High-speed architectures for binary-tree based stream ciphers: Leviathan case study

Transcription

1 High-speed rhitetures for inry-tree sed strem iphers: Levithn se study Astrt Rel-time pplitions suh s streming medi nd voie require enryption lgorithms tht do not propgte errors nd support fst enryption on smll loks. Sine IP pkets re delivered out-of-order in routed networks it is diffiult to synhronize the soure nd the destintion, therefore requiring enryption lgorithms to support out-of-order genertion of key strem. In this pper we investigte high-speed prllel nd pipeline rhitetures for Levithn, inry tree sed synhronous strem ipher tht does not propgte errors nd supports ordered nd out-of-order key strem genertion. The prllel rhiteture ounds the worst-se vrine in the time etween onseutive key words nd the pipeline rhiteture genertes key words t uniform rte. In order to eliminte the storge overhed ssoited with strightforwrd preorder trversl, we developed novel trversl sheme tht intertwines inorder trversl with preorder trversl. We implemented pipeline rhiteture using Xilinx FPGAs to support Gps key strem genertion rte.

2 Introdution The Internet is onnetionless routed network uilt of interonneted nodes known s routers nd end-hosts. The Internet Protool (IP) is used y nodes in the internet to ommunite with eh other. Routers forwrd trffi to end-hosts nd to other routers sed on IP pket heder informtion. Although the IP pket heder informtion is suffiient to route pkets, it does not provide for the privy of the pket dt. In order to gurntee the privy of the pket dt the Internet hs n overly of Virtul Privte Networks (VPN) []. There re two ommonly used methods for uilding VPNstrusted VPN nd seure VPN. In trusted VPN the provider gurntees tht no other trffi hs ess to the links providing servie. In seure VPN the nodes ommunite y enrypting the informtion. Seure VPNs re primrily uilt using the IP Seurity Protool (IPSe) []. Deployment of IPSe sed VPN hs elerted the demnd for high-speed ryptogrphi rhitetures supporting keyed hsh funtions, puli-key lgorithms, privte-key lok iphers nd strem iphers []. Hsh funtions trnslte ritrry length messges into fixed length digest. Asymmetri puli-key lgorithms use one-wy funtions nd seprte enryption nd deryption keys; one nnot derive the deryption key from the pulily ville enryption key. On the other hnd, symmetri privte-key lgorithms use single key for enryption nd deryption. While privte-key lok iphers operte on lrge loks of plintext (iphertext), strem iphers operte on loks s smll s single it. Exmples of lok iphers inlude Dt Enryption Stndrd (DES) [] nd Advned Enryption Stndrd (AES) [5]. initil stte Internl Stte Seed Key K Next Stte Funtion Output Funtion Keystrem Plintext Ciphertext Figure : Key strem genertor: The output funtion, the next stte funtion nd the stte differentite strem ipher implementtions. The key words in the key strem, the plintext nd the iphertext hve the sme length. Strem iphers generte pseudorndom key strem from smller seed key nd re prtil pproximtions to the one-time pd [6]. A one-time pd is rndom key used only one to enrypt plintext of equl length. The pseudorndom key strem is xored with the plintext strem to generte iphertext strem []. Figure shows key strem genertion y strem ipher. While synhronous strem ipher does not onsider the iphertext while generting the key strem, n synhronous strem ipher does. Consequently, unlike n synhronous strem ipher, synhronous strem does not propgte errors. In synhronous strem ipher oth the enrypting nd the derypting entities should e in the sme stte. This requires tht the key strem e generted in strit sending numeril yte order. For the IP sed routed networks in whih the pkets rrive out-of-order this mounts to genertion of key strem for pkets tht hve yet to rrive in order to proess the pkets tht hve lredy rrived. Liner Feedk Shift Register (LFSR) sed synhronous strem iphers [8] nd lok iphers operting in strem ipher mode [9],[][] do not hve the ility to generte the key strem out-of-order. Levithn is inry tree sed synhronous strem ipher tht hs the ility to seek to ny ritrry segment of the key strem []. In this pper we will investigte high-speed Levithn inry tree trversl rhitetures to support ordered nd out-of-order key strem genertion. Setion desries Levithn strem ipher while Setion disusses prllel nd pipeline rhitetures for inry tree sed key strem genertor. It desries the design of pipeline rhiteture. Setion presents the results for pipeline rhiteture implementtion. Setion 5 onludes this pper.

3 . Relted Reserh Before designing rhitetures for inry tree sed key strem genertor we will investigte relted pplition of tree trversl the routing tle lookup within Internet routers. The routing tle lookup is performed on rrivl of eh IP pket (i.e., ingress IP pket) y looking up the next-hop-ddress. Tle illustrtes typil routing tle where the entries re of the form <route-prefix, next-hop-ddress> []. The route-prefix is mthed with the signifint its of the -it destintion IP ddress of the ingress pket. The ingress pket is forwrded to the next-hop ddress ssoited with longest prefix mthing with the signifint its of destintion IP ddress. The longest prefix mthing t high-speed motivtes development of lgorithms for serhing the forwrding tle to perform fst route lookups. Tle : Forwrding tle with four prefixes nd the orresponding next-hop ddresses. A * denotes wildrd its. Prefix Next-hop P * H P * H P * H P * H One of the ommonly used pproh for longest prefix mth is to serh inry tree, ommonly known s lookup trie, tht hs rnhes leled or. The nd orresponds to the right nd the left rnhes respetively. The inry tree is trversed performing serh opertion using signifint its of the destintion IP ddress s serh key. Trversing to prtiulr node represents ontenting the lels of ll the rnhes in the pth from the root node. The longest prefix serh opertion proeeds itwise strting from the root node of the lookup trie. The left (right) rnh of the root node is tken if the first it of the serh key is ( ), following the remining pth of trversl is determined in similr mnner using suessive its of the serh key. The serh ends when left or right hild pointers re pointing to null pointer or does not hve the mthing it. The ontented lels rete the longest prefix mthing the signifint its of the destintion ddress. A smple lookup trie is shown in Figure. P P P trie n o d e n e x t - h o p - p t r le ft-p tr rig h t-p tr P Figure : A lookup trie with nodes mrked P P denote nodes whih hve vlid next-hop-ptr. Contented rnh lels long the pth from the root node to the nodes P P impliitly form prefixes. The serh opertion entils trversing the lookup trie. This is similr to the preorder trversl of the inry omputtion tree in Levithn. The differene etween the lookup trie nd the omputtion tree prevents us from using the rhitetures used for serhing the lookup trie for preorder trversl of inry omputtion tree. The differenes re () the node stte informtion (i.e., trie node struture) is stored permnently for the lookup trie in ontrst it is only used one to ompute the stte informtion for the hild node in the se of inry omputtion tree, () trversl order depends on the serh key for lookup trie versus it is predetermined to preorder for omputtion tree, nd () the result of omprison etween the signifint its of the IP destintion ddress nd ontention rnh lels determine the level t whih the

4 trversl of lookup trie stops versus ll the lef nodes of omplete inry tree re trversed in the se of inry omputtion tree. Levithn: A Binry Tree Bsed Strem Cipher In Levithn inry tree strem ipher the key strem is ontention of output keys omputed t its lef nodes. A key t lef node is otined y omputing funtions t ll nodes in the pth from the root node. Levithn is omplete inry tree sed strem ipher prmeterized y the numer of its n per output key word nd the numer of its m in the user key. Preorder trversl [] of the inry omputtion tree genertes n ordered key strem. In Levithn there re inry omputtion trees, eh of height 6 nd 6 lef nodes. In this pper n is its, m is 6 its, eh output key is its nd the input user key is 6 its. Levithn mps the 6-it user key to 5 ytes ( its per key word x 6 key words per inry tree x trees) of pseudorndom key strem. rnh funtion lef node node numer 5 lef funtion lef 6 numer Figure : In Levithn omputtion tree of height, the funtion () is exeuted when going from node to its left (right) hild. The funtion is exeuted t the lef nodes to generting the key strem. In Levithn tree of height shown in Figure nodes re leled in redth-first-trversl fshion strting with the root node s. Assoited with eh node is 96-it stte z y x, where the z, y nd x re eh its. The stte of the root node is tree #. The stte t node is used to otin the stte of its left nd the right hildren using (=f d) nd (=g d) funtions respetively. Funtions f, g nd d re defined s: f(z y x) = z S(R(S(R(y)))) L(S(L(S(x)))) g(z y x) = z+ L(S(L(S(y)))) S(R(S(R( x)))) d(z y x) = z x+y+ z x+y+z R nd L indite right rotte nd left rotte y 8-its. S is non-liner key dependent sustitution funtion S(x x x x )=x S (x ) x S (x ) x S (x ) S (x ), where tles S, S, S nd S re setup using seed key. At lef node the output key word is omputed y pplying the funtion (y x)= x y. An out-of-order key strem is generted y seeking to the prtiulr lef node followed y preorder trversl of the inry tree. High-speed genertion of key strem is equivlent to high-speed preorder trversl of inry trees. High-Speed Arhitetures for Binry Tree Bsed Key strem Genertor A strightforwrd pproh to generting the -it key words t ll the lef nodes of inry tree of height h requires O(hx h ) time for omputing ll funtions nd O( h ) for storing ll output key words. For inry tree of height 6 this trnsltes to O(6x 6 ) time for omputing the funtions nd nd 6 -it memory lotions for storing the key strem. Sine the storge requirement is not prtil the output key words should e generted dynmilly. One pproh to dynmilly generting the key strem entils trversing the unique pth from the root to the orresponding lef node nd omputing the key words y exeuting the funtions or t ll the nodes on this pth. This sheme yields O(hx h ) time nd O() storge. The time intervl etween onseutive output key words for this strightforwrd pproh is T key_period = 6xT. Next, we will desrie two high-speed tree trversl rhitetures tht re signifint improvements over this is the ontention opertion

5 rhiteture.. Prllel Arhiteture We propose n rhiteture wherein the stte informtion omputed t n intermedite node is stored nd reused. In this rhiteture the time intervl etween onseutive output key words is ( Nd/ + ) x T where Nd is the numer of nodes etween onseutive lef nodes in n inorder trversl of the inry tree. The time intervl etween onseutive keys is proportionl to the numer of nodes etween the orresponding lef nodes. As shown in Figure () the time intervl etween output key words generted y nodes nd is different from the time intervl etween output key words generted y nodes nd. This is euse there is one node (node 5) etween nodes nd nd five nodes (nodes 5,,, nd 6) etween nodes nd. Figure () summrizes the time intervls etween onseutive key words T = T + T = xt T = T + T + T = xt T T T T T5 T6... Time Lef node Current next Nd T key_period 8 9 T 9 T T 5 T T T 5 T Figure : () Time intervl etween onseutive keys is to the numer of nodes etween the orresponding lef nodes. () T key_period for onseutive lef node pirs for inry tree of height Computing key words t onseutive lef nodes in prllel n ound the vrition in T key_period. Speifilly, if T key_period etween onseutive key words exeeds predetermined ound, the pths leding to the onseutive output key words re omputed in prllel. For exmple, onsider predetermined ound of for the inry tree of height in Figure 5. During ordered key strem genertion, node 5 long the pth to the output key word t node nd node long the pth to the output key word t node re rried out in prllel. Similrly, during out-of-order key strem genertion of key words orresponding to nodes nd, the funtions nd t node long the pths to these nodes re rried out in prllel. Nd = 5 urrent su-tree next su-tree Nd = 5 next su-tree 5 6 urrent su-tree () () Figure 5: Illustrtes funtions trversed in prllel for generting () ordered nd () out-of-order output keystrem. From Figure 5 () nd () it n e seen tht the ondition for strting prllel trversl is different for omputing ordered nd out-of-order output key words. For the ordered output key words the prllel trversl is initited if the intermedite node visited is root of su-tree with the rightmost lef node greter then the threshold Nd prt from the next lef. For the out-of-order output key words the prllel trversl is initited if n intermedite node visited is Nd/ nodes prt from the lef whose stte informtion is used to ompute the output key word eing seek. 5

6 Preorder trversl of the inry omputtion tree entils visiting nodes using node-left su tree-right su tree rule. When node is first visited oth the nd funtions re omputed. While the 96-it result of the funtion is used immeditely, the result of funtion is stored for use when the right su tree of the node is visited. The first olumn of Tle lists the order in whih funtions nd re omputed, stored nd used during the preorder trversl of inry tree of height. For omputing output key word t node 8, the funtions nd t intermedite nodes, nd re omputed entiling dditionl storge elements for the stte informtion of nodes, 5 nd 9. The totl dditionl storge for inry tree equls storge element its x tree height, giving 96 x its for the tree of height. The totl dditionl storge for inry omputtion tree of height 6 would equl 96 x 6 its. Let us look t when the results of funtions nd re used. While the results of funtion re used when node is first visited, the results of funtion re stored when node is first visited nd used lter. In order to redue the storge requirement for the intermedite node stte informtion, we propose to trverse the inry omputtion tree using n intertwined preorder -inorder trversl whih entils visiting nodes using the Node -Left-Node -Right rule. The Node nd Node represent omputing funtions nd. The preorder -inorder trversl essentilly superimposes the preorder trversl of funtions nd the inorder trversl of funtions. For the intertwined preorder -inorder trversl the intermedite nodes re visited in the order of,,, 8,, 9,, 5,, 5,,,, 6,, 6,,,,,, 5. If the ssumption is mde tht the funtions t lef node re omputed with funtions t their prent node, the omined omputtion written s single opertion gives the node sequene of,, (, 8), (, 9),, (5, ), (5, ),,, (6, ), (6, ),, (, ), (, 5) for the inry tree of height. The funtions re omputed in n inorder sequene of,, 5,, 6,, nd the funtions re omputed in n preorder sequene of,,, 5,, 6,. The right olumn of Tle lists the order of funtions omputed with preorder -inorder trversl of inry tree of height, in whih the stte informtion for siling nodes is not stored. The stte informtion for nodes 8 nd 9 use the sme storge elements in the intertwined preorder -inorder trversl given identil resoures. Tle : The funtion omputtion order for preorder nd preorder -inorder trversls of the inry tree height nd storge element requirements. preorder trversl t node t node, store t node t node, store t node t node, store t node 8 t node 9, empty t node t node 5, empty t node t node 5, store t node t node, empty t node 5 t node, empty t node t node, store t node 6 t node 6, store t node t node, empty t node 6 t node, empty t node t node, store t node t node 5, empty t node intertwined preorder-inorder trversl preorder inorder t node t node t node t node 8 t node5 t node t node t node 6 t node t node t node t node t node 9 t node t node 5 t node t node t node 6 t node t node t nnode t node 5.. Extension to m-ry tree trversl The prllel trversl rhiteture for the inry tree sed keystrem genertor n e extended to m-ry tree sed 6

7 keystrem genertor, where m =,, 8. The Figure 6 illustrtes n m-ry tree where m = nd tree height =. The prllel trversl pproh for inry tree n e extended to trverse m-ry tree euse the ssumption tht the rnhes trversed in prllel hve identil omputtion times, T = mx(t...t n, T...T n, T ), where T is the mximum of ll the times to ompute ny of the funtions t intermedite nodes nd lef nodes, n e extended for m-ry tree. Also the preorder -inorder trversl rule of Node -Left Node n -Left-Node -Right Node n -Right is extended for trversl of nodes in n m-ry tree, where Node n, nd Node n, represent omputing funtions n, nd n respetively. If n m-ry tree is preorder trversed the totl dditionl storge elements required for node stte informtion would equl storge element its x tree height x m-. The time period etween onseutive output key words: T key_period = {( Nd/ + ) x T}. The onditions to strt the prllel trversl for the ordered nd out-of-order output key words is sme s for inry tree trversl given tht su-trees omputed in prllel lne the times tken to ompute ll their funtions. le f n u m e r Figure 6: -ry tree of height where the lef numers re its wide.. Pipeline Arhiteture Overlpping the omputtion of funtions long pths leding to the onseutive output key words generte keystrem t uniform rte, independent of numer of nodes etween the onseutive lef nodes. The time period etween omputing the onseutive output key words T key_period is equl to the time to ompute the funtion t lef node: T key_period = T, when numer of pths overlpping is equivlent to height of the tree. The overlpping omputtion of funtions long the pths leding to the onseutive funtions t lef nodes essentilly hides the lteny entiled in omputing the onseutive output key words. key key key key key key 5 key 6 key t node t node t node t node t node t node t node 8 t node t node t node funtion yle 5 6 t node 9 t node 5 t node t node t node 5 t node t node t node t node 6 t node t node t node 8 t node t node 6 t node t node 9 t node t node t node t node t node t node 5 Figure : Pipeline trversl of omputtion tree of height. Funtion yle = lok yles.

8 In pipeline rhiteture the omputtion of funtions in the pth to the urrent nd the onseutive output key words re pipelined. The depth of the pipeline is equl to the height of the inry omputtion tree plus one for n dditionl stge for funtion t lef node. An ssumption is mde tht ll the funtions omputed in pipeline stges hve identil omputtion times: T = mx(t, T, T ), where T is the mximum of ll the times to ompute ny of the funtions t intermedite nodes nd lef nodes. Figure shows pipelined pths for the inry tree of height, where the funtions t nodes,,, 8,,,, 9 nd so on re omputed in tht order. The funtions long the pth trversed from the root node to the lef node re omputed in suessive stges of the pipeline nd their results re stored in the stge registers. The results from the pipeline stge registers re used y the following stges to ompute the stte informtion of the node t the next level of the tree. As shown in Tle, the seond itertion for funtion t node overlps with the first itertion for funtion t node. Here DSXSRY denotes ompute funtion d red from ROM lotion speified y the lest signifint 8 its of X (SX) nd red from ROM lotion speified y the lest signifint 8 its of the 8-it right rotted Y (SRY) in next lok yle XOR the resulting dt red from the ROM with its respetive ddresses. Tle : Illustrtes smple yle-y-yle opertions within the -stge pipeline when trversing inry tree of heigh in preorder. D: ompute funtion d, S: red from ROM lotion speified y lest signifint 8 it of the -it rgument nd XOR the dt red from ROM with the ddress in next lok yle, R: right rotte -it rgument y 8 its, L: left rotte -it rgument y 8 its, C: funtion t lef node, X: -it rgument, Y: -it rgument, N: omplement of -it rgument nd P: pss 96-it stte informtion to next stge y writing it to the pipeline stge register. Clok # Word DSX SLX DSX LXP SRY SRY SRY Word DSX SRY SLXS DSX SLX LXP LXP C C C RY SRY SRY DSR SLXS DSX SLX SRX LXP LXP NXS LYP C C C RY SRY SRY SLY Y For the tree of height, overll lok yles re required to generte eh of the -it output key word. The lok yles re ttriuted to lok yles per stge for exeuting funtion plus n dditionl lok yles for the stge exeuting funtion t lef node. For Levithn inry omputtion tree of height 6, overll 5 lok yles re required to generte eh of the -it output key words. lk lk reset -it key reset Controller root_stte strt Key56 kesetup_strt soxopy_strt soxopy_ keysetup_ Keysetup funtion_selet selet root_stte Pipeline Stge Funtion A nd B dt_out 96-Bit Stge Register Pipeline Stge Funtion A nd B 96-Bit Stge Register Pipeline Stge5 Funtion A nd B 96-Bit Stge Register S S S S RAM 56 x 8 ddress, enle,r/w dt_in 56x SBOX 56x SBOX 56x SBOX Figure 8: Pipeline rhiteture for 6-stge keystrem pipeline plus n dditionl stge for funtion t lef node. SBOX: sustitution tle implemented s RAMs/ROMs. In the se key setup is performed on generl purpose proessor the SBOX n e implemented s ROMs. 8

9 Figure 8 shows the design of pipeline rhiteture omputing Levithn keystrem divided into three loks, the key setup, the pipeline nd the pipeline ontroller. The keystrem pipeline omputes keystrem y implementing funtion t intermedite node in its suessive stges. For stge pipeline, during first lok yles stge would exeute funtion t node speified y opertion sequene DSXSRY SLXSRY LXP long pth to output key word t lef node 8. Suessively during seond lok yles stge would exeute seond itertion of funtion t node long the pth to output key word t lef node 9 nd stge would exeute funtion t node long pth to output key word t node 8. The pipeline stges ompute su-funtions d, f or g of funtions or respetively, tking overll lok yles. The lok yles re ttriuted to the reds from sustitution tle whih tke lok yles nd to the pipeline stge registers whih dd lok yle dely. Within the pipeline stges, the intermedite vlues of X, Y nd Z re stored in temporry registers t every lok yles. For funtion, speified y opertion sequene DSXSRY SLXSRY LXP, the intermedite vlues stored in the pipeline stge s internl registers t the end of first lok yle re X nd 8-it right rotted Y, t the end of seond lok yle the 8-it left rotted XORed X nd 8-it right rotted XORed Y nd t the end of third lok yle the 8-it left rotted XORed X nd XORed Y. The XORed opertion is with respet to the ROM ddress of the X nd Y rguments... Keystrem Pipeline The pipeline rhiteture ws seleted for implementtion s it omputes keystrem t uniform rte: T key_period = T. For Levithn keystrem pipeline shown in Figure 8, there re 6 pipeline stge registers to store the node stte informtion nd funtions t intermedite nd lef nodes implemented s pipeline stges with 56x sustitution tle ROMs ssoited with eh stge. The ontroller speifies stge-y-stge ehvior of the pipeline vi funtion_selet ontrol signl. All pipeline stge implementtions, exept the one implementing the funtion t lef node, re identil. The first stge gets s input the root node stte informtion tree numer from the ontroller. The lst stge register, whih stores the lef node stte informtion, feeds into -it XOR performing liner redution of 6-its to -it output key word. The 6-its input to the XOR re two lest signifint -it words, y nd x, of the lef node stte informtion. Eh stge of the pipeline implements funtions nd using -it dditions, it-wise omplement nd rotte opertors. The -it entries of sustitution tle get written y the key setup lok nd re red y the pipeline stge lok implementing funtions nd. The pipeline stges implement two sustitution tles enling the omputtion of omponents of su-funtions f or g in prllel. For funtion f, defined s f(z y x)= z S(R(S(R(y)))) L(S(L(S(x)))), omputtion of y nd x omponents re performed in prllel given two opies of sustitution tle... Pipeline Controller The ontroller vi the funtion_selet signl feed to eh of the pipeline stges indite, whih of the two funtions or is to e exeuted in the next lok yle. The pttern of funtion_selet signls vlues indite the preorder trversl of the inry omputtion tree. The dt flow in the pipeline is node stte informtion z y x resulting from exeution of funtions or implemented in pipeline stge. The exeution of funtion or in pipeline stges result in node stte informtion input to suessive stge whih exeutes the funtion t next level node of the inry tree. The lef numers speify the pth from the root to prtiulr lef node. The preorder trversl of inry tree of height 6 strts from the root trversing first to the left most lef following pth {} 6. For generting out-of-order output key word the strting lef numer (i.e., the pth to the lef eing seek) ould e provided s n input, inditing the seek opertion. The funtion_selet signl gets new vlue every lok yles, the numer of lok yles required for omputing the funtions plus the stge register dely. Figure 9 shows the ontroller rhiteture for inry tree of height three. It is designed using one -it ounter, three -it registers, inverters nd muxs. The -it ounter is leled s lef ounter, three -it registers re leled s pth registers nd muxs re leled pth_mux, it_mux, nd stge_mux. The stte of the ontroller nd mux inputs re set upon tive. The eomes tive every three lok yles. The funtion_selet signl is onstruted y reding the pth register its from the most signifint it to the lest signifint it positions of the pth registers. The pth register it position red hnges upon tive. The most signifint it is red when the lef numer is inserted into prtiulr 9

10 pth register, the seond most signifint it is red upon next tive nd so on. The reding of lest signifint it indites ompletion of trversl to prtiulr lef numer stored in the pth register. After reding the lest signifint it from the pth register, new lef numer is inserted into tht prtiulr pth register on next tive nd the proess of trversl to newly inserted lef is restrted y reding the most signifint it. The pth to the lef node lredy trversed is disrded upon tive. The lef ounter inrements y one upon tive. Also upon tive one of the pth registers is feed the pth_mux output nd the it position of pth registers re feed s it_mux inputs. Pth registers ontrol funtion exeuting in prtiulr pipeline stge nd is updted every xh lok yles upon tive y seleting inputs to the stge_mux. The inry tree of height hs 8 lef nodes. Figure 9 shows the ontroller stte efore nd fter the insertion of pth for lef numer in the pth register. Upon insertion of the lef numer, pth registers would hve vlues <>, <>, <>, whih is different from the pth register vlues <>, <>, <>. In ontrst to the preorder trversl, stk struture is not used to trk the nodes visited with respet to the root. Insted the presented ontroller uses lef numer s pth from the root node to indite the rnhes trversed. it_mux pth registers pth register order pth registers pth register order 5 6 lef numer 8 9 tive: pth trversl ompletes -----> -----> tive: pth trversl strts -----> -----> stge_mux funtion_selet <,,> <,,> it position red -it ounter pth_mux tive funtion_selet <,,> <,,> lef ounter -it ounter Figure 9: Controller rhiteture for height omputtion tree. Trversl strts from lef numer. The pth register whose lst signifnt it hs een red lef ounter nd lef ounter lef ounter + upon tive... Disussion The key setup lok ws implemented nd its results re presented, though no detiled rhiteture study ws. The key setup omputes four 56x8 tles tht store invertile sustitution funtions, S, S S nd S. These tles re generted pseudo-rndomly y swpping elements t rndom in seed key dependent mnner. These four sustitution tles, lso known s SBox, re generted every 5 ytes of output key words using the 8 yte seed key nd red y the pipeline stge funtions. The key setup is not in the ritil pth for generting the keystrem, therefore key setup ould e implemented on generl purpose proessor. The key setup design onsists of -it registers, 6-it ounters, -it dders nd mod opertors. All four 56x8 tles re ontented into single 56x sustitution tle, reduing numer of reds issued y the pipeline stge funtions from four to one. This is possile s ll the su-omponents of the funtion S index to the sme lotion in RAM/ROM. S funtion is implemented s RAM/ROM lookup (red) issued from the pipeline stge funtion. The pipeline trversl n e optimized further t inresed storge requirements. Trversls of the overlpping pths n void re-omputing the funtions t intermedite node tht hve lredy een omputed while trversing to the previous output key words. The dditionl storge is entiled in trking the pths lredy trversed. Tle illustrtes the pth tle tht store distint set of node numers long the pths lredy trversed for inry tree of height.

11 Tle : Pth Tle stores the pths trversed s distint set of nodes lef node numer node numers logn pth 8 <,, > <,, 5> <,, 6> <,, >.. Extention to m-ry tree The pipeline rhiteture for trversl of inry tree n e extended to trversl of m-ry tree of height h. The differenes etween the inry tree nd the m-ry tree implementtions re in the pipeline stge funtion nd the ontroller. The pipeline stge implements m different funtions insted of funtions of inry tree pipeline stge. The ontroller for m-ry tree trversl n use the lef numers just s in inry tree to onstrut the funtion_selet signl. The funtion_selet signl to eh stge would e q-its wide, where m = q. For exmple, -ry tree would require the funtion selet signl to e -it wide insted of single it s is the se for implementtion of inry tree sed keystrem pipeline stge. The similrities etween the pipeline rhiteture for the inry tree nd the m-ry tree design re: () fixed period etween omputing onseutive output key words T key_period = T, () the depth of the pipeline is equl to the height of the m-ry omputtion tree plus n dditionl stge for the funtion t lef node nd () the funtions long the pths of m-ry tree trversed from the root node to the lef node re omputed in suessive stges of the pipeline nd their results re stored in the stge registers used y the following stges to ompute the stte informtion of the node t the next level. The pipeline trversl to first 8 lef nodes of -ry tree of height is illustrted in Figure. key key key key key key 5 key 6 key t node t node t node t node 6 t node t node t node t node t node 5 t node 8 t node t node funtion yle 6 t node 9 t node t node t node t node t node 8 t node t node t node 9 t node t node t node Figure : Pipeline trversl of -ry tree of height. Funtion yle = lok yles. Tle 5 summrizes the order of time tken to ompute funtions t intermedite nodes nd storge requirement for the trversl rhitetures presented for m-ry omputtion tree. Tle 5: Trversl rhitetures omplexity Approh Computtion Time Storge Strightforwrd O(hxm h ) O(m h ) Prllel O(m h ) O(Nd) Pipeline O(h) O()

12 The storge requirements entil storge for either the output key words or in the se of prllel trversl storge for intermedite node s stte informtion within the prllel su-tree. Results In order to mesure the throughput of pipeline we evlute the key setup nd pipeline lok seprtely. The key setup n e exeuted onurrently while omputing the keystrem in prtil systems. Implementtion results re otined y trgeting Xilinx Virtex II [5] series FPGAs. The ModelSim SE [6] nd the Synplify Pro [] re used to perform funtionl simultion. The design guidelines followed re in [8]. The timing simultion of ontroller nd pipeline loks re performed using the timesim.vhd to verify ginst the funtionl simultion. The timesim.vhd file ws generted y Xilinx ISE 5.i. The post ple nd route results from Xilinx ISE 5.i of the pipeline nd its ontroller loks give the re = 686 slies, frequeny = 5 MHz nd throughput = 5 Mps. The lok period ws rounded upwrds from 9.95 ns to ns, otined from the Timing Anlyzer of Xilinx ISE tool whih nlyzes post ple nd route stti timing. The wveform snpshots presented re from funtionl simultion using the lok period otined from Timing Anlyzer. Figure shows the simultion snpshot of intertion etween the ontroller nd the pipeline. The signl mrked point to the funtion_selet signl when the 5 th pipeline stge is omputing the lef node stte informtion used to ompute the st output key word. The signls mrked, nd shows the output of the 5 th pipeline stge used in omputing the st output key word nd the funtion_selet signl used to ompute the nd output key word. Signls mrked 5, 6 nd repet sme tions s desried y signls mrked, nd for omputing nd output key word nd the funtion_selet signl used for omputing rd output key word. Figure : Simultion wveform of the intertion etween the ontroller nd the pipeline stges. Figure shows the simultion snpshot of the 5 th pipeline stge when omputing funtion. The signls mrked show the stte of pipeline stge funtion in eh lok yle. The signl mrked indites the strt_funs signl inditing strt of the pipeline stge funtion. The strt_funs signl stys tive only for single lok yle. The signl mrked, nd point to output from previous pipeline stge, red ddresses issued to ROM nd ROM, nd updte of temporry registers to store intermedite vlues of x, y nd z respetively. In yle the signls mrked 5 nd 6 repet tions for signls mrked y nd for suessive stge. At the end of rd lok yle signl mrked shows the stte informtion for the next node s vlue stored in pipeline stge register.

13 Figure : Simultion wveforms of the pipeline stge 5 exeuting funtion. 5 Conlusion From vrious rhitetures we hose to implement the pipeline rhiteture euse it offers uniform rte for omputing keystrem. In omprison to softwre implementtion on Pentium II with lok rte of 5 MHz on ustom ASIC design tht hieves throughput of 5 Mps [], the simple pipeline rhiteture design with lok rte of 5 MHz on merhnt silion FPGAs yields throughput of 5 Mps. The pipeline rhiteture is flexile nd n esily e modified to inrese the throughput. The throughput for omputing the keystrem using pipeline rhiteture n e nerly douled (~ Gps) if the pipeline stge 5 omputes funtions nd in prllel nd instntiting seond opy of the funtion. These hnges will yield 6-its insted of -its of keystrem every lok yle, effetively douling the throughput t inrese in hrdwre. If the design ws implemented on ASIC tehnology it would yield etter results.

14 6 Referenes [] VPN Tehnologies, Definitions nd Requirements, June. [] S. Kent nd R. Atkinson, Seurity Arhiteture for IP, RFC, Novemer 998. [] A. Menezes, P. vn Oorshot nd S. Vnstone, Hndook of Applied Cryptogrph, CRC Press, 996. [] US Ntionl Bureu of Stndrds, Dt Enryption Stndrd, Federl Informtion Proessing Stndrd (FIPS), Pulition 6, Jnury 99. [5] Federl Informtion Proessing Stndrd, Announing the Advned Enryption Stndrd (AES), Ntionl Institute of Stndrd nd Tehnology (NIST), Novemer. [6] M. J. B. Roshw, Strem Ciphers: RSA Lortories Tehnil Report TR- Version., RAS Lortories, July 995. [] P. Crowley nd S. Luks, Bis in the LEVIATHAN Strem Cipher, Fst Softwre Enryption: Eighth Interntionl Workshop, April. [8] P. Ekdhl nd T. Johnsson, SNOW: A new strem ipher, Deprtment of Informtion Tehnology, Lund University, Novemer,. [9] H. Lipm, P. Rogwy nd D. Wgner, Comments to NIST onerning AES modes of opertion: CTR-mode enryption, Symmetri Key Blok Cipher Modes of Opertion Workshop, MD, USA, Otoer. [] R. Pereir nd R. Adms, The ESP CBC-Mode Cipher Algorithms, Internet Engineering Tsk Fore RFC 5, Novemer 998. [] K. Alexnder, R. Krri, I. Minkin, K. Wu, P. Mishr nd X. Li, Towrds - Gps Cryptogrphi Arhitetures, ISCIS, Otoer. [] D. A. MGrew nd S. R. Fluhrer, The Strem Cipher Levithn, New Europen Shemes for Signtures, Integrity nd Enryption (NESSIE), Otoer. [] T. H. Corment, C. Leiserson, R. Rivest nd C. Stein, Introdution to Algorithms, nd Edition, MIT Press, Septemer. [] P. Gupt, Algorithms For Routing Lookups nd Pket Clssifition, Ph.D. Disserttion, Stnford University, Deemer. [5] Xilinx Corportion, Virtex II FPGA Dt Book, Septemer. [6] Model Tehnology Inorported, ModelSim SE Users Guide, April. [] Synpliity Corportion, Synplify Pro Users Guide, Otoer. [8] D. J. Smith, HDL Chip Design: A Prtil Guide for Designing, Synthesizing nd Simulting ASICs nd FPGAs Using VHDL or Verilog, Doone Pulitions, Mrh 998.