -1 against 125 mAh.g -1 for the substituted phase with less manganese content LiMn 0.50 Fe 0.50 PO 4 /C.

5 studiedFIGURESFig. 1

 51 FIGURES

Fig. 2 57 10 Fig. 3

 2103 Fig.2 57 Fe Mössbauer spectra for LiMnyFe1-yPO4/C, where y = 0.50 and y = 0.75 .

Fig. 4 Fig. 5 Fig. 6

 456 Fig.4 Average potential of redox reactions in LiMnyFe1-yPO4 .

Fig. 7 :

 7 Fig. 7: Mössbauer spectra of LixMn0.50Fe0.50PO4/C obtained at the indicated x values .

Fig. 9

 9 Fig. 9 Schematic diagram of the different mechanisms observed during the first charge .

Fig. 10

 10 Fig.10 Evolution of the Isomer Shift Vs. Average potential .

  and 5b. The diffractograms corresponding to the first cycle of phase LiMn 0.50 Fe 0.50 PO 4 are shown in Figure6a. At the beginning of the charge (blue In the second region (0.50 ≤ x ≤ 0.70), shown in black in Figure6a, the diffraction lines corresponding to the Li 0.70 Mn 0.50 Fe 0.50 PO 4 phase are shifted to upper angles, indicating the existence of a solid solution domain in charge and discharge. This also is supported by gradual increase (~ 21%) of the quadrupole splitting of Fe 3+ with the oxidation of iron. Therefore, in this area the electrochemical reaction can be written as follow:

	Li . Mn .ହ ୍୍ Fe .ଶ ୍୍ Fe .ଷ ୍୍୍ PO ସ ↔
	Li .ି Mn .ହ ୍୍ Fe .ଶି ୍୍	Fe .ଷା ୍୍୍	PO ସ αLi ା αe ି
	LiMn .ହ ୍୍ Fe .ହ ୍୍ PO ସ and Li . Mn .ହ ୍୍ Fe .ହ ୍୍,୍୍୍ PO ସ for the charge and discharge in the range 0.70 ≤ x <
	0.95.
	The electrochemical reaction in this region can be written:
	Li ଵ. Mn .ହ ୍୍ Fe .ହ ୍୍ PO ସ ↔ ሺαሻLi . Mn .ହ ୍୍ Fe .ଶ ୍୍ Fe .ଷ ୍୍୍ PO ସ
	ሺ1 െ αሻLi ଵ. Mn .ହ ୍୍ Fe .ହ ୍୍ PO ସ 0.30αLi ା 0.30αe ି ሺwhere 0 <α 1ሻ

area) (0.70 ≤ x < 0.95) a new phase appears in both XRD patterns and Mössbauer data. The (020) peak of the pristine material vanishes at the expense of a new peak locate at 29.3°. In this domain, the Mössbauer spectra (Figure

7

) indicate the transformation of initial Fe 2+ into two components: the first is associated with Fe 3+ with the parameters (δ = 0.42 mm/s and ∆ = 1.12 mm/s) and a second component associated with a new Fe 2+ component (δ = 1.26 mm/s and ∆ = 2.72 mm/s). The quadrupole splitting of this new Fe 2+ is lower than that of the initial Fe 2+ indicating an increase of the distortion of the iron environment

[START_REF] Liu | Quadrupole splitting distributions in purpurite and related minerals[END_REF]

caused by the deintercalation of Li + and iron oxidation. This observation allows us to conclude to formation of a mixed valence phase with the following composition: Li . Mn .ହ ୍୍ Fe .ଶ ୍୍ Fe .ଷ ୍୍୍ PO ସ . It is worth noting that such phases (called ferrisicklerites Li x<1 (Fe,Mn)PO 4 ) have been reported by mineralogists and attributed to natural oxidation of triphylite Li(Fe,Mn)PO 4

[START_REF] Fontan | FERRISICKLERITE OF SIDI BOU OTHMANE PEGMATITES (JEBILET, MOROKKO) AND MINERAL GROUP WITH A TRIPHYLITE STRUCTURE[END_REF][START_REF] Liu | Quadrupole Splitting Distributions in Purpurite and Related Minerals[END_REF][START_REF] Alberti | CRYSTAL-STRUCTURE OF FERRISICKLERITE, LI-LESS-THAN(1) (FE-3+, MN-2+) PO4[END_REF]

. From the study of 45 ferrisicklerite minerals, Fanton et al. have concluded on the absence of any structural order of the Mn and Fe cations in this family of materials

[START_REF] Fontan | FERRISICKLERITE OF SIDI BOU OTHMANE PEGMATITES (JEBILET, MOROKKO) AND MINERAL GROUP WITH A TRIPHYLITE STRUCTURE[END_REF]

.

From these observations we conclude to a biphasic mechanism with the coexistence of

  . Similar spectra have been reported for natural purpurite (Fe,Mn)PO 4 31 . The electromechanism of the charge and discharge of LiMn 0.50 Fe 0.50 PO 4 /C is done in three steps as the LiMn 0.25 Fe 0.75 PO 4 /C phase. At beginning, the

		View Online
	Downloaded on 29 August 2012	Published on 07 August 2012 on http://pubs.rsc.org | doi:10.1039/C2RA20949G	RSC Advances Accepted Manuscript
		mechanism is biphasic, with the coexistence of LiMn ,ହ ୍୍ Fe ,ହ ୍୍ PO ସ and a mixed composition
		Li . Mn .ହ ୍୍ Fe .ଶ ୍୍ Fe .ଷ ୍୍୍ PO ସ up to x = 0.50. From x = 0.50, the second domain is a solid solution
		where the phase Li ୶ Mn ,ହ ୍୍ Fe ,ଶ ୍୍ Fe ,ଷ ୍୍୍ PO ସ oxidizes up to x = 0.16. The last domain is biphasic
		between Li ,ହ Mn ,ହ ୍୍ Fe ,ହ ୍୍୍ PO ସ and Mn ,ହ ୍୍ Fe ,ହ ୍୍୍ PO ସ .

  0.75 Mn 0.75 Fe 0.25 PO 4 and Mn 0.75 Fe 0.25 PO 4 ) are

		View Online
	Downloaded on 29 August 2012	Published on 07 August 2012 on http://pubs.rsc.org | doi:10.1039/C2RA20949G	RSC Advances Accepted Manuscript
		shown in Table 1. Component Mn 0.75 Fe 0.25 PO 4 is characterized by a quadrupole splitting of 1.705
		mm/s.

Table 1

 1 Published on 07 August 2012 on http://pubs.rsc.org | doi:10.1039/C2RA20949G Mössbauer spectra of LixMn0.75Fe0.25PO4/C obtained at the indicated x values .Li 0.75 Mn 0.75 Fe 0.25 PO 4 Mn 0.75 Fe 0.25 PO 4 Hyperfine parameters of the composition involved during the electrochemical charge process .

	Li 0.70 Mn 0.50 Fe 0.50 II,III PO 4

Page 20 of 22 RSC Advances RSC Advances Accepted Manuscript Downloaded

  on 29 August 2012 Published on 07 August 2012 on http://pubs.rsc.org | doi:10.1039/C2RA20949G

	View Online
	hal-00736973, version 1 -1 Oct 2012

RSC Advances Accepted ManuscriptDownloaded on 29 August 2012 Published on 07 August 2012 on http://pubs.rsc.org | doi:10.1039/C2RA20949G View Online

Downloaded on 29 August 2012 Published on 07 August 2012 on http://pubs.rsc.org | doi:10.1039/C2RA20949G View Online

Acknowledgment

The authors would like to thank SAFT Company and CNRS (contract SAFT/CNRS N°029888) through the Ph.D. grant of Alexis Perea and ANR PHOSPHALION (National Research Agency) Stock-E program (ANR-09-STOCK-E-07) for financial support and Manfred Womes for fruitful discussions. Région Languedoc-Roussillon is gratefully acknowledged for the financial support to Xrays and gamma-rays platform (Contracts n° 2006 Q-086 and 2008 094192) a ICGM/AIME (CNRS UMR 5253), Université Montpellier II, CC 15-02

Place E. Bataillon, 34095 Montpellier Cedex 5, France. E-mail: alexis.perea@univ-montp2.fr b Saft Recherche Division, 111-113 Bld. Alfred Daney, 33074 Bordeaux, France


Mickaël Dardaillon
email: mickael.dardaillon@insa-lyon.fr

Kevin Marquet
email: kevin.marquet@insa-lyon.fr

Tanguy Risset
email: tanguy.risset@insa-lyon.fr

Antoine Scherrer
email: antoine.scherrer@inria.fr

Software Defined Radio Architecture Survey for Cognitive Testbeds

Keywords: Software radio, Cognitive radio, Computer architecture, Reviews, Digital communications

In this paper we present a survey of existing prototypes dedicated to software defined radio. We propose a classification related to the architectural organization of the prototypes and provide some conclusions about the most promising architectures. This study should be useful for cognitive radio testbed designers who have to choose between many possible computing platforms. We also introduce a new cognitive radio testbed currently under construction and explain how this study have influenced the test-bed designers choices.

I. INTRODUCTION

Radio technologies have been developed in a static paradigm: protocols, radio resources allocation and access network architecture were defined beforehand, providing non-adaptable radio systems. Nowadays, the saturation of radio frequency bands calls new era of radio networking which will be characterized by self-adaptive mechanisms. These mechanisms will rely on software radio technologies.

The concept of software radio has been coined by J. Mitola in his seminal work during the early 90's [START_REF] Mitola | Software Radios Survey, Critical Evaluation and Future Directions[END_REF]. While implementing the whole radio node in software is still an utopia, many architectures now hitting the market include some degree of programmability. Unfortunately, there is no agreement on the hardware architecture embedded in a mobile terminal with SDR facilities. Various technologies are used: ASIC, FPGA, DSP, GPP, etc. These technologies are often mixed and sometimes the term configurable is more adequate than programmable for them.

Studying architectures for emerging SDR systems is of crucial importance because of the need to define the hardware abstraction layer of SDR systems: the radio hardware abstraction layer (R-HAL). We believe that it is also of first importance for testbed providers, as we explain later in the paper.

In 2010, two important surveys where published [START_REF] Palkovic | Future Software-Defined Radio Platforms and Mapping Flows[END_REF], [START_REF] Ulversoy | Software defined radio: Challenges and opportunities[END_REF]. In [START_REF] Ulversoy | Software defined radio: Challenges and opportunities[END_REF], Tore Ulversøy provides a very complete review of SDR challenges related to software architecture, computational requirements, security, certification and business for SDR systems. Some SDR architecture prototypes are mentioned but are not the main topic of the study, and many other prototypes have been delivered since 2010. In [START_REF] Palkovic | Future Software-Defined Radio Platforms and Mapping Flows[END_REF], Palkovic This work is partially supported by Région Rhône Alpes ADR 11 01302401. et al. provide a precise comparative study between the Imec Bear Platform and other important SDR multi-core architectures. The comparison is made for architectures and programming flows. Our study focuses more precisely on architectures of SDR platforms available up to now. Programming models and programming tools used in these platforms are very important topics but much less mature today, most of these platforms being currently programmed "by hand". All the performances results presented in this paper are taken from bibliography.

Another goal of our contribution is to show how such a technological survey can be useful for cognitive radio testbed providers. In 2009, an NSF report [4] pointed out the lack of cognitive radio testbeds and urges "The development of a set of cognitive networking testbeds that can be used to evaluate cognitive networks at various stages of their development". We are currently involved in the development of a cognitive radio testbed called CortexLab which is part of the FIT platform [START_REF]Equipex fit: Future internet of things[END_REF]. Our work is motivated by the development of this platform: what is the most adapted SDR node for a cognitive testbed accessed via Internet ?

The rest of the paper is organized as follows: section II provides a brief summary of radio and SDR technology. Section III describes the different platforms and gather them in categories. The analysis of the different categories is made in the section IV. Section V describes the choices made for the CortexLab testbed. We draw conclusions in section VI. The different components of a radio system are illustrated in Fig. 1. Of course, all of the digital components may not be programmable, but the bigger the programmable part (DSP/FPGA part on Fig. 1), the more software the radio. Dedicated circuits are usually needed, for which the term configurable is more adapted than programmable. In a typical SDR, the analog part is limited to a frequency translation down to an intermediate band which is sampled, and all the signal processing is done digitally. To encourage a common meaning for the term "SDR", the SDR Forum (recently renamed Wireless Innovation Forum) proposes to distinguish five tiers. Tier 0 corresponds to hardware radio, Tier 1 corresponds to software controlled radio (only the control functions are implemented in software) and Tier 2 corresponds to software-defined Radio and is the most popular definition of SDR: the radio includes software control of modulation, bandwidth, frequency range and frequency bands. Tier 3 and 4 are not realistic today.

II. SDR TECHNOLOGY

Building an SDR terminal includes choosing a computing platform for the digital part, a sampling frequency and a radio front-end. In addition to the careful choice of a computing platform, the designer must make a trade-of between sampling frequency and terminal complexity. For instance, sampling a signal at 4.9 GHz (hence with a 10 GHz sample rate) is today not available with reasonable power consumption. Even with an evolution to lower power ADC, a high bandwidth ADC would produce more samples, hence require a more powerful or specialized platform. In this paper, we focus on the digital part represented on the left side of Fig. 1.

Finally, Cognitive Radio is a wireless system that can sense the air, and decide to configure itself in a given mode. Tier 2 SDR platforms are natural candidates for cognitive radio implementation but cognitive radios do not have to be SDR.

The hardware platforms we review in the following are considered from a SDR point of view. They target the implementation of wireless communication protocol stacks from application down to physical layer (including baseband processing and intermediate frequency conversion), for emission (TX) and/or reception (RX).

III. SURVEY OF HARDWARE PLATFORMS FOR SDR

In order to classify the SDR platforms, we need to define objective criteria. Trying to define criteria based on used technology can be tricky, as most platform are heterogeneous. Moreover, the technology used may not be a relevant criterion for platform users. The user will mainly be interested in the four following features: programmability, flexibility, energy consumption and computing power. Choosing a computing platform for a given application is a trade-of between these cost functions.

However, from the programmer point of view, the architecture is of major importance because it will have a crucial impact on programming models and tools used on the platform. We finally end up with six categories:

• General-purpose CPU approach • Co-processor approach • Processor-centric approach • Configurable units approach • Programmable blocks approach • Distributed approach Each approach is described in their corresponding subsections.

A. General-purpose CPU approach

The general-purpose CPU approach uses familiar computer processor to provide a computing platform, it is depicted in Fig. 2. It offers a flexible and easy way to program the platform, but with a high energy consumption for a performance objective.

RF

/ / P U o o / / co-processor Fig. 2. General-purpose CPU approach with optional co-processor

USRP:

The Universal Software Radio Peripheral (USRP) [START_REF]Universal software radio peripheral (usrp)[END_REF] is representative of the General-purpose CPU approach. It is composed of high frequency ADC/DAC which sample the signal in intermediate frequency. A FPGA converts and stores baseband signal. Most of the signal processing is done by a CPU connected to the FPGA by a USB link (USRP1) or a ethernet link (USRP2). The platform is widespread and supported by third party software. It is aimed to work with GNU radio, but is also compatible with National Instruments LabView and Mathworks Matlab.

Quicksilver: The Quicksilver [START_REF]Quicksilver[END_REF] module is similar in behaviour with the USRP. However, it is only able to receive RF signals.

Microsoft SORA: Recently, Microsoft developed SORA [START_REF] Tan | Sora: high-performance software radio using general-purpose multi-core processors[END_REF]. This platform is connected to the computer by a PCIe bus, which permits low latency and high throughput data transmission. It makes extensive use of modern CPU features to perform 802.11b/g processing in real time.

With the advance of Moore Law, one could imagine that future computers will be able to compute all protocols in real time. However, as shown in [START_REF] Ulversoy | Software defined radio: Challenges and opportunities[END_REF], the increase in data throughput is higher than the increase in computing power. Therefore, this kind of architecture will only be able to support past protocols, unless it can make use of higher parallelism.

B. Co-processor approach

In order to accelerate the signal processing, optimizations of the General-purpose CPU approach have been explored recently. They rely on the addition of a co-processor to perform heavy processing. It reduces the price to pay in terms of energy while keeping high programmability and flexibility.

The work presented in [START_REF] Horrein | Adapting a SDR environment to GPU architectures[END_REF] uses a GPU as a co-processor in a GNU radio flow. It permits gains of a factor 3 to 4 in processing speed.

KUAR: The Kansas University Agile Radio (KUAR) [START_REF] Minden | KUAR: A Flexible Software-Defined Radio Development Platform[END_REF] uses an embedded PC associated to a FPGA. The choice of the model of computation is left to the programmer, ranging from a full VHDL implementation (category described in subsection III-E) to a full processor implementation close to the GNU radio flow.

Other developments use generic DSP as central processor, which provides higher efficiency while keeping high programmability.

Texas Instruments: Texas instruments offers a threecore DSP with specialized symbol and chip rate accelerators. This product provides programming flexibility for WCDMA base cells, with support for up to 64 users and different protocols [START_REF] Agarwala | A 65nm C64x+ multi-core DSP platform for communications infrastructure[END_REF].

Imec ADRES: The ADRES (Architecture for Dynamically Reconfigurable Embedded Systems) [START_REF] Bougard | A coarse-grained array accelerator for software-defined radio[END_REF] developed by Imec is a coarse grain reconfigurable architecture. It is built around a main CPU and the ADRES accelerator. The ADRES is seen by the processor as a VLIW, while being an array of 16 functional units (FU). Each FU is a SIMD processor, which leverages the data parallelism. The processor is programmed using the DRESC compiler [START_REF] Mei | DRESC: A retargetable compiler for coarse-grained reconfigurable architectures[END_REF], in ANSI C. The DRESC compiler generates code to unroll loops and compute them using the ADRES accelerator. The ADRES is aimed at telecommunications, with benchmarks on 802.11n up to 108 Mbps and LTE up to 18 Mbps, with an average consumption of 333 mW [START_REF] Bougard | A coarse-grained array accelerator for software-defined radio[END_REF].

Hiveflex: Hiveflex [START_REF]Hiveflex[END_REF] produces accelerators based on many small cores. These accelerators are scalable in number of cores, depending on the application. All wireless protocols are targeted, from 802.11 to LTE, but no details about computing power or energy consumption are given. The accelerators are sold as soft IP with HiveCC, the company SDK.

These architectures offer only limited task parallelism, which may reduce their efficiency. The next categories fill this gap using tailored architectures with heterogeneous types of processors.

C. Processor-centric approach

P U ARM P U RF / / • • • P U P U Fig. 3. Processor-centric approach
One approach to get efficient and specialized platforms is to use dedicated processors. In this approach, dedicated processors are used to compute signal processing. The main processor, usually an ARM, is used for control.

The processor-centric approach has a high programmability, but the flexibility of the platform is reduced by its specific architecture. The architecture concept is depicted on Fig. 3.

NXP EVP16: The NXP EVP16 [START_REF] Berkel | Vector Processing as an Enabler for Software-Defined Radio in Handheld Devices[END_REF], presented in 2005, is composed of several units. An ARM processor provides control and LINK/MAC layers. A conventional DSP, a vector processor and several hardware accelerators are used for signal processing. The vector processor is built as a vectorized pipeline and addressed as a VLIW. It performs UMTS for a 640 kbps bandwidth at 35 MHz, with a maximum of 300 MHz [START_REF] Berkel | Vector Processing as an Enabler for Software-Defined Radio in Handheld Devices[END_REF].

Infineon MuSIC: Infineon built the MuSIC [START_REF] Ramacher | Software-Defined Radio Prospects for Multistandard Mobile Phones[END_REF] as a multi-DSP solution for SDR. The control is processed by an ARM processor. Signal computation is processed by 4 SIMD DSP and dedicated processors for filtering and channel encoding. Power consumption in WCDMA mode is 382 mW for the worst case and 280 mW for normal case. This chip is provided as a commercial solution under the name X-GOLD SDR 20 by Infineon [START_REF] Ramacher | Architecture and implementation of a Software-Defined Radio baseband processor[END_REF]. It is programmed using a mix of C code and assembly code for critical processing.

Sandblaster: The Sandblaster architecture [START_REF] Schulte | A low-power multithreaded processor for baseband communication systems[END_REF] is built around 3 units, the fetch and branch, the integer and load/store and the SIMD vector unit. Task parallelism is managed by a Token Triggered Threading (T 3 ) component, which provides hardware support for multithreading. On the SB3011 [START_REF] Glossner | The Sandbridge SB3011 Platform[END_REF], 4 sandblaster cores are integrated and controlled by an ARM processor. It is programmed in ANSI C with a dedicated compiler. Maximum consumption is 171 mW for WCDMA at 384 kbps [START_REF] Glossner | The Sandbridge SB3011 Platform[END_REF]. The SB3500 is sold as an IP by Optimum Semiconductor Technologies (http://optimumsemi-tech.com).

University of Michigan ARDBEG: The University of Michigan at Ann Arbor developed the SODA [START_REF] Woh | SODA: A Low-power Architecture For Software Radio[END_REF] SDR platform, and its prototype version ARDBEG [START_REF] Woh | From SODA to scotch: The evolution of a wireless baseband processor[END_REF]. SODA was developed as a complete software SDR solution. It consists of an ARM for control and 4 SIMD DSP for signal processing. ARDBEG builds on that platform by adding hardware turbo decoder and optimizing DSP for signal processing. All programming is made using C code. Consumption results on ARDBEG for WCDMA and 802.11a are under 500 mW [START_REF] Woh | From SODA to scotch: The evolution of a wireless baseband processor[END_REF].

University of Dresden Tomahawk: The University of Dresden, Germany developed the Tomahawk SDR chip [START_REF] Limberg | A fully programmable 40 GOPS SDR single chip baseband for LTE/WiMAX terminals[END_REF], aiming at LTE and WiMAX. It uses two Tensilica RISC processors for control, six vector DSP and two scalar DSP for signal processing, as well as ASIC accelerators for filtering and decoding. The scheduling is done by dedicated hardware and C code is used for programming. No protocol has been implemented yet on this platform. From the authors estimation, the platform consumption is about 1.5 W [START_REF] Limberg | A fully programmable 40 GOPS SDR single chip baseband for LTE/WiMAX terminals[END_REF].

D. Configurable units approach

In order to offer lower energy consumption, some platforms substitute DSP for configurable units. The difference between specialized DSP and configurable units is very thin, however we think that there is a frontier between these two types of devices.

Fujitsu SDR LSI: Fujitsu developed the SDR LSI [START_REF] Saito | Single-Chip Baseband Signal Processor for Software-Defined Radio[END_REF] in 2005. The platform makes extensive use of hardware accelerators, associated to reconfigurable processors. All these components are connected to a crossbar data network, and controlled by a central ARM processor. The chip was able to run 802.11a/b with a maximum throughput of 43 Mbps [START_REF] Saito | Single-Chip Baseband Signal Processor for Software-Defined Radio[END_REF].

Imec BEAR: The BEAR SDR platform [START_REF] Palkovic | Future Software-Defined Radio Platforms and Mapping Flows[END_REF] is the evolution of the ADRES from Imec. It is constituted of an ARM processor for control and three ASIPs for coarse time synchronisation on different front ends. Two ADRES coarse grain configurable architectures, as described in subsection III-B, are used for baseband processing with a Viterbi accelerator. The platform can be programmed with C or Matlab code, using the Imec development chain. In terms of energy consumption, BEAR achieves 2x2 MIMO OFDM at 108 Mbps for 231 mW [START_REF] Derudder | A 200Mbps+ 2.14 nJ/b digital baseband multi processor system-on-chip for SDRs[END_REF]. Imec is licensing the BEAR platform as an IP block.

CEA Magali: The Magali SDR chip [START_REF] Clermidy | An Open and Reconfigurable Platform for 4G Telecommunication: Concepts and Application[END_REF] is developed by the CEA as a telecommunication demonstration platform. It is built on a network on chip, each peripheral having an access to the network, with an ARM processor controlling configurations. Computation is done by coarse grain reconfigurable cores called Mephisto and reconfigurable IP for OFDM, decoding and deinterleaving. Smart memory engines are distributed on the NoC and act like DMA, while also providing data rearrangement. The chip performs 4x2 MIMO LTE reception in the most demanding scenario with a consumption of 236 mW [START_REF] Jalier | Heterogeneous vs homogeneous MPSoC approaches for a mobile LTE modem[END_REF].

EURECOM ExpressMIMO: The ExpressMIMO is developed as a configurable units approach on a FPGA by EURECOM [START_REF] Nussbaum | Open Platform for Prototyping of Advanced Software Defined Radio and Cognitive Radio Techniques[END_REF]. All the configurable units share a common network interface, DMA engine and microcontroller, and each as a specific configurable IP for data processing. The board targets OFDM MIMO implementation and uses the open-source OpenAirInterface framework [START_REF]Open air interface[END_REF].

University of Twente Annabelle: University of Twente, Netherlands developed the Annabelle SDR chip. It is also built on a network on chip, using coarse grain reconfigurable cores. An ARM processor is used for control, and accelerator modules (Viterbi, etc.) are connected to the ARM through an AMBA bus. Only OFDM specific benchmarks have been published at the time of submission.

E. Programmable blocks approach

The last approach uses programmable blocks and is mainly constituted of FPGAs. It doesn't provide programmability as it is, but great flexibility to create tailored architectures. Programmable blocks offer high computing power for moderate energy consumption.

XiSystem: The XiSystem [START_REF] Lodi | XiSystem: a XiRisc-based SoC with reconfigurable IO module[END_REF] is a VLIW architecture featuring 3 concurrents datapaths, including a PiCoGA (Pipelined Configurable Gate Array). The PiCoGA is an oriented datapath FPGA which executes specific instructions for the processor at run-time. The development is made with C to provide code for both the VLIW and the PiCoGA. It is aimed at embedded signal processing in general, with a benchmark on MPEG2 encoding and an average consumption of 300 mW [START_REF] Lodi | XiSystem: a XiRisc-based SoC with reconfigurable IO module[END_REF].

Rice University WARP: The Rice University has developed WARP [START_REF]Warp[END_REF], an open SDR platform. The computation is done by a Xilinx Virtex FPGA. Programming uses VHDL language. An open source community is led by the Rice University to offer open source implementations on the platform.

Rutgers University WINC2R: WINC2R is an original platform for SDR developed by the Rutgers University. The platform is built on a FPGA, with softcore processors and accelerators. Softcore processors can be programmed with GNU radio. Computation flow can be balanced on processors or accelerators, depending on the constraints. Moreover, by using an FPGA, accelerators can be chosen and tuned during development. 802.11a has been implemented on the platform [START_REF] Satarkar | Performance analysis of the WiNC2R platform[END_REF].

Lyrtech: The Lyrtech company [START_REF]Lyrtech[END_REF] offers development tools and platforms for SDR based on FPGA. Development is done using Simulink model-based approach. The platform is presented as supporting MIMO WiMAX. Many other companies offer similar products based on FPGA ([34], [START_REF]Pentek[END_REF] for instance).

F. Distributed approach

The distributed approach has only few elements, distributed control representing a challenge in terms of programmability. We present here SDR platforms using distributed computing.

Picochip: Picochip [START_REF] Pulley | Software defined baseband processing for 3G base stations[END_REF] approaches signal processing using many small cores. These cores are mapped on a deterministic matrix. A C based development tool flow is provided by the company. No benchmark is provided for this chip. However, the company is annoucing OFDM and 4G base stations as reference applications on its website.

UC Davis AsAP: The University of California at Davis developed the Asynchronous Array of Simple Processors [START_REF] Truong | A 167-processor computational platform in 65 nm CMOS[END_REF] (AsAP). This project aims at providing signal processing computation using small processors. All processors can communicate with their nearest neighbours, in a grid like array. The version 2 adds hardware accelerators for FFT, Viterbi and video motion estimation, while increasing the total number of cores to 167. Complete 802.11a/g is processed at 54 Mbps using 198 mW [START_REF] Truong | A 167-processor computational platform in 65 nm CMOS[END_REF].

CEA Genepy: CEA Genepy [START_REF] Jalier | Heterogeneous vs homogeneous MPSoC approaches for a mobile LTE modem[END_REF] is using coarser grain for its distributed approach. It is based on Magali [START_REF] Clermidy | An Open and Reconfigurable Platform for 4G Telecommunication: Concepts and Application[END_REF] technology, using the Network on Chip and the coarse grain configurable cores presented in subsection III-D. The control carried out by the ARM processor is undertaken by distributed small RISC processors. Each cell on the network is composed of two Mephisto cores, one Smart Memory Engine and a RISC controller. The platform is purely homogeneous, with no hardware accelerators. In terms of computing power, 4x2 MIMO LTE reception is processed with a total consumption of 192 mW [START_REF] Jalier | Heterogeneous vs homogeneous MPSoC approaches for a mobile LTE modem[END_REF].

IV. ANALYSIS

In order to better understand each category, we summarize the main characteristics for key-platforms that use different approaches in Table I. Energy consumption is not defined for FPGA-based platforms because it is heavily dependent on the configuration. Based on these key platforms, we draw conclusions on the application fields of each category. If you don't want to study energy consumption nor architecture algorithm adequacy, the general-purpose CPU approach is the easiest way to go. However, if you intend to study energy consumption or computing power impact, this approach is not recommended. Indeed, dedicated hardware platforms have very different behaviours compared to generic processors. This makes it difficult to establish a relationship between computing power and energy consumption for the generic approach and others. As an example, for a given protocol, computing requirements may vary with a factor of 100 in the literature, depending on the architecture granularity.

In order to study computing power and have the lowest energy consumption, a heterogeneous approach which exploits hardware acceleration is a better starting point. In this family, using DSPs as in Imec's solution [START_REF] Palkovic | Future Software-Defined Radio Platforms and Mapping Flows[END_REF] or configurable blocks as in Magali [START_REF] Clermidy | An Open and Reconfigurable Platform for 4G Telecommunication: Concepts and Application[END_REF] is clearly a pragmatic and efficient approach.

Unfortunately, using such a solution makes you heavily dependent on the platform architecture, and porting a waveform to a different architecture can be tricky. Providing a common HAL is a real challenging but promising way to develop practical multi platform SDR.

Alternatively, the programmable blocks approach provides a flexible and efficient platform for prototyping. It can be versatile in the architecture choice, see the radically different approaches from [START_REF]Warp[END_REF] and [START_REF] Satarkar | Performance analysis of the WiNC2R platform[END_REF] for example.

From these perspectives, we are now going to address the problem of building a cognitive SDR testbed.

V. COGNITIVE RADIO TESTBED

A. Related work

Large-scale cognitive radio testbeds are mandatory to develop and evaluate the performance of upcoming PHY/MAC layers and future cognitive radio algorithms. Whereas numerous testbeds are available in the field of wireless communications (sensor or 802.11-oriented, see for instance Orbit developped at Winlab, Rutgers University), only a few large-scale testbeds have been developed in the SDR and cognitive radio field. Appart from on-going projects such as CREW [START_REF]Cognitive radio experimentation world[END_REF] or TRIAL [START_REF]Trial environment for cognitive radio and networks[END_REF] and some small testbeds involving less than 10 nodes, we found only one testbed developed at Virginia Tech., CORNET [START_REF] González | Open-source sca-based core framework and rapid development tools enable software-defined radio education and research[END_REF], where 48 USRP2 with custom RF front-ends have been dispatched in the ceilings of a building, spanning 4 floors. The registered users can remotely program and run experiments on the USRPs. Nodes can be programmed using the OSSIE framework [START_REF] González | Open-source sca-based core framework and rapid development tools enable software-defined radio education and research[END_REF] also developed at Virginia Tech.

B. Cortexlab

We are currently building a new cognitive radio testbed in Lyon named CortexLab [START_REF]Cortexlab: Cognitive radio testbed[END_REF], as part of the Future Internet of Things [START_REF]Equipex fit: Future internet of things[END_REF] french funding, we will deploy about 50 cognitive radio nodes together with 50 wireless sensor nodes in a electromagnetically isolated room so as to bring radio propagation under control. The testbed will be open to the scientific community within two years and will allow academics and industrials to conduct real-life cognitive radio experiments. Nodes will be remotely programmable just as if users had them on their desk. Our approach differs from CORNET in that 1) the topology and the room have been selected to target reproducibility and control over the radio propagation and 2) the nodes will have the computing power to run WiFi/LTE in real-time at standard rates and using 2x2 MIMO. We believe USRP2, even with a powerful host PC, cannot achieve such a computing power. The organization of CortexLab testbed is illustrated on Fig. 4.

Our main objective is to enable users to run real-time communications with custom APP (application such as traffic generation), MAC (medium access control) and PHY layers implementing state of the art (WiFi, Zigbee) and upcoming (LTE, LTE adv.) standards. The programmability of the platform is a key factor since this has to be done easily and remotely.

Following the conclusions of the previous section, we chose to mix two types of nodes in the testbed: general-purpose CPU nodes and programmable blocks nodes. The general-purpose CPU nodes should be able to run an open source environment (GNU radio or Open Air interface for instance) allowing rapid prototyping at slow data rates, and the programmable ones should be able to run advanced and MIMO PHY layers. Fig. 5 shows a block diagram of a node. The difference between the general-purpose CPU and the programmable node is the size of the FPGA and the function of the PHY layer that are assigned to it. Note that the programming of FPGA is much different from software programming, involving different skills and most of the time different people. The challenge is therefore to abstract those pieces of hardware such that they can be derived from higher-level specifications. We are currently investigating two approaches in this field: high-level synthesis and Systemgenerator coupled with Matlab.

VI. CONCLUSION

We have reviewed existing platforms for software-defined radio and classified them with respect to their programmability, flexibility, energy consumption and computing power. Although the classification we proposed is clearly arbitrary and based on our experience, we believe this survey gives an up-to-date global view of the available solutions. Based on our study, we saw that some platforms trends are emerging. In our case, as we intend to study computing power and energy consumption while keeping programmability, we chose a mixed FPGA/generalpurpose processor platform.

A promising research direction we are investigating at the moment is the design of a software layer able to abstract from the different categories we have seen in this paper.

Fig. 4 .

 4 Fig. 4. Overview of the CortexLab testbed

Fig. 5 .

 5 Fig. 5. Hardware/software requirements for the CortexLab cognitive radio node.


Mickaël Dardaillon
email: mickael.dardaillon@insa-lyon.fr

Cédric Lauradoux
email: cedric.lauradoux@inria.fr

Tanguy Risset
email: tanguy.risset@insa-lyon.fr

Hardware Implementation of the GPS authentication

Keywords: GPS, parallel/serial implementation, multiplication by a constant

In this paper, we explore new area/throughput tradeoffs for the Girault, Poupard and Stern authentication protocol (GPS). This authentication protocol was selected in the NESSIE competition and is even part of the standard ISO/IEC 9798. The originality of our work comes from the fact that we exploit a fixed key to increase the throughput. It leads us to implement GPS using the Chapman constant multiplier. This parallel implementation is 40 times faster but 10 times bigger than the reference serial one. We propose to serialize this multiplier to reduce its area at the cost of lower throughput. Our hybrid Chapman's multiplier is 8 times faster but only twice bigger than the reference. Results presented here allow designers to adapt the performance of GPS authentication to their hardware resources. The complete GPS prover side is also integrated in the network stack of the PowWow sensor which contains an Actel IGLOO AGL250 FPGA as a proof of concept.

I. INTRODUCTION

A current trend in cryptography is the design of primitives with a low-cost implementation. Lightweight cryptography [START_REF] Eisenbarth | A Survey of Lightweight-Cryptography Implementations[END_REF] is interested in metrics such as the circuit area, energy consumption or code size. The Girault, Poupard and Stern authentication protocol (GPS) is one of the oldest lightweight primitives which has been recommended by the European project NESSIE [START_REF] Baudron | GPS -An metric Identification Scheme for on the Fly Authentication of Low Cost Smart Cards[END_REF] and appeared in the ISO/IEC 9798-5 standard [START_REF]ISO/IEC 9798 -Information technology -Security techniques -Entity authentication[END_REF]. GPS is a reference in the domain of lightweight authentication and the existing implementations aim to reduce as much as possible the area. In this paper, we explore the trade-off between speed and area in the implementation of GPS.

Implementing GPS consists in designing an adder and a multiplier. The latter is the most critical part in a GPS core. Three typical strategies can be followed to implement this core: serial, parallel and a trade-off between the previous two that we designate by hybrid. The serial implementation based on shift-and-add has been already covered in [START_REF] Mcloone | Public Key Cryptography and RFID Tags[END_REF] and is the baseline for area. The other two strategies have not yet been studied. The parallel implementation is the traditional method to achieve the best speed at the drawback of a large area. The hybrid implementation in our paper is in fact a serialization of the parallel approach that takes advantage of hardware repetition. It provides a trade off between serial/parallel approaches by executing chunks of parallel multiplication.

This work is partially supported by Région Rhône Alpes ADR 11 01302401.

To implement a parallel implementation of GPS, we face a big challenge: implementing parallel multiplier with large variable operands is out-of-question. To overcome this limitation, we have specialized our parallel and hybrid implementations for a specific key. The complexity of our multiplier is therefore reduced to the implementation of a multiplier by a constant [START_REF] Wirthlin | Constant Coefficient Multiplication Using Look-Up Tables[END_REF].

We attempt to integrate our different implementations in the network stack of the wireless sensor platform PowWow. This platform embeds an Actel IGLOO FPGA with a 8 MHz clock cycle. Our simulation results for a security level of 128-bit show that the parallel implementation of GPS with a secret takes 1µs against 42µs for the existing serial implementation at 8 MHz. However, it does not fit within the FPGA. The integration of GPS into our platform is only possible for hybrid and serial implementation.

We note that the basic GPS protocol requires a 320µs response time, but McLoone and Robshaw circumvent this difficulty by using a different protocol in their article [START_REF] Mcloone | Public Key Cryptography and RFID Tags[END_REF] with a 18ms latency. Our implementation fulfil the 320µs constraint for all architectures at 8 MHz, and would help reach this goal at a lower frequency for parallel and hybrid implementations.

The rest of this paper is organized as follows. The GPS protocol is reminded in Section II. The Section III describes the existing serial implementation of GPS. The main contributions of the paper are given in Section IV and V with the description of the parallel and hybrid implementation. The performances are compared and analyzed in Section VII.

II. GPS PROTOCOL

The GPS authentication protocol [START_REF] Baudron | GPS -An metric Identification Scheme for on the Fly Authentication of Low Cost Smart Cards[END_REF] is an interactive zeroknowledge authentication protocol initially proposed by Girault, Poupard, and Stern [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF]. It provides provable security based on the composite discrete logarithm problem. It also combines short transmissions and minimal on-line computation, using precomputed "coupons". This protocol has been selected in the NESSIE portfolio [START_REF]Portfolio of recommended cryptographic primitives[END_REF] and it is mentioned in the ISO/IEC 9798-5 Clause 8 [START_REF]ISO/IEC 9798 -Information technology -Security techniques -Entity authentication[END_REF] as a reference. Throughout the paper, we implicitly refer GPS as this variant "with coupons". a) Description: The parameters used in this protocol are the following:

• S, C, D are public integers, where |S| ≈ 180 bits1 , |C| = 32 and |D| = |S| + |C| + 80, • n = p × q is a public composite modulus, where p and q are secret primes, |n| = 1024, |p| = |q| = 512,

• g is an element of Z * n , • Φ = (C -1) × (S -1), • s ∈ [0, S[ and I = g -s mod n, • a coupon i is a couple (r i , x i = g ri mod n), where r i ∈ [0, D[ is a random number.
At the beginning, the prover P has a unique identifier Id P , a unique pair of keys (the private s and the public I) and a set of coupons c computed by a higher trusted entity. The verifier V knows the prover's identifier and public key.

Verifier V

Prover P Id V , I Id P , s, I, c

Id P , xi ←---------- (1)
(2)

n V -----------→ (4) y ← ----------- (3)
Fig. 1. The GPS protocol.

GPS, depicted in Fig. 1, works as follows.

(1) The prover P chooses a coupon (r i , x i ), and sends its identifier Id P and x i to the verifier R.

(2) The verifier answers a challenge n V randomly chosen in the interval [0, C[. (3) The prover computes y = r i + n V × s, and sends y to the verifier. (4) The verifier checks if:

• g y × I n V mod n = x i , • y ∈ [0, D + Φ[.
The arguments supporting the security of GPS can be found in [START_REF] Baudron | GPS -An metric Identification Scheme for on the Fly Authentication of Low Cost Smart Cards[END_REF], [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF]. They are not included because the security of GPS is not affected by our results.

In the remaining of the paper, s is named the secret, n V is named the challenge and r i the commitment (see [START_REF] Baudron | GPS -An metric Identification Scheme for on the Fly Authentication of Low Cost Smart Cards[END_REF]).

b) Existing implementation: GPS authentication has been designed for constraint embedded systems such as smart cards, RFID or sensors networks. The critical part for the implementation is on the prover side assuming that the verifier (RFID reader or a base station) suffers from less restriction.

Two steps are critical for the prover: the computation of x i (Step (1)) and y (Step (3)). The computation of x i is the most expensive one (exponentiation) but the prover has nothing to do thanks to the coupons (pre-computation). Therefore, the last remaining cost is the Step (3) which consists of the multiplication by s and the addition of r i . The multiplication by s is the most complex due to the size of the multiplicands.

GPS was first designed for smart cards [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF]. McLoone and Robshaw proposed in [START_REF] Mcloone | Public Key Cryptography and RFID Tags[END_REF], [START_REF] Mcloone | New Architectures for Low-Cost Public Key Cryptography on RFID Tags[END_REF] the first hardware implementation of GPS. Their solution is based on the shift-and-add algorithm for multiplication. It offers a very small hardware footprint. This implementation is described in Section III and it serves as the reference in our comparison.

Girault and Lefranc [START_REF] Girault | Public Key Authentication with One (Online) Single Addition[END_REF] proposed a variant of GPS which exploits low Hamming weight secret s. The multiplication is transformed in an addition when the secret is chosen properly. This variant can significantly reduce the cost of GPS. However, this solution was subsequently attacked in [START_REF] Coron | A New Baby-Step Giant-Step Algorithm and Some Applications to Cryptanalysis[END_REF], and it is not considered in this work.

In the following sections, the different architectures for GPS are explored. Two criteria are examined: area and speed. A cryptographic design can be tuned for a specific key or support any value for the key. Throughout this paper, fixed-key and variable-key implementation are considered. McLoone and Robshaw have proposed in [START_REF] Mcloone | Public Key Cryptography and RFID Tags[END_REF] the reference serial implementation of GPS. This architecture is based on the classical shift-and-add multiplication (Fig. 2). The core of the design is a 16-bit adder. The product n V ×s is decomposed into a succession of 16-bit additions. The same 16-bit adder is re-used to perform the final addition n V × s + r i in 16-bit chunks. The architecture of McLoone and Robshaw is presented on Fig. 3. The control logic block process the challenge n V bitwise and drives the multiplexers. The first multiplexer selects 16 bits of the secret s or 0, depending on the challenge bit. The adder sums the multiplexer data with the previous results stored in the shift register. The final addition of r i with the result is controlled by the second multiplexer. The same hardware is re-used for this addition. The data is processed sequentially by 16-bit blocks to obtain a serial architecture. The balance between occupied area and execution time is set by the data bus size. Doubling the data bus size halve the required run cycles, while increasing the adder and the multiplexer size.

III. SERIAL IMPLEMENTATION

We have implemented the serial architecture of McLoone and Robshaw independently, and we get area results close to their original article for the different security parameters (see Table I). However, McLoone and Robshaw results only take into account the computing hardware. We give results for a complete implementation of the serial multiplier, including memories for n V , r i , s and y.

IV. PARALLEL IMPLEMENTATION

A multiplier can be implemented using lookup tables (ROM). Let us consider two variable operands n V and s, of size |n V | and |s|. The product n V × s has a |n V | + |s| bits width. A lookup table approach requires to store:

2 |n V |+|s| × (|n V | + |s|) bits.
While being attractive for small values of n V and s, lookup tables are clearly not practicable for GPS, i.e. |n V | ≥ 32.

A first attempt to reduce this cost consists in fixing s. This hypothesis implies our implementation is dedicated to a given key. In cryptographic implementations, the key can be updated. To our knowledge, there are two exceptions. FPGA supplier provides encryption scheme with fixed key to protect the users bit-stream. White-box cryptography [START_REF] Wyseur | White-Box Cryptography[END_REF] also uses implementation with fixed key but to obfuscate the key into the code. Our goal is to show that implementation with fixed key can provide benefits in term of throughput.

Using this assumption, the cost of a table lookup multiplier can be reduced to:

2 |n V | × (|n V | + |s|) bits.
This approach is still not reasonable for GPS.

To further reduce the memory size, Chapman proposed in [START_REF] Chapman | Constant Coefficient Multipliers for the XC4000E[END_REF] the KCM method (for k constant multiplier) to decompose the computation into partial products. Let us explain Chapman's KCM method in decimal basis (Fig. 4) for the multiplication of 953 × x. If one can store in look-up tables (LUT) the nines values 1 × 953, 2 × 953,. . . , 9 × 953, then one can compute the whole product by simply adding stored values as indicated in the Fig. 4 For an hardware design, KCM uses 2 basis rather than the decimal basis. The choice of depends on the trade-off between the cost (memory and adder) and the technology characteristics (number of inputs per lookup table). For example, a classic Xilinx Virtex 4 as 4-input LUT, and our Actel Igloo as 3-input LUT. First, 2 values need to be stored in each table, hence for a total memory size of:

|n V | × 2 × (|s| + ) bits.
The results obtained from these tables are combined by |n V | -1 adders of |s| + bits.

n V (0 : 3) n V (4 : 7) n V (8 : 11)
s × n V (0 : 3) Fig. 5. KCM constant multiplier (adapted from [START_REF] Wirthlin | Constant Coefficient Multiplication Using Look-Up Tables[END_REF]).

This architecture is illustrated on Fig. 5 for |s| = 8, |n V | = 12 and = 4. Each lookup table takes one part of n V as an input. The partials results are combined using 2 adders to produce the final result. Note that the left shifts are done by positioning the partial results and have no gate cost. Note also that the result is obtained in a single cycle, with a very long critical path that could slow down the clock cycle of the circuit. To cope with this clock cycle problem, the designer can pipeline the circuit, increasing latency but maintaining a throughput of 1 result per clock cycle.

For our GPS implementation of the parallel approach, we used a KCM operator generated by the FloPoCo library2 . This library is an open source project for non-standards arithmetic operators. It provides in particular several integer constant multipliers [START_REF] Brisebarre | Integer and floatingpoint constant multipliers for FPGAs[END_REF]. All operators are pipelined to run at high frequency (default setting at 300 MHz on Virtex FPGA). The Fig. 6 illustrates the parallel implementation of GPS used in our design. The notation KCM 32,4 (s) stands for Chapman constant multiplier of a 32-bit number with the constant s, using 4-input LUT. The product is computed by the constant multiplier core generated with FloPoCo, with the secret s as a constant. The result s × n V is added to r i .

This architecture is the fastest in terms of speed using the property that the secret s is constant to reduce the size of the implementation. The performance results of the parallel approach are presented further in the paper, but the design could not fit on a small embedded FPGA such as the IGLOO AGL250 used in PowWow, hence the need of a trade-off between the serial and parallel approach. The idea of the hybrid implementation is to serialize the KCM architecture of Fig. 5 horizontally. Indeed, each horizontal row of LUT is the same: it contains all the values of s multiplied by 0, 1, . . . , 2 -1. Hence if we sequentialize the addition of one row with the others we may use a single LUT of size 2 × |s| + . The challenge n V is sent by blocks of four bits to drive the LUT, the output of the LUT is added to the accumulation register and then shifted by four bits for the next addition.

V. HYBRID IMPLEMENTATION

The architecture, illustrated on Fig. 7, uses one KCM table of 2 × (|s| + ) bits to compute the product between bits of the challenge and the constant s. The result is accumulated and shifted by bits each cycle. The adder is reused to sum the result of the multiplication with r i . All the computation is done using a parallel adder. To further reduce the critical path, the adder could also be sequentialized with a sequence of smaller adders as it was done for the serial approach in section III.

VI. EXPERIMENTAL PLATFORM

We performed our implementation on the wireless sensor platform PowWow 3 . This platform is specifically designed to be energy efficient [START_REF] Berder | PowWow : Power Optimized Hardware/Software Framework for Wireless Motes[END_REF], and offers a constraint hardware platform in terms of area and time. It uses the Actel IGLOO AGL250 FPGA for control and a Texas Instrument CC2420 chip for RF communications. Actel IGLOO uses non volatile flash technology for FPGA dedicated to low power.

We integrated the GPS authentication into the network stack of the platform. The physical layer is based on the 802.15.4 standard with a CSMA/CA access provided by the CC2420 and controlled by the FPGA. It supports a simple point to point access with the verifier in order to process the whole 3 http://powwow.gforge.inria.fr GPS authentication (see Fig. 1 for details). In our set-up, the verifier is a computer interfaced with a Senslab4 node for telecommunications.

The implementation was verified by authenticating the prover to the verifier 8 times in a row, and with different keys on separate synthesis, using vectors generated by GMP 5 as reference. The serial architecture was evaluated with several challenge and key sizes (|s| = {128, 256, 512}, |n V | = {16, 20, 32}). The hybrid architecture could be implemented on the platform for a key size up to 256 bits. The experimental set-up is illustrated on Fig. 8. In order to validate our work, we have implemented independently the serial approach of GPS to check that our results were compatible with those of McLoone and Robshaw in [START_REF] Mcloone | Public Key Cryptography and RFID Tags[END_REF]. The synthesis was done on the Cadence ATL Compiler and normalized to a NAND size to be consistent with [START_REF] Mcloone | Public Key Cryptography and RFID Tags[END_REF]. The Table I compares our area results with the existing ones. The difference is below 5 % for a serial implementation with an 8-bit adder and below 10 % with an 16-bit adder. We consider these differences as acceptable: our serial implementation can be used as a benchmark to compare the different architectures. From Section III to V, three different approaches to implement GPS have been described to obtain a low area footprint, an high throughput or a trade-off between them. We now aim to verify these expectations, compare our implementations quantitatively and determine the influence of the secret size.

Prover Verifier

The three approaches discussed above were written in VHDL and different synthesis were made. All the results are given for a synthesis and a mapping performed using Actel tools and targeting Actel IGLOO AGL250. The targeted clock cycle was fixed for all impementations at 8 MHz, frequency used on the PowWow platform. During our experiments, we have aligned systematically the bus size on the adder size. Moreover, we evaluated the overall footprint, including all the required memories. This is an important point, as it turns out that memories are occupying much more space than computing parts. It also permits to illustrate the gains obtained by using a constant multiplier, which includes the constant memory. We plotted the area and throughput for the three implementations on Fig. 9. This illustrates the three different balances between area and throughput achieved by the three implementations. Moreover, these balances are maintained for the different levels of security, and both the area and throughput can be represented by a linear approximation in function of the secret size (y = a * |s| + b). We observe that the area is increasing with the security size for the serial (a = 5, 6), the parallel (a = 89, 8) and the hybrid (a = 11, 3 ) implementation, with the best scaling for the serial approach in regards of the area. In terms of throughput, the serial implementation as a negative slope (a = -46, 3 * 10 -6 ), contrary to the parallel (a = 125 * 10 -3 ) and hybrid (a = 61, 9 * 10 -6 ) implementations, which gets a better throughput by using a larger secret |s|.

The results shown in Table II compares the three implementations in terms of hardware area, run cycles and throughput (in cycles per byte of result). We use the serial implementation as a reference for our comparison. The parallel implementation has an area 10 times larger than the serial implementation. For that cost, its pipeline structure provides a new result each cycle and a 40 times smaller latency when using multiauthentication. The hybrid implementation offers a middle ground with an area less than doubled, and an 8 times smaller latency.

We also explored the impact of the adder size on the area for the serial implementation in the Table III. To reduce the area, it would seems logical to choose the smallest adder. However, it impacts also the bus size and how the memory is addressed. Therefore, choosing the smallest adder is not necessarily the best solution because it can imply an addressing overhead. The gain for the adder can be offset by the memory cost. This effect is highly dependent on the underlying technology. In our case, the 16-bit adder has a lower area than the 8-bit one. In order to be complete on the implementation footprint, we should also add the coupon footprint. By using a PRNG as suggested in the McLoone and Robshaw article [START_REF] Mcloone | Public Key Cryptography and RFID Tags[END_REF], one can reduce the footprint to 1000 NAND equivalent for storing 20 coupons, with another 1000 NAND for the PRNG. This would require about 2300 core cells, and is compatible with the serial and hybrid implementation for 128-bit and 256-bit secret size.

VIII. CONCLUSION

Several architectures for GPS are presented in this work offering different balances between area and throughput. With respect to this goal, our contribution is three-fold. First, we have shown that using a fixed key can enable new implementations possibilities. Second, we have serialized KCM to reduce its area cost. To our knowledge, this is the first time that such a trade-off is proposed for KCM. Third, we have integrated our GPS cores into a real platform (PowWow) to enable nodes authentication in a wireless sensor network. By integrating the memory cost, we have a better view of the overall area needed for GPS. Two of our cores are compatible with the platform constraints.

We have shown the benefits of having a fixed key for the implementation of GPS. In return, an adversary may exploit these features to mount side-channel attacks (SPA, DPA. . . ). While not considered in this work, it will be interesting to analyze how resistant are our implementations to these attacks.

We focused on GPS but our results impact the implementation of more cryptosystems. In term of hardware architecture, GPS is very similar to WIPR [START_REF] Oren | A low-resource public-key identification scheme for RFID tags and sensor nodes[END_REF] and BlueJay [START_REF] Saarinen | The BlueJay Ultra-Lightweight Hybrid Cryptosystem[END_REF]. These two cryptosystems are based on an early paper of Shamir [START_REF] Shamir | Memory Efficient Variants of Public-Key Schemes for Smart Card Applications[END_REF] which introduced randomized multiplication cryptosystem. The cores of these proposals are an adder and a multiplier as for GPS. Our solutions can be adapted to implement WIPR, BlueJay and Shamir's scheme. In a future work, we will compare the implementations of these different schemes.

101001 × 110 1 ×Fig. 2 .

 12 Fig. 2. Shift-and-add classical binary multiplication.

Figure 1 : Serial architecture 1 Fig. 3 .

 113 Figure 1: Serial architecture

Fig. 4 .

 4 Fig. 4. Chapman KCM principle for multiplication by 953 in decimal basis.

Fig. 6 .

 6 Figure 2: Parallel architecture

2 Fig. 7 .

 27 Figure 2: Parallel architecture

Fig. 8 .

 8 Fig. 8. PowWow running a wireless authentication.

Fig. 9 .

 9 Fig. 9. Area vs throughput for a 32-bit challenge (log scale) and different secret sizes (|s| = {128, 256, 512}).

  for 953 × 482.

			953
		×	482
	4 × 953 × 100 → + 3812 . .
	8 × 953 × 10	→ +	7624 .
	2 × 953	→	1906
			459346

In all the paper we use the notation |X| for the size in bits of number X 978-1-4673-2921-7/12/$31.00 c

IEEE

http://flopoco.gforge.inria.fr

http://www.senslab.info

http://gmplib.org

ACKNOWLEDGMENTS

The authors wants to thank Florent de Dinechin from Aric INRIA team for his help on constant multiplication and Romain Fontaine from the CAIRN INRIA team for his help on the RF-communication of PowWow platform.