USRE44594E1 - Method and circuit for data encryption/decryption - Google Patents

Method and circuit for data encryption/decryption Download PDF

Info

Publication number
USRE44594E1
USRE44594E1 US13/456,457 US201213456457A USRE44594E US RE44594 E1 USRE44594 E1 US RE44594E1 US 201213456457 A US201213456457 A US 201213456457A US RE44594 E USRE44594 E US RE44594E
Authority
US
United States
Prior art keywords
transformation
state array
column
data
circuit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US13/456,457
Inventor
Marco Macchetti
Stefano Marchesin
Umberto Bondi
Luca Breveglieri
Guido Bertoni
Pasqualina Fragneto
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
STMicroelectronics SRL
Original Assignee
STMicroelectronics SRL
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by STMicroelectronics SRL filed Critical STMicroelectronics SRL
Priority to US13/456,457 priority Critical patent/USRE44594E1/en
Application granted granted Critical
Publication of USRE44594E1 publication Critical patent/USRE44594E1/en
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H04L9/0631Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12Details relating to cryptographic hardware or logic circuitry
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/24Key scheduling, i.e. generating round keys or sub-keys for block encryption

Definitions

  • the invention relates to encryption/decryption techniques and more specifically refers to Advanced Encryption Standard (AES) cryptosystems based e.g. on the so-called Rijndael algorithm.
  • AES Advanced Encryption Standard
  • the Rijndael algorithm is a block cipher algorithm operating on blocks of data.
  • the algorithm reads an entire block of data, processes the block and then outputs the encrypted data.
  • the Rijndael algorithm needs a key, which is another block of data.
  • the proposed AES standard will include only a 128-bit standard length for plaintext blocks and 128, 192 and 256-bit standard lengths for the key material.
  • Each generic round Ri develops along the lines shown in FIG. 2 and is essentially based on a first processing step currently referred to as the S-box step or function. This generates a matrix array which is subjected to a row shifting process followed by column mixing.
  • the respective key scheduled for round Ri is then added to produce the output of the round.
  • the output of the final round corresponds to the encrypted data.
  • the first and last rounds are at least marginally different from the other rounds: the first round is in fact comprised of key addition only, while the last round does not provide for mix column transformation.
  • the decryption algorithm of AES is very similar to the encryption process just described.
  • the decryption process is essentially based on a sequence of steps reproducing in a complementary manner the sequence of steps of the encryption process, wherein each transformation is replaced by the respective inverse transformation.
  • FIG. 3 is a schematic representation of a round in matrix form.
  • the application of a single round can essentially be described as the application to an array of input data ID of a matrix M to generate a corresponding array of output data OD.
  • Data ID and OD are in typical 32-bit format partitioned in four 8-bit words (bytes).
  • FIG. 4 shows a typical embodiment of an encryption system implementing the Rijndael/AES algorithm according to the traditional approach followed so far.
  • the system shown in FIG. 4 is intended to generate encrypted data starting from unencrypted data UD. Both unencrypted and encrypted data UD and ED are arranged in a 32-bit word format.
  • reference numeral 12 designates a demultiplexer which distributes the input unencrypted data stream UD over four different paths leading to respective adder modules 14 a, 14 b, 14 c and 14 d where the first key addition is performed.
  • Reference numerals 24 a, 24 b, 24 c and 24 d designates respective sets of byte registers wherein the 32-bit words subjected to the first key addition are distributed over four byte registers to be subsequently fed to respective sets of modules 34 a, 34 b, 34 c and 34 d where the S-box processing takes place.
  • Reference 16 designates a module which implements the shift row operation. Data blocks resulting from row shifting are fed to respective mix column modules 18 a, 18 b, 18 c and 18 d.
  • modules 18 a, 18 b, 18 c and 18 d which are arranged over four parallel 8-bit words—are then fed to respective key addition modules 20 a, 20 b, 20 c and 20 d where the key addition operation is performed.
  • key addition modules 20 a, 20 b, 20 c and 20 d After being subjected to key addition in modules 20 a, 20 b, 20 c and 20 d data are loaded into final registers 22 a to 22 d from which the encrypted code words are fed to a multiplexer unit 26 to generate the encrypted data stream ED.
  • the main disadvantage of the prior art solutions exemplified by the arrangement shown in FIG. 4 lies in the complex circuitry required to implement the encryption/decryption mechanism. Such a disadvantage is particularly felt to those envisaged applications of cryptosystems adapted for use in embedded systems such as, e.g., smartcards and the like.
  • One main object of the present invention is thus to provide an improved form of implementing the Rijndael/AES algorithm making it possible to expand the field of use of such algorithm in cryptosystems.
  • this object as well as additional objects are achieved by means of a method and system using a transposed arrangement for the internal state array of a matrix to provide a more rapid encryption/decryption process.
  • the present invention also provides a circuit for implementing the process.
  • the arrangement of the invention can in fact be regarded as embodying a novel encryption method, which however can be rendered compatible with existing standards through initial and final transposition steps.
  • FIGS. 1 to 4 illustrate prior art approaches for implementing the Rijndael/AES algorithm
  • FIG. 5 illustrates comparison to FIG. 3 , the basic underlying mechanism of the present invention.
  • FIG. 6 is a schematic diagram of a data encryption/decryption circuit according to the present invention.
  • Rijndael is a secret key cryptographic algorithm working in block cipher mode. This means that it operates on blocks of data and not on single bits or bytes.
  • the algorithm reads an entire block, processes it and then outputs the encrypted block.
  • the decryption operates in a complementary way to re-obtain plaintext starting from encrypted data.
  • the initial specification for this algorithm includes 128-bit, 192-bit and 256-bit as possible lengths for the plaintext blocks and for the key material.
  • the prospected AES standard will expectedly include only 128-bit as standard length for plaintext blocks and 128, 192 and 256-bit as standard length for the key material.
  • the input, output and cipher key bit sequences are processed as arrays of bytes formed by dividing these sequences into groups of 8 contiguous bits (bytes). Internally, the operations of the AES algorithm are performed on a two dimensional array of bytes called the state.
  • matrix ID represents the input bytes
  • matrix M represents the state bytes
  • OD designates the output bytes.
  • the state consists of four rows of bytes, each row containing 4 bytes, thus making the state a 4 ⁇ 4 matrix.
  • each column of the state array M form 32-bit words, hence the state can also be interpreted as a one-dimensional array of 32-bit words (columns), where the column number provides an index into this array.
  • each round is a fixed set of transformations that are applied to the state.
  • the number of these rounds is chosen as a function of the key length.
  • three possible key sizes of 128-bit, 196 and 256 bits can be considered.
  • 10 rounds as shown in FIG. 1
  • 12 rounds or 14 rounds are to be computed, respectively.
  • the present invention is based on the unexpected recognition that using for the internal state array a transposed arrangement (that is, using—in the place of matrix M—matrix M′ where the rows have been exchanged for the columns and vice-versa) leads to a surprising speed-up and simplification of the encryption/decryption process.
  • c is the column index which can be equal to 0, 1, 2, and 3.
  • operator means a multiplication in a Galois field applied to each of the four 8-bit terms comprising the 32-bit words being processed (i.e. ⁇ 02 ⁇ x 0 means ⁇ 02 ⁇ S 0,0 ⁇ 02 ⁇ S 1,0 ⁇ 02 ⁇ S 2,0 ⁇ 02 ⁇ S 3,0 ) while the operator+is a sum in Galois Fields, a logic XOR between two 32-bit words.
  • Such a transposition requires a redefinition of most of the operations performed in a round of the algorithm, and also if the key schedule. Therefore, also the round keys must be transposed before being applied to a round providing for the use of a transposed state.
  • the preferred embodiment of the invention provides for the key schedule being applied directly in the transposed manner.
  • FIG. 6 shows how the prior art arrangement shown in FIG. 4 is simplified and rendered faster by resorting to the invention.
  • the solution of the invention has a basic impact on the shift row block 16 and the mix column blocks 18 a, 18 b, 18 c and 18 d of FIG. 4 .
  • shift column modules 16 a, 16 b, 16 c and 16 d each acting on a respective flow from one of the S-box modules 34 a, 34 b, 34 c and 34 d—are substituted for shift row module 16 .
  • a single mix column module 18 is provided jointly operating on all of the sixteen 8-bit words output from shift column modules 16 a, 16 b, 16 c, 16 d is substituted for mix column modules 18 a, 18 b, 18 c and 18 d of the prior art arrangement of FIG. 4 .

Abstract

Data are converted between an unencrypted and an encrypted format according to the Rijndael algorithm, including a plurality of rounds. Each round is comprised of a fixed set of transformations applied to a two-dimensional array, designating states, of rows and columns of bit words. At least a part of the transformations are applied on a transposed version of the state, wherein rows and columns are transposed for the columns and rows, respectively.

Description

FIELD OF THE INVENTION
The invention relates to encryption/decryption techniques and more specifically refers to Advanced Encryption Standard (AES) cryptosystems based e.g. on the so-called Rijndael algorithm.
BACKGROUND OF THE INVENTION
The Rijndael algorithm is a block cipher algorithm operating on blocks of data. The algorithm reads an entire block of data, processes the block and then outputs the encrypted data. The Rijndael algorithm needs a key, which is another block of data. The proposed AES standard will include only a 128-bit standard length for plaintext blocks and 128, 192 and 256-bit standard lengths for the key material.
For a general review of the Rijndael/AES algorithms reference may be made to the following documents/websites:
    • J. Daemen, V. Rijmen, “AES Proposal: Rijndael” www.nist.gov/aes;
    • J. Daemen, V. Rijmen, “The Block Cipher Rijndael” Smart Card Research and Applications, LNCS 1820, J.-J. Quisquater and B. Schneier, Eds., Springer-Verlag, 2000, pp. 288-296;
    • J. Daemen and V. Rijmen, “Rijndael, the advanced encryption standard”, Dr. Dobb's Journal, Vol.-26, No. ˜3, March 2001, pp. 137-139;
    • V. Rijmen, “Efficient Implementation of the Rijndael S-box” “www.eas.kuleuven.ac.be/˜rijmen/rijndael/”;
    • J. Gladman “A specification for Rijndael, the AES Algorithm” March 2001 “www.fp.gladman.plus.com/”;
    • M. Akkar, C. Giraud “An implementation of DES and AES, secure against some attacks”—Proceedings of CHES 2001, pp. 315-325;
    • M. McLoone, J. V. McCanny “High performance single-chip FPGA Rijndael algorithm implementations”—Proceedings of CHES 2001, pp. 68-80;
    • V. Fischer, M. Drutarovsky “Two methods of Rijndael implementation in reconfigurable Hardware” Proceedings of CHES 2001, pp. 81-96;
    • H. Kuo and I. Verbauwhede “Architectural optimization for a 3 Gbits/sec VLSI Implementation of the AES Rijndael algorithm”, Proceedings of CHES 2001, pp. 53-67;
    • Rudra, P. K. Dubey, C. S. Jutla, V. Kumar, J. R. Rao, and P. Rohatgi “Efficient Rijndael encryption implementation with composite field arithmetic” Proceedings of CHES 2001, pp.175-188;
    • A. Dandalis, V. K. Prasanna, J. P. D. Rolim “An adaptive cryptographic engine for IPSec architecutures” Field-Programmable Custom Computing Machines, 2000 IEEE Symposium on 2000, pp. 132-141; 132-141.
    • “Advanced Encryption Standard (AES)” “www.nist.gov/aes”,
    • National Institute of Standards and Technology “www.nist.gov/aes”;
    • Rijndael Home Page's “www.esat.kuleuven.ac.be/rijmen/rijndael/”;
    • Gladman Home Page “www.fp.gladman.plus.com/”;
The encryption process based on the Rijndael algorithm follows the general layout shown in FIG. 1 of the enclosed drawings.
    • Unencrypted data are subject to a sequence of “rounds” R1, R2, . . . , R9, R10. Each round in turn provides for the application of a respective round key (i.e. round key 1, round key 2, . . . ) generated according to a key scheduling process KS.
Each generic round Ri develops along the lines shown in FIG. 2 and is essentially based on a first processing step currently referred to as the S-box step or function. This generates a matrix array which is subjected to a row shifting process followed by column mixing.
The respective key scheduled for round Ri is then added to produce the output of the round. The output of the final round (designated round 10 in FIG. 1) corresponds to the encrypted data.
More specifically, the first and last rounds are at least marginally different from the other rounds: the first round is in fact comprised of key addition only, while the last round does not provide for mix column transformation.
The decryption algorithm of AES is very similar to the encryption process just described. The decryption process is essentially based on a sequence of steps reproducing in a complementary manner the sequence of steps of the encryption process, wherein each transformation is replaced by the respective inverse transformation.
All of the foregoing corresponds to basic principles and criteria well known to those of skill in the art (see, for instance, the references cited in the introductory portion of this description), thus making it unnecessary to provide a more detailed description herein. This applies more to the point to the steps/functions designated “S-box” and “Add Key” in FIG. 2.
FIG. 3 is a schematic representation of a round in matrix form.
Apart from the add round key, sub byte and shift row operations, the application of a single round can essentially be described as the application to an array of input data ID of a matrix M to generate a corresponding array of output data OD. Data ID and OD are in typical 32-bit format partitioned in four 8-bit words (bytes).
In current implementations of the Rijndael/AES algorithm, matrix M is thus a matrix including 4×4=16 elements s0, . . . , s15 is corresponding to a byte.
The block diagram of FIG. 4 shows a typical embodiment of an encryption system implementing the Rijndael/AES algorithm according to the traditional approach followed so far.
The system shown in FIG. 4, designated 10 overall, is intended to generate encrypted data starting from unencrypted data UD. Both unencrypted and encrypted data UD and ED are arranged in a 32-bit word format.
In the diagram of FIG. 4, reference numeral 12 designates a demultiplexer which distributes the input unencrypted data stream UD over four different paths leading to respective adder modules 14a, 14b, 14c and 14d where the first key addition is performed.
Reference numerals 24a, 24b, 24c and 24d designates respective sets of byte registers wherein the 32-bit words subjected to the first key addition are distributed over four byte registers to be subsequently fed to respective sets of modules 34a, 34b, 34c and 34d where the S-box processing takes place.
Reference 16 designates a module which implements the shift row operation. Data blocks resulting from row shifting are fed to respective mix column modules 18a, 18b, 18c and 18d.
These latter modules are intended to be bypassed during the last round. In fact the structure shown permits the first round to be calculated immediately. Iterative calculation is then carried out for the following rounds. As indicated, the last round does not provide for the mix column step, whereby lines are shown enabling such a step to be bypassed during the last round.
The data output from modules 18a, 18b, 18c and 18d—which are arranged over four parallel 8-bit words—are then fed to respective key addition modules 20a, 20b, 20c and 20d where the key addition operation is performed. After being subjected to key addition in modules 20a, 20b, 20c and 20d data are loaded into final registers 22a to 22d from which the encrypted code words are fed to a multiplexer unit 26 to generate the encrypted data stream ED.
All of the foregoing again corresponds to principles and criteria which are known to those of skilled in the art.
The main disadvantage of the prior art solutions exemplified by the arrangement shown in FIG. 4 lies in the complex circuitry required to implement the encryption/decryption mechanism. Such a disadvantage is particularly felt to those envisaged applications of cryptosystems adapted for use in embedded systems such as, e.g., smartcards and the like.
SUMMARY OF THE INVENTION
One main object of the present invention is thus to provide an improved form of implementing the Rijndael/AES algorithm making it possible to expand the field of use of such algorithm in cryptosystems.
According to the present invention, this object, as well as additional objects are achieved by means of a method and system using a transposed arrangement for the internal state array of a matrix to provide a more rapid encryption/decryption process. The present invention also provides a circuit for implementing the process.
The arrangement of the invention can in fact be regarded as embodying a novel encryption method, which however can be rendered compatible with existing standards through initial and final transposition steps.
DETAILED DESCRIPTION OF THE DRAWINGS
The invention will now be described, by a way of non limiting example, by referring to the enclosed drawings, wherein:
FIGS. 1 to 4, illustrate prior art approaches for implementing the Rijndael/AES algorithm,
FIG. 5 illustrates comparison to FIG. 3, the basic underlying mechanism of the present invention, and
FIG. 6 is a schematic diagram of a data encryption/decryption circuit according to the present invention.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS OF THE PRESENT INVENTION
In order to better understand the basic underlying principle of the invention, it must be recalled that Rijndael is a secret key cryptographic algorithm working in block cipher mode. This means that it operates on blocks of data and not on single bits or bytes. The algorithm reads an entire block, processes it and then outputs the encrypted block. The decryption operates in a complementary way to re-obtain plaintext starting from encrypted data.
To operate properly, the Rijndael algorithm needs a key, which is another block of data.
The initial specification for this algorithm includes 128-bit, 192-bit and 256-bit as possible lengths for the plaintext blocks and for the key material. The prospected AES standard will expectedly include only 128-bit as standard length for plaintext blocks and 128, 192 and 256-bit as standard length for the key material.
The following description will therefore deal—by way of example only—with 128-bit blocks, as this adheres to the presently prognosticated standard.
The input, output and cipher key bit sequences are processed as arrays of bytes formed by dividing these sequences into groups of 8 contiguous bits (bytes). Internally, the operations of the AES algorithm are performed on a two dimensional array of bytes called the state.
Specifically, by referring again to FIG. 3, matrix ID represents the input bytes, matrix M represents the state bytes, and OD designates the output bytes. The state consists of four rows of bytes, each row containing 4 bytes, thus making the state a 4×4 matrix.
The four bytes in each column of the state array M form 32-bit words, hence the state can also be interpreted as a one-dimensional array of 32-bit words (columns), where the column number provides an index into this array.
As shown in connection with FIG. 2, the Rijndael cipher algorithm operates in rounds. Each round is a fixed set of transformations that are applied to the state.
The number of these rounds is chosen as a function of the key length. In the case of the three examples referred to in the foregoing, three possible key sizes of 128-bit, 196 and 256 bits can be considered. Depending on these sizes, 10 rounds (as shown in FIG. 1), 12 rounds or 14 rounds are to be computed, respectively.
The present invention is based on the unexpected recognition that using for the internal state array a transposed arrangement (that is, using—in the place of matrix M—matrix M′ where the rows have been exchanged for the columns and vice-versa) leads to a surprising speed-up and simplification of the encryption/decryption process.
According to the prior art, an operation is applied to the columns, for instance column S0 S1 S2 S3 of matrix M1.
When the state is transposed, the column becomes S0 S4 S8 S12.
This concept may be better understood by referring to the example which follows of a transformation carried out on a non-transposed state.
[ S 0 , c S 1 , c S 2 , c S 3 , c ] = [ 02 03 01 01 [ S 0 , c 01 02 03 01 S 1 , c 01 01 02 03 S 2 , c 03 01 01 02 ] S 3 , c ]
where c is the column index which can be equal to 0, 1, 2, and 3.
If a new, transposed form is used, the main transformation for the new mix column becomes
y0=({02}·x0)+({03}·x1)+x2+x3
y1=x0+({02}·x1)+({03}·x2)+x3
y2=x0+x1+({02}·x2)+({03}·x3)
y3=({03}·x0)+x1+x2+({02}·x3)
Transposed Form xi=S0,i S1,i S2,i S3,i
where xi, 0≦i≦3 are the words of the transposed state, and yi, 0≦i≦3 are the words of the transposed state after mix column transformation.
In the foregoing, operator means a multiplication in a Galois field applied to each of the four 8-bit terms comprising the 32-bit words being processed (i.e. {02}·x0 means {02}·S0,0 {02}·S1,0 {02}·S2,0 {02}·S3,0) while the operator+is a sum in Galois Fields, a logic XOR between two 32-bit words.
Such a transposition requires a redefinition of most of the operations performed in a round of the algorithm, and also if the key schedule. Therefore, also the round keys must be transposed before being applied to a round providing for the use of a transposed state.
A trivial solution for that purpose is simply to apply the original key schedule unchanged and then add code to transpose every created round key. In that way, a large overhead would be introduced.
For that reason, the preferred embodiment of the invention provides for the key schedule being applied directly in the transposed manner.
This means that the internal behavior of the system is modified, and simplified, the only requirement to obtain compatibility with the standard being that the state must be retransposed before being outputs.
The block diagram of FIG. 6 shows how the prior art arrangement shown in FIG. 4 is simplified and rendered faster by resorting to the invention.
In FIG. 6 parts and components which are identical or equivalent to those already described in connection with FIG. 4 have been indicated with the same reference numerals.
Essentially, the solution of the invention has a basic impact on the shift row block 16 and the mix column blocks 18a, 18b, 18c and 18d of FIG. 4.
In the solution of the invention, four shift column modules 16a, 16b, 16c and 16d—each acting on a respective flow from one of the S- box modules 34a, 34b, 34c and 34d—are substituted for shift row module 16.
By referring to the two tables reproduced in the foregoing, it will become apparent that in the solution of the invention generation of each of the components y0 y1 y2 y3 essentially derives from a linear combination of words x0 x1 x2 x3. This makes it possible to implement the respective transformation simply by means of adder modules (and shift registers).
In the block diagram of FIG. 6 a single mix column module 18 is provided jointly operating on all of the sixteen 8-bit words output from shift column modules 16a, 16b, 16c, 16d is substituted for mix column modules 18a, 18b, 18c and 18d of the prior art arrangement of FIG. 4.
Experimentation carried out by the applicants demonstrates that the invention significantly increases the speed of implementing the Rijndael algorithm, even if the overhead due to the initial and final transpositions of the state array is taken into account.
Direct comparison of the solution of the invention with the so-called Gladman's implementation (reportedly the fastest soft implementation of the Rijndael algorithm currently available) shows that the invention leads to improvements in terms of encryption and decryption speeds of 46% and 33%, respectively, for a 128-bit key size.
Improvements demonstrated in encryption and decryption speeds with a 192-bit key size are 39% and 25%, respectively.
Finally, improvements in encryption and decryption speed of 45% and 32%, respectively were demonstrated for a 256-bit key size.
It will be appreciated that advantages in terms of latency are primarily felt at the level of software implementation, while the main advantage at the hardware level lies (even with identical performance in terms of latency) in the smaller amount of functional units required. This leads to simpler and less expensive systems, which is a particularly relevant factor in the case of decryption systems.
The solution of transposing the state matrix can be applied to all cases contemplated by the Rijndael algorithm, advantages being significant especially for 128 and 256 bit words. As indicated, if no initial and final transpositions to ensure compatibility with the existing standards are effected, a thoroughly novel cryptographic systems is obtained.
The present invention has been described with reference to the preferred embodiments. However, the present invention is not limited to those embodiments. Various changes and modifications may be made within the spirit and scope of the amended claims.

Claims (45)

The invention claimed is:
1. A method of converting data between an unencrypted format and an encrypted format, the data being organized in bit words and being stored in at least one register, the method comprising:
using a circuit cooperating with the at least one register to convert the data by at least performing a plurality of transformation rounds, each transformation round having a respective round key and comprising applying at least one transformation to a two-dimensional array of rows and columns of bit words defining a state array,
exchanging each of the rows with a respective column of the state array to form a transposed state array for at least one of the transformation rounds so that the at least one transformation is applied to the transposed state array,
transposing the respective round key, and
applying the respective transposed round key to the state array in at least one of the transformation rounds; and
using the circuit to transpose an output of a final round from the plurality of transformation rounds.
2. A method according to claim 1 wherein the bit words are 8-bit words.
3. A method according to claim 1 wherein the state array is a 4×4 matrix of bit words.
4. A method according to claim 1 wherein the plurality of transformation rounds comprises at least 10 transformation rounds.
5. A method according to claim 1 wherein performing further comprises performing at least one transformation round on a non-transposed state array.
6. A method according to claim 1 further comprising adding code to transpose the respective round key for each of the plurality of transformation rounds.
7. A method according to claim 1 wherein each respective round key is applied according to a round key schedule.
8. A method according to claim 7 wherein the round key schedule comprises a transposed round key schedule.
9. A device for converting data between an unencrypted format and an encrypted format, the device comprising:
at least one register configured to store the data in the form of bit words; and
a circuit configured to convert the data by at least
performing a plurality of transformation rounds, each transformation round having a respective round key and comprising
applying at least one transformation to a two-dimensional array of rows and columns of bit words defining a state array,
exchanging each of the rows with a respective column of the state array to form a transposed state array for at least one of the transformation rounds so that at least one transformation is applied to the transposed state array,
transposing the respective round key, and
applying the respective transposed round key to the state array in at least one of the transformation rounds, and
transposing an output of a final round from the plurality of transformation rounds.
10. A device according to claim 9 wherein said at least one register is configured to store bit words as 8-bit words.
11. A device according to claim 9 wherein said circuit is a decoder for converting data from an encrypted data format to an unencrypted data format.
12. A device according to claim 9 wherein said circuit is configured to operate on a state array comprising a 4×4 matrix of bit words.
13. A device according to claim 9 wherein said circuit is configured to perform a plurality of transformation rounds performs at least 10 transformation rounds.
14. A device according to claim 9 wherein said circuit comprises at least one S-box processing module, said at least one S-box processing module being configured to operate on a group of bit words defining a cell of a column of the state array.
15. A device according to claim 14 wherein the at least one S-box processing module comprises a plurality of S-box modules, each of the plurality of S-box modules being configured to operate on a corresponding cell of a column of the state array.
16. A device according to claim 15 wherein the colunm of the state array comprises four cells.
17. A device according to claim 9 wherein the circuit further comprises a plurality of shift column modules, each of said plurality of shift column modules being configured to perform a column shift operation on a column of the state array.
18. A device according to claim 17 wherein a column shift operation performed by each of said plurality of shift column modules generates shift column data, and wherein said circuit further comprises a single mix column module to perform column mix operations on shift column data.
19. A device according to claim 9 wherein said circuit is an encoder for converting data from an unencrypted data format to an encrypted data format.
20. A device according to claim 19 wherein said circuit is an embedded system for use in a smart card.
21. A device according to claim 11 wherein said circuit is an embedded system for use in a smart card.
22. A method of converting data between an unencrypted format and an encrypted format, the data being organized in 8-bit words and being stored in at least one register, the method comprising:
using a circuit cooperating with the at least one register to convert the data by at least performing a plurality of transformation rounds for converting the data, each transformation round having a respective round key and comprising
applying at least one transformation to a two-dimensional array of rows and columns of 8-bit words defining a state array comprising a 4×4 matrix of 8-bit words,
exchanging each of the rows with a respective column of the state array to form a transposed state array for at least one of the transformation rounds so that the at least one transformation is applied to the transposed state array,
transposing the respective round key, and
applying the respective transposed round key to the state array in at least one of the transformation rounds; and
using the circuit to transpose an output of a final round from the plurality of transformation rounds.
23. A method according to claim 22 further comprising adding code to transpose the respective round key for each of the plurality of transformation rounds.
24. A method according to claim 22 wherein each respective round key is applied according to a round key schedule.
25. A method of converting data between an unencrypted format and an encrypted format, the data being organized in bit words and being stored in at least one storage element, the method comprising:
using a circuit cooperating with the at least one storage element to convert the data by at least performing a plurality of transformation rounds, each transformation round having a respective round key and comprising
applying at least one transformation to a two-dimensional array of rows and columns of bit words defining a state array,
exchanging each of the rows with a respective column of the state array to form a transposed state array for at least one of the transformation rounds so that the at least one transformation is applied to the transposed state array,
transposing the respective round key, and
applying the respective transposed round key to the state array in at least one of the transformation rounds; and
using the circuit to transpose an output of a final round from the plurality of transformation rounds.
26. A method according to claim 25 wherein the bit words are 8-bit words.
27. A method according to claim 25 wherein the state array is a 4×4 matrix of bit words.
28. A method according to claim 25 wherein the plurality of transformation rounds comprises at least 10 transformation rounds.
29. A method according to claim 25 wherein performing further comprises performing at least one transformation round on a non-transposed state array.
30. A method according to claim 25 further comprising adding code to transpose the respective round key for each of the plurality of transformation rounds.
31. A method according to claim 25 wherein each respective round key is applied according to a round key schedule.
32. A method according to claim 31 wherein the round key schedule comprises a transposed round key schedule.
33. A device for converting data between an unencrypted format and an encrypted format, the device comprising:
at least one storage element configured to store the data in the form of bit words; and
a circuit configured to convert the data by at least
performing a plurality of transformation rounds, each transformation round having a respective round key and comprising
applying at least one transformation to a two-dimensional array of rows and columns of bit words defining a state array,
exchanging each of the rows with a respective column of the state array to form a transposed state array for at least one of the transformation rounds so that at least one transformation is applied to the transposed state array,
transposing the respective round key, and
applying the respective transposed round key to the state array in at least one of the transformation rounds, and
transposing an output of a final round from the plurality of transformation rounds.
34. A device according to claim 33 wherein said at least one storage element is configured to store bit words as 8-bit words.
35. A device according to claim 33 wherein said circuit is configured to operate on a state array comprising a 4×4 matrix of bit words.
36. A device according to claim 33 wherein said circuit is configured to perform a plurality of transformation rounds performs at least 10 transformation rounds.
37. A device according to claim 33 wherein said circuit comprises at least one S-box processing module, said at least one S-box processing module being configured to operate on a group of bit words defining a cell of a column of the state array.
38. A device according to claim 37 wherein the at least one S-box processing module comprises a plurality of S-box modules, each of the plurality of S-box modules being configured to operate on a corresponding cell of a column of the state array.
39. A device according to claim 38 wherein the column of the state array comprises four cells.
40. A device according to claim 33 wherein the circuit further comprises a plurality of shift column modules, each of said plurality of shift column modules being configured to perform a column shift operation on a column of the state array.
41. A device according to claim 40 wherein a column shift operation performed by each of said plurality of shift column modules generates shift column data, and wherein said circuit further comprises a single mix column module to perform column mix operations on shift column data.
42. A device according to claim 33 wherein said circuit is an encoder for converting data from an unencrypted data format to an encrypted data format.
43. A device according to claim 42 wherein said circuit is an embedded system for use in a smart card.
44. A device according to claim 33 wherein said circuit is a decoder for converting data from an encrypted data format to an unencrypted data format.
45. A device according to claim 44 wherein said circuit is an embedded system for use in a smart card.
US13/456,457 2001-10-10 2012-05-29 Method and circuit for data encryption/decryption Active 2024-10-11 USRE44594E1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US13/456,457 USRE44594E1 (en) 2001-10-10 2012-05-29 Method and circuit for data encryption/decryption

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US09/974,705 US7801301B2 (en) 2001-10-10 2001-10-10 Method and circuit for data encryption/decryption
US13/456,457 USRE44594E1 (en) 2001-10-10 2012-05-29 Method and circuit for data encryption/decryption

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US09/974,705 Reissue US7801301B2 (en) 2001-10-10 2001-10-10 Method and circuit for data encryption/decryption

Publications (1)

Publication Number Publication Date
USRE44594E1 true USRE44594E1 (en) 2013-11-12

Family

ID=29216577

Family Applications (2)

Application Number Title Priority Date Filing Date
US09/974,705 Ceased US7801301B2 (en) 2001-10-10 2001-10-10 Method and circuit for data encryption/decryption
US13/456,457 Active 2024-10-11 USRE44594E1 (en) 2001-10-10 2012-05-29 Method and circuit for data encryption/decryption

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US09/974,705 Ceased US7801301B2 (en) 2001-10-10 2001-10-10 Method and circuit for data encryption/decryption

Country Status (1)

Country Link
US (2) US7801301B2 (en)

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4328487B2 (en) * 2002-01-28 2009-09-09 インターナショナル・ビジネス・マシーンズ・コーポレーション Combination circuit, encryption circuit, generation method thereof, and program
US7221763B2 (en) * 2002-04-24 2007-05-22 Silicon Storage Technology, Inc. High throughput AES architecture
US7257229B1 (en) * 2002-06-07 2007-08-14 Winbond Electronics Corporation Apparatus and method for key scheduling
US10572824B2 (en) 2003-05-23 2020-02-25 Ip Reservoir, Llc System and method for low latency multi-functional pipeline with correlation logic and selectively activated/deactivated pipelined data processing engines
JP2006526227A (en) 2003-05-23 2006-11-16 ワシントン ユニヴァーシティー Intelligent data storage and processing using FPGA devices
KR100800468B1 (en) * 2004-01-29 2008-02-01 삼성전자주식회사 Hardware cryptographic engine and method improving power consumption and operation speed
US7613295B2 (en) * 2004-02-18 2009-11-03 Harris Corporation Cryptographic device and associated methods
DE602004023436D1 (en) * 2004-03-29 2009-11-12 St Microelectronics Sa PROCESSOR FOR EXECUTING AN AES ALGORITHM
US8331559B2 (en) * 2004-10-12 2012-12-11 Chiou-Haun Lee Diffused data encryption/decryption processing method
US20060078107A1 (en) * 2004-10-12 2006-04-13 Chiou-Haun Lee Diffused data encryption/decryption processing method
US8379841B2 (en) * 2006-03-23 2013-02-19 Exegy Incorporated Method and system for high throughput blockwise independent encryption/decryption
GB2440992A (en) * 2006-08-02 2008-02-20 Farhad Dalvi Encryption of an ordered first set of bits using rearrangement which depends on at least two encryption keys
US7949130B2 (en) 2006-12-28 2011-05-24 Intel Corporation Architecture and instruction set for implementing advanced encryption standard (AES)
WO2009029842A1 (en) * 2007-08-31 2009-03-05 Exegy Incorporated Method and apparatus for hardware-accelerated encryption/decryption
GB0717992D0 (en) * 2007-09-15 2007-10-24 Univ Sheffield Encryption apparatus and method
US9191197B2 (en) * 2007-10-10 2015-11-17 Canon Kabushiki Kaisha AES encryption/decryption circuit
TWI409644B (en) * 2007-11-02 2013-09-21 Tatung Co Ltd Data encryption / decryption control method and its circuit
US8316338B2 (en) * 2009-02-09 2012-11-20 The United States Of America, As Represented By The Secretary Of Commerce, The National Institute Of Standards & Technology Method of optimizing combinational circuits
DE102014216392A1 (en) * 2014-08-19 2016-02-25 Robert Bosch Gmbh Symmetric iterated block ciphering method and corresponding device
US10482543B2 (en) * 2016-05-12 2019-11-19 Kurt B. Schuh Apparatus and method for validating transactional data
EP3560135A4 (en) 2016-12-22 2020-08-05 IP Reservoir, LLC Pipelines for hardware-accelerated machine learning

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5533127A (en) 1994-03-18 1996-07-02 Canon Information Systems, Inc. Encryption system
US20010024502A1 (en) 2000-03-06 2001-09-27 Kaubshiki Kaisha Toshiba Encryption apparatus and method, and decryption apparatus and method based on block encryption
US20020157009A1 (en) 2001-04-24 2002-10-24 Hitachi. Ltd. Method for obtaining a solution of an optimization problem
US20020191784A1 (en) 2001-06-08 2002-12-19 Nhu-Ha Yup Circuit and method for implementing the advanced encryption standard block cipher algorithm in a system having a plurality of channels

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5533127A (en) 1994-03-18 1996-07-02 Canon Information Systems, Inc. Encryption system
US20010024502A1 (en) 2000-03-06 2001-09-27 Kaubshiki Kaisha Toshiba Encryption apparatus and method, and decryption apparatus and method based on block encryption
US20020157009A1 (en) 2001-04-24 2002-10-24 Hitachi. Ltd. Method for obtaining a solution of an optimization problem
US20020191784A1 (en) 2001-06-08 2002-12-19 Nhu-Ha Yup Circuit and method for implementing the advanced encryption standard block cipher algorithm in a system having a plurality of channels

Non-Patent Citations (8)

* Cited by examiner, † Cited by third party
Title
http://groups-beta.google.com/group/comp.lang.forth-May 28, 2001, 1:59 pm by Jabari Zakiya "Advanced Encryption Standard (AES) 2nd Part"; pp. 1-12; Google Group. *
Karri et al. "Concurrent Error Detection of Fault-Based Side-Channel Cryptanalysis of 128-Bit Symmetric Block Ciphers" DAC 2001, Jun. 18-22, 2001: Law Vegas, NV; 2001 ACM; 1-58113-297-2/01/0006.
Mc Loone, Maire; McCanny, John V; "Rijndael FPGA Implementation Utilizing Look-Up Tables", Sep. 26-28, 2001; Signal Processing Systems, 2001 IEEE Workshop; pp. 349-360. *
McLoone et al. "Rijndael FPGA Implementation Utilizing Look-Up Tables" 0-7803-7145-3/01; 2001 IEEE.
Ramesh Karri, Kaijie Wu, Piyush Mishra, Yongkook Kim; "Concurrent error detection of fault-based side-channel cryptanalyis of 128-bit symmetric block ciphers"; Jun. 2001; Proceedings of the 38th conference on Design automation; pp. 579-584. *
Riaz A. Usmani, "Applied Lineaar Algebra" (1987) pp. 34-36. *
Zakiya Advanced Encryption Standard (AES) 2nd Part: http//groups-beta.google.com/group/comp.lang.forth/messages/13942DF3ECF97F79?HL, May 2001.
Zakiya Advanced Encryption Standard (AES) 2nd Part: http//groups-beta.google.com/group/comp.lang.forth/messages/A8640A6548D8FC1B, May 2001.

Also Published As

Publication number Publication date
US20030068036A1 (en) 2003-04-10
US7801301B2 (en) 2010-09-21

Similar Documents

Publication Publication Date Title
USRE44594E1 (en) Method and circuit for data encryption/decryption
AU767323B2 (en) Block encryption device using auxiliary conversion
Bertoni et al. Efficient software implementation of AES on 32-bit platforms
EP2356771B1 (en) Low latency block cipher
US7295671B2 (en) Advanced encryption standard (AES) hardware cryptographic engine
Gueron Intel’s new AES instructions for enhanced performance and security
JP3818263B2 (en) AES encryption processing device, AES decryption processing device, AES encryption / decryption processing device, AES encryption processing method, AES decryption processing method, and AES encryption / decryption processing method
EP2058781B1 (en) Encryption device, encryption method, and computer program
EP1833190B1 (en) Table splitting for cryptographic processes
CN111431697B (en) Novel method for realizing lightweight block cipher CORL
Buell Modern symmetric ciphers—Des and Aes
CN111314054A (en) Novel high-security lightweight ECEG block cipher realization method, system and storage medium
CN1795637B (en) Method and apparatus for a low memory hardware implementation of the key expansion function
CN111262685B (en) Novel method and device for realizing Shield block cipher generated by secret key and readable storage medium
Shylashree et al. FPGA implementations of advanced encryption standard: A survey
Dalakoti et al. Hardware efficient AES for image processing with high throughput
Aoki et al. Optimized Software Implementations of E2
JP2006235440A (en) Semiconductor integrated circuit
AU2022204632A1 (en) Method for determining a cryptographic key, computer program, and data processing system
KR100406724B1 (en) A multiplicative inverse operator for modulo n and data encryption apparatus including the same operator
Prodhan et al. Performance Analysis of Parallel Implementation of Advanced Encryption Standard (AES) Over Serial Implementation
Stalin et al. Analysis of Different Composite Field Architectures for S-Box in
Raval et al. Optimized AES Algorithm Using FeedBack Architecture

Legal Events

Date Code Title Description
FPAY Fee payment

Year of fee payment: 4

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552)

Year of fee payment: 8

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1553); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 12