Native composite-field AES encryption/decryption accelerator circuit

Advanced Encryption Standard (AES) is a symmetric-key encryption protocol that some computing platforms use to encrypt and decrypt all read/write hard drive accesses. In order to prevent such reads/writes from swamping processor performance, hardware acceleration of AES encrypt/decrypt operations is desirable.

AES provides several modes of operation. AES-128, AES-192 and AES-256 modes of operation submit 128-bit input data to, respectively, 10, 12 and 14 iterations of an AES round operation. The AES round operation includes successive SubstituteByte, ShiftRow and MixColumns transformations, followed by an AddRoundKey operation.

During the SubstituteByte transformation, each 8-bits of the 128-bit input data is input to one of sixteen S-boxes. Each S-box computes the multiplicative inverse of its respective 8-bit input in the Galois Field GF(2 8 ). Some implementations map the 8-bit input to a composite field GF(2 4 ) 2 , compute the multiplicative inverse in GF(2 4 ) 2 , map the result back to GF(2 8 ), and proceed to the ShiftRow transformation. These existing implementations are unsuitable in terms of silicon footprint, power and/or cycle time.

FIG. 1 is a flow diagram of a process according to some embodiments.

FIG. 2 is a diagram of an S-block according to some embodiments.

FIG. 3 is a diagram of a square-multiply circuit according to some embodiments.

FIG. 4 is a diagram of a GF(2 4 ) multiplier circuit according to some embodiments.

FIG. 5 is a diagram of a circuit to determine a multiplicative inverse according to some embodiments.

FIG. 6 is a diagram of an affine transform circuit according to some embodiments.

FIG. 7 is a diagram of an inverse-affine transform circuit according to some embodiments.

FIG. 8 is a diagram of a ShiftRow/InverseShiftRow block according to some embodiments.

FIG. 9 is a diagram illustrating matrices of a MixColumn transformation and an InverseMixColumn transformation according to some embodiments.

FIG. 10 is a diagram of a MixColumn/InverseMixColumn block according to some embodiments.

FIG. 11 is a diagram of an 8-bit slice of a MixColumn block according to some embodiments.

FIG. 1 is a flow diagram of process 100 according to some embodiments. Process 100 may be executed by dedicated hardware such as an encryption accelerator embodied as a functional block of a microprocessor, or in a dedicated integrated circuit. Process 100 and any of the processes described herein may be performed by hardware, software (including microcode), or a combination of hardware and software.

Input data of Galois Field GF (2 k ) is initially received at 110 . The input data may comprise 128-bit data of Galois Field GF (2 8 ) according to some embodiments. Next, at 120 , the input data is mapped to composite Galois Field GF (2 nm ), where nm=k. In some embodiments, n=4 and m=2.

A SubstituteByte transformation is performed on the data at 130 . Generally, the SubstituteByte transformation comprises a non-linear byte substitution in Galois Field GF(2 4 ) 2 . The transformation includes two sub-transformations: multiplicative inverse and affine transformation. The SubstituteByte transformation, as well as the other transformations and operation of process 100 , may conform to the NIST Advanced Encryption Standard (FIP PUB 197, Nov. 26, 2001). Embodiments are not limited thereto.

The input data may be broken into 16 8-bit fields, each of which is input to a respective S-box to perform the two sub-transformations of the SubstituteByte transformation. FIG. 2 illustrates S-box 200 to receive an 8-bit field according to some embodiments. S-box 200 includes square-multiply circuit 210 , Galois Field (2 n ) multipliers 220 , inverse circuit 230 , affine transformation block 240 and inverse affine transformation block 250 .

Square-multiply circuit 300 of FIG. 3 may comprise an implementation of circuit 210 . Similarly, multiplier 400 of FIG. 4 may implement any one or more of multipliers 220 of S-box 200 . Multiplier 400 takes advantage of the respective arrival times of its inputs to reduce its delay from 3XORs+1NAND gate to 2XORs+1NAND gate, by tying early arriving inputs to inputs 410 .

An example of inverse circuit 230 is illustrated by circuit 500 of FIG. 5 . Notably, circuit 500 comprises calculation of X −5 (circuit 510 ) and X 4 (circuit 520 ) in Galois Field GF(2 4 ) 2 , wherein X=the 8-bit input data. Circuit 500 also includes a multiplier 530 to determine the multiplicative inverse X −1 by multiplying X −5 and X 4 in Galois Field GF(2 4 ) 2 .

Native GF(2 4 ) 2 S-boxes require custom affine and inverse-affine matrices, with multiplicative factors and constants which are also mapped from GF(2 8 ) to GF(2 4 ) 2 . Moreover, affine transformation block 240 is active during the encrypt operation only and should be bypassed during the decrypt operation. Conversely, inverse affine transformation block 250 is active during the decrypt operation only and should be bypassed during the encrypt operation.

S-box 200 advantageously includes a common datapath for affine transformation block 240 and inverse-affine transformation block 250 . Affine transformation block 600 of FIG. 6 may provide features to implement such a common datapath. Block 600 is bypassed during decrypt by the use of integrated Mux-XOR circuits 610 . XOR gates 620 that feed into Mux-XOR circuits 610 are specialized XOR gates in which the output inverter is converted to a NAND gate. During decrypt (i.e., Encrypt=0, Encrypt#=1), the outputs of XOR gates 620 are forced to ‘1’, and the bypass paths of Mux-XOR circuits 610 are activated. Inverse-affine transformation block 700 also uses Mux-XOR circuits 610 at the output to bypass block 700 during encrypt.

Returning to process 100 , a ShiftRow transformation is performed at 140 in Galois Field GF(2 nm ). The shift row transformation may comprise a linear diffusion process operating on an individual row. As a result, each row of an input array is rotated by a certain number of byte positions.

FIG. 8 illustrates ShiftRow/InverseShiftRow block 800 according to some embodiments. Block 800 uses a folded datapath organization to reduce a total number of wires by 50% over conventional implementations. The ShiftRow transformation (i.e., during encrypt mode) and the InverseShiftRow transformation (i.e., during decrypt mode) share the same wires, with tristate buffers enabled in either mode to tap off a signal at an appropriate column to perform the required permutation.

Next, at 150 , a MixColumns transformation in Galois Field GF(2 nm ) is performed on the output of the ShiftRow transformation of 140 . The MixColumns transformation is also a linear diffusion process. A column vector is multiplied in Galois Field GF(2 nm ) using a fixed matrix in which bytes are treated as polynomials of degree less than four.

The matrix of the MixColumns transformation and the matrix of the InverseMixColumns transformation are transformed from conventional implementations to operate in Galois Field GF(2 nm ). Moreover, some embodiments implement the two matrices using a common datapath. The composite field polynomial x 2 +x+B may be chosen to maximize the overlap between the two matrices, although other polynomials may be chosen in accordance with some embodiments. FIG. 9 illustrates the matrix of the MixColumns transformation and the matrix of the InverseMixColumns transformation in Galois Field GF(2 nm ) according to some embodiments.

FIG. 10 illustrates MixColumn/InverseMixColumn block 1000 according to some embodiments. Block 1000 operates on 32-bits of data and includes four 8-bit blocks 1010 - 1016 to generate each scaled term and XOR-tree 1020 to add up the relevant terms. FIG. 111 depicts 8-bit block 101 X according to some embodiments. The composite field polynomial has been selected to minimize the size of 8-bit block 101 X.

The AddRoundKey operation is performed on the current data at 160 . The AddRoundKey operation is also performed in Galois Field GF(2 nm ). Specifically, each byte of the current array may be added (in GF(2 nm )) to a byte of a corresponding array of the round subkeys. The subkeys are derived from original keys by XORing two previous columns. Next, at 170 , it is determined whether additional iterations are needed.

As mentioned above, AES-128, AES-192 and AES-256 modes of operation require 10, 12 and 14 iterations of the AES round operation, respectively. Embodiments are not limited to these modes or these numbers of iterations. Regardless, if additional iterations are needed, flow returns to 130 where the current data (i.e., the data output by the prior AddRoundKey operation) is subjected to the SubstituteByte transformation.

Flow therefore cycles between 130 and 170 until it is determined that additional iterations are not needed. Than, at 180 , the current data (i.e., the data output by the prior AddRoundKey operation) is mapped from the composite Galois Field GF(2 nm ) to Galois Field GF(2 k ). Some embodiments may therefore provide AES encryption/decryption of a Galois Field GF(2 k ) input using less silicon footprint, power and/or cycle time than prior implementations.

The several embodiments described herein are solely for the purpose of illustration. Therefore, persons in the art will recognize from this description that other embodiments may be practiced with various modifications and alterations.