CENTRE FOR NEWFOUNDLAND STUDIES TOTAL OF 10 PAGES ONLY MAY BE XEROXED (Without Author's Permission) COMPACT HARDWARE IMPLEMENTATION OF ADVANCED ENCRYPTION STANDARD WITH CONCURRENT ERROR DETECTION by Namin Yu A thesis submitted to the School of Graduate Studies in partial fulfillment of the requirements for the degree of Master Faculty of Engineering and Applied Science Memorial University of Newfoundland August 2005 St. John's Newfoundland Canada Abstract A compact, efficient and highly reliable implementation of the Advanced Encryption Standard (AES) is the desirable encryption core for any practical low-end embedded application. In this thesis we design and implement a compact hardware AES system with concurrent error detection. We investigate various architectures for compact AES implementations in 0.18 f!m CMOS technology. We first explore a new compact digital hardware implementation of the AES s-boxes applying the discovery of linear redundancy in the AES s-boxes. Although the new circuit has a small size, the speed of this implementation is also reduced. Encryption architectures without key scheduling that employ four s-boxes and only one s-box are implemented using the new AES s-boxes, as well as based on other compact s-box structures. The comparison of the implementations based on different architectures and s-box structures indicates that the implementation using four s-boxes 4 based on arithmetic operations in GF(2 ) has the best trade-off of area and speed. Therefore, using this s-box implementation, a complete encryption-decryption architecture with key scheduling employing the four s-box structure is implemented. In order to be adaptive to various practical applications, we optimize the implementation with the fours-box structure to support five different operation modes. In addition, high reliability and resistance to malicious attacks are achieved by applying concurrent error detection technology. After the studies of fault models and I practical fault induction techniques, two concurrent error detection schemes based on both parity code and hardware redundancy are proposed and implemented. The proposed 16-bit and 32-bit parity code based concurrent error detection schemes achieve 100% detection for single injected faults and detection of many multiple faults with about 67% hardware overhead to the original AES compact hardware implementation. n Acknowledgments First of all, I would like to thank my supervisor Dr. Howard M. Heys for his guidance, support and encouragement throughout my study and research. During the past two years, he has supported me with a lot of help and patience, giving me many suggestions and discussions about the research challenges and the chance to attend various conferences. The financial suppmt he provided along with the School of Graduate Studies is also highly appreciated. I am very grateful to Dr. Cheng Li for his advice with the digital design and utilization of the CAD tools provided by CMC, as well as teaching me courses. I would also like to thank Dr. Ramachandran Venkatesan and Dr. Theodore S. Norvell for their instruction in the graduate courses during my Master program. I am also very grateful to my fellow graduate student colleagues in the Computer Engineering Research Laboratories for their support and friendship that makes the lab a big and warm family. Especially thanks to Reza Shahidi who helps me a lot with the computer problems and arranges all the activities in the lab, and Padmini Vellore for her invaluable advice and help in the school and life. Lastly, I would like to thank my dear family and friends in China for their love, trust and encouragement throughout my studies and life, and sincerely thank my friends in St. John' s, Fang Zhang, Yaying Tu, Weirnin Hua, Yue Ma and Doug Hart for their care and support that make my life so colorful and enjoyable. ill Contents Abstract .......................................................................................................... I Acknowledgments ....................................................................................... III Contents ....................................................................................................... IV List of Figures ............................................................................................. IX List of Tables ............................................................................................... XI List of Abbreviations and Symbols .......................................................... XII 1 Introduction ................................................................................................ ! 1.1 Information Security ................................................................................................. 2 1.1.1 Symmetric-key Encryption System ... ................................................. .... .. .......... 3 1.1.1.1 Block Ciphers ..... .......... .. ................ ..... ....... .............. ................................... 4 1.1.1.2 Stream Ciphers ............................................................................................ 5 1.1.2 Public-key Encryption System ............ .. .... .. .. .. .. ................................................. 6 1.2 Software Vs. Hardware Implementation ................................................................... 8 1.3 Hardware Design and Implementation Methodology .......................... .. ................. 10 1.4 Motivation and Objectives ...................................................................................... 13 2 AES Algorithm Hardware Implementation .......................................... 15 2.1 Advanced Encryption Standard (AES) ................................... ................................ 15 2.2 AES Hardware Implementations ..................................................................... ........ 17 2.2.1 High Speed AES Hardware Implementations .................................................. 18 2.2.1.1 High Speed ASIC Implementations ........................... .. ... .. ........................ 18 IV 2.2.1.2 High Speed FPGA Implementations ......................................................... 22 2.2.2 Compact AES Hardware Implementations ...................................................... 24 2.2.2.1 Compact ASIC Implementations .............................................................. 24 2.2.2.2 Compact FPGA Implementations ............................................................. 25 2.3 AES Algorithm Hardware Design Tradeoffs .......................................................... 26 2.3.1 Architecture Tradeoff ....................................................................................... 27 2.3.2 Round Functions Tradeoff ............................................................................... 29 2.3.3 Datapath Tradeoff ............................................................................................ 30 2.3.4 Device Technology Tradeoff ........................................................................... 31 2.4 Conclusion ............................................................................................................... 31 3 Compact Implementation of AES S-box ................................................ 33 3.1 S-box Hardware Implementation ............................................................................ 33 3.1.1 The Construction of S-box ............................................................................... 33 3 .1.2 Look-up Table .................................................................................................. 34 3.1.3 Composite Filed Arithmetic ............................................................................. 35 4 3.1.3.1 Composite Field GF (2 ) ........................................................................... 36 2 3.1.3.2 Composite Field GF (2 ) ........................................................................... 37 3.2 Linear Redundancy of AES S-box .......................................................................... 39 3.3 New Implementation of AES S-box ........................................................................ 40 3.3.1 D Matrix Block.................................................................................. ............... 41 3.3.2 b0_logic Block .................................................................................................. 41 3.4 Performance Analysis and Comparison .................................................................. 42 3 .4.1 Area Complexity .............................................................................................. 43 v 3.4.2 Delay .................................................................. .............................................. 44 3.4.3 Power Consumption ......................................................................................... 45 3.5 Conclusion ...... .... .................... ................................................ ................................. 47 4 Compact Encryption-Decryption Architecture .................................... .48 4.1 Encryption Architecture Without Key-scheduling .................................................. 48 4.1.1 Encryption Architecture using Four S-boxes .................................................. .48 4.1.2 Encryption Architecture Using Only OneS-box ............................................. 50 4.1.3 Performance Analysis and Comparison ..........................................................