2 Gbit/s Hardware Realizations of RIJNDAEL and SERPENT: A Comparative Analysis

Transcription

1 2 Gbit/s Hardware Realizations of RIJNDAEL and SERPENT: A Comparative Analysis Adrian K. Lutz 1, Jürg Treichler 2, Frank K. Gürkaynak 3, Hubert Kaeslin 4, Gérard Basler 2, Andres Erni 1, Stefan Reichmuth 1, Pieter Rommens 2, Stephan Oetiker 3, Wolfgang Fichtner 3 Integrated Systems Laboratory, ETH Zurich 1 Rijndael Design Team 2 Serpent Design Team 3 Integrated Systems Laboratory 4 Microelectronics Design Center

2 Contents Context Architectural Transforms Variations of Architectural Parameters Rijndael Architecture Serpent Architecture Comparison Conclusions

3 Context Term project at the Integrated Systems Laboratory of ETH Zurich 2 teams of 3 EE 4th year students 14 weeks to tape-out 0.6 m 3 LM CMOS technology Maximum die size 50 mm 2 Pin compatibility Focus on ASIC hardware implementation

4 Impact of Architectural Transforms Legend Area A Replication Actual Effect Towards Throughput Towards Hardware Efficiency Pipelining Iterative Decomposition Towards Hardware Economy Time Sharing Ideal Effect Time per Data Item T

5 Variations of Architectural Parameters

6 Variations of Architectural Parameters

7 The Rijndael Chip AES 128bit implementation Andres Erni Adrian K. Lutz Stefan Reichmuth

8 Algorithm Summary 128bit user key bit round keys 10 rounds 8x8-S-box instantiate 1, 2, 5, or 10 rounds

9 Rijndael Architecture - Overview Parallel Round Data Reg Key Reg AddKey Round Key Register Key Generator Parallel Round 2 Controller Data Reg 32

10 Rijndael Architecture - Overview Parallel Round Data Reg Key Reg AddKey Round Key Register Key Generator Parallel Round 2 Controller Data Reg 32 Largest potential for optimizations in rounds

11 Rijndael Architecture - Round Basic architecture: separate encryption and decryption paths Encryption Path InvMixCol InvShiftRows InvSubBytes AddKey Pipeline Reg SubBytes ShiftRows MixColumns AddKey Pipeline Reg Decryption Path Problem: Large area requirement

12 Encryption Path Decryption Path InvMixCol InvShiftRows InvSubBytes AddKey SubBytes ShiftRows MixColumns Pipeline Reg Rijndael Architecture - Round Shared AddKey Function Problem: Large area requirement

13 Rijndael Architecture - Round SubBytes and InvSubBytes occupy 85 % of the area Encryption Path InvMixCol InvShiftRows InvSubBytes AddKey Pipeline Reg SubBytes ShiftRows MixColumns Decryption Path Problem: Large area requirement

14 Rijndael Architecture - Round Rijndael S-box consists of two operations Encryption Path SubBytes Mult Inverse Aff Trans Inv Aff Trans Mult Inverse InvSub Bytes Decryption Path Multiplicative inverse can be shared

15 Rijndael Architecture - Round Sharing Mult Inverse saves 30 % to 50 % of area Encryption Path SubBytes Inv Aff Trans Mult Inverse Aff Trans InvSubBytes Decryption Path

16 Rijndael Architecture - Round Round architecture with shared Mult Inverse Encryption Path InvMixCol 6 ns InvShiftRows SubBytes Inv Aff Trans 4 ns Mult Inverse InvSubBytes Aff Trans ShiftRows MixColumns 5.5 ns 1.5 ns AddKey Pipeline Reg Decryption Path Problem: Location of intraround pipeline register

17 Rijndael Architecture - Round Partition of the rounds not suited for intraround pipelining Encryption Decryption: Partition 1 SubBytes ShiftRows MixColumns 1 InvSubBytes InvShiftRows InvMixColumns 10 9 SubBytes ShiftRows MixColumns SubBytes ShiftRows 9 10 InvSubBytes InvShiftRows InvMixColumns InvSubBytes InvShiftRows 2 1

18 Rijndael Architecture - Round Shifting round limits makes intraround pipelining possible. Encryption Decryption: Partition 1 SubBytes ShiftRows MixColumns 1 InvSubBytes InvShiftRows InvMixColumns 10 9 SubBytes ShiftRows MixColumns SubBytes ShiftRows 9 10 InvSubBytes InvShiftRows InvMixColumns InvSubBytes InvShiftRows 2 1

19 Rijndael Architecture - Round Partition of the rounds suited for intraround pipelining Encryption Decryption: Partition 2 SubBytes ShiftRows MixColumns 1 InvSubBytes InvShiftRows InvMixColumns 10 9 SubBytes ShiftRows MixColumns SubBytes ShiftRows 9 10 InvSubBytes InvShiftRows InvMixColumns InvSubBytes InvShiftRows 2 1

20 Rijndael Architecture - Round InvMixColumns can be shifted to a better location Encryption Path SubBytes InvMixCol InvShiftRows Inv Aff Trans Mult Inverse AddKey Pipeline Reg Aff Trans ShiftRows MixColumns InvSubBytes AddKey has to be duplicated Decryption Path

21 Encryption Path SubBytes Decryption Path InvShiftRows Inv Aff Trans InvMixCol MUX Mult Inverse Aff Trans ShiftRows MixColumns Pipeline Reg AddKey Rijndael Architecture - Round Architecture suited for intraround pipelining 6.5 ns 1.5 ns 4 ns AddKey InvSubBytes 5.5 ns

22 Encryption SubBytes Path Decryption Path InvShiftRows Inv Aff Trans Mult Inverse Pipeline Reg Aff Trans AddKey ShiftRows InvMixCol MixColumns Pipeline Reg AddKey Rijndael Architecture - Round Introduction of intraround pipelining InvSubBytes Final architecture implemented in silicon

23 The Serpent Chip Gérard Basler Pieter Rommens Jürg Treichler

24 Algorithm Summary 256bit user key bit round keys 32 rounds 8 types of 4x4-S-boxes instantiate preferably 8, 16, or 32 rounds also possible: 1, 2, or 4 rounds

25 Architecture Development Step 1 Round 1 Round 2 Round 3 Round 4 Round 5 Round 6 Round 7 Round 8 Round 25 Round 26 Round 27 Round 28 Round 29 Round 30 Round 31 Round 32 Round key storage Problem: area requirement Key Generation

26 Architecture Development Step 2 Round 1 Round 2 Round 3 Round 4 Round 5 Round 6 Round 7 Round 8 Round key storage Problem 1: insufficient throughput Key Generation

27 Architecture Development Step 3 Round 1 Round 2 Round 3 Round 4 Round 5 Round 6 Round 7 Round 8 Problem 2: area exceeds fixed allowance Round key storage Key Generation

28 Architecture Development Step 4 Round 1,5 Round 2,6 Round key storage Round 3,7 Round 4,8 Key Generation

29 Serpent Architecture - Round Encryption Path Key Reg Key Mix Lin Trans -1 S-Box-Array S-Box -1 -Array Lin Trans Key Mix Decryption Path

30 Serpent Architecture - Round Encryption Path Key Reg Key Mix Lin Trans -1 S-Box-Array S-Box-Array S-Box -1 -Array S-Box -1 -Array Lin Trans Key Mix Decryption Path

31 Architecture Development Step 4 Round 1,5 Round 2,6 Round key storage Round 3,7 Round 4,8 Problem: longest path Key Generation

32 Architecture Development Step 5 Round 1,5 Round 2,6 Round 3,7 Key Generation On The Fly Temp Key Reg Temp Key Reg Key Reg 33rd Key Temp Key Reg Temp Key Reg Round 4,8

33 Key Generator Controller Ctrl Sig Data In Reg Stack Data Out Serpent Architecture Final Round 4 Round 2 Round 3 Key In Reg Round Encryption Decryption

34 Comparison: Functionality Rounds in the algorithm Data length User key length Rounds in hardware Round key computation Rijndael bit 128bit 2 stored Serpent bit 128bit 192bit 256bit 4 on the fly

35 Comparison: Figures of Merit Comparison based on 128bit keys Technology, process name Area per hardware round (after synthesis) Area for round key generation Chip area (estimated, after synthesis) Chip area (effective) Data throughput (estimated, ECB) Data throughput (measured, ECB) Rijndael Serpent 0.6 m 3LM, AMS CUA 6.3 mm mm mm mm mm mm 2 49 mm 2 49 mm Gbit/s 1.86 Gbit/s 2.26 Gbit/s 1.96 Gbit/s

36 Conclusions (I) Both chips were designed from scratch synthesized fabricated measured 1 Throughputs and areas almost identical: in ECB and CTR modes: 2 Gbit/s in feedback modes: 500 Mbit/s Contributions towards optimum datapath design 1 Serpent chip: fully functional; Rijndael chip: limited functionality due to error in mask fabrication

37 Conclusions (II) Considering that the two algorithms are rather different in nature, their respective performances in hardware come remarkably close. Rijndael + Reuse of the same S-box for all rounds Serpent + Accommodates multiple key lengths with no impact on hardware architecture + Number of rounds (32) is hardware-friendly

38 Thank You for Your Attention Questions?