高產能低功率先進加密標準晶片之設計與網路應用

Design of a High-Throughput Low-Power AES Cipher for Network Applications

林信夷(Hsin-I Lin)

指導教授 ： 黃稚存

國立清華大學/電機資訊學院/資訊工程學系/碩士(2006年)

摘要

先進加密標準(AES)是由美國國家標準與科技學會(NIST)在2001年提出推薦的。我們的AES設計支援了Electronic Code Book (ECB)，Cipher Block Chaining (CBC)，Counter (CTR)，以及Counter with CBC-MAC (CCM)模式。在經過分析之後，兩接段的管線架構對於大多數的模式是比較有效率的。近幾年許多的AES研究被發表。SBox，在AES中運算量最大的一個元件通常是用查表或是合成場的算術運算來實現。但是在加密與解密時SBox的表格是不一樣的，因此無法做分享的動作。我們的設計方法是將SBox拆成Multiplicative Inverter與Affine Transformation兩個元件，並且將Multiplicative Inverter使用查表去實現。如此，SBox就可以在加密與解密間作分享的動作來減低硬體花費。另外，拆解後的SBox在平衡的切割上估計只會造成128位元的管線暫存器也比合成場的SBox所造成的192位元管線暫存器來的少多了。除了Multiplicative Inverter的作法之外，我們也將Affine Transformation與AES演算法中做矩陣乘法的MixColumns()合併。此外，一個re-timing的技術也能夠減少面積與最長路徑的長度。我們的AES可以在128, 192, 256位元長的密鑰長度下操作，並且每個回合即時產生密鑰。使用典型的0.18微米互補金氧半導體器件技術可以達到250MHz的時脈，並且在128位元長的密鑰下可以達到每秒3.2十億位元的處理能力。使用典型的0.13微米互補金氧半導體器件技術可以達到333MHz的時脈，並且在128位元長的密鑰下可以達到每秒4.27十億位元的處理能力。此外，我們也考慮了電力以及測試能力。電力的消耗在0.18微米製程中估計為113.4毫瓦，以及在0.13微米製程中為43.78毫瓦。測試的範圍在使用212組樣本下為98.38%。我們的AES在0.18微米製程技術下使用了78.8千個邏輯閘，以及在0.13微米製程技術下使用了91.1千個邏輯閘。

關鍵字

先進加密標準 ； 密碼 ； 密碼學

並列摘要

The Advanced Encryption Standard (AES) was proposed by National Institute of Standard
and Technology (NITS) of the United States in 2001. Our AES design supports Electronic
Code Book mode (ECB), Cipher Block Chaining mode (CBC), Counter mode (CTR),
and Counter with CBC-MAC mode (CCM) operation modes. After analysis, 2-stage pipeline
architecture is cost-e±cient for most modes. In recent year, lots of research of AES is proposed.
SBox, the heaviest component in AES, is always implemented in Look-up-table (LUT)
or composite ‾eld arithmetic. But the LUT based SBox can not be shared in encryption
and decryption. In our design, we decompose the SBox to multiplicative inverter and a±ne
transformation, and only implement the inverter in LUT. Therefore, the SBox can be shared
between encryption and decryption to decrease the overhead. In addition, the decomposed
SBox will need only 128 bit pipeline register at the balanced pipeline position in datapath
which is less than 192 bit in composite ‾eld arithmetic SBox. Besides the multiplicative
inverter, our a±ne transformation is also merged into the MixColumns(), which performs
a matrix multiplication in AES algorithm. In addition, a re-timing technique is applied to
reduce the area and critical path. Our AES core can operate in 128, 192, 256 bit key, and the
round key is generated on-the-°y. Using a typical 0.18 ¹m CMOS technology, 250 MHz clock
rate is achieved, and the throughput for 128 bit key is 3.2 Gbps. Using a typical 0.13 ¹m
CMOS technology deals a better clock rate of 333 MHz, and the throughput for 128 bit key
is 4.27 Gbps. Besides, the power and testability is also considered. The power consumption
is estimated as 113.4mW in 0.18 ¹m process, and 43.78mW in 0.13 ¹m process. The fault
coverage is 98.38% with 212 test patterns. The gate count of our AES core is 78.8K gates
using 0.18 ¹m CMOS technology, and 91.1K gates using 0.13 ¹m CMOS technology.

並列關鍵字

AES ； cipher ； cryptography

參考文獻

Dept. Electrical Engineering, National Tsing Hua University, Hsinchu, Taiwan, June

[2] National Institute of Standards and Technology (NIST), Advanced Encryption Standard

[3] M. Dworkin, Recommendation for block cipher modes of operation", Technical report,

National Institute of Standards and Technology (NIST), Gaithersburg, MD, Dec. 2001,

[4] M. Dworkin, Recommendation for block cipher modes of operation: The