Implementation Complexity of Bit Permutation Instructions

Transcription

1 Implementaton Complexty of Bt Permutaton Instructons Zhje Jerry Sh and Ruby B. Lee Department of Electrcal Engneerng, Prnceton Unversty, Prnceton, NJ 085 USA {zsh, Abstract- Several bt permutaton nstructons, ncludng GRP, OMFLIP, CROSS, and BFLY, have been proposed recently for effcently performng arbtrary bt permutatons. Prevous work has shown that these nstructons can accelerate a varety of applcatons such as block cphers and sortng algorthms. In ths paper, we compare the mplementaton complexty of these nstructons n terms of delay. We use logcal effort, a process technology ndependent method, to estmate the delay of the bt permutaton functonal unts. Our results show that for 6-bt operatons, the BFLY nstructon s the fastest among these bt permutaton nstructons; the OMFLIP nstructon s next; and the GRP nstructon s the slowest. I. INTRODUCTION Bt permutaton operatons permute the bts n the operand. They are very effectve for achevng dffuson n block cphers [1], where dffuson dsspates the redundancy n the plan text over the encrypted cpher text. Bt permutaton operatons are used n many cphers such as the Data Encrypton Standard (DES), Twofsh and Serpent. However, arbtrary bt permutatons are not drectly supported on exstng mcroprocessors, and hence very slow. As a result, many cphers such as RC5 [] use data-dependent rotaton (DDR) nstead. DDR uses only log(n) bts to specfy the shft amount for n-bt words. Ths property of DDR has reduces the strength of the cphers and makes them vulnerable to cryptanalytc attacks [3]. Several nstructons have been proposed recently to do arbtrary bt permutaton effcently. They are GRP [], OMFLIP [5], CROSS [6], and BFLY [7, 8]. Each nstructon has ts advantages and dsadvantages [9]. For example, GRP can accelerate subword sortng [10] and has good cryptographc propertes [11]. OMFLIP needs only four stages regardless of how many bts are to be permuted. But these nstructons have not been compared wth each other n detal n terms of mplementaton complexty and latency. In ths paper, we compare the mplementaton complexty of bt permutaton nstructons n terms of the latency, or delay, of ther respectve permutaton unts. Ideally, when a new nstructon s added to a processor, the cycle tme of the processor should not be sgnfcantly mpacted. Knowng the relatve delays of these permutaton functonal unts s very helpful when decdng whch one to nclude n a gven processor. We use a process technology ndependent method, logcal effort [1], to compare the delays of dfferent permutaton unts. Logcal effort s a desgn methodology that can be used to estmate the number of stages requred to mplement the crtcal path of a gven logc functon, and hence estmate ts delay n a process technology ndependent way. In Secton II, we brefly descrbe the logcal effort methodology. In Secton III, we descrbe the bt permutaton nstructons and dscuss ther mplementaton. In Secton IV, we use logcal effort to estmate and compare the delay of dfferent permutaton crcuts. Secton V concludes the paper. II. LOGICAL EFFORT Logcal effort [1] s a technology-ndependent method to estmate the number of stages requred to mplement a gven logc functon wth CMOS and to determne the maxmum possble speed of the crcut. It uses the followng concepts: logcal effort g : The total gate capactance of a logc gate relatve to that of a mnmum-szed nverter electrcal effort h: The rato of output capactance of a gate to ts nput capactance branchng effort b: The rato of total capactve load on one logc gate s output to the gate capactance of the next gate on the path examned parastc delay p: The total dffuson capactance on the output node of a gate relatve to that of a mnmum-szed nverter. The delay of a sngle gate can be calculated as: d = gh + p (1) To fnd the delay along a path, we frst calculate the total path effort: F = GBH () where G = Πg, B = Πb, and H = Πh. Πg means the product of the logcal effort of all the gates along the path. Smlarly, Πb s for the total branch effort and Πh for the total electrcal effort. The total electrcal effort H = Πh reduces to the rato of the output capactance loadng the last gate to the gate capactance of the frst gate on the path. Normally, we assume a crcut drves a copy of tf, so H = 1. Once the path effort has been calculated, the deal number of stages requred to acheve the logcal functon can be estmated as: N = log 3.6 F. (3) where 3.6 s the stage effort achevng the best performance [1]. N s then rounded to the nearest nteger that s reasonable for the path, and the effort delay for each stage can

2 be calculated as: α = F 1/N () α can be used to decde the transstor sze n each stage along the path. The basc dea s to estmate the number of stages usng the deal stage effort α=3.6, and then calculate the real α from the estmated number of stages. Fnally, the total delay of the path can be calculated as: D = Nα + P, (5) where P = p. The results n (5) are n the basc tme unt used n logcal effort, whch s ndependent of process technology. Dvdng D n (5) by fve gves the estmated delay n terms of fan-out of four (FO), the delay of an nverter that drves four dentcal nverters. III. BIT PERMUTATION INSTRUCTIONS We now descrbe the permutaton nstructons CROSS, BFLY, OMFLIP and GRP. A. CROSS The CROSS nstructon defned n [6] s based on the Benes network. A Benes network conssts of a butterfly network followed by an nverse butterfly network. An n-bt butterfly network conssts of log(n) stages. In each stage, n bts are dvded nto n/ pars. Two bts n a par can go to the same poston at the output or exchange poston wth the other one. Ths s determned by a sngle control bt. So n/ control bts are needed for n/ data pars at each stage. The stages are dfferentated by how bts are pared. If we count stages startng from 1, the dstance between two pared bts n stage s n/. Fgure 1 shows an example of a 16-bt butterfly network. Each small box s lke a :1 MUX, where one of two bts n a par s ected. In the frst stage, the dstance between two pared bts s 16/ = 8. In the last stage, the dstance s one,.e., two bts are next to each other. INPUT CROSS permutes the bts n Rs usng any two stages n a Benes network that are specfed by m1 and m, and stores the permuted bts n Rd. The two stages specfed by m1 and m are confgured wth bts n Rc; the lower n/ bts are used to confgure Stage m1, and hgher n/ bts to confgure Stage m. A method s gven n [6] to confgure a Benes network to perform any permutatons of the nput bts usng all stages n a Benes network. log(n) CROSS nstructons are needed to acheve any one of the n! permutatons of n bts. B. BFLY The BFLY nstructon s also based on the Benes network. However, BFLY uses the full butterfly network (sx stages for 6 bts) to permute nput bts whle CROSS uses only two stages of the butterfly network or nverse butterfly network per nstructon. To perform arbtrary n-bt permutatons, another nstructon IBFLY s requred to permute bts wth the full nverse butterfly network. In ths paper, we focus only on the BFLY nstructon. IBFLY wll have smlar latency as BFLY. C. OMFLIP The OMFLIP nstructon s based on the omega-flp network. A full omega network conssts of log(n) omega stages, and all omega stages are the same; a full flp network conssts of log(n) flp stages, and all flp stages are the same. A full omega-flp network, constructed by concatenatng a full omega network wth a full flp network, s somorphc to a Benes network. An OMFLIP nstructon permutes bts wth two stages of the full omega-flp network, and log(n) nstructons can perform arbtrary n-bt permutaton. OMFLIP uses only two stages each tme, and all omega stages or all flp stages are the same. Hence, only two omega stages and two flp stages are enough to do the OMFLIP nstructons. Such a -stage network s shown n Fgure. Unlke CROSS, the number of stages n the functonal unt does not depend on the number of bts to be permuted. INPUT omega flp flp OUTPUT Fgure 1: A 16-bt butterfly network The nverse butterfly network can be constructed by reversng the stages n a butterfly network. A Benes network s constructed by concatenatng a butterfly network wth an nverse butterfly network. A CROSS nstructon s defned as: CROSS,m1,m Rd, Rs, Rc OUTPUT omega Fgure : A -stage omega-flp network for 16-bt OMFLIP operatons

3 D. GRP The GRP nstructon s defned as: GRP Rd, Rs, Rc The GRP nstructon permutes the data bts n Rs accordng to the control bts n Rc. The bts n Rs are dvded nto two groups dependng on whether the correspondng bt n Rc s 0 or 1. The two groups of bts are then placed next to each other n Rd. The bts wth a control bt of 0 are placed at the left end; the bts wth a control bt of 1 at the rght end. Fgure 3 shows an example of an 8-bt GRP operaton. Snce the control bt of b, c, f, and h s 0, these four bts are placed at the left end n Rd. a, d, e, and g are placed at the rght end because ther control bt s 1. Rs a b c d e f g h Rc output o, and a ect sgnal. The output o s connected wth the nput when and only when = 1. In Fgure 6, (I 0, I 1, I, I 3 ) and (I, I 5, I 6, I 7 ) are the outputs of two GRPZ crcuts. In both of them, z bts are already placed at the left end and other bts at the rght end are set to 0. Those bts that are set to 0 wll be referred to as padded 0s. (S, S 3, S, S 1, S 0 ) s a one-hot code ndcatng the number of padded 0s n (I 0, I 1, I, I 3 ). Dependng on how many padded 0s are n (I 0, I 1, I, I 3 ), one of (S, S 3, S, S 1, S 0 ) s set to 1, and that bt determnes at whch row the outputs are connected to the nputs. At the output, padded 0s n (I 0, I 1, I, I 3 ) are replaced wth bts shftng n from (I, I 5, I 6, I 7 ), and all the z bts are located at the left end. For example, when (I 0, I 1, I ) are z bts and I 3 s a padded 0, only S 1 s set to 1. The nputs and outputs are connected at the second row. The output (O 0,,O 7 ) = (I 0, I 1, I, I, I 5, I 6, I 7, 0). n/ bts n/ bts Rd b c f h a d e g Fgure 3: 8-bt GRP operaton There are many ways to mplement a GRP operaton. Here, we descrbe a parallel mplementaton. For convenence, the bts n Rs wth a control bt of 0 are referred to as z bts, and the bts wth control bt of 1 as w bts. The GRP operaton can be performed n three conceptual steps. Step 1 grabs all z bts and sets other bts n the word to 0; Step grabs w bts and sets other bts n the word to 0; Step 3 merges the z bts and the w bts by OR-ng the results generated n the two prevous steps. Step 3 s straghtforward. And f we can grab z bts n Step 1, Step can use the same crcut to grab w bts for flppng control bts changes w bts to z bts. We use the dvde-and-conquer strategy to grab z bts n n bts, as shown n Fgure. Frst, the n nput bts are dvded nto two halves. After puttng z bts at the left end n each half, we combne the z bts n both halves, puttng all z bts at the left end and settng the rest of the bts to 0. For each half of n/ bts, we can apply the same method by dvdng them nto two halves of n/ bts. Each set of n/ bts can be further dvded nto smaller sets untl every set has only one bt. For sets that has only one bt, the z bt s already at the left end f the only bt s a z bt. Otherwse, t s set to 0. Ths can be done wth the crcut shown n Fgure 5, whch we call GRP1Z. In the fgure, s the nput data bt, and c s the correspondng control bt. When c = 0, the output d = because s a z bt. When c = 1, d s set to 0. (k 1, k 0 ) s one-hot code ndcatng the number of bts that are set to 0 n (d). So (k 1, k 0 ) = (1, 0) when c = 1 because one bt d s set to 0. A crcut that grabs z bts from a n-bt set s called GRPnZ. GRP1Z s llustrated n Fgure 5. GRPZ conssts of two GRP1Zs, and combnes ther outputs; the crcut that does combnaton s called GRPZD. GRPZ conssts of two GRPZDs, and combnes ther results wth a GRPZD, and so on. Fgure 6 presents a dagram of GRP8ZD, whch combnes z bts from two -bt sets. Each small box s the basc cell that s shown n Fgure 7. The basc cell has a data nput, a data S0 S1 S S3 S z bts INV1 INV 0s n bts Fgure : Grab z bts recursvely c k 1 k 0 d d (k 1,k 0 ) 0 (0, 1) 1 0 (1, 0) NAND1 INV3 Fgure 5: GRP1Z: the frst stage n GRP unts I0 I1 I I3 I I5 I6 I7 0 O0 O1 O O3 O O5 O6 O7 Fgure 6: Dagram of GRP8ZD The crcuts generatng ect sgnals have a smlar structure to that of the data combnng crcuts shown n Fgure 6. These crcuts generate the number of padded 0s n

4 each set of data bts. We call these crcuts GRP1ZS, GRPZS, GRPZS, and so on. n_0 n_1 n n out n o Fgure 7: Basc cell Fgure 8 shows the block dagram of the datapath of GRP6, a GRP functonal unt for 6 bts. We frst use GRP1Z to generate z bts and w bts for 1-bt groups. Then, we keep combnng the output of smaller sets to generate z bts and w bts for a larger set untl we get all the z bts and w bts for the 6 bts. Then, the z bts and w bts are combned wth OR gates to get the result of the 6-bt GRP operatons. 6 data bts and 6 control bts 6 OR gates output 6 data bts and 6 nverted control bts n reverse order Fgure 8: Dagram of GRP6 1: : 1 bt bts 3: bt bts 6: 16 bt 3 bts 7: 3 bt 6 bts IV. ANALYSIS OF DIFFERENT PERMUTATION CIRCUITS We now estmate the delay of the 6-bt permutaton functonal unts that performs the BFLY, OMFLIP, and GRP nstructons. As mentoned earler, we assume each permutaton unt drves a copy of tf. In our calculaton, only the capactance of the wres s consdered. Wres are converted nto a number of nverters, the total nput capactance of whch s the same as the capactance of the wres. We estmate the capactance of a wre travelng across a cell as equvalent to 1/3 the nput capactance of a mnmum-szed nverter [Appendx A]. A. BFLY butterfly network latency In the butterfly network shown n Fgure 1, each box can be consdered as a :1 MUX. In a real mplementaton, we use :1 MUXI shown n Fgure 9 nstead of MUX. MUXI works smlarly to a MUX except that the output of MUXI s nverted. Ths causes no problem as long as sgnals are nverted an even number of tmes. n_0 n_1 Fgure 9: Transstor dagram of a :1 MUXI The numbers n Fgure 9 ndcate the rato of the wdth of transstors to the wdth of an N-type transstor n a mnmumszed nverter. To acheve the same drve characterstcs as a mnmum-szed nverter, we double the sze of transstors that are connected n seres. The parastc delay of the :1 MUXI can be calculated as [1]: wd p mux = pnv = pnv = p (6) nv The denomnator n (6) s the sum of the wdth of transstors that are connected to the output n a mnmum-szed nverter; and the numerator s the sum of wdth of transstors that connected to the output n the MUXI. The capactance of each nput s twce that of a mnmumszed nverter. Therefore, the logcal effort per data nput s. The logcal effort of the ect sgnal s. The load of the gates n each stage, except for the last stage, conssts of wres and MUXIs n the next stage. As mentoned earler, wres are converted nto a number of nverters that have the same capactance, and then can be modeled as branchng effort. Let N cells be the number of cells that the longest wre travels across n a stage. Snce an output n a stage needs to drve the wre and two data nputs of :1 MUXIs, we can estmate the branchng effort n each stage wth the followng formula [1]: Ncells + Ctotal Cwre + Cmux = = = 3 Ncells (7) b = + C C 6 useful mux Table 1 lsts the branchng effort, logcal effort, and the parastc delay of gates on the crtcal path of a full 6-bt butterfly network. We use (7) to calculate the branchng effort n all stages except for the last stage. The load of the last stage s the wre and the ect sgnals n the frst stage because we assume the crcut drves another copy of tf. Suppose the ect sgnal has to cross 3 cells to reach both MUXIs n the frst stage. In addton, the ect sgnal needs to drve the ect sgnal for two :1 MUXIs; each has a gate capactance four tmes as a mnmum-szed nverter (See Fgure 9). The branchng effort before the nverter n the :1 MUXIs can be calculated as: (3/3 + ) / = 8/3 In Table 1, the p n Stage 1 s fve because of the nverter n :1 MUXIs for the ect sgnal.

5 TABLE 1: LOGICAL EFFORT AND PARASITIC DELAY IN BUTTERFLY NETWORK Stage Crtcal Load b g p Gate 1 MUXI Track+ 16/6+ 5 MUXIs = 1/3 MUXI Track+ 8/6+ MUXIs =10/3 3 MUXI Track+ /6+ MUXIs =8/3 MUXI Track+ /6+ MUXIs =7/3 5 MUXI Track+ 1/6+ MUXIs =13/6 6 MUXI Track+ 8/3 ect sgnals Total The total effort can be calculated as F = GBH = = The optmal number of stages s: N = log 3.6 F = 9 There are already seven stages (ncludng the nverter nsde the frst MUXI). Two nverters can be added along the path to drve long wres. Ths ncreases the parastc delay by two. Therefore, the total delay s: 1/ N 1/9 D = N F + P = (5 + ) = 60. Hence, the delay s about 1.0 FO. The delay of the nverse butterfly network s estmated as 13.0 FO [Appendx B], slghtly longer than the delay of the butterfly network. B. -stage omega and flp network latency The OMFLIP nstructon can be performed wth a -stage omega-flp network that has two omega stages and two flp stages. Snce t uses only two of the four stages each tme, data need to pass through the other two stages. Such pass through paths do not exst n omega or flp stages, so they need to be added n the stages. After the pass through paths are added, an output n an omega or a flp stage can choose one from three nput bts. Two of them are defned by omega or flp stages (Fgure ) and the thrd s for the pass through path. So each box n Fgure can be mplemented wth the 3:1 MUXes that s shown n Fgure 10. In the fgure, data bts ether go through two :1 MUXI or one nverter and one :1 MUXI. MUXI1 chooses one from n_0 and n_1, the two pared bts defned by the omega or flp network. MUXI chooses one from the output of MUXI1 and the pass-through source n_p. Snce MUXI nverts the nput, n_p s nverted before gong to MUXI. If pass = 1 n a stage, data take the pass through path. Alternatvely, 3:1 MUXIs may be used for shorter delays from the data nput to the output. The dagram of a 3:1 MUXI s presented n Fgure 11. Fgure 11a shows the transstors for ectng data nputs, whch have smlar structure as those n :1 MUXIs. The ect sgnals n Fgure 11a are generated n Fgure 11b from pass and. The parastc delay of 3:1 MUXIs s sx; and the logcal effort per data nput s two, the same as that for :1 MUXIs. Snce 3:1 MUXIs have shorter delays from the data nput to the output, we wll use them to mplement omega or flp stages except for the frst omega stage, where the delay s domnated by the ect sgnal. In the frst omega stage, 3:1 MUXes wll be used for they have short delays from pass to the output. pass n_0 n_1 n_p MUXI1 INV1 pass MUXI out Fgure 10: Implementng a 3:1 MUX wth :1 MUXIs n_0 n_0 _0 n_0 INV1 INV n_1 n_1 _1 n_1 INV3 a) b) n_p n_p _p n_p NAND1 NAND INV INV5 INV6 Fgure 11: 3:1 MUXIs for omega or flp stages out n_p _p n_0 _0 n_1 _1 TABLE : LOGICAL EFFORT AND PARASITIC DELAY FOR -STAGE OMEGA-FLIP NEWORK Stage Gate Load b g p 1 MUXI n Track + (3/3+3*)/ 5 3:1 MUX 3 3:1 MUXIs = 5/3 3:1 MUXI Track + (3/3+3*)/ 6 3 3:1 MUXIs = 5/3 3 3:1 MUXI Track + (3/3+3*)/ 6 3 3:1 MUXIs = 5/3 3:1 MUXI NOT 1 6 NOT Track + (6/3+6*)/ ect sgnals =16/3 Total The logcal effort, branchng effort, and parastc delay for -stage omega-flp network are lsted n Table.

6 The output of the frst three stages needs to drve wres and three data nputs of 3:1 MUXIs. The longest wre n a stage needs to cross 3 cells. Snce 3:1 MUXes are used n the frst stage, the data are nverted only three tmes. As a result, a stage of NOT gate s added after the fourth stage. The NOT gates drve 6 pass sgnal of 3:1 MUXes, plus a wre crossng 6 cells. Here, we assume each stage has a separate pass sgnal. The total effort can be calculated as: F = GBH = = The optmal number of stage s: N = log 3.6 F = 10 The gates lsted n Table already have sx stages, ncludng the nverter nsde the :1 MUXI n the frst stage. Four nverters may be added along the path. The delay of such a stage can be estmated as: D=N F 1/N + P = 10 F 1/10 + ( + ) = 68.8 The delay s about 13.8 FO. C. GRP mplementaton latency The basc cell shown n Fgure 7 s slow and reduces the nose margn. We wll use the transmsson gate (TG) shown n Fgure 1 when mplementng the GRP unt. Snce the load of the nverter INV s one P-type transstor, we use the mnmum-szed nverter. Thus, the nput load of s (3 + ) / 3 = 5/3. The nput load of s,.e., twce as a mnmumszed nverter. INV 1 n TRI Fgure 1: Implementaton of the basc cell (TG) n the GRP unt If the crtcal path extends from to o n a TG, the TG has g = and p =. If the crtcal path extends from to n to o, the TG has a logcal effort g= /3 1, where s the wdth of the transstor that n drves n TG, and 1 s the logcal effort of INV. The parastc delay p becomes three because of INV. Snce TGs generate the nverted sgnals, some stages may have the nverted ect sgnals. In such stages, we use ITGs nstead of TGs and nverters. Fgure 13 shows the dagram of an ITG, whch s the same as a TG except that t uses the nverted ect sgnal. In a TG, the nput goes to the output when = 1 whle n an ITG, the nput goes to the output when = 0. The nput load of the data nput n an ITG s the same as n a TG; the nput load of ncreases to 7/3. If the crtcal path extends from to n to o, an ITG has g = /3, and p = 3. Table 3 lsts the branchng effort, logcal effort, and the parastc delay of gates on the crtcal path of GRP6. In the o table, TG. refers to the ect nput of a TG, and TG. refers to the data nput. INV 1 n TRI Fgure 13: The dagram of ITG that uses the nverted ect sgnal TABLE 3: LOGICAL EFFORT AND PARASITIC DELAY OF GRP6 Stage Gate Load Track Length b g p GRP1Z INV1 INV + NAND 7 38/ TG. + TG. GRP1Z INV TG. 7 9/ TG. GRPS TG ITG ITG. GRPS ITG 8 TG. 5 95/6 + 5 TG. GRP8S TG 16 ITG. 7 71/ + 9 ITG. GRP16S ITG 3 TG / TG. GRP3S TG 6 ITG /3 GRP6D ITG * NOR /5 /3 3 NOR INV 1 5/3 INV INV 1 1 Total * The crtcal path extends from to o n ths stage. The total effort can be calculated as: F = GBH = Πg* Πb = = The optmal number of stages s: N = log 3.6 F = 3 Snce there are two stages n GRP6D, we already have 11 stages shown n Table 3. Twelve nverters need to be added along the path to drve the large load. The delay of the path can be calculated as: D=N F 1/N + P = 13 F 1/3 + (18 + 1) = When dvded by fve, ths s about.7 FO. D. Comparson and dscusson Table compares the latency of the dfferent 6-bt permutaton functonal unts. We see that GRP s the slowest, and the 6-stage butterfly network (BFLY) s the fastest. The -stage OMFLIP s n the mddle. Although OMFLIP needs o

7 only four stages because there are only two dfferent types of stages, the -stage OMFLIP unt s not as fast as the 6-stage butterfly network for 6-bt operatons. Ths s because one of the control sgnals has to drve all the gates n a stage; the length of the longest wre does not change between stages; and addng the pass through paths ntroduces delays. In the butterfly network, no sgnals have to drve a large number of gates, and the wres become shorter and shorter - the length of the wres reduces by half between stages. In addton, the butterfly network already provdes a pass-through path n every stage. GRP s the most complcated of the bt permutaton nstructons we nvestgated. Although the data do not go through a large number of gates, the ect sgnals have a very large load n the later stages. In addton, wres become longer as the combnng crcuts become larger. TABLE : THE LATENCY OF DIFFERENT FUNCTIONAL UNITS (6 BITS) Functonal Unt Latency (FO) GRP.7 OMFLIP ( stages wth pass-throughs) 13.8 BFLY (6-stage Butterfly network) 1.0 Normally, mcroprocessors have a cycle tme of 0-30 FO [13]. Aggressve desgns may use a cycle tme around 16 FO [13]. Except for the GRP unt, both the OMFLIP unt and the BFLY unt can fnsh n one cycle even n aggressve desgns. The GRP nstructon can fnsh n one cycle on most mcroprocessors, but t may affect the cycle tme on more aggressvely-desgned mcroprocessors or take two cycles. V. CONCLUSIONS In ths paper, we use the logcal effort method to compare the delay of dfferent bt permutaton unts for permutng 6 bts. We found that GRP s the slowest, and the butterfly network (BFLY) the fastest, wth OMFLIP n the mddle. Although OMFLIP only needs four stages, t s not as fast as the 6-stage butterfly network used by BFLY because of ts long wres between stages, the large load on one of the control sgnals, and the overhead for addng the pass through paths. The butterfly network already has a pass-through path n each stage; the length of the wres reduces by half between stages; and no sgnal has to drve a large number of gates. We present a fast, herarchcal mplementaton of the GRP operaton. Ths s the most complex mplementaton of these bt permutaton nstructons; ect sgnals have a very large load n the later stages, and wres become very long when the combnng crcuts are large. For typcal processors, GRP, OMFLIP, and BFLY permutaton unts can all complete n a sngle cycle. Even for processors wth aggressve cycle tmes around 16 FO, both OMFLIP and BFLY can fnsh n one cycle, but GRP would take two cycles or cause the cycle tme to ncrease. Although the GRP nstructon s slower than the BFLY or OMFLIP nstructon, t has better cryptographc propertes than the other two [11], and s more versatle wth a varety of applcatons ncludng fast subword sortng [10], multmeda as well as fast cryptography [9,11]. It s an open queston as to whether a faster mplementaton of the GRP nstructon exsts, and ths can be nvestgated n future work. ACKNOWLEDGMENT The authors wsh to thank Professor Nel Burgess of Cardff Unversty for hs tme and valuable suggestons. REFERENCES [1] C. E. Shannon, Communcaton Theory of Secrecy Systems, Bell System Tech. Journal, Vol. 8, pp , October 199 [] R.L. Rvest, The RC5 encrypton algorthm, Fast Software Encrypton: Second Internatonal Workshop, volume 1008 of Lecture Notes n Computer Scence, pp , December 199 [3] B. Kalsk and Y.L. Yn. On dfferental and lnear cryptanalyss of RC5. Lecture Notes n Computer Scence 963, Advances n Cryptology -- Crypto'95, pp , Sprnger-Verlag, 1995 [] Zhje Sh and Ruby B. Lee, Bt Permutaton Instructons for Acceleratng Software Cryptography, Proceedngs of the IEEE Internatonal Conference on Applcaton-Specfc Systems, Archtectures and Processors, pp , July 000 [5] Xao Yang and Ruby B. Lee, Fast Subword Permutaton Instructons Usng Omega and Flp Network Stages, Proceedngs of the Internatonal Conference on Computer Desgn, pp. 15-, September 000 [6] Xao Yang, Mansh Vachharajan and Ruby B. Lee, Fast Subword Permutaton Instructons Based on Butterfly Networks, Proceedngs of Meda Processors 1999 IS&T/SPIE Symposum on Electrc Imagng: Scence and Technology, pp , January 000 [7] Ruby B. Lee, Zhje Sh and Xao Yang, How a Processor can Permute n bts n O(1) cycles,, Proceedngs of Hot Chps 1 A symposum on Hgh Performance Chps, August 00 [8] Zhje Sh, Xao Yang and Ruby B. Lee, Arbtrary Bt Permutatons n One or Two Cycles, Proceedngs of the IEEE Internatonal Conference on Applcaton-Specfc Systems, Archtectures and Processors, June 003 [9] Ruby B. Lee, Zhje Sh and Xao Yang, "Effcent Permutaton Instructons for Fast Software Cryptography", IEEE Mcro, Vol. 1, No. 6, pp , December 001 [10] Zhje Sh and Ruby B. Lee, Subword Sortng wth Versatle Permutaton Instructons, Proceedngs of the Internatonal Conference on Computer Desgn (ICCD 00), pp. 3-1, September 00 [11] Ruby B. Lee, Ronald L. Rvest, L. J. B. Robshaw, Z. J. Sh, and Y. L. Yn, On permutaton operatons n cpher desgn, submtted for publcaton [1] Ivan Sutherland, Bob Sproull, Davd Harrs, Logcal Effort: Desgnng Fast CMOS Crcuts, Morgan Kaufmann Publshers, 1999 [13] R. Ho, K. Ma, and M. Horowtz, The future of wres, Specal Proceedngs of IEEE, Vol. 89, No., pp , Aprl 001 [1] MOSIS, MOSIS Parameter Test Results (0.5 um), 05/t5t_mm_non_ep_mtl-params.txt, June 003 [15] Artsan Components, Inc., TSMC 0.5um Process.5-Volt SAGE Standard Cell Lbrary Databook, November [16] MOSIS, MOSIS Parameter Test Results (0.18 um), 018/t18h_mm_non_ep-params.txt, June 003 [17] Jan M. Rabaey, Dgtal ntegrated crcuts: a desgn perspectve, Prentce Hall, 1996 [18] Nel Burgess, New models of prefx adder topologes, to be publshed n Journal of VLSI Sgfnal Processng, 00

8 APPENDIX A. The capactance of wres Ths secton s based on correspondence wth Professor Nel Burgess n July 00. The capactance s estmated for process technologes of 0.5µm and 0.18µm, as shown n Table 5. The gate capactance s taken from [1, 16]. It s assumed that a mnmum-sze nverter has an nfet rato of :1 and a pfet rato of :1. The capactance of the wres depends on many factors. The parameters for M1 are taken from [1, 16], assumng typcal layout strateges, where M1 does not overlap wth polyslcon and M. TABLE 5: ESTIMATION OF WIRE CAPACTIANCE 1 Process technology 0.5 µm 0.18 µm Gate capactance/unt area 6000 af/µm 8300 af/µm 3 Gate capactance of a mnmum-szed nverter.5 ff 1.61 ff Area capactance of M1 70 af/µm 77 af/µm 5 Frngng capactance of M1 35 af/µm 38.5 af/µm 6 Wdth of M1 tracks 0.5 µm 0.30 µm 7 Capactance of M1 track per µm af af 8 Number of nverters wth equvalent capactance of 1-µm M1 wre 9 Cell wdth 7. µm 5. µm 10 Number of nverters wth equvalent capactance of wre travelng across a cell 1/3 1/3 The gate capactance of mnmum-szed nverter, whch s lsted n row 3 n the table, s calculated as [17]: g_len (g_len + g_len ) g_cap where g_len s feature sze of the process technology, and two and four are the wdth-to-length rato of nfet and pfet, respectvely. g_cap s the gate capactance per unt area. The wre capactance of 1-µm M1 track, whch s lsted n row 7 n the table, s calculated as [17]: area_cap w_wdth + frngng_cap where w_wdth s the wdth of the wre; area_cap s the capactance per unt area and frngng_cap s the frngng capactance per unt length. The length of the wre does not appear n the formula because t s one here. Row 8 n the table s the number of mnmum-sze nverters that have a capactance equvalent to that of 1-µm wre. It s calculated by dvdng row 7 by row 3. In 0.5µm technology, the heght of :1 MUXI s 6. µm [15], and the wdth ranges from 6.3µm to 7.µm, where smaller ones are used to drve small loads. It s safer to choose a larger one. Row 10 s generated by multplyng row 9 by row 8. Table 5 shows the capactance of wre extendng across a :1 MUXI s approxmately one thrd of the capactance of a mnmum-szed nverter. Burgess uses smlar method n [18] to estmate the delay of adders, and shows the estmaton matches the smulaton results well. B. Delay of nverse butterfly network The followng table lsts the branchng effort, logcal effort, and parastc delay for calculatng the delay of the nverse butterfly network. In the table, all MUXIs refer to :1 MUXIs. TABLE 6: LOGICAL EFFORT AND PARASITIC DELAY OF THE INVERSE BUTTERFLY NETWORK Stage Gate Load b g p 1 MUXI Track + MUXIs /6+ =7/3 5 MUXI Track + MUXIs /6+ =8/3 3 MUXI Track + MUXIs 8/6+ =10/3 MUXI Track + MUXIs 16/6+ = 1/3 5 MUXI Track + MUXIs 3/6+=/3 6 MUXI Track + MUXIs 8/3 ect sgnal Total The total effort can be calculated as: F = GBH = = The optmal number of stage s: N = log 3.6 F = 9 Snce there are already seven stages (ncludng the nverter nsde MUXI), we add two nverters on each path. Ths wll ncrease the parastc delay by. Therefore, the delay s: 1/ N 1/9 D = N F + P = 9 F = 65.0 When dvded by 5, ths s about 13.0 FO. The nverse butterfly network s slghtly slower than the butterfly network because the delay of the stage that has the longest wres can not overlap wth the delay of the control sgnals.