Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F7/38—Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation
  • G06F7/48—Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation using non-contact-making devices, e.g. tube, solid state device; using unspecified devices
  • G06F7/52—Multiplying; Dividing
  • G06F7/523—Multiplying only
  • G06F7/53—Multiplying only in parallel-parallel fashion, i.e. both operands being entered in parallel
  • G06F7/5324—Multiplying only in parallel-parallel fashion, i.e. both operands being entered in parallel partitioned, i.e. using repetitively a smaller parallel parallel multiplier or using an array of such smaller multipliers
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F7/38—Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation
  • G06F7/48—Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation using non-contact-making devices, e.g. tube, solid state device; using unspecified devices
  • G06F7/50—Adding; Subtracting
  • G06F7/505—Adding; Subtracting in bit-parallel fashion, i.e. having a different digit-handling circuit for each denomination
  • G06F7/5052—Adding; Subtracting in bit-parallel fashion, i.e. having a different digit-handling circuit for each denomination using carry completion detection, either over all stages or at sample stages only
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
  • G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
  • G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
  • G06F7/722—Modular multiplication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2207/00—Indexing scheme relating to methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F2207/38—Indexing scheme relating to groups G06F7/38 - G06F7/575
  • G06F2207/3804—Details
  • G06F2207/3808—Details concerning the type of numbers or the way they are handled
  • G06F2207/3812—Devices capable of handling different types of numbers
  • G06F2207/382—Reconfigurable for different fixed word lengths
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2207/00—Indexing scheme relating to methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F2207/38—Indexing scheme relating to groups G06F7/38 - G06F7/575
  • G06F2207/3804—Details
  • G06F2207/3808—Details concerning the type of numbers or the way they are handled
  • G06F2207/3828—Multigauge devices, i.e. capable of handling packed numbers without unpacking them
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F7/38—Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation
  • G06F7/48—Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation using non-contact-making devices, e.g. tube, solid state device; using unspecified devices
  • G06F7/499—Denomination or exception handling, e.g. rounding or overflow
  • G06F7/49931—Modulo N reduction of final result
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/12—Details relating to cryptographic hardware or logic circuitry
  • H04L2209/125—Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations

Definitions

• This invention relates to high-performance network encryption devices, particularly encryption devices which 5 incorporate both hardware and software.
• Privacy is accomplished through encryption/decryption.
• encryption/decryption is performed based on algorithms which are intended to allow data transfer over an open channel between parties while maintaining the privacy of the message contents. This is accomplished by encrypting the data using an encryption key by the sender and decrypting it using a decryption key by the receiver (sometimes, the encryption and decryption keys are the same) .
• Encryption algorithms can be classified into public-key and secret key algorithms. In secret-key algorithms, both keys are secret whereas in public-key algorithms, one of the keys is known to the general public.
• Block ciphers are representative of the secret- key cryptosystems in use today. Usually, for block ciphers, the encryption key is the same as the decryption key. A block cipher takes a block of data, typically 32-128 bits, as input and produces the same number of bits as output. The encryption and decryption are performed using a key, anywhere from 56-128 bits in length. The encryption algorithm is designed such that it is very difficult to decrypt a message without knowing the key. In addition to block ciphers, Internet security protocols also make heavy use of public-key algorithms.
• a public key cryptosystem such as the Rivest, Shamir, Adelman (RSA) cryptosystem described in U.S. patent 5,144,667 issued to Pogue and Rivest uses two keys, only one of which is made public. Once someone publishes a key, anyone may send that person a secret message using that key. However, decryption of the message can only be accomplished by use of the secret key.
• the advantage of such public-key encryption is secret keys do not need to be distributed to all parties of a conversation beforehand. In contrast, if only secret-key encryption were used, multiple secret keys would have to be generated, one for each party intended to receive the message, and each secret key would have to be privately communicated.
• public-key algorithms are so computationally intensive, they are typically not used to encrypt entire messages. Instead, private-key cryptosystems are used for message transfer.
• the private key used to encrypt the message called the session key, is chosen at random and encrypted using a public key.
• the encrypted session key, as well as the encrypted message, are then sent to the other party.
• the other party uses its secret key to decrypt the session key, at which point the message may be decrypted using the session key.
• a different session key is used for each communication, so that if one session key is ever broken, only the one message encrypted with it may be read.
• This public-key/private-key method can also be used to protect continuous communications, such as interactive terminal sessions that never terminate in normal operation. In this case, the session key is periodically changed (e.g. once an hour) by repeating the public-key generation technique. Again, frequent changing of the session key limits the amount of data compromised if the encryption is broken.
• Network-level encryption devices allowing access to corporate networks using a software-based solution are experiencing widespread usage.
• Products such as Raptor Eagle Remote and others perform encryption entirely in software.
• the software limits the encryptor's throughput. Session key generation using public-key techniques may take several minutes. For this reason, session keys are not re-generated as often as some people would like.
• software does have the advantage that the encryption algorithms are easily changed in response to advances in the field.
• Other devices use a combination of hardware and software.
• the Northern Telecom (now Entrust) Sentinel X.25 encryption product uses a DES chip produced by AMD to perform the DES secret-key encryption.
• Hardware implementations of DES are much faster, since DES was designed for efficient implementation in hardware.
• a transposition that takes many CPU instructions in software can be done using parallel special -purpose lookup tables and wiring.
• the Sentinel also makes use of a Motorola DSP56000 processor to perform the public-key operations.
• the single-cycle multiplication ability of the DSP made this approach significantly faster than implementing the public-key algorithms on regular CISC microprocessors .
• a preferred high-performance programmable network encryption device integrated into a single chip, is a parallel-pipelined processor system whose instruction set is optimized for common encryption algorithms.
• the present invention realizes the advantages of both hardware and software approaches. Since the processor is a programmable processor, any encryption algorithm may be implemented, contrary to a hardware implemented encryption processor which is dedicated to executing only one algorithm. However, the processor's architecture permits parallel computations of a nature useful for encryption, so its performance more closely approximates that of a dedicated hardware device.
• an electronic encryption device comprises an array of processing elements. Each processing element comprises an instruction memory for storing a round of an encryption algorithm, the round comprising a sequence of instructions.
• the processing element also includes a processor for implementing the round from the instruction memory and data storage for storing encryption data operands and encrypted data resulting from implementing the round.
• Each processing element of the array implements one of the rounds and transfers results to successive processing elements such that the array of processing elements implements successive rounds of the encryption algorithm in a processing element pipeline.
• the data storage has a portion thereof which is shared between adjacent processing elements of the linear array for transfer of data between adjacent processing elements of the linear array.
• the shared data storage is preferably comprised of dual port memories but may also comprise shared registers .
• the preferred processing element comprises a control unit and an ALU.
• the control unit, ALU, instruction memory and data storage, including local data memory and shared data memory, are connected to a local processing element bus.
• the local bus is segmented by a switch into a local instruction bus segment, connecting the instruction memory and the control unit, and a local data bus segment connecting the ALU, local data memory and shared data memory.
• the switch permits either independent simultaneous operation on the two local bus segments or a communication between the two bus segments.
• Each processing element further comprises a multiplier for performing multiplication operations within the processing element.
• the preferred encryption device further comprises a global random access memory and a global bus through which data is transferred between the global random access memory and the processing element data storage.
• a central processor is coupled to the global bus for processing data words which are wider than data words processed by the processing elements.
• the multipliers of the plural processing elements may be adapted for concatenation as segments of a wider multiplier used by the central processor.
• each multiplier comprises partial product adders having input selection circuitry for selecting a first set of inputs when operating as an individual multiplier and a second set of inputs, including inputs from adjacent processing elements, when concatenated.
• the central processor comprises a novel adder.
• each of plural adder segments has a carry output and a sum output and each of the adder segments processes a segment of each of two operands.
• Selectors select the carry outputs as carry inputs to successive adder segments for successive clock cycles so long as any carry results in an adder cycle.
• Selectors also select each sum output as an operand input to the same adder segment. Accordingly, so long as any carry results in an adder cycle, the sum output of an adder is fed back to its input, and the adder segment receives a carry input generated as a carry output from a preceding segment in a preceding cycle .
• each processing element performs a modular adjust operation to compute M mod N without using a divide circuit .
• Each processing element also performs a modulo add/subtract operation to compute A ⁇ B mod N. Further, each processing element performs a modulo multiply operation to compute A x B mod N.
• FIGS 1A and IB are block diagrams of potential applications of the present invention.
• Figure 2 is a block diagram of an encryption chip embodying the present invention.
• Figure 3 is a block diagram of a processing element in the encryption chip of Figure 2.
• Figure 4 illustrates a preferred chip layout of the circuitry of Figures 2 and 3.
• Figure 5 illustrates the processing element of Figure 3 redrawn to correspond to the layout of Figure 4 and to illustrate the PE local bus and global bus connections .
• Figure 6 illustrates an adder circuit used in the PK ALU of Figure 2.
• Figure 7 illustrates a full adder symbol used in a multiplier of the PK ALU.
• Figure 8 illustrates processing in the first stage of a 4 x 4 multiplier using full adders.
• Figure 9 illustrates three stages of the 4 x 4 multiplier.
• Figure 10 illustrates the adders of a wide multiplier with the adders of the 4 x 4 multiplier overlaid thereon.
• Figure 11 is a block diagram of a 4 x 4 multiplier adapted to be concatenated with like multipliers in a wide word length multiplier of Figure 10.
• Figure 12 illustrates a conventional implementation of an 8 -bit adder using full adders.
• Figure 13 is a conventional implementation of a carry lookahead adder.
• Figure 14 is a block diagram illustration of a DES encryption round.
• Figures 15A-D are functional diagrams illustrating modular add, subtract, adjust and combination of all three operations according to embodiments of the present invention.
• the encryption chip of the present invention may be programmed to perform common data encryption and decryption algorithms on one or more data streams in any application.
• the principal purpose of the encryption chip is to perform high speed data encryption using algorithms that are expected to be in use on the Internet, at data rates of 100-2000 Mbps .
• Example applications are illustrated in Figures 1A and IB.
• data from a source 22 is encrypted in an encryption chip 24 before the data is passed into a public network 26.
• the data is then decrypted in encryption chip 28 before being forwarded to a destination 30.
• the source and the destination are themselves networks such as local area networks. In that case, the encryption chips provide a secure path between the local area networks and the public network 26.
• DES Three main secret -key block encryption algorithms are in common use today: DES, RC5 and IDEA.
• the first two algorithms are standard Internet Protocol SECurity IPSEC standard algorithms.
• IDEA is the algorithm used by PGP, a popular email encryption program.
• each round is a sequence of operations in an encryption algorithm. Anywhere from 8-32 rounds are required to completely implement an encryption algorithm.
• the operations performed by each round are often the same, although they need not be.
• each round is implemented with a few machine instructions .
• each round is implemented with dedicated circuitry.
• the hardware is typically pipelined, with each round being implemented in its own pipeline stage.
• Figure 2 illustrates an integrated chip solution, henceforth referred to as the encryption chip, according to an embodiment of the present invention.
• the encryption chip implies the chip can perform encryption, it should be noted that the chip is also designed to perform decryption and message digest functions as well.
• the input stage converts the serial data stream to block-aligned data suitable for processing as an input to an encryption/decryption pipeline.
• the size of the input blocks is programmable.
• the pipeline is made up of a plurality of processing elements 37 arranged in a linear array, each containing an instruction memory, a register file, an ALU, local and shared data memory, and control circuitry. Each of the processing elements is designed to process 32-bit wide data words.
• the encrypted data is taken from the last processing element in the pipeline into an output stage 42, which converts the block data back into a serial stream format and forwards the data over the network or to a local destination.
• Data can be transferred among non-adjacent processing elements and/or other elements within the encryption ship via a global data bus 38.
• I/O communication logic 54 which allows communication with a host CPU (not shown) . Host CPU communication is required to program the encryption chip prior to use.
• Global random access memory (RAM) 44 is also connected to the global data bus 38, allowing global communication among the processing elements.
• a control CPU 52 synchronizes the operations of the encryption pipeline processors. This CPU may be implemented using any available embedded CPU core such as MIPS, ARM or ARC.
• a public-key (PK) core processor 46 is connected to the control CPU 52.
• the PK core includes a register file 48 consisting of 8-16 512-bit wide registers as well as a PK ALU 50.
• the PK core processor can make data transfers to and from the global RAM 44 over a 512 -bit bus in one system clock cycle. 512 -bit operands are processed in the ALU 50, typically in 2-32 clock cycles.
• the PK core ALU 50 is a coprocessor controlled by the control CPU 52, performing only arithmetic and logic operations along with loads and stores. Other instructions necessary for implementing PK algorithms can be executed within the control CPU 52.
• the encryption chip implements the code for each round of a secret key algorithm in a separate processing element of the pipeline. Once computed upon, data from one PE is transferred to the next PE where the next round is implemented. The first PE is then free to process an encryption round for the next block of data coming in. The pipeline process continues for the remaining PE's. The time required to encrypt a block using this architecture is therefore equal to the time required to encrypt one round.
• the basic application of a block algorithm transforms a block of plaintext (unencrypted information) into a similar-sized block of ciphertext (encrypted information) and vice-versa.
• This operating mode is known as electronic codebook (ECB) mode. Due to its many inherent security weaknesses, methods of introducing feedback into the encryption by cycling some of the basic output back into the input are commonly used.
• the encryption chip uses the global data bus 38 to perform cipher feedback (CFB) .
• CFB cipher feedback
• ECB mode a new block of data can be encrypted once per pipeline cycle, which can be 10-100 instructions.
• CFB mode each datum must pass through the pipeline multiple times. This mode substantially reduces throughput on a single channel.
• peak performance can be achieved by encrypting multiple data channels, interleaved in the pipeline.
• FIG. 3 A block diagram of one individual processing element PE according to an embodiment of the present invention is shown in Figure 3.
• the processing element 37 consists of an ALU 56 operating on 32 -bit words from a register file 58 made up of 8-16 32-bit registers.
• the register file 58 and ALU 56 are controlled by a control unit 60 which decodes instructions from a processing element instruction memory 62.
• Each processing element instruction memory stores at least one round of an encryption algorithm, where a round is defined as a sequence of instructions in an encryption algorithm.
• the PE data memory space accessible by each processing element is divided into four areas: a local PE memory 64 (in Figure 3, designated as PE n local memory) , a shared memory 66 (in Figure 3, designated as PE n n _ x shared memory shared between the n-th and n-l-th processing element) , and a second shared memory 68 (in Figure 3, designated as PE n+l n shared memory shared between the n+l-st and n-th processing element) , and the global memory 44 as described with reference to Figure 2, which is accessible to all PEs . All of these memories are mapped into the address space of a processing element, say the n-th processing element. No special instructions are required to access any type of memory; all memories are accessible by all memory access instructions .
• the memories 66 and 68 of a processing element are dual port SRAMs and are shared with the PE of the previous and next pipe stage, respectively. Note that a PE ' s next-neighbor memory is the same as the next PE ' s previous-neighbor memory.
• the global memory 44 is connected to the global communication bus. Only one processing element is allowed to access the global memory 44 at any one time. This memory is used to pass data between non-adjacent processing elements, for example, during feedback encryption algorithms and can serve as supplemental storage for individual processing elements.
• the PE instruction memory 62 has an instruction set resembling that of a modern RISC processor integer unit. The instruction set is more or less orthogonal in that any register can be used as an operand to any instruction. No floating-point or memory management support need be provided, since neither are useful in encryption. However, the instruction set contains the following useful enhancements: a modular addition/subtraction instruction, a modular multiplication instruction and a modulo adjust instruction.
• the modular addition/subtraction instruction computes A ⁇ B mod N (the number "M mod N" is the remainder when M is divided by N) .
• Figures 15A through 15D illustrate the combination of the modular add, subtract and adjust into one 3-in-l modulo arithmetic unit .
• Figure 15A illustrates the modular add operation. If the two numbers to be added, A and B, are both less than N, then their sum from adder 120 can be reduced modulo N by subtracting N in subtractor 122, and then selecting through the multiplexer 124 either the output of the subtractor or the original number, depending on the sign of the difference.
• Figure 15C computes M mod N, given that M is either a sum or a difference of A and B, both already reduced to mod N. If M is negative, the logic 132 causes adder/subtractor 134 to add N to M to produce the result through multiplexor 136. If M is positive, then logic 132 causes subtraction of N, and returns the difference if it is positive or M if the difference is negative. This instruction may be used in conjunction with sum and difference instructions to render the modular addition/subtraction instruction unnecessary.
• the 3-in-l arithmetic unit combines the modulo add, modulo subtract and modulo adjust into a single unit which is implemented within each processing element.
• adder/subtractor 138 serves the function of either of devices 120 and 128, and adder/subtractor 140 serves the function of any of devices 122, 126 and 134.
• Multiplexor 142 corresponds to devices 124, 130 and 136.
• M is applied to the A input and the B input is set at zero.
• This combined unit is most efficient in area at the cost of speed.
• This combined unit is also useful in implementing Montgomery's method for modular multiplication without trial division, "Modular Multiplication Without Trial Division," by Peter L. Montgomery, Mathematics of Computation, Vol. 44, No. 170, April 1985, pages 519-521.
• the modular multiplication instruction computes A*B mod N.
• the multiplier used for this instruction will be described in more detail below.
• the encryption chip provides a full modular multiply instruction, for reasons which will become clear below.
• Table 1 gives a representative sample of the instruction set of the PEs to be used in subsequent examples. Other conventional RISC instructions may also be implemented.
• FIG. 4 A general layout of the encryption chip is illustrated in Figure 4, assuming 16 processing elements and a 512 -bit wide public key PK core unit.
• the PK core word width of 512 bits was chosen due to its layout convenience. A width of 1024 bits for example, would require more silicon area but would also double performance .
• the individual elements can be compared to the elements of Figures 2 and 3. Sixteen of the processing elements are linearly arranged in a column in the large region of the layout to the lower left, one being shown in detail.
• the shared multiplier element 70 is shown associated with the illustrated processing element. As previously described, a 32x32 multiplier segment 70 is associated with each processing element for performing 32 -b it multiplications within the respective processing elements. Alternatively, the multiplier elements 70 can be concatenated to serve as a wide 512x32 bit multiplier for the public-key ALU 50.
• the public-key PK ALU 50 is located to the right of the secret-key SK elements, made up of the processing elements as described above.
• the PK register file 48 Next to the PK ALU is the PK register file 48. Together, the PK ALU 50 and the PK register file 48 make up the PK processing core, identified in Figure 2 as 46. To the right of the PK core is located the global memory (RAM)
• the global data bus 38 links the SK elements, the PK core 46, the global RAM 44, the communication logic 54 and the control CPU 52.
• FIG. 5 The layout of a typical processing element with the local bus connections is shown in Figure 5. All components of a processing element may communicate via a local processing element data bus 72, which handles all the memory - register transfers. Note that the next- neighbor shared PE memory 68 is laid out in line with the other elements of the illustrated processing element, whereas, the previous -neighbor shared PE memory 66 is laid out in line with the elements of the previous-neighbor processing element. For programming and testing purposes, all PE memories are accessible from the global bus 38. A switch 74 normally disconnects the local bus 72 from the global bus 38 but may be selectively closed to enable data transfer between the local RAM 64 and the global RAM 44.
• Another switch 76 allows the local bus 72 to be segmented into independent segments such that the control unit 60 can read instructions from the RAM 62 simultaneously with transfer of data on the bus 72. As such, operations within the processing element may be pipelined with one instruction being processed in the control unit while a prior instruction is executed in the PE ALU 56. During execution of encryption code, switches 74 and 76 are normally open, so that instruction fetches from the instruction RAM may proceed concurrently with data fetches from the data memories and register file. Many multiprocessor architectures have been proposed. Most of them are designed for general -purpose multiprocessing, so communication between processing elements is usually done using a switching matrix that can be dynamically configured to switch data from any one PE to any other. These switch designs are extremely complex.
• an embodiment of the present invention uses a simpler linear arrangement of the PEs with much less switching circuitry.
• the use of shared memory as the interconnect technique rather than I/O ports as documented in the literature produces a much simpler and more powerful programming model.
• a and B are connected with a single 32-bit I/O port. In order for A to transfer multiple words of data to B, A must write each word to the I/O port and wait for B to read it.
• a and B are connected by a shared memory large enough to hold all words of the communication, then A may write out its data without waiting for B to read any.
• PE B has the freedom to read the words out in any order, or to pick and choose from the data as required by the job at hand.
• some of the shared memory is not required for communication, then it may be used as an extension of the local memory to provide additional local work space.
• Efficient public-key encryption requires efficient modular exponentiation, provided by the public-key coprocessor.
• This unit comprises the following items:
• PK register file 48 consisting of 16 512-bit wide registers
• PK 512x32-bit multiplier 70 made up of concatenated SK multiplier elements (this unit can perform a 512x512 multiply in only 32 clock cycles)
• PK 512 -bit adder ALU 50 which can perform addition in 2-16 cycles, typically no more than 2
• the PK core processor accelerates modular multiplication by performing it using 512 -bit words.
• a 512x512 multiply operation using the PK unit of the invention would be implemented by performing 16 512x32 multiplies using the concatenated multiplier elements of the 16 processing elements described below. Assuming each multiply requires 2 clock cycles and 16 such multiplies are required, a 512x512 multiply would require 32 clock cycles and a 2048x2048 multiply would require only 512 clock cycles. The full modular exponentiation operation, requiring 4096 multiplies, would take a total of 2 million clock cycles. This represents an 80 fold improvement to the Pentium example discussed earlier. The performance improvement of PK algorithms is expected to be similar. This represents a significant performance gain compared to the prior art, and will enable more frequent changing of session keys, thereby increasing security.
• Adders are not shared between the public key PK and secret key SK units. Rather, since addition and logic operations are common for both PK and SK, each unit has its own adder, so that operations may proceed concurrently.
• a 512 -bit single cycle adder would be extremely complex and would add substantially to the critical path time of the ALU.
• the 512 -bit adder in the ALU 50 is formed of 16 32-bit adders as illustrated in Figure 6.
• the AND-gate 78 and multiplexer 80 initially apply two 32 -bit operand segments to each of the 32 -bit adders A0-A15. Note that the AND-gate 78 represents a
• Each 32 -bit adder computes a 32- bit sum along with a carry output .
• the carry output of one adder is connected through a D flip-flop 79 to the carry input of the next. If a carry is generated in the first cycle, then it is clocked into the flip-flop where it is available as a carry input for the next clock cycle.
• Each sum is returned to one input of the same adder through a D flip-flop 81 and multiplexer 80; the other input of the adder is held at zero using the AND gate 78 during successive clock cycles.
• the step of adding back the sum as a carry input for each adder is repeated as long as any carry results at the output of any of the 32 -bit adders.
• a 512 -bit adder is composed of 32 -bit adders, whose design is well-known today and has been well optimized.
• the maximum clock speed of an individual 32 -bit adder is expected to be more than twice that of a 512 -bit carry lookahead design.
• the two-or-more cycle adder according to the invention would on average operate faster than a large 512-bit adder, while consuming less chip area.
• Multipliers are large in area. Each secret -key processing element must contain its own multiplier in order to implement any secret key algorithm requiring multiplication, for example IDEA which will be discussed in more detail below.
• the area taken by each PE multiplier collectively is significant and as a result, use of this area is made in implementing the 512x32 -bit public key multiplier.
• the large 512x32 multiplier is implemented by concatenating the 16 32x32 multipliers in each secret key processing element.
• the secret and public key units can share the multiplier elements, as is illustrated in the layout of the chip in Figure 4.
• multiplier elements Use of the multiplier elements must therefore be coordinated between the secret key processing elements and the PK core processor since the PK core processor cannot perform a multiply operation when any one of the secret key processing elements is itself independently performing a multiply operation.
• a simple design of a combination 4x4/4xN multiplier is illustrated below. Note that more advanced techniques of multiplier design such as Booth encoding and 4:2 compressors are available. The following example provides a simple presentation:
• Single-digit multiplication can be easily implemented by using an AND gate.
• the result, when using two 4 -bit operands, consists of 16 bits of partial product. These partial products must be added together efficiently.
• the partial products could, for example, be added using two 4-bit and one 6-bit full adder, but they would take a substantial time to perform the addition of the partial products, since the carry may have to propagate through several adders. The overall result of such an adder implementation would be too slow.
• a better approach would consist of an adder whose carry has to go through fewer stages .
• the basic component of the preferred multiplier is a full adder, a circuit that takes three inputs and outputs the two-bit sum of their inputs.
• a full adder is illustrated using the symbol in Figure 7.
• the use of squares instead of binary numbers is for generality and convenience.
• the three squares at the top show the three inputs of the full adder.
• the two squares at the bottom show the sum and carry outputs .
• the carry is to the lower left to indicate its place value is twice that of the sum.
• the first stage of the addition of a 4x4 multiplier is illustrated in Figure 8.
• 16 squares some shown in black, some as white boxes, represent the bits of a partial product which has to be added.
• the bits shown in black will be added in the first stage using four full adders 82.
• the bits shown as white boxes are not to be added in the first stage, but simply transferred down as shown with the arrows in Figure 8, in preparation for the next addition stage.
• the sum of the adders in the first stage is shown below the summing line.
• the second stage is shown in Figure 9. Arrows once again indicate bits which are not operated on during this current stage and simply transferred down, while black boxes denote bits that are to be added in this current (second) stage.
• black boxes denote bits that are to be added in this current (second) stage.
• four full adders 84 are used to add the black box elements.
• a comparison of the performance of various adder and multiplier architectures helps to illustrate the advantages of the multiplier according to the present invention.
• a naive implementation of a 4 -bit adder consists of four full adders A0-A3 in series as shown in Figure 12.
• the carry out C out of the rightmost adder could potentially affect every one of the adder stages to the left of it.
• the critical path in this design is therefore four adder stages. Since the typical full adder consists of two or more logic stages, the total gate delay of an four-bit adder could exceed 8 stages.
• An improved four-bit adder is a carry lookahead design.
• a three-bit carry lookahead adder is shown in Figure 13.
• a four-bit design is only a little more complex.
• a detailed discussion of operation of the AND gates 102, OR gates 104 and Exclusive-OR gates 106 is not presented since this is a well known circuit.
• the advantage of a carry lookahead adder is that carries propagate to final sum bits in only four logic gates. More complex designs for wider numbers have more stages of logic, but they are still faster than a carry chain design.
• the carry save design creates a critical path through two full adders, plus the final carry lookahead adder.
• An implementation using only full adders would have a longer critical path since a naive adder using chained carries is slower than the carry lookahead adder.
• the resulting multiplier would again be slower, since carry lookahead adders are slower than individual full adders. Note that the multiplier design according to the present invention never propagates a carry from one adder to another at the same partial product level. In this manner, the critical path through the multiplier is sure to include no more than two full adders in the first two stages of partial product summation.
• Figure 10 illustrates a much wider 4xN multiplier.
• the large black boxes 82, 84,86 denote the same full adder hardware that was used in Figure 9. Note that full adders are necessary in this case, since in each circumstance, three inputs are being added together. In Figure 9, simpler circuitry could have been used since not all circumstances required the addition of three inputs. However, in order to create a system which can handle a 4xN case, full adders are preferably used for all stages with some additional circuitry to determine how to treat a case with fewer than three inputs . Dual mode adders are therefore created, some having a multiplexer feeding one of their inputs to select between the output of a previous stage or a single bit partial product.
• FIG 11 illustrates the full adders A required to implement the boxed regions 82,84,86 of Figure 10 with respective carry outputs at the lower left.
• each adder A is a full adder. Some of the adders have only two inputs in the 4x4 case
• adders i.e. the secret key case
• 4xN case i.e. the public key case
• the two input adders must have their third input gated with an enable signal.
• Some adders also require a multiplexer to provide one of their inputs to select between the output of a previous stage or a single-bit partial product.
• the carry- lookahead adder 86 on the bottom requires a carry-out every four positions to generate the last bit of the product in the 4x4 case.
• D' is the neighboring (either to the left or to the right) equivalent of D.
• the 8-bit final sum is indicated as S7 , S6 , S5 , S4 , S3 , S2 , SI , SO and the three lower-order bits of the left-hand neighbor's sum are S2',S1',S0'.
• the 2:1 multiplexer 88 has a selection signal Sel. In general, if Sel is logic 1, then the left input is passed to the output of the multiplexer; otherwise, if Sel is logic 0, the right input is passed to the output of the multiplexer. The Sel signal is also used to gate the AND gates 90.
• RC5 is perhaps one of the simplest encryption algorithms to implement. It basically utilizes three types of operations: XOR, additions and rotations, all supportable by any one of the processing elements discussed above, as shown in Table 1. Although RC5 has a variable length block, most commonly, each round of the RC5 algorithm operates on a 64 -bit data block plus a key value stored in Sil and Si2 which are constants within each processing element, depending only on the round and the key.
• a 64 -bit input block is split into two 32 -bit words which are then stored in locations A and B in the previous-neighbor memory, the output block is to be written to A_next and B_next in the next-neighbor memory.
• An example of a round of the RC5 encryption algorithm follows: Loop : load rl, A xor rl , B rol rl , B add rl, Sil store rl , A_next load r2, B xor r2 , r2 , rl rol r2 , r2 , rl add r2, Si2 store r2 , B_next sync Loop
• each round requires 11 clock cycles. If the encryption chip is designed using a logic process that can run up to 400 MHZ, then 36 million blocks can be encrypted per second, or 288 MB/s in ECB mode. If we assume 12 rounds (a typical case for RC5) , then compared to a conventional CPU running at the same clock speed, the concurrent execution of multiple PEs according to an embodiment of the present invention results in a 12-fold performance improvement over the conventional software implementation.
• IDEA is one of the most secure block algorithms available and has a substantially more complex structure. It operates on 64 -bit plaintext blocks. A 128-bit key is used. The same algorithm is used both for encryption and decryption. The main philosophy of the algorithm is to mix operations from different algebraic groups, operations such as XOR, addition modulo 2 l ⁇ , and multiplication modulo 2 16 +1. These operations are used to operate on 16-bit blocks.
• IDEA therefore makes use of both modular multiplication and addition, which are expensive operations in software.
• the multiplication is complicated by IDEA'S treatment of zero: in a multiply, a zero is interpreted as (-1) modulo 65537. Assuming that the value 65537 has been pre-loaded into register r8 of the processing element's register file, and that register rO contains zero, the following multiplication macro is presented for illustrative purposes:
• MACRO MMULT (A, B, RESULT)
• Each round of IDEA consists of modular multiplications, modular addition and exclusive-OR.
• the 128-bit key is broken down into subkeys .
• Each processing element's subkey is a function solely of the key and the processing element, and therefore can be computed in advance and stored in the PE.
• the plaintext input to IDEA consists of four 16-bit sub-blocks XI through X4 , as indicated earlier.
• Each round uses six subkeys Kl through K6 , and can be coded as follows:
• the encryption chip hardware implementation accelerates the execution by a factor of eight or more. Additional acceleration is provided by the modular multiply instruction which is not available on most microprocessors. The above code requires roughly 50 clock cycles to perform one round.
• the encryption chip can encrypt with IDEA at a rate of 64 MB/s, about three times faster than a 25 MHZ hardware implementation developed at ETH University in Zurich.
• DES Data Encryption Standard
• DES is also a block cipher encrypting data in 64 -bit blocks.
• a 64 -bit block of plaintext is the input and a 64 -bit ciphertext is the output.
• both encryption and decryption use the same algorithm, making DES a symmetrical algorithm.
• DES creates subkeys from a single key, in this case 56 bits. The subkeys are a function of the PE and the 56- bit key, so they can be computed in advance.
• the basic concept behind DES consists of a substitution followed by a permutation on the text based on the key.
• the following operations make up the core of DES: • Expansion: The 64 -bit block is divided into two 32- bit pieces 108,110. One piece is unaffected by the encryption. (The pieces are operated on every other round.) The piece that is affected is divided into eight groups of four bits. Each group is expanded by copying the two bits adjacent to it.
• Each expanded group is XOR ' ed at 112 with a subkey.
• the six-bit result of the XOR is used to index a 64- entry x 4-bit lookup table 114 called an S-box.
• Each of the eight groups uses its own S-box.
• the output from the S-boxes is permuted at 116: the bits are scrambled. Eight outputs yield 32 bits.
• the 32 -bit output is XOR ' ed at 118 with the other 32-bit half of the block.
• the operations can be coded as follows: expansion is performed by copying the input word, and masking bits such that there are two words: one representing even- numbered S-box inputs and one representing odd-numbered S-box inputs. The two words are XOR ' ed with key information. The result is used to index the S-box lookup table. The data in each S-box is pre-permuted, so that the output of the S-box is 32 -bit data. The final value is the logical OR of all components. Sample code follows:
• This sample code requires 44 clock cycles to perform one round.
• a data rate of 72 MB/s can be achieved. This rate compares favorably with hardware implementations of DES available in the mid- 1990' s, that encrypt at rates ranging from 1-35 MB/s.
• VLSI Technology's VM007 can encrypt up to 200 MB/s.

Landscapes

• Engineering & Computer Science (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Computational Mathematics (AREA)
• Mathematical Analysis (AREA)
• Pure & Applied Mathematics (AREA)
• Mathematical Optimization (AREA)
• Theoretical Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Computing Systems (AREA)
• Mathematical Physics (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Storage Device Security (AREA)
• Advance Control (AREA)
• Complex Calculations (AREA)
• Bus Control (AREA)

Priority Applications (3)

Applications Claiming Priority (2)

Publications (2)

Family

ID=21862723

Family Applications (1)

Country Status (8)

Cited By (6)

Families Citing this family (153)

Family Cites Families (49)

• 1998
  • 1998-02-27 US US09/032,029 patent/US6088800A/en not_active Ceased
  • 1998-07-30 CA CA002244337A patent/CA2244337C/en not_active Expired - Fee Related
• 1999
  • 1999-02-26 FR FR9902446A patent/FR2778519B1/fr not_active Expired - Fee Related
  • 1999-02-26 JP JP2000533976A patent/JP3979786B2/ja not_active Expired - Fee Related
  • 1999-02-26 DE DE19983127T patent/DE19983127T1/de not_active Withdrawn
  • 1999-02-26 KR KR1020007009108A patent/KR100638189B1/ko not_active Expired - Fee Related
  • 1999-02-26 WO PCT/CA1999/000176 patent/WO1999044329A2/en not_active Ceased
  • 1999-02-26 GB GB0021091A patent/GB2350218B/en not_active Expired - Fee Related
• 2000
  • 2000-06-01 US US09/584,930 patent/US6434699B1/en not_active Expired - Lifetime
• 2006
  • 2006-07-18 JP JP2006195950A patent/JP5025180B2/ja not_active Expired - Fee Related
• 2010
  • 2010-08-26 JP JP2010189796A patent/JP5208174B2/ja not_active Expired - Fee Related
• 2012
  • 2012-09-04 US US13/603,137 patent/USRE44697E1/en not_active Expired - Lifetime

Also Published As

Similar Documents

Legal Events