CHAPTER 1 INTRODUCTION

Transcription

1 1 CHAPTER 1 INTRODUCTION 1.1 Advance Encryption Standard (AES) Rijndael algorithm is symmetric block cipher that can process data blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits, which is specified by the flips standard. Rijndael was designed to handle additional block sizes and key lengths; however, they are not adopted by this standard. Throughout the remainder of this thesis, the algorithm specified herein will be referred to as the AES algorithm. The algorithm may be used with the three different key lengths indicated above, and therefore these different flavors may be referred to as AES-128, AES-192 and AES-256 [86]. This specification includes the following sections: 1. Mathematical properties that is useful in understanding the algorithm. 2. Algorithm specification, covering the key expansion, encryption, and decryption routines. Implementation issues, such as key length support, keying restrictions, and additional block/key/round sizes. All byte values in the AES algorithm will be presented as the concatenation of its individual bit values (0 or 1) between braces in the order {b7, b6, b5, b4, b3, b2, b1, b0}. For example, { } identifies the specific finite field element It is also convenient to denote byte values using hexadecimal notation with each of two groups of four bits being denoted by a single character as in Table1.1.

2 2 Table 1.1 Hexadecimal representations of bit patterns. Bit pattern Character a 1011 b 1100 c 1101 d 1110 e 1111 f Hence the element { } can be represented as {63}, where the character denoting the four-bit group containing the higher numbered bits is again to the left. Some finite field operations involve one additional bit to the left of an 8-bit byte.

3 3 Where this Extra bit is present, it will appear as {01} immediately preceding the 8-bit byte; for example, a 9-bit sequence will be presented as {01} {1b} Arrays of Bytes Arrays of bytes will be represented in the form of the bytes and the bit ordering within bytes are derived from the 128-bit input sequence as follows. The pattern can be extended to longer sequences (i.e., for 192- and 256-bit keys), Fig 1.1 shows how bits within each byte are numbered. Input bit sequence Byte number Bit numbers in bytes Fig 1.1 Indices for Bytes and Bits The State Internally, the AES algorithm s operations are performed on a two-dimensional array of bytes called the State. The State consists of four rows of bytes, each containing Nb bytes, where Nb is the block length divided by 32. In the State array denoted by the symbols, each individual byte has two indices, with its row number r in the range 0 r<4and its column number c in the range 0 c< Nb.

4 4 This allows an individual byte of the State to be referred to as sr, c or s[r, c]. For this standard, Nb = 4, i.e., 0 c<4. The array of input bytes is copied into the State array as illustrated in Fig 1.2. The Cipher or Inverse Cipher operations are conducted on this State array, after which its final value is copied to the output of the array of bytes, Input bytes State array Output bytes in 0 in 4 in 8 in 12 s 0,0 s 0,1 s 0,2 s 0,3 out 0 out 4 out 8 out 12 in 1 in 5 in 9 in 13 s 1,0 s 1,1 s 1,2 s 1,3 out 1 out 5 out 9 out 13 in 2 in 6 in 10 in 14 s 2,0 s 2,1 s 2,2 s 2,3 out 2 out 6 out 10 out 14 in 3 in 7 in 11 in 15 s 3,0 s 3,1 s 3,2 s 3,3 out 3 out 7 out 11 out 15 Fig 1.2 State array input and output. Hence, at the beginning of the Cipher or Inverse Cipher, the input array is copied to the State array according to the scheme: At the end of the Cipher and Inverse Cipher, the State is copied to the output array out as follows: The State as an Array of Columns The four bytes in each column of the State array form 32-bit words, where the row number r provides an index for the four bytes within each word. The state can hence be interpreted as a one-dimensional array of 32 bit words (columns), w0...w3, where the column number c provides an index into this array. Hence, for the example in Fig 1.2, the State can be considered as an array of four words, as follows:

5 5 1.2 Mathematical Preliminaries All the bytes in the AES algorithm are interpreted as finite field elements using the polynomial notation. Finite field elements can be added and multiplied, but these operations are different from those used for numbers. The following subsections introduce the basic mathematical concepts needed for AES encryption and decryption process Addition The addition of two elements in a finite field is achieved by adding the coefficients for the corresponding powers in the polynomials for the two elements. The addition is performed with the XOR operation (denoted by Å) - i.e., modulo 2 - so that consequently, subtraction of polynomials is identical to addition of polynomials. Alternatively, addition of finite field elements can be described as the modulo 2 addition of corresponding bits in the byte. For two bytes For example, the following expressions are equivalent to one another: (Polynomial notation); (Binary notation); (Hexadecimal notation).

6 Multiplication In the polynomial representation, multiplication in (denoted by *) corresponds with the multiplication of polynomials modulo, an irreducible polynomial of degree 8. A polynomial is irreducible if its only divisors are one and itself. For the AES algorithm, this irreducible polynomial is or {01}*{1b} in hexadecimal notation. For example, {57} {83} = {c1}, because and The modular reduction by m(x) ensures that the result will be a binary polynomial of degree less than 8, and thus can be represented by a byte. Unlike addition, there is no simple operation at the byte level that corresponds to this multiplication. The multiplication defined above is associative, and the element {01} is the multiplicative identity. For any non-zero binary polynomial b(x) of degree less than 8, the multiplicative inverse of b(x), denoted b-1(x), can be found as follows: the extended Euclidean algorithm [7] is used to compute polynomials a(x) and c(x) such that Which means

7 7 Moreover, for any a(x), b(x) and c(x) in the field, it holds that Follows that the set of 256 possible byte values, with XOR used as addition and the multiplication defined as above, has the structure of the finite field Multiplication by x multiplying the binary polynomial defined in equation with the polynomial x results in The result ( x* b x )is obtained by reducing the above result modulo m(x), as defined in equation the result is already in reduced form. If b7= 1, the reduction is accomplished by subtracting (i.e., XOR ing) the polynomial m(x). It follows that multiplication by x (i.e., { } or {02}) can be implemented at the byte level as a left shift and a subsequent-conditional bitwise XOR with {1b}. This operation on bytes is denoted by x time ().Multiplication by higher powers of x can be implemented by repeated application of x time (). By adding intermediate results, multiplication by any constant can be implemented. For example, {57} {13} = {fe} because Thus

8 Polynomials with Coefficients in elements as: Four-term polynomials can be defined - with coefficients that are finite field Which will be denoted as a word in the form The polynomials in this section behave somewhat differently than the polynomials used in the definition of finite field elements, even though both types of polynomials use the same indeterminate, x. The coefficients in this section are themselves finite field elements, i.e., bytes, instead of bits; also, the multiplication of four-term polynomials uses a different reduction polynomial, defined below. The distinction should always be clear from the context. To illustrate the addition and multiplication operations, let Equation (1.14) defines a second four-term polynomial. Addition is performed by adding the finite field coefficients of like powers of x. This addition corresponds to an XOR operation between the corresponding bytes in each of the words in other words, the XOR of the complete word values. Thus, using the equations of (1.13) and (1.14), Multiplication is achieved in two steps. In the first step, the polynomial product c(x) = a(x) b(x) is algebraically expanded, and like powers are collected to give Where

9 9 The result, c(x), does not represent a four-byte word. Therefore, the second step of the multiplication is to reduce c(x) modulo a polynomial of degree 4; the result can be reduced to a polynomial of degree less than 4. For the AES algorithm, this is accomplished with the polynomial x The modular product of a(x) and b(x), denoted by a(x) Ä b(x), is given by the fourterm polynomial d(x), defined as follows: With When a(x) is a fixed polynomial, the operation defined in equation (1.18) can be written in matrix form as: Because 14+ x is not an irreducible polynomial over GF ( ), multiplication by a fixed four-term polynomial is not necessarily invertible. However, the AES algorithm specifies a fixed four-term polynomial that does have an inverse. Another polynomial used in the AES algorithm has which is the polynomial x 3. Inspecting the

10 10 equation above shows that its effect is to form, the output word by rotating bytes in the input word. This means that is transformed into 1.3 Algorithm Specification For the AES algorithm, the length of the input block, the output block and the State is 128bits. This is represented by Nb = 4, which reflects the number of 32-bit words (number of columns) in the State. For the AES algorithm, the length of the Cipher Key, K, is 128, 192, or 256 bits. The key length is represented by Nk= 4, 6 or 8, which reflects the number of 32-bit words (number of columns) in the Cipher Key [4]. Methods Key length Block Size Number of (Nk words) (Nb words) Rounds (Nr) AES AES AES Fig 1.3 Key-Block-Round combinations. For the AES algorithm, the number of rounds to be performed during the execution of the algorithm is dependent on the key size. The number of rounds is represented by Nr, where Nr= 10 when Nk= 4, Nr= 12 when Nk= 6, and Nr= 14 when Nk= 8. The only Key-Block-Round combinations that conform to this standard are given in Fig 1.3. For implementation, it is related to the key length, block size and

11 11 number of rounds. For both its Cipher and Inverse Cipher, the AES algorithm uses a round function that is composed of four different byte-oriented transformations: (1) Byte substitution using a substitution table (S-box), (2) Shifting rows of the State array by different offsets, (3) Mixing the data within each column of the State array, and (4) Adding a Round Key to the State Cipher At the start of the Cipher, the input is copied to the State array using the conventions. After an initial Round Key addition, the State array is transformed by implementing a round function 10, 12, or 14 times (depending on the key length), with the final round differing slightly from the first Nr=1 round. The final State is then copied to the output. The round function is parameterized using a key schedule that consists of a onedimensional array of four-byte words derived using the Key Expansion routine. The individual transformations Sub Bytes (), Shift Rows (), Mix Columns (), and Add Round Key () process the State and are described in the following subsections. All Nr rounds are identical with the exception of the final round, which does not include the Mix Columns () transformation. 1.4 AES Encryption Encryption is the process of converting the plain text into a format which is not easily readable and is called as cipher. The cipher is got by doing a series of mathematical operations iteratively.

12 12 Fig 1.4 AES Encryption Flow and Processing Steps Sub Bytes () Transformation The Sub Bytes () transformation is a non-linear byte substitution that operates independently on each byte of the State using a substitution table (S-box). This S-box (Fig 1.5), which is invertible, is constructed by composing two transformations [1]: 1. Take the multiplicative inverse in the finite field GF (2 8 ), described in Sec the element {00} is mapped to itself. 2. Apply the following affine transformation Bit of a byte c with the value {63} or { }. Here and elsewhere, a prime on a variable (e.g., b ) indicates that the variable is to be updated with the value on the right [3].

13 13 Fig 1.5 Block diagram of SubBytes Transformation. The various transformations (e.g., Sub Bytes (), Shift Rows (), etc.) act upon the State array that is addressed by the state pointer. Add Round Key () uses an additional pointer to address the Round Key. In matrix form, the affine transformation element of the S-box can be expressed as: Shift Rows () Transformation In the Shift Rows () transformation, the bytes in the last three rows of the State are cyclically shifted over different numbers of bytes (offsets). The first row, r = 0, is not shifted. Specifically, the Shift Rows () transformation proceeds as follows:

14 14 Where the shift value shift(r, Nb) depends on the row number, r, as follows (recall that Nb= 4): Shift(1,4)=1 ; shift(2,4) =2; shift (3,4)=3. Fig 1.6 ShiftRows, cyclically shift the last three rows in the state Mix Columns () Transformation The Mix Columns () transformation operates on the State column-by-column, treating each column as a four-term polynomial. The columns are considered as polynomials over GF ( ) and multiplied modulo x4+ 1 with a fixed polynomial a(x), given by This can be written as a matrix multiplication. Let

15 15 As a result of this multiplication, the four bytes in a column are replaced by the following: Fig 1.7 MixColumns operates on the state column by column Add Round Key () Transformation In the Add Round Key () transformation, a Round Key is added to the State by a simple bitwise XOR operation. Each Round Key consists of Nb words. Those Nb words are each added into the columns of the State, such that

16 16 Where [wi] are the key schedule words, and round is a value in the range 0 round Nr. In the Cipher, the initial Round Key addition occurs when round = 0, prior to the first application of the round function. The application of the Add Round Key () transformation to the Nr rounds of the Cipher occurs when 1 round Nr. Fig 1.8 Add Round Key XORs each column of the state with a word from the key schedule. 1.5 AES Decryption The decryption of the data which was encrypted using the AES is done by inverting all the encryption operations with the same key with which it is encrypted since the AES is a symmetric encryption standard. In the decryption process the sequence of the transformations differs from that of the encryption but the key expansion for encryption and decryption are the same [9]. However sequence of several

17 17 properties of the AES algorithm is same in encryption as well as in its equivalent decryption. Fig 1.9 AES 128-bit Decryption Algorithm. As shown in the block level diagram above, the AES decryption initially performs key-expansion on the 128-bit key block. Then the round key signal starts the actual decryption process once the data process is ready. It starts by executing an inverse add round key between cipher text with the modified key (generated in the last iteration of the encryption process) from key expansion. After this step, the AES decryption repeats the inverse shift row, inverse sub, inverse add round key, and inverse mix column steps nine times. At the last iteration, it does an inverse shift row, inverse sub bytes and inverse add round key to generate the original data.

18 Inv Shift Rows () Transformation Inv Shift Rows () is the inverse of the Shift Rows () transformation. The bytes in the last three rows of the State are cyclically shifted over different numbers of bytes (offsets). The first row, r = 0, is not shifted. The bottom three rows are cyclically shifted by Nb), (Nb r shift -bytes, where the shift value, shift (r, Nb) depends on the row number. Specifically, the Inv Shift Rows () transformation proceeds as follow Inv Sub Bytes () Transformation Inv Sub Bytes () is the inverse of the byte substitution transformation, in which the inverse S-box is applied to each byte of the State. This is obtained by applying the inverse of the affine transformation followed by taking the multiplicative inverse in GF ( ) Inv Mix Columns () Transformation Inv Mix Columns is the inverse of the Mix Columns transformation. Inv Mix Columns () operates on the State column-by-column, treating each column as a fourterm polynomial. The columns are considered as polynomials over GF ( ) and multiplied modulo x with a fixed polynomial (x), given by As described in Sec 1.4.3, this can be written as a matrix multiplication. Let

19 19 As a result of this multiplication, the four bytes in a column are replaced by the following: Inverse of the Add Round Key () Transformation Add Round Key (), is its own inverse, since it only involves an application of the XOR operation. In the straightforward Inverse Cipher, the sequence of the transformations differs from that of the Cipher, while the form of the key schedules for encryption and decryption remains the same. However, several properties of the AES algorithm allow an Equivalent Inverse Cipher that has the same sequence of transformations as the Cipher (with the transformations replaced by their inverses). This is accomplished with a change in the key schedule. The two properties that allow for this Equivalent Inverse Cipher are as follows: 1. The Sub Bytes () and Shift Rows () transformations commute; i.e. a Sub Bytes () transformation immediately followed by a Shift Rows () Transformation is equivalent to a Shift Rows () transformation immediately followed by a Sub Bytes () transformation. The same is true for their inverses, Inv Sub Bytes () and Inv Shift Rows. 2. The column mixing operations - Mix Columns () and Inv Mix Columns () are linear with respect to the column input, which means Inv Mix Columns (state XOR Round Key) =Inv Mix Columns (state) XOR Inv Mix Columns (Round Key).

20 20 These properties allow the order of Inv Sub Bytes () and Inv Shift Rows () transformations to be reversed. The order of the Add Round Key () and Inv Mix Columns () transformations can also be reversed, provided that the columns (words) of the decryption key schedule are modified using the Inv Mix Columns () transformation. The equivalent inverse cipher is defined by reversing the order of the Inv Sub Bytes() and Inv Shift Rows() transformations, and by reversing the order of the Add Round Key() and Inv Mix Columns() transformations used in the round loop after first modifying the decryption key schedule for round = 1 to Nr-1 using the Inv Mix Columns() transformation. The first and last Nb words of the decryption key schedule shall not be modified in this manner. 1.6 Features of VLSI Twenty years ago at the first conference in this series there was consensus that the best way to apply VLSI technology to information processing problems was to build parallel computers from simple VLSI building blocks. Four of the seven papers in the architecture session addressed this topic including two papers on tree machines, one on cellular automata, and another one on dataflow. Considerable research over the past two decades focused on the design of parallel machines and many valuable research contributions were made. The mainstream computer market, however, was largely unaffected by this research. Most computers today are uniprocessor and even large servers have only modest numbers (a few 10s) of processors. The situation today is different. It is again to anticipate an exponential increase in the number of devices per chip. However, unlike 1979, there are few opportunities remaining to apply this increased density to improve the performance of uniprocessor. Adding devices to modern processors to improve their performance is already well beyond the point of diminishing returns. There are few credible alternatives to using the increased device count other than to build additional processors. Because the chip areas

21 21 of contemporary machines are dominated by memory, adding processors (without adding memory) boosts efficiency by giving a large return in performance for a modest increase in total chip area. To realize the potential of such fine-grain machines to convert VLSI density into application performance we must address challenges of locality, overhead, and software [7] Architecture Challenges of VLSI Considerable work is needed before the vision of a fine-grain machine becomes a reality. Two areas in particular demand attention: managing locality and reducing overhead. Methods must be developed to manage data locality for irregular problems with significant global interaction. While the vast majority of real programs have irregular, data-dependent, and often time-varying data structures, most work to date on data layout has addressed only regular data structures [5]. A run-time mechanism to migrate data and tasks that simultaneously balances load and minimizes communication is required. Such a mechanism will involve both hardware, to identify communication patterns and to remap addresses, and software, to implement migration and replication policies. As with much of computer architecture, the art is in defining the right interface between these two components. To simplify the task of extracting parallelism at fine granularity, communication and synchronization overhead must be reduced to a minimum. Low overhead (a few clock cycles) makes it feasible to make every few loop iterations ( clock cycles) a separate task. Reducing the task size greatly increases the amount of available parallelism and hence makes it easier to parallelize programs. It is also important that synchronization be made as specific as possible. Many parallel programs have poor speedup because they are over synchronized, performing a barrier synchronization every loop iteration. By synchronizing on individual data elements, rather than on the flow of control, the end of one loop iteration can be overlapped with

22 22 the beginning of the next iteration, eliminating a sequential bottleneck and greatly increasing performance [87]. Much progress has already been made on the design of low-overhead mechanisms. The J-Machine is able to perform remote task invocations in 50 clock cycles [NWD93]. The M-Machine offers single-cycle communication and synchronization between on-chip tasks [KDM+98]. More work is needed to further reduce overhead while at the same time offering a simple, abstract model to the programmer. Locality and overhead are fundamental issues that will determine how the next generation of computer systems will be organized. Such fundamental questions cannot be addressed by the benchmark parameter studies that have become very popular in the computer architecture community. While such parameter studies are good at fine-tuning a machine, they are not suitable for the large scale exploration of the design space where programs must be significantly restructured to exploit a new design. Tuning is needed for fine-grain machines as well. Once the major issues have been resolved, parameter studies can be conducted to determine the appropriate ratio of processors to memory. If the 20% cost is considered too high, one can do nearly as well with 16 processor pairs on a chip, each with 64 megabytes of memory, giving a cost increase of only 5%. As an aside, because it is better able to exploit locality, the fine-grain computer is able to outperform the uniprocessor even on completely sequential programs that are limited by memory latency to evaluate alternative clustering strategies, and the division of memory resources across the memory hierarchy.

23 Thesis Organization A brief outline of the various chapters of the thesis is as follows. Chapter 1 Provides fundamental and basic information about the AES. It deals with S- Box, Shift-Rows, MixColumns and Add Round key transformations for Chiper, Inverse Chiper process and also the features and challenges in VLSI. Chapter 2 Deals with review of literature survey about the AES. It gives detailed study of the previous research work done and it reviews the AES to be proposed. Chapter 3 Provides information about Fault Analysis in AES-CBC Algorithm Using Hamming Code for Space Applications with analyzed results. Chapter 4 A Secure Implementation of Nonlinear AES S-Box and Fault Analysis in AES-CM Algorithm Using Hamming Code for Space Applications, analysis of the area and power for different AES architecture Chapter 5 Discussed about the Design and Analysis of Nonlinear AES S-Box and Mix-Column Transformation with the Pipelined architecture. The architectural design and FPGA based implementation are presented. Chapter 6 Provides the information about result and discussions for all these methods. Chapter 7 Concludes the overall work which has been done. It provides highlights on the thesis work and proposes suggestions for future work.