Hardware-Focused Performance Comparison for the Standard Block Ciphers AES, Camellia, and Triple-DES

Transcription

1 Hardware-ocused Performance Comparison for the Standard Block Ciphers AES, Camellia, and Triple-DES Akashi Satoh and Sumio Morioka Tokyo Research Laboratory IBM Japan Ltd.

2 Contents Compact and High-Speed Architectures for AES Compact and High-Speed Architectures for Camellia Compact and High-Speed Architectures for Triple-DES S-Box Comparison between AES and Camellia Hardware Performance Comparison in ASIC Conclusion

3 Compact and High-Speed Architectures for AES

4 AES Algorithm 12-bit data blocks with 12-/192-/256-bit keys SPN structure using 4 primitive functions takes 11 rounds 1-bit XOR 12 -bit S-Box 16 a 00 a 10 a 20 a 30 a 00 a 10 a 20 a 30 a 01 a 02 a 03 a 11 a 12 a 13 a 21 a 22 a 23 a 31 a a 33 a a a a 31 a 33 k 00 k 01 k 02 k 03 k k k k k k k k k k k k a 02 a S-Box b 00 b b02 b a ij a b10 b b 12 ij b a 22 a b20 b b22 b a b b b b = b 00 b 01 b 02 b 03 b b b b b b b b b b b b Cipherihg Block 12-bit plain text AddRoundKey SubBytes ShiftRows MixColumns AddRoundKey << S-Box Key Scheduler 12-bit secret key Rcon[1] -bit Rotation 4 -bit Permutation 4 a a 12 a a 30 a 01 a a03 a 10 a 11 a 13 a 21 a a23 a 31 a a33 a0 j a a a a 10 a 11 a 1j a 13 a 20 a 21 a a 2j 23 a 30 a 31 a 33 a 3j no shift left rotation by 1 left rotation by 2 left rotation by 3 x c( ) a 00 a 01 a 02 a03 a 10 a a a 30 a a 31 b 0j b b b b b b 1j b b b b 2j b b b b b 3j SubBytes ShiftRows MixColumns AddRoundKey SubBytes ShiftRows AddRoundKey 12-bit cipher text << S-Box << S-Box Rcon[9] Rcon[10]

5 Compact Architecture for AES Primitive components are shared between encryption, decryption, and key scheduling -bit data path is repeatedly used to process 12-bit data Key scheduler reuses the S-Box in the ciphering block while ShiftRows is executing Encryption and decryption take 54 clock cycles Ciphering Block -1 5:1 affine MxCo -bit Data Reg ShiftRows InvShiftRows affinē 1 << -bit Key Reg x -1 x -1 x -1 x -1 SubBytes InvSubBytes MxC 5:1 AddRoundKey Rcon [ i ] 4:1-1 MxCo Key Scheduler

6 High-speed Architecture for AES Straightforward implementation with 12-bit data path Encryption and decryption take 10 clocks each Ciphering Block Data Input Key Scehduler AddRoundKey Data Register ShiftRows/InvShiftrows Secret Key Register << d affinē 1, d x -1 x -1 x -1 x -1 -bit d, affine d -1 Slice -bit Slice -bit Slice SubBytes Rcon [ i] Round Key Register -1 MxCo -1 MxCo -1 MxCo -1 MxCo SubBytes/ InvSubBytes MxCo -1 MxCo AddRoundKey

7 Compact and High-Speed Architectures for Camellia

8 Camellia Algorithm 12-bit data blocks with 12-/192-/256-bit keys 2 L/L -1 functions are inserted between 3 eistel network blocks It takes 22 rounds for both encryption and decryption kw 1 k 1~6 kl 1 k 7~12 kl 3 k 13~1 kw 3 Plain Text eistel Network L L -1 eistel Network L L -1 eistel Network kw 2 kl 2 kl 4 kw 4 eistel network k 1 k 2 k 3 k 4 k 5 k 6 x x7 x6 x5 x4 x3 x2 x1 kl k z S1 z7 S4 z6 S3 z5 S2 z4 S4 z3 S3 z2 S2 z1 S1 L function AND <<1 P function -1 L function OR kl z' z'7 z'6 z'5 z'4 z'3 z'2 z'1 Cipher Text OR AND <<1

9 -bit Slice of function -bit S-Box is reused twice to generate a -bit function as output Two -bit S-Box output blocks are added through permutation layer and XOR operation function Sbox 0 Permutation Sbox Sbox Permutation 0 Sbox Permutation

10 Divide and Merge Primitive unctions Number of S-Boxes is halved by using -bit slice of function k S1 S4 S3 S2 S4 S3 S2 S1 P function k H k L S1 S4 S3 S2 Merge L/L -1 function and Key whitening L function -1 L function >>1 + <<1 >>1 <<1

11 Data Path using -bit Slice of function Data are processed as -bit blocks in each round Right half of the data is always processed to simplify controller k 1~6 Plaintext kw 2 kw 1 eistel Network k 1H k 1L k 2H k 2L kw 1 k 1~6 kl 1 k 7~12 kl 3 k 13~1 kw 3 Plain Text eistel Network L L -1 eistel Network L L -1 eistel Network Cipher Text kw 2 kl 2 kl 4 kw 4 k 1 k 2 k 3 k 4 k 5 k 6 k 7~12 k 13~1 kl 2 kl 1 eistel Network kl 4 kl 3 kw kw 3 4 L -1 L eistel Network L -1 L Ciphertext k 3H k 3L k 4H k 4L k 5H k 5L k 6H k 6L

12 Ciphering Block Compact Architecture Key/Data Input Share function between data randomization block and key scheduler Round keys are generated by repeating 16-bit and 1-bit rotations Encryption and decryption take 44 clocks K L K A 4:1 Data <<16 >>16 <<1 >>1 3:1 12 Key Scheduler :1 12 Key L/L -1 KeyAdd Data Output H L L H

13 High-Speed Architecture Data/Key Input Original -bit function is used Execute function and L/L -1 functions or key whitening linear functions in the same cycle to reduce the number of clocks K L K A <<16 >>16 <<1 >>1 <<17 >>17 >> :1 3:1 H L Data L H Data Output encryption and decryption takes 1 clocks <<16 >>16 <<1 >>1 4:1 L L :1 3:

14 Compact and High-Speed Architectures for Triple-DES

15 DES Algorithm -bit data block with 56-bit key 16-round eistel network Triple-DES takes 4 rounds S-Box is a random substitution table Straightforward implementation can obtain compact hardware with high operating frequency Plain Text IP 4 4 Key Scheduler P E S0 S1 S2 S3 S4 S5 S6 S7 function IP -1 4 Cipher Text

16 Compact High-Speed Compact and High-Speed Architectures for DES Three architectures containing 1-/2-/4-round functions execute triple-des in 4/24/12 clocks Multi-round/clock version obtained higher throughput due to the decrease of register access and the logic compression on the stacked round functions 1round/clock Total 4cycles 56 2rounds/clock Total 24cycles 56 4rounds/clock Total 12cycles 56 Data Key Data Key Data Key Round func. 4 Schedule Round func. Round func. 4 4 Schedule Round func. Round func Round func. Round func. 4 Schedule

17 S-Box Comparison between AES and Camellia

18 Compact AES S-Box Architecture ield conversion from G(2 ) to G(((2 2 ) 2 ) 2 ) by isomorphism functions Hierarchical architecture of the G(((2 2 ) 2 ) 2 ) inverter is very compact Isomorphism function and affine transformation are merged into a single XOR matrix G(2 ) isomorphism G(((2 2 ) 2 )) 2 inversion G(((2 2 ) ) G((2 2 ) 2 ) G(2 2 ) G(2) 2 2 ) 4 4 x 2 λ x G(((2 2 ) 2 ) 2 ) inverter G(2 ) isomorphism merged affine trans x 2 φ x G((2 2 ) 2 ) inverter G(2 2 )inverter

19 Small Camellia S-Box Architecture Camellia uses G((2 4 ) 2 ) inverter G(2 4 ) inverter is implemented as a lookup table affine trans. G((2 4 ) 2 ) inversion G((2 4 ) 2 ) G(2 4 ) 4 4 x 2 ω x G((2 4 ) 2 ) inverter affine trans.h G(2 4 ) inverter

20 S-Box Performance in ASIC Synthesized using a 0.13 um ASIC library G(((2 2 ) 2 ) 2 ) inverter is smaller than G((2 4 ) 2 ) by 26% Lookup table inverter is 2 times faster but 3 times bigger Performance of S-Boxes are almost the same between AES and Camellia Component Method Size (gates) Delay (ns) Inverter AES Camellia Inverter SubBytes InvSubBytes S1~S4 G((2 4 ) 2 ) G(((2 2 ) 2 ) 2 ) Table G(((2 2 ) 2 ) 2 ) Table G(((2 2 ) 2 ) 2 ) Table G((2 4 ) 2 ) Table ~ ~ ~ ~1.40

21 Hardware Performance Comparison in ASIC

22 AES/Camellia/Triple-DES in ASIC In compact architecture, 3 algorithms show same performance In high-speed architecture, 12-bit eistel-cipher Camellia is 2 times faster than -bit eistel-cipher Triple-DES SPN-cipher AES is 1.6 times faster than Camellia Throughput (Mbps) Mbps/5.4Kgates Mbps/6.5Kgates Mbps/5.5Kgates AES (Ours) Camellia (Ours) Triple-DES(Ours) AES (Conventional) Camellia (Conventional) 3.46Gbps/36.9Kgates 2.15Gbps/29.Kgates 1.07Gbps/16.9Kgates Small & ast Gate Count (Kgates) (0.13um ASIC, worst case)

23 Hardware Efficiency Hardware efficiency defined by throughput /gate is compared High-speed versions show higher efficiency because no additional circuits or delays for component sharing are required High-speed versions with composite field S-Box show the best performance Hardware Efficiency (Kbps/gate (0.13um ASIC, worst case) cycles Lookup table 44 Area optimized Speed optimized 1 1 Lookup table 4 24 Camellia Triple-DES 12

24 Conclusion

25 Conclusion Compact and high-speed hardware architectures for AES, Camellia, and triple-des were proposed Composite field S-Boxes for compact designs were presented Hardware performance using ASICs was evaluated All algorithms showed similar performance in compact implementations Block size (12/ bits and network structure (SPN/eistel) determined throughput in high-speed implementations Well-designed primitive components for SPN cipher can make very compact hardware SPN cipher is also suitable for high-speed hardware