[attachment=6631]
High-Throughput Low-Cost AES Processor


Chih-Pin Su, Tsung-Fu Lin, Chih-Tsun Huang, and Cheng-Wen Wu, National Tsing Hua University

---

ABSTRACT

We propose an efficient hardware implementation of the Advanced Encryption Standard algorithm, with key expansion capability. Compared to the widely used table lookup technique, the proposed basis transformation technique reduces the hardware overhead of the S-Box by 64 percent. Our pipelined design has a very high throughput rate. Using typical 0.35 μm CMOS technology, a 200 MHz clock is easily achieved, and the throughput rate in the non-feedback cipher mode is 2.38 Gb/s for 128-bit keys, 2.008 Gb/s for 192-bit keys, and 1.74 Gb/s for 256-bit keys, respectively. Testability of the design is also considered. The hardware cost of the AES design is approximately 58K gates using a standard synthesis flow.

INTRODUCTION


The rapidly growing number of Internet and wireless communication users has led to increasing demand for security measures and devices to protect user data transmitted over open channels. Two types of cryptographic systems have been developed for that purpose: symmetric (secret key) and asymmetric (public key) cryptosystems. Symmetric cryptography, such as in the Data Encryption Standard (DES), 3DES, and Advanced Encryption Standard (AES) [1], uses an identical key for the sender and receiver, both to encrypt the message text and decrypt the cipher text. Asymmetric cryptography, such as in the Rivest-Shamir-Adleman (RSA) and Elliptic Curve algorithms, uses different keys for encryption and decryption, eliminating the key transportation dilemma. Symmetric cryptography is more suitable for the encryption of a large amount of data. The AES algorithm defined by the National Institute of Standards and Technology (NIST) of the United States has been widely accepted to replace DES as the new symmetric encryption algorithm [1]. AES encryption is an efficient scheme for both hardware and software implementation. Much work has been presented on hardware implementations of AES using field programmable gate arrays (FPGAs) [2–5], and comprehensive analyses of the performance of the AES finalists was presented based on FPGA implementations, before Rijndael was selected as the AES algorithm. Mostapproaches use a ROM/RAM-based lookup table (LUT) to implement the most critical transformation step in the AES algorithm, the SubBytes transformation (also known as the S-Box). This approach is cost effective for SRAM-based FPGAs, but may not be a good choice for application- specific integrated circuit (ASIC) implementation. An alternative LUT-based approach that combines the S-Box and MixColumn transformation has been reported using different technologies [6, 7]. Besides the LUT-based approaches, results from several other projects have shown that implementing an arithmetic circuit in a composite field to compute the multiplicative inverse and affine transformation of the S-Box provides an excellent trade-off between silicon area and performance. The composite field implementation was first recommended by the inventor of Rijndael [8]. Some implementations based on this idea can be found in [9–12]. An extended low-power implementation was proposed in [13], and in [14] a unified hardware architecture where the AES and Camellia algorithms share the same composite-field inverse function was also presented. We present a hardware-efficient design for the AES algorithm. The S-Box was implemented based on composite-field arithmetic [11]. The chip has been implemented and verified for both encryption and decryption, with standard key lengths of 128, 192, and 256 bits. The key expansion procedure was also implemented on the chip.