Improved IDEA. The IDEA 1 (International Data Encryption Algorithm) algorithm. 1 The IDEA cryptographic algorithm is patented in Europe and in the

Transcription

1 Improved IDEA Sérgio L. C. Salomão Vladimir C. Alves João M. S. de Alcâtara Felipe M. G. Fraca Military Istitute of Egieerig Pca. Geeral Tiburcio 0, Rio de Jaeiro, RJ, Brazil COPPE/Federal Uiversity of Rio de Jaeiro P.O. Box Rio de Jaeiro, RJ, Brazil Abstract Data security is a importat issue i today s computer etworks. This paper presets the Improved IDEA chip, which implemets a ew versio of the IDEA cryptographic algorithm. Improved IDEA is orieted towards computer etwork applicatios demadig high throughput. Its architecture was based o architecture of the HIPCrypto chip, which exploits both the spatial ad the temporal parallelism available i the IDEA algorithm. These ew versios ca ecrypt/decrypt at data rates up to 6.5 Gbps. 1. Itroductio I the recet years, we have witessed a fast icrease i the umber of idividuals ad orgaizatios usig wide computer etworks for persoal ad professioal activities. Amog the variety of ew uses of computer etworks, there are several applicatios that are highly sesitive to data security. A example is commercial exchage o the Iteret [1, 15]. Bacard [2], Cohe [5] ad Kaufma et al. [7] provide a broad coverage about security issues o computer etworks. Cryptographic algorithms are a essetial part i etwork security. A well kow cryptographic algorithm is the Data Ecryptio Stadard (DES) [9, 11], widely adopted i security products. Aother cryptographic algorithm is the Iteratioal Data Ecryptio Algorithm, IDEA [, 11]. IDEA is cosidered as oe of the most importat post-des cryptographic algorithms, due to its high immuity to attacks [13, 11]. This paper describes the Improved IDEA cryptographic algorithm, a modified versio of the IDEA algorithm. The mai goal of this ew cocept is to obtai a performace icrease over the origial HIPCrypto chip [10]. For this, we replaced the multiply uits by SMER fuctio. As cosequece, we obtai a circuit twice as faster tha the origial HIPCrypto circuit. The remaider of this paper is orgaized i five sectios. Sectio 2 describes the IDEA cryptographic algorithm. Sectio 3 describes the SMER algorithm. Sectio 4 describes the architecture of the HIPCrypto chip, while Sectio 5 describes the Improved IDEA. Sectio 6 gives the results ad coclusios. 2. The IDEA Cryptographic Algorithm The IDEA 1 (Iteratioal Data Ecryptio Algorithm) algorithm [] is the evolutio of a iitial algorithm (the Proposed Ecryptio Stadard, or PES) devised by Xuejia Lai ad James Massey. Some authors [13, 11] cosider IDEA as the most secure cryptographic algorithm available at this time. Curretly, there is o kow attack techique or machie able to break the IDEA algorithm. IDEA is a symmetric, block-orieted cryptographic algorithm, as show i Figure 1. It operates o plaitext blocks ad uses 12-bit key, what makes it practically immue to brute-force attacks. IDEA is built upo a basic fuctio, which is iterated eight times, see Figure 1. The first iteratio operates o the iput plaitext block ad the successive iteratios operate o the block from the previous iteratio. After the last iteratio, a fial trasform step produces the ciphertext U.S. 1 The IDEA cryptographic algorithm is pateted i Europe ad i the

2 block. The algorithm ivolves oly three simple operatios: bitwise exclusive-or, additio modulo ad multiplicatio modulo. The th iteratio receives a iput block as four sub-blocks to, ad produces four blocks, to, as ilustrated i Figure 1. The 12-bit key is divided ito 52 sub-keys. Six subkeys, to, are used i the th iteratio ad four subkeys, to, are used i the fial trasform. The operatios performed i the th iteratio are: 1. tiply sub-block by sub-key 2. sub-block ad sub-key 3. sub-block ad sub-key 4. tiply sub-block by sub-key 5. XOR the results of (1) ad (3) 6. XOR the results of (2) ad (4) 7. tiply the result of (5) by sub-key. the results of (6) ad (7) 9. tiply the result of () by sub-key 10. the results of (7) ad (9) 11. XOR the results of (1) ad (9) 12. XOR the results of (3) ad (9) 13. XOR the results of (2) ad (10) 14. XOR the results of (4) ad (10) Plaitext sub-blocks Iteratio 1 6 Sub-keys Z 1 X 1 X 2 X 3 X 4 Z 2 Z 3 Z 4 iteratio. Let to deote the four sub-blocks of the ciphertext block. The operatios performed i the fial trasform, as show i Figure 1(c), are: 1. tiply sub-block by sub-key to obtai 2. sub-block ad sub-key to obtai 3. sub-block ad sub-key to obtai 4. tiply sub-block by sub-key to obtai Ecryptio sub-keys are geerated through a iterative process: o each step, the 12-bit key is sub-divided ito eight sub-keys ad the rotated left by 25 bits. This process cotiues util all the sub-keys for the eight iteratios ad for the fial trasformatio have bee geerated. Decryptio sub-keys are calculated as either the additive or the multiplicative iverses of the ecryptio keys. More details about sub-key geeratio ca be foud i [11]. 3. SMER: Schedulig by tiple Edge Reversal 3.1 Schedulig by Edge Reversal (SER) Cosider a eighborhood-costraied system composed of a set of processes ad a set of atomic shared resources represeted by a coected graph where is the set of processes, ad, the set of edges defiig the itercoectio topology. A edge is preset betwee ay two odes if ad oly if the two correspodig processes share at least oe atomic resource. Iteratio 2 6 Sub-keys Z 5 Iteratio 6 Sub-keys Z 6 Fial Trasformatio 4 Sub-keys Ciphertext Sub-blocks Y 1 Y 2 Y 3 Y 4 th iteratio (repeated eight times) Z7 X 1 X 2 X 3 X 4 Z Z9 Z10 Figure 2. SER diagram. Y1 Y2 Y3 Y4 fial trasformatio (c) Figure 1. IDEA cryptographic algorithm. The outputs of the oe iteratio are the four sub-blocks produced by steps (11) to (14). The two ier sub-blocks from steps (12) ad (13) are swapped, except for the last SER works i the followig way: startig from ay acyclic orietatio o there is at least oe sik ode, i.e., a ode that has all its edges directed to itself. All sik odes are allowed to operate while other odes remai idle. This obviously esures mutual exclusio at ay access made to shared resources by sik odes. After operatio a sik ode will reverse the orietatio of its edges, becomig a source ad thus releasig the access to resources to its eighbors. A ew acyclic orietatio is de-

3 fied ad the whole process is the repeated for the ew set of siks [14, 3]. Let deote this greedy operatio, SER ca be regarded as the edless repetitio of the applicatio of g( ) upo. Assumig that is fiite, it is easy to see that evetually a set of acyclic orietatios will be repeated defiig a period of legth. This simple dyamics esures that o deadlock or starvatio will ever occur sice at every acyclic orietatio there is at least oe sik, i.e., oe ode allowed to operate. Also, it is proved that iside ay period every ode operates exactly times [14, 3]. SER is a fully distributed graph dyamics algorithm. A very iterestig property of this algorithm lies i its geerality i the sese that ay topology will have its ow set of possible SER dyamics [14, 3]. Figure 2 illustrates the SER dyamics. i j eij edges Ni Nj i ri rj-1 j Figure 3. SMER represetatio. 3.2 Schedulig by tiple Edge Reversal (SMER) SMER is a geeralizatio of SER where pre-specified access rates to atomic resources are imposed to processes i a distributed resource-sharig system which is represeted by a multigraph. Differetly from SER, i the SMER dyamics a umber of orieted edges ca exist betwee ay two odes. Betwee ay two odes ad,, there ca exist uidirected edges,, as ilustrated i Figure 3. The reversability of ode is, i.e., the umber of edges that shall be reversed by towards each of its eighbourig odes, idiscrimiately, at the ed of operatio. Node is a r-sik if it has at least edges directed to itself from each of its eighbours. Each r- sik ode operates by reversig edges towards its eighbours; a ew set of r-siks will operate ad so o. Similarly to siks uder SER, oly r-sik odes are allowed to operate uder SMER. It is easy to see that with SMER, odes are allowed to operate more tha oce cosecutively. The followig lemma states a basic topologic costrait towards the defiitio of, where gcd is the greatest commo divisor ad is the sum of the greatest multiple of that does ot exceed the umber of shared resources orieted from to, ad from to, respectively i the iitial orietatio. lemma Let odes ad be two eighbors i. If o deadlock arises for ay iitial orietatio of the shared resources betwee ad, the ad. [4, 6]. Whe we have two odes, = This property is show i Figure 3. A full example of the SMER dyamics is preseted i Sectio The HIPCrypto Chip As stated i Sectio 1, our mai goal i desigig the HIPCrypto chip [10] was to obtai a device which would meet the performace requiremets of applicatios i curret ad future high-speed data etworks. This was achieved by icludig parallel executio techiques i the chip s architecture. By usig spatial (multiple uits) ad temporal (pipelie) parallelism to perform the basic fuctio, oe iteratio of the algorithm ca be completed o each clock cycle. A secod level of pipeliig ca also be employed i the executio of the etire algorithm. I a typical symmetric-key cryptosystem [11], the key shared by a group of parters is chaged i a log term basis. For this reaso, HiPCryto s architecture provides subkey storage oly. Sub-keys are geerated exterally by the host system ad the dowloaded ito the chip [10]. The cryptographic chip was implemeted i a 0.7, two metal layer CMOS techology. Figure 4 shows the chip s orgaizatio. The datapath icludes the add, multiply ad exclusive-or uits, the FIFOs ad the memories for subkey storage. The datapath desig has started at the structural level ad ivolved direct schematic editio for optimizatio purposes. The cotrol uit s state machie was described i VHDL ad the automatically sythesized with the aid of a commercial sythesis tool. The add uits were desiged from 2-bit adder stadard cells, while the exclusive-or arrays were built from 1-bit xor stadard cells. The multiply uits are automatically geerated macrocells. The typical delay time for the add ad multiply uits were 5.7 s ad 14. s, respectively. The multiply uit delay was the mai limitig factor to the clock cycle time.

4 e e Fifo 2x16 x32 r/w e e Fifo 2x16 Fifo 2x16 e x32 r/w e x12 e r/w Fifo 5x64 memory /cotrol sigals Cotrol Uit ec/dec cofig clock i Figure 5. The ode is associated to four bits ad these bits are the SMER fuctio iput, as ilustrated i Figure 5. The SMER fuctio iput determies the iitial state. The SMER key cotais two parts, as show i Figure 5(c). The cofiguratio part, b7 b6 b5, represets the possible SMER cofiguratios, i.e, determies the combiatio of ad. The cycle umber part, b4 b3 b2 b1 b0, determies how may steps will be ecessary i order to obtai the fial state. This fial state produces the four bit output bit e e 2x64 r/w Data iput 4 bits 7 bits SMER fuctio Data output 4 bits Figure 4. HIPCrypto implemetatio Improved IDEA The mai goal of this work is to icrease the HIPCRypto performace. For achievig this target, we replaced the multiply uits by SMER fuctios. Takig ito accout diverse possibilities, we choose for the SMER fuctio the followig cofiguratio: - two odes ad fiftee edges - ad coprime umbers, makig possible (cycle umber) be maximum, i.e., = ( + )/ gcd(, ) = 16. The possible cofiguratios of ad that satisfy Nc = 16 are show i Table I. Table I. Possible Cofiguratios of ad. cofiguratio bits The ad combiatio is called SMER cofiguratio. Each SMER cofiguratio has sixtee states, as show b7 b6 b5 b4 b3 b2 b1 b0 Cofiguratio (c) Figure 5. SMER example. Number of cycles As example, supose that the SMER key is The bits 001 determie the SMER cofiguratio, therefore = 3 ad = 13. The cycle umber is supplied by the bits Assigig 1010 to the SMER iput, we obtai the SMER output 0110, as show i Figure 5. The process of retrievig data works o the same way, however the bits associated to cycle umber eed to be chaged by its complemet. I the above example, the ew SMER key will be For this ew key ad the SMER iput beig 0110, the SMER output will be 1010,i.e., the same value that was apply o the first step of this example. The SMER fuctio must have the followig caracteristics: - be faster tha the multiply uit

5 - do ot decrease the iformatio diffusio, i.e, do ot chage the algorithm security The first caracteristic will be demostrated i the ext sectio. The latter will be aalysed followig: The two basic techiques for obscurig the redudacies i a plaitext message are cofusio ad diffusio [12]. Cofusio hides the relatioship betwee the plaitext ad the ciphertext ad the key. Diffusio spreads the ifluecy of idividual plaitext or key bits over as much of ciphertext as possible. A immediate way to produce diffusio is through multiplicatio. Block algorithms use both cofusio ad diffusio. As a geeral rule, diffusio aloe is easily cracked. However, we ca do a simple aalysis over the difficulty of brokig the multiplicatio fuctio or the SMER fuctio. by four SMER fuctios ( operatios), ow deoted SMER block. Each SMER fuctio requires a 7-bit key. Thus, four SMER fuctios will eed a 2-bit key (the multiply uit uses oly key). This ecessarity produces a alteratio i the subkey geeratio. The key geeratio adopted for Improved IDEA is similar to the oe used i HIPCrypto []. The oly differece cosists i executig three more rotatio steps i the mai i order to obtai more twety four subkeys. These subkeys are cocateated to HIPCrypto subkeys i order to atted 2-bit subkeys ecessary for each four SMER fuctios. 6. Results ad Cocludig Remarks Plaitext Fuctio Ciphertext = 1101 Validatio. Three validatio tests were coducted successfully.the first oe cosisted i verifyig whether the hardware implemetatio of the SMER fuctio produces expected results. The secod test cosisted i verifyig whether the chip i ecryptio mode produces a ciphertext correctly ecrypted uder the improved IDEA algorithm. The third test cosisted i verifyig whether the chip operatig i decryptio mode performs the iverse fuctio correctly. tiply Plaitext uity Ciphertext (c) SMER Plaitext fuctio Ciphertext Figure 6. SMER diffusio. possible s = Figure 6 shows the 4-bit ciphertext obtaied through the operatio betwee a give key ad a 4-bit plaitext. Supose ow, that we kow values of plaitext ad ciphertext. If the block is a trucated multiplicatio there is oly oe possible value for the key, as show i Figure 6, ad this value is easily determiated. But, if the block is a SMER fuctio there will be eight possible values, as show i Figure 6(c). This illustrates that the SMER fuctio presets cosiderably higher diffusio i compariso to multiplicatio. For the Improved IDEA, each multiply uit is replaced SMER performace. Iitially, the SMER block was described i VHDL at the structural level resultig i a SMER soft-core. It ca be used to sythetize hardware implemetatio of the SMER block. The SMER soft-core was automatically sythetized usig Syopsys sythesis tools. This sythesis used stadard cells with two metal-layer 0.7 CMOS ad resulted i a maximum delay of 7.7 s. Improved IDEA x HYPCrypto. As metioed, a 0.7 two-metal CMOS techology was employed i the experimetal implemetatio of our cryptographic chips. The HIPCrypto preseted a typical clock frequecy of 53 MHz [10], while the Improved IDEA preseted a typical clock frequecy aroud 100 MHz. The HIPCrypto core area resulted i approximately 29 [10], while the Improved IDEA preseted approximately 35. The area icrease of the Improved IDEA over the HIPCrypto is a cosequece of the area differece betwee SMER block ad multiply uit. The SMER block preseted a core area of 1.6 while the multiply uit has approximately 1.0. Gate-level simulatios were performed i order to obtai estimates of the operatig clock frequecy. From these simulatios, we have estimated a typical clock frequecy. For the typical clock value, Table II ad Table III resume the expected chip throughputs i each possible cofiguratio for

6 HIPCrypto ad Improved IDEA, respectively. Table II. Throughput of the HIPCrypto chip. Cofiguratio Iteratios per Chip Throughput oe device eight iteratios 424 Mbps two devices four iteratios 4 Mbps four devices two iteratios 1.7 Gbps eight devices oe iteratio 3.4 Gbps Table III. Throughput of the Improved IDEA chip. [10] S. L. C. Salomao, V. C. Alves, ad E. M. Chaves Fo. HIPCrypto: A High-Performace VLSI Cryptographic Chip. Published i the proceedigs of the 11th Aual IEEE Iteratioal ASIC Coferece, Sept [11] B. Scheier. Applied Cryptography. Joh Wiley ad Sos, New York, NY, [12] C. E. Shao. A mathematical theory of commuicatio. Bell System Techical Joural, pages Vol. 27, N. 1, pp , 194. [13] A. Taebaum. Computer Networks. 3rd Editio,Pretice Hall, Upper Saddle River, NJ, [14] V. Barbosa. A Itroductio to Distributed Algorithms. MIT Press, [15] J. Wilso. Data security hits home. IEEE Micro, page, Oct Cofiguratio Iteratios per Chip Throughput oe device eight iteratios 09 Mbps two devices four iteratios 1,6 Gbps four devices two iteratios 3,2 Gbps eight devices oe iteratio 6,5 Gbps As the mai goal of the Improved IDEA is to obtai a higher performace tha the HIPCrypto, the area overhead for the Improved IDEA chip (approximately 21 percet) is totally compesated performace improvemet (approximately 90 percet). Other importat issue is the security icrease offered by the SMER fuctios. Refereces [1] N. Asoka, P. Jaso, M. Steier, ad M. Waider. The state of the art i electroic paymet systems. IEEE Computer Magazie, 30(9):25 2, Sept [2] A. Bacard. The Computer Privacy Hadbook. Peachpit Press, Berkeley, CA, [3] V. Barbosa ad E. Gafi. Cocurrecy i Heavily loaded Neighborhood-Costraied Systems. ACM Trasactios o Prog. Laguage ad Systems, pages vol.11,. 4, Oct [4] V. C. Barbosa, M. R. F. Beevides, ad F. M. G. Fraca. Sharig Resources at Nouiform Access Rates. Relatrio Tcico - Programa de Egeharia de Sistemas e Computao, Nov [5] F. B. Cohe. Protectio ad Security o the Iformatio Superhighway. Wiley ad Sos, New York, NY, [6] F. M. G. Fraca. Schedulig weightless systems with selftimed Boolea etworks. Workshop o Weightless Neural Networks, pages pp 7 92, Apr [7] C. Kaufma, R. Perlma, ad M. Specier. Network Security. Pretice Hall, Eglewood Cliffs, NJ, [] X. Lai ad J. Massey. A proposal for a ew block ecryptio stadard. I Proceedigs of the EUROCRYPT 90 Coferece, pp , [9] N. F. P.. Natioal Bureau of Stadards. Data ecryptio stadard. Natioal Bureau of Stadards, U.S. Departmet of Commerce, Ja