Comparison of the Hardware Performance of the AES Candidates Using Reconfigurable Hardware

Transcription

1 Comparison of the Hardware Performance of the AES Candidates Using Reconfigurable Hardware Master s Thesis Pawel Chodowiec MS CpE Candidate, ECE George Mason University Advisor: Dr. Kris Gaj, ECE George Mason University

2 Outline Introduction to AES contest Introduction to FPGAs and Hardware Implementations Modes of Operation Implementations in Basic Iterative Architecture Implementations in Pipelined Architecture Summary

3 Most Popular Secret-Key Ciphers American standards DES 56 bit key AES-contest Triple DES 112, 168 bit keys AES - Rijndael 128, 192, and 256 bit keys Other popular algorithms IDEA Blowfish RC5 CAST Serpent Twofish RC6 Mars

4 Deep Crack Electronic Frontier Foundation, 1998 Total cost: $220,000 Average time of search: 4.5 days/key 1800 ASIC chips, 40 MHz clock

5 AES Contest - NIST Evaluation Criteria Security Software Efficiency Hardware Efficiency Flexibility

6 AES Contest Effort June Candidates from USA, Canada, Belgium, France, Germany, Norway, UK, Isreal, Korea, Japan, Australia, Costa Rica Round 1 Security Software efficiency August final candidates Mars, RC6, Rijndael, Serpent, Twofish Round 2 Security Hardware efficiency October winner: Rijndael Belgium

7 Hardware Efficiency Comparisons Government and large companies ASIC Academia and small business FPGA NSA Mitsubishi USC WPI GMU UC Berkeley IBM MICRONIC

8 Which way to go? ASICs FPGAs High performance Low power Low cost (but only in high volumes) Off-the-shelf Low development costs Short time to the market Reconfigurability

9 Reconfigurability External ROM and microprocessor enable changing an FPGA function in several milliseconds Encryption vs. decryption vs. key scheduling FPGA FPGA FPGA Key scheduling Encryption Decryption Various algorithms 5-15 ms 5-15 ms FPGA FPGA FPGA AES Triple DES IDEA 5-15 ms 5-15 ms

10 Target FPGA devices Xilinx Virtex - XCV m CMOS process CLB slices 32 4-kbit block RAMs 1 mln equivalent logic gates Up to 200 MHz clock Configurable Logic Block slices (CLB slices) Programmable Interconnects Block RAMs

11 Methodology and Tools Implementation Code in VHDL Verification 2. Synthesis and Implementation 1. Functional simulation Xilinx, Foundation Series v. 2.1 Aldec, Active-HDL Netlist with timing 3. Timing simulation Aldec, Active-HDL Bitstream 4. Experimental Testing USC-ISI, SLAAC-1V FPGA board

12 Top level block diagram control input/key Control unit input interface key scheduling encryption/decryption output interface memory of internal keys output

13 Primary factor in choosing the encryption/decryption unit architecture Symmetric-key cipher mode of operation: 1. Non-feedback cipher modes ECB, counter mode 2. Feedback cipher modes CBC, CFB, OFB

14 Non-feedback Counter Mode - CTR IV IV+1 IV+2 IV+N-1 IV+N... E E E E E... M 0 M 1 M 2 M N-1 M N C 1 C 2 C 3 C N-1 C N C i = M i AES(IV+i) for i=0..n

15 Feedback cipher modes - CBC M 1 M 2 M 3 M N-1 M N IV... E E E E E... C 1 C 2 C 3 C N-1 C N C 1 = AES(M i IV) C i = AES(M i C i-1 ) for i=2..n

16 Feedback cipher modes CBC, CFB, OFB

17 Typical Structure of a Block Cipher Round Key[0] Initial transformation i:=1 Round Key[i] Cipher Round i:=i+1 i<#rounds? #rounds times Round Key[#rounds+1] Final transformation

18 Basic iterative architecture multiplexer register one round combinational logic

19 Architectures suitable for feedback modes MUX register MUX round 1 one round combinational logic round round K round 1 round round #rounds

20 Partial Loop Unrolling multiplexer register K rounds combinational logic round 1 round round K

21 Loop Unrolling: Speed vs. Area Throughput - basic architecture - loop unrolling - resource sharing basic architecture loop-unrolling k=2 k=3 k=4 k=5 resource sharing Area

22 MARS - General Structure plaintext + subkey forward mixing keyed forward transformation keyed backwards transformation subkeys subkeys backwards mixing - subkey ciphertext

23 MARS - Keyed Transformation D3 from mix transf. D2 from mix transf. D1 from mix transf. D0 from mix transf. D3 loop D2 loop D1 loop D0 loop optional swap optional rotation to the right 128-bit register optional swap Keyed transformation core D3 loop D2 loop D1 loop D0 loop

24 MARS - Keyed Transformation Core D3 D2 D1 D / +/ 2 3 E 32 >>>13 <<<13 >>>13

25 MARS E-function 1 <<< S K[4+2i] 2 <<< K[5+2i] <<< 13 3 <<< 5 <<< 5 *

26 RC6 Round R 0 R 1 R 2 R d e d e F S[2i+1] F S[2i] A A d e d e B 5 5 <<< + S[2i+1] + <<< S[2i] B R 1 R 0 R 3 R 2 d e e d d e e d feedback to R 0 feedback to R 1 feedback to R 2 feedback to R 3

27 Rijndael Different Circuits for Encryption and Decryption plaintext ciphertext ByteSub ShiftRow MixColumn InvMixColumn InvShiftRow subkey subkey InvByteSub ciphertext plaintext

28 Rijndael Resource Sharing Between Encryption and Decryption inversed affine transformation encryption inversed element in Galois field decryption affine transformation ShiftRow MixColumn InvShiftRow InvMixColumn subkey subkey

29 First basic architecture of Serpent - Serpent I1 Ki bit register regular Serpent round 32 x S-box x S-box to bit multiplexer 32 x S-box 7 K linear transformation output

30 Alternative basic architecture of Serpent: Serpent I8 128 K32 K0 K7 128 output 128-bit register round 0 32 x S-box 0 linear transformation round 7 32 x S-box 7 linear transformation 128 one implementation round of Serpent = 8 regular cipher rounds

31 Twofish Encryption/Decryption Round <<<1 F - function >>>1 <<<1 >>>1

32 Twofish F-function h q 0 M2 q 0 M0 q 1 q 1 q 0 q 0 q 1 q 0 q 1 MDS + PHT K 2i q 1 q 1 q 0 h q 0 M3 q 0 M1 q 1 q 1 q 0 q 0 q 1 q 0 q 1 MDS <<< 8 + <<< 9 K 2i+1 q 1 q 1 q 0

33 My Results: Basic architecture - Speed Throughput [Mbit/s] Serpent Rijndael Twofish RC6 Mars 3DES

34 My Results: Basic architecture - Area Area [CLB slices] Twofish RC6 Rijndael Mars Serpent 3DES

35 Comparison with results of other groups: Speed Throughput [Mbit/s] Serpent I My Results University of Southern California Worcester Polytechnic Institute 149 Rijndael Twofish Serpent RC6 Mars I

36 Comparison with results of other groups: Area Area [CLB slices] Our Results University of Southern California Worcester Polytechnic Institute Twofish RC6 Serpent Rijndael Mars I Serpent I8

37 My Results: Encryption in cipher feedback modes (CBC, CFB, OFB) - Virtex FPGA Throughput [Mbit/s] Rijndael Serpent I8 200 Twofish Serpent I RC6 Mars Area [CLB slices]

38 NSA Results: Encryption in cipher feedback modes (CBC, CFB, OFB) - ASIC, 0.5 m CMOS Throughput [Mbit/s] Rijndael Serpent I1 RC6 Twofish Mars Area [mm 2 ]

39 Conclusions for feedback cipher modes (1) (CBC, CFB, OFB) Speed (throughput) should be the primary criteria of comparison Basic iterative architecture is the most appropriate for comparison and future implementations Serpent and Rijndael are over twice as fast as the next best candidate for all implementations

40 Conclusions for feedback cipher modes (2) (CBC, CFB, OFB) Results confirmed by - three independent university groups for FPGAs, and - NSA group for ASICs Results of comparison independent of implementation technology (FPGAs vs. ASICs)

41 Non-Feedback Cipher Modes ECB, counter

42 Comparison for non-feedback cipher modes, e.g. Counter Mode - CTR IV IV+1 IV+2 IV+N-1 IV+N... E E E E E... M 0 M 1 M 2 M N-1 M N C 1 C 2 C 3 C N-1 C N C i = M i AES(IV+i) for i=0..n

43 NSA approach: Traditional methodology register MUX K registers MUX one round, no pipelining combinational logic round 1 = one pipeline stage round 2 = one pipeline stage round K = one pipeline stage.... #rounds registers round 1 = one pipeline stage round 2 = one pipeline stage.... round #rounds = one pipeline stage

44 My approach: New methodology a) b) register MUX k registers MUX one round, no pipelining combinational logic one round = k pipeline stages.... d) #rounds k registers c) round 1 = k pipeline stages round 2 =k pipeline stages K k registers round 1 = k pipeline stages round 2 = k pipeline stages MUX round #rounds =k pipeline stages.... round K = k pipeline stages....

45 My approach: Inner-Round Pipelining multiplexer register1 pipeline stage 1 one round register2 pipeline stage register k pipeline stage k

46 Comparison of the traditional and new design methodologies (1) Throughput mixed inner and outer-round pipelining K=2 K=3 - inner-round pipelining - mixed inner and outer-round pipelining - basic architecture - outer-round pipelining inner-round pipelining k=2 k opt K=2 basic architecture K=3 K=4 outer-round pipelining Area

47 Comparison of the traditional and new design methodologies (2) Latency inner-round pipelining mixed inner and outer-round pipelining k opt k=2 K=2 K=3 - inner-round pipelining - mixed inner and outer-round pipelining - basic architecture - outer-round pipelining basic architecture K=2 K=3 K=4 K=5 outer-round pipelining Area

48 NSA architecture: Full outer-round pipelining #rounds registers round 1 = one pipeline stage round 2 = one pipeline stage.... round #rounds = one pipeline stage Total # of pipeline stages = #rounds

49 NSA Results: Full outer-round pipelining CMOS ASIC 0.5 m Throughput [Gbit/s] Serpent Rijndael Twofish RC6 Mars

50 My approach: Full mixed inner- and outer-round pipelining k registers round 1 = k pipeline stages.... round 2 =k pipeline stages round #rounds =k pipeline stages.... Total # of pipeline stages = #rounds k

51 My Results: Full mixed pipelining Throughput [Gbit/s] 16.8 Virtex FPGA Serpent Twofish RC6 Rijndael

52 Speed-up compared to the basic architecture Our results NSA Rijndael Serpent Serpent Twofish I8 I1 RC6 Mars

53 My approach: Full Mixed Pipelining Cipher 1 Cipher 2 round 1 round 1 round 2 minimum clock period round 10 round 16 Speed = block size min_clock_period

54 My Results: Full mixed pipelining Area [CLB slices] dedicated memory blocks, RAMs 46, ,700 21,000 12, RAMs Serpent Twofish RC6 Rijndael

55 Conclusions for non-feedback cipher modes (1) ECB, counter All ciphers can achieve approximately the same speed. Area should be the primary criteria of comparison. Architecture with inner round pipelining combined with full outer round pipelining is the most appropriate for comparison and future implementations Serpent, Twofish and Rijndael are the most cost-efficient and take approximately the same amount of area

56 Conclusions for non-feedback cipher modes (2) ECB, counter No agreement regarding the methodology and architecture used for comparison NSA methodology favored ciphers with simple (fast) cipher round (Serpent and Rijndael) My methodology fair practical (superior throughput/area ratio)

57 Summary (1) All five AES finalists implemented in basic architecture The best throughput for four of them The best throughput/area ratio Four AES finalists implemented in mixed architecture The highest throughput ever reported

58 Summary (2) Basic iterative architecture is the most appropriate for comparison and future implementations of ciphers in feedback modes of operation Gives best throughput/area ratio Throughput is the comparison criteria Mixed architecture is the most appropriate for comparison and future implementations of ciphers in non-feedback modes of operation Area is the comparison criteria Independent of number and complexity of rounds

59 Summary (3) - My Ranking of Ciphers Serpent, Rijndael Rijndael offers better throughput/area ratio RC6, Twofish Both ciphers slower in basic architecture MARS Slow and large

60 Summary (4) - Survey filled by AES3 conference participants # votes RijndaelSerpentTwofish RC6 Mars

61 Possible Extensions of this Work Study implementations of key schedules Forward and backward key schedules Study new modes of operation New contest started by NIST Comparison of Stream and Block Ciphers

62 Questions.