U N I V E R S I T Y. Toward Gbps Cryptographic Architectures. Ramesh Karri, Piyush Mishra, Igor Minkin Kaiji Wu, Khary Alexander, Xuan Li

Transcription

1 Polytehni U N I V E R S I T Y Towrd - Gps Cryptogrphi Arhitetures Rmesh Krri, Piyush Mishr, Igor Minkin Kiji Wu, Khry Alexnder, Xun Li Otoer 22 WICAT TR 2-5

2 Towrds - Gps Cryptogrphi Arhitetures Khry Alexnder!, Rmesh Krri, Igor Minkin, Kijie Wu, Piyush Mishr, Xun Li! IBM Corportion, Poughkeepsie, NY, 26, klex@utopi.poly.edu ECE Deprtment, Polytehni University, 5 Metroteh Center, Brooklyn, NY, 2 rmesh@indi.poly.edu, iminki, kwu3, pmishr, Astrt Support for seure trnstions over inseure puli ommunition networks, uilt top high-speed optil infrstruture, requires ryptogrphi primitives with -Gps throughput. In this pper we present vrious hrdwre rhitetures for high-speed lok nd strem iphers nd study the ssoited throughput nd re trde-offs. We demonstrte high-speed enryption rhitetures for Advned Enryption Stndrd (AES) sed lok nd strem iphers nd SNOW strem ipher with 4.7Gp, 4.6Gps nd 2.2Gps throughput rtes respetively. We then present our ongoing work on high-speed rhitetures for tree-sed strem ipher Levithn. Keywords: ryptogrphy, enryption, lok-ipher, strem-ipher, FPGA, VHDL, AES, Rijndel, SNOW, Levithn Introdution Demnd for high-speed enryption is rpidly inresing due to the lrge ndwidth requirements of the evolving network pplitions. These pplitions inlude Virtul Privte Network (VPN) ggregtion points, seure e-ommere we servers nd Lol Are Networks (LANs) with ggregte seurity protool offlod. As result, ryptogrphi proessing in softwre is proving to e indequte, therey fueling the industry's push towrds hrdwre implementtions of vrious ryptogrphi rhitetures. In this pper we present vrious hrdwre rhitetures for high-speed lok nd strem iphers nd study the ssoited throughput vs. hrdwre re trde-offs. Cryptogrphi lgorithms re lssified s hsh, privte- nd puli lgorithms. Hsh lgorithms operte on ritrry length messges to rete fixed length digest or hsh. Puli lgorithms, lso known s symmetri- lgorithms, use the si ide of one-wy funtions to generte enryption-deryption pir to e used for dt enryption. On the other hnd, funtionlity nd seurity of privte- lgorithms, lso known s symmetri- lgorithms, depend on the single privte. Privte- lgorithms re silly of two types, lok ipher nd strem ipher, nd n operte in vrious modes of opertion suh s Eletroni Book Code (ECB), Output Feed Bk (OFB), nd Cipher Blok Chin (CBC) mode. Blok iphers proess plintext (iphertext) messges in disrete loks nd enryption (deryption) of prtiulr plintext (iphertext) with lok ipher results in the sme iphertext (plintext) when the sme is used. Exmples of lok iphers inlude Dt Enryption Stndrd (DES), triple-des (3DES), nd AES finlist lgorithms - Rijndel, Twofish, RC6 nd Serpent. After thorough study of seurity nd performne enhmrks NIST hose Rijndel s the winner. Strem iphers, on the other hnd, re prtil pproximtions to the one time pd, operting with time-vrying trnsformtion on individul elements s smll s single its. With strem ipher, the trnsformtion of these smller units will vry, depending on when they re enountered during the enryption proess. Strem iphers n e reted from dedited strem genertors, suh s Liner Feedk Shift Register (LFSR) nd tree-sed strem iphers or y ertin modes of opertion of lok iphers. Exmples of strem iphers re SNOW, Levithn nd Rijndel in Integer Counter Mode (ICM). Severl hrdwre implementtions of ryptogrphi lgorithms hve een desried in literture, suh s the lgorithm-speifi implementtions of DES [[8], [9], [], []], IDEA [2], Twofish [2], nd Blowfish [2] nd hrdwre-softwre o-design sed rypto-proessors, suh s CryptoMni [3]. In this pper we present our work on vrious hrdwre rhitetures for high-speed lok nd strem iphers tht hieve to Gps throughput rtes nd study the ssoited throughput nd re trde-offs. Setion 2 desries the implementtion results of the four AES [7] finlist lok iphers on Field Progrmmle Gte Arrys (FPGAs). It lso presents vrious high-speed rhitetures for these symmetri lok iphers nd vlidtes these using AES (Rijndel). Setion 3 disusses high-speed rhitetures for strem iphers - AES in ICM, SNOW, nd Levithn - followed y the orresponding implementtion results. Setion 4 onludes this study. This work is supported y CISCO University Reserh Progrm

3 2 Blok Ciphers A symmetri lok ipher enrypts plintext y itertively pplying round trnsformtion to the input lok using different round-s for eh round. Round s re derived from the privte y using -shedule trnsformtion. Deryption is the reverse proess of enryption. Usully the omplexity of enryption nd deryption opertions is more signifint thn tht of genertion opertion. Hene, in this pper we only fous on optimizing the opertions used y dt enryption nd deryption for etter system performne. Figure shows the rhiteture for symmetri Rijndel [] enryption nd deryption. During enryption input lok is exlusive-or (XOR) with round- in the pre-proessing step nd the output is itertively trnsformed N r times using round funtion where N r denotes the totl numer of itertions nd eh itertion uses different round. Figure : AES itertive lok ipher A round funtion onsists of series of opertions (AES uses Sustitution Box (SBox) - Shift Row (SRow) - Mix Column (MixCol) - Key XOR (KXor)). Numer of rounds of enryption nd deryption is funtion of the dt lok size, user size nd the desired level of seurity. In most ses, inresing the numer of enryption rounds improves seurity t the ost of system throughput nd vie-vers. For exmple, AES proesses dt loks of 28 its, using ipher s of 28, 92 or 256 its. Tle shows the numer of enryption/deryption rounds orresponding to these three different sizes. Tle : Numer of rounds of AES s funtion of dt loks size nd user sizes N k N r 2 4 N = 4, N k = length/32, N r = MAX (N, N k ) FPGA Implementtion of Blok Ciphers Tle 2 shows the results of our implementtion of four AES finlist lok iphers on Xilinx Virtex series XCV FPGAs. All FPGA implementtion were rried out using Synpliity Synplify VHDL ompiler, Modelteh Modelsim VHDL simultor nd Xilinx Ple nd Route (PAR) tools. Detils of these implementtion results n e found in [3]. One Virtex slie ontins two look-up tles (LUTs) nd eh LUT n implement four-input, one-output logi funtion. Throughput of ipher represents the totl numer of its enrypted per seond nd is lulted s numer of its enrypted / (opertion yles * lok durtion). Tle 2: Implementtion results for AES finlists Are (Slies) Frequeny (MHz) Throughput (Mps) Rijndel RC Twofish Serpent An itertive looping rhiteture minimizes the hrdwre re requirements y implementing only one round over whih the ipher itertes N r times per lok. This sheme however results in low throughput nd n e ostly in terms of the input nd round storge nd multiplexing requirements. Throughput rtes of ll these implementtions were less thn 5 Mps. Therefore dvned rhitetures need to e designed to hieve the trget throughputs of Gps nd higher. 2.2 Advned Arhitetures for Blok Ciphers Itertive lok iphers offer vriety of rhiteturl options, eh with the ssoited re nd throughput trdeoffs. For exmple, loop-unrolled rhiteture llows implementtion of up to N r rounds s single omintionl logi lok, reduing the hrdwre for round multiplexing nd the numer of lok yles per lok. However, this pproh mximizes the hrdwre requirements nd yields worst se register-register dely. Another option for high-speed rhitetures is pipelining. A prtilly pipelined rhiteture hieves this y inresing the numer of loks of dt tht re eing simultneously operted upon. Eh round is implemented s the tomi round element nd the intermedite dt re registered, deresing the worst-se register-to-register dely. In the se of full-length pipeline, the system will output n N-it lok t eh lok yle one the lteny of the pipeline hs een met. This rhiteture, however, lso signifintly inreses the required hrdwre resoures. Bsi pipelining n e extended y su-pipelining to overome these shortomings. For exmple, AES n e su-pipelined y prtitioning the SRow nd MixCol opertions. This dereses the worst-se register-register

4 dely nd inreses the numer of dt loks tht n e operted on simultneously y ftor equl to the numer of su-divisions. However, these enefits ome t the ost of n inrese in the numer of lok yles, therey requiring orresponding derese in the worst-se dely etween the stges. 2.3 FPGA Implementtion of Advned Arhitetures for AES Blok Ciphers After nlyzing these vrious rhitetures we deided to optimize the su-pipelined AES lok ipher with 28-it lok nd 28-it user size to investigte the ssoited throughput vs. re trdeoffs. An importnt oservtion regrding AES is tht the most dominnt opertion of AES is the SBox sine 28-it dt pth requires sixteen opies of the 8-it SBox [3]. As result, round funtion ws su-pipelined to isolte it from SRow, MixCol nd KXOR. Even though the seond stge ontined multiplexer (to ypss MixCol during the lst round of enryption) SBox opertion still formed the ritil pth. Two rhitetures were developed using this su-pipelined round nd in oth the ses sheduling ws performed priori. First rhiteture (SP ) [2] is uilt round one round with one su-pipeline register to split it into 2-stges. Figure 2 shows tht round-s were stored in -RAM nd 28-it TextIn port ws used to supply oth user nd plintext. Seond rhiteture is five stge prtilly pipelined (SP_5_) loop unrolling of the su-pipelined round, s shown in Figure 3. First four rounds were optimized y removing the ypss multiplexer in the seond stge of the su-pipeline sine MixCol is lwys performed in these stges. In this se round s were stored in file of registers. This rhiteture resulted in stge pipeline (5 rounds * 2 stges per round) with 2. yles (2 + / ) per lok. 2.4 Comprison with previous work Tle 3 shows the implementtion results for these two AES rhitetures on Xilinx XC2V2BG575-5 FPGA. TextIn KeyReg resetcold reset lk input whitening X preround lodnewtext Key Shedule KSClk 28-Bit Register Controller SP KeyRAM roundnum 2-Stge pipeline within Round Round RndClk donoop 28-Bit Register TextOut TextOutRedy Figure 2: Single su-pipelined round SP-- The Five-stge loop unrolled implementtion needs only single opy of the -shedule. This result in less thn 4 times re overhed while hieving more thn 4 times the throughput of one stge su-pipelined design. Tle 3: FPGA implementtion results of AES Are Frequeny Cyles/ Throughput (slies) (MHz) Blok (Mps) SP SP_5_ Advned rhitetures for AES were lso implemented on Xilinx XCV FPGA in order to ompre them with their previous implementtions t Worester Polytehni Institute (WPI). Unlike [2] our designs lso implement the sheduling funtion nd use Xtime funtion to implement MixCol opertion. Our implementtions showed signifint improvement over previous works, with 5% inrese in throughput 2% derese in hrdwre re nd these results would improve further if we do not onsider the shedule overheds. Figure 3: Five-stge su-pipelined round SP-5-

5 3 Strem Ciphers A strem ipher genertes strem tht is usully omined with plintext vi itwise exlusive-or (XOR) opertion for enryption nd deryption. Following setions desrie high speed rhitetures for AES-sed, SNOW nd Levithn strem iphers. 3. AES-sed Strem Cipher Certin modes of opertion of lok ipher effetively trnsform it into strem genertor nd s suh ny lok ipher n e used s strem ipher. One suh mode of opertion is Integer Counter Mode (ICM) proposed in [4]. The strem is generted from n ICM nd segment index nd XORed with plintext to generte the orresponding ipher text. Length of the ICM is dependent on the lok-length nd the -length prmeters of the underlying lok ipher. The AES lok ipher, presented in the prior setion, ws implemented in ICM mode to rete n effiient synhronous strem genertor. Figure 4 shows tht the generlized interfe of our implementtion filittes esy IP reuse of AES lok ipher rhitetures for AES strem ipher with some trivil modifitions. The only dditionl omponents needed re the optimized ount initilizer nd ounter with prllel lod. Constnt ddition in prllel-lod ounter ws fster (97MHz) thn the lok ipher. A multiplexer ws used to drive the lok ipher input from either the In input for the ICM or the ounter. TextIn reset lk initctr ontrol signls PLCounter ontrol signls '' lodnewtext Controller SP reset resetcold Enryptor SP or SP_5_ lk TextOutRedy TextOut X 28-Bit Register Figure 4: AES Integer Counter Mode strem ipher ICM ounter initiliztion lgorithm required 96-it ddition whih turned out to e the min system ottlenek (see results orresponding to the un-optimized implementtion in Tle 5). Therefore, ICM ounter initiliztion ws optimized y folding the ddition onto single 32-it rry-selet dder operting TextOut t 8 MHz. This ddition took three yles, ut ws performed during -shedule. Implementtion results of these implementtions re shown in Tle SNOW Strem Cipher A Liner Feedk Shift Register (LFSR) is mehnism for generting strem of inry its [6]. The register onsists of series of ells tht re initilized using the seret. At eh loking instnt the ontents of the ells re shifted right y one position nd non-liner opertion (e.g. XOR) is pplied to suset of the ell ontents nd fed k into the leftmost ell. This is n exmple of mny-to- feedk topology. Another wy to implement n LFSR is with -to-mny topology where the most signifint it is used in ll the tps. Regrdless of the topology, LFSRs re fst nd esy to implement in oth hrdwre nd softwre nd with pproprite feedk the generted tps sequenes n hve good sttistil pperne. Figure 5 shows SNOW, LFSR sed synhronous strem ipher tht supports sizes of 28 nd 256 its [6]. This rhiteture does not permit strightforwrd trdeoff etween re nd throughput sine it nnot e roken into multiple rounds of omputtion to filitte pipelining. Also, sine there is dependeny etween the genertions of onseutive words in the strem, they nnot e produed in prllel. Critil pth onsists of two 32-it dditions, two XORs nd left-shift y seven. Therefore in order to inrese its performne we investigted vriety of high-speed rhitetures for dders. S S2 S3 S4 S5 S6 S7 S8 S9 S S S2 S3 S4 S5 S6 ALPHA _CONST << GEN_IN SETUP R Finite Stte Mhine EN INIT ENABLE INIT ENABLE CLK USER_KEY EN CLK 28 GEN_OUT Figure 5: SNOW strem ipher dt pth KEY_STREAM Tle 4 shows the results of this nlysis sed on whih it ws deided to employ 32-it rry selet dders using 8-it rry look-hed dders. Resulting design oupied 752 slies nd operted t frequeny of MHz. This is pproximtely three times fster thn the fstest softwre implementtion of SNOW strem ipher on Pentium III systems.

6 Tle 4: Comprison of FPGA implementtion of 32-it dders on XC2V2 Frequeny (MHz) Ripple-Crry 3.6 Crry Look-hed 43.9 Crry Look-hed (8 slies) 76 Crry-Selet (4-it CLA) 72 Crry-Selet (8-it CLA) Levithn Strem Cipher Levithn is omplete inry-tree sed strem ipher whose leves re trversed onseutively from left to right to form strem [5]. A strightforwrd pproh for generting 32-it vlues t ll the lef nodes entils O (h2 h ) omputtion time nd t lest O (2 h ) storge requirements where h denotes the height of the tree. For exmple, for inry tree of height sixteen this trnsltes to it memory lotions for storing s nd O (2 2 ) omputtion time. In order to redue this storge requirement strem should e generted dynmilly. A simple pproh for generting the strem dynmilly entils trversing unique pth from the root of the tree to the orresponding lef node nd exeuting the funtions within eh node. This sheme yields worst-se omputtion time whih is equl to the height times the exeution time of node funtion nd the storge requirement of the order O (). Period etween the genertions of onseutive vlues is T _period = T A B(5) + T C, therey yielding low throughput. yle Figure 6: Pipelined trversl of omputtion tree We investigted pipelined rhitetures to proess pths leding to onseutive s. Depth of the pipeline is determined y the height of the tree. This sheme offers fixed period etween genertions of onseutive s. Figure 6 shows tree of height five nd its respetive pipelined pths. Dtflow in the pipeline trverses the pths from either the intermedite node or the root node to the lef nodes. Eh pth from the root to the lef node is trversed y tking dvntge of the shred intermedite nodes. All the node funtions long the pth trversed from the root to the lef node re exeuted in suessive stges of the pipeline nd their results re stored in the pipeline registers. Thus, when the dt flow of the pth trversing to the onseutive lef node is pipelined these vlues need not e re-omputed. This rhiteture n lso effiiently implement power-wre pipeline in whih lok gting is performed to disle speifi dt pths during empty pipeline slots. 3.4 FPGA Implementtion of Strem Ciphers Implementtion results of the vrious strem iphers on the Virtex-II series FPGAs re presented in Tle 5. Optimized AES strem ipher opertes t the sme speed s the AES lok ipher (Tle 3), though it onsumes 5% more re. 32-it dt pth SNOW throughput pprohes 3 Gps. Expnsion of this design to 28-it dt pth promises throughputs in the 2Gps rnge. Tle 5: FPGA implementtion results of strem iphers Are (slies) Frequeny (MHz) Throughput (Mps) AES ICM Un-optimized SP-- Optimized AES ICM SP-5- Un-optimized Optimized SNOW Conlusion Vrious high-speed rhitetures of enryption primitives were disussed to stisfy the rpidly inresing demnds of rodnd dt networks. Optimized FPGA implementtions of AES lok nd strem iphers nd SNOW strem ipher with high throughput rtes of 4.7 Gps, 4.6 Gps nd 2.2 Gps respetively were presented. Shemes exploiting prllelism nnot e diretly extended to iphers operting in the feedk modes suh s CBC, CFB, nd OFB. On the other hnd, deryption in these feedk modes n utilize these high-speed rhitetures sine they llow dt pth prllelism.

7 An nlysis of the work under progress on the pipelined implementtions of Levithn strem ipher with optimized storge nd omputtion requirements ws lso presented. 5 Referenes [] J. Demen, V. Rijmen, AES proposl: Rijndel, First Advned Enryption Stndrd (AES) Conferene, CA, USA, 998. [2] A. J. Elirt, W. Yip, B. Chetwynd, C. Pr, An FPGA-sed performne evlution of the AES lok ipher ndidte lgorithm finlists, IEEE Trnstions on VLSI Systems, Vol. 9, No. 4, pp , August 2. [3] R. Krri, K. Wu, P. Mishr, nd Y. Kim, Conurrent error detetion of fult-sed side-hnnel ryptnlysis of 28-it symmetri lok iphers, Proeedings, IEEE Design Automtion Conferene (DAC), NV, USA, June 2. [4] H. Lipm, P. Rogwy, nd D. Wgner, Comments to NIST onerning AES modes of opertions: CTR-mode enryption, Symmetri Key Blok Cipher Modes of Opertion Workshop, MD, USA, Otoer 2. [5] D. A. MGrew nd S. R. Fluhrer The strem ipher Levithn, New Europen Shemes for Signtures, Integrity nd Enryption (NESSIE), Otoer 2. [6] P. Ekdhl nd T. Johnsson, SNOW: A new strem ipher, Deprtment of Informtion Tehnology, Lund University, Novemer, 2. [7] Federl Informtion Proessing Stndrds (FIPS), Announing the Advned Enryption Stndrd (AES), Ntionl Institute of Stndrds nd Tehnology (NIST), Novemer 2. [8] D. W. Dvis nd W. L. Prie, Seurity for Computer Networks, Wiley, 989. [9] HiFn Corportion. [] S/39 nd OS/39 Cryptogrphy. ml [] Shiv Corportion. [2] X. Li, On the Design nd Seurity of Blok Ciphers, Hrtung-Gorre Veerlg, 992 [3] L. Wu, C. Wever, nd T. Austin, CryptoMni: A fst flexile rhiteture for seure ommunition, Interntionl Symposium on Computer Arhiteture (ISCA), Sweden, June 2.