Lecture 2B

RTL Design Methodology

Transition from

Pseudocode & Interface

to a Corresponding Block Diagram

Structure of a Typical Digital System

Datapath(Execution

Unit)

Controller(Control

Unit)

Data Inputs

Data Outputs

Control & Status Inputs

Control & Status Outputs

Control Signals

StatusSignals

Hardware Design with RTL VHDL

Pseudocode

Datapath Controller

Block

diagram

ASM

chart

VHDL code VHDL code

Interface

1. Text description2. Interface3. Pseudocode4. Block diagram of the Datapath5. Interface divided into Datapath and Controller6. ASM chart of the Controller

7. RTL VHDL code of the Datapath, Controller, and Top-level Unit

8. Testbench for the Datapath, Controller, and Top-Level Unit

9. Functional simulation and debugging10. Synthesis and post-synthesis simulation11. Implementation and timing simulation12. Experimental testing using FPGA board

Steps of the Design ProcessIntroduced in Class Today

4

Class Exercise 2

CIPHER

PseudocodeSplit input I into four words, I3, I2, I1, I0, of the size of w bits each

A = I3; B = I2; C = I1; D=I0B = B + S[0]D = D + S[1] for i = 1 to r do { T = (B*(2B + 1)) <<< k U = (D*(2D + 1)) <<< k A = ((A T) <<< U) + S[2i]⊕ C = ((C U) <<< T) + S[2i + 1] ⊕ (A, B, C, D) = (B, C, D, A) }A = A + S[2r + 2]C = C + S[2r + 3]O = (A, B, C, D)

Notation

w: word size, e.g., w=8 (constant)

k: log2(w) (constant)

A, B, C, D, U, T: w-bit variables

I3, I2, I1, I0: Four w-bit words of the input I

r: number of rounds (constant)

O: output of the size of 4w bits

S[j] : 2r+4 round keys stored in two RAMs.

Each key is a w-bit word.

The first RAM stores values of S[j=2i], i.e., only round keys

with even indices. The second memory stores values of

S[j=2i+1], i.e., only round keys with odd indices.

Operations

⊕ : XOR

+ : addition modulo 2w

– : subtraction modulo 2w

* : multiplication modulo 2w

X <<< Y : rotation of X to the left by the number of positions

given in Y

X >>> Y : rotation of X to the right by the number of positions

given in Y

(A, B, C, D) : Concatenation of A, B, C, and D.

4w

clk

reset

I

write_I

Sj

DONE

O

CIPHER

4w

Write_Sj

w

j m

Circuit Interface

Interface Table

Note:m is a size of index j. It is a minimum integer, such that 2m -1 2r+3.

Protocol (1)An external circuit first loads all round keys S[0], S[1], S[2], …, S[2r+2], [2r+3]to the two internal memories of the CIPHER unit.

The first memory stores values of S[j=2i], i.e., only round keys with even indices. The second memory stores values of S[j=2i+1], i.e. only round keys with odd indices.

Loading round keys is performed using inputs: Sj, j, write_Sj, clk.

Then, the external circuits, loads an input block I to the CIPHER unit, using inputs: I, write_I, clk.

After the input block I is loaded to the CIPHER unit, the encryption starts automatically.

Protocol (2)

When the encryption is completed, signal DONE becomes active, and the output O changes to the new value of the ciphertext.

The output O keeps the last value of the ciphertext at the output, until the next encryption is completed. Before the first encryption is completed, this output should be equal to zero.

Assumptions

• 2r+4 clock cycles are used to load round keys to internal RAMs

• one round of the main for loop of the pseudocode executes in one clock cycle

• you can access only one position of each internal memory of round keys per clock cycle

As a result, the encryption of a single input block I

should last r+2 clock cycles.

Initial Transformation

Final Transformation

#rounds times

Round Key[i]

i:=i+1

Round Key[0]

i:=1

i<#rounds?

Cipher Round

Round Key[#rounds+1]

Typical Internal Structure of a Secret-Key Block Cipher

Basic iterative architecture(no Initial Transformation, no Final Transformation)

register

combinationallogic

one round

multiplexer

round key

input

output

IN

OUT

P1

C1

P2

C2

P3

Basic architecture: Timing

#rounds · clock_period

CLK

Primary parameters of hardware implementationsof secret-key block ciphers

Latency Throughput

Encryption/decryption

Time to encrypt/decrypt

a single block of data

Mi

Ci

Number of bits encrypted/decrypted

in a unit of time

Encryption/decryption

Mi

Mi+1

Mi+2

Ci

Ci+1

Ci+2

Advanced Encryption StandardAES

AES Encryption

AES Decryption

SubBytes&

InvSubBytes

ShiftRows

MixColumns

InvShiftRows

InvMixColumns

round key

round key

round key

round key

Data input

Data output

Encryption circuit Decryption circuit

R1

Basic Iterative Architecture of AES(Encryption and Decryption)

Encryption round Decryption round

Data input

Data output

round key

Encryption input

Decryption input

Encryptionfeedbackoutput

Encryptionfinaloutput

Decryptionfinaloutput

Decryptionfeedbackoutput

round key

round key

Initial Transformation

keyscheduling

encryption/decryption

memory of round keys

output

input

input interface

output interface

Control unit

control

Top Level Block Diagram

key

Modes of Operation

Block vs. stream ciphers

Stream cipher

Internal state - ISBlock cipher

KK

M1, M2, …, Mn m1, m2, …, mn

C1, C2, …, Cn c1, c2, …, cn

Ci=fK(Mi) ci = fK(mi, ISi) ISi+1=gK(mi, ISi)

Every block of ciphertext is a function of only one

corresponding block of plaintext

Every block of ciphertext is a function of the current block

of plaintext and the current internal state of the cipher

Typical stream cipher

Sender Receiver

PseudorandomKeyGenerator

mi

plaintext

ci

ciphertext

kikeystream

keyinitialization vector (seed)

PseudorandomKeyGenerator

mi

plaintext

ci

ciphertext

ki keystream

key initializationvector (seed)

Standard modes of operation of block ciphers

Block cipher Block cipherturned into

a stream ciphers

ECB mode Counter modeCFB modeCBC mode

ECB (Electronic CodeBook) mode

Electronic CodeBook Mode – ECBEncryption

M1 M2 M3

E

Ci = EK(Mi) for i=1..N

MN-1 MN

E E E E. . .

C1 C2 C3 CN-1 CN

K K K K K

Electronic CodeBook Mode – ECBDecryption

C1 C2 C3

D

Ci = EK(Mi) for i=1..N

CN-1 CN

D D D D. . .

M1 M2 M3 MN-1 MN

K K K K K

Counter Mode

Counter Mode - CTREncryption

m1m2 m3

E

ci = mi ki

ki = EK(IV+i-1) for i=1..N

mN-1 mN

. . .

E E E E. . .

c1 c2 c3 cN-1 cN

IV IV+1 IV+2 IV+N-2 IV+N-1

k1k2 k3

kN-1 kN

K K K K K

Counter Mode - CTRDecryption

c1c2 c3

E

mi = ci ki

ki = EK(IV+i-1) for i=1..N

cN-1 cN

. . .

E E E E. . .

m1 m2 m3 mN-1 mN

IV IV+1 IV+2 IV+N-2 IV+N-1

k1k2 k3

kN-1 kN

K K K K K

Counter Mode – CTR(simplified block diagram)

EK

IN

OUT

counter

IV

ci

mi

EK

IN

OUT

counter

IV

ci

mi

IS1 = IV

ci = EK(ISi) mi

ISi+1 = ISi+1

ISi ISi

Counter Mode – Potential for Parallel Processing

M0 M1 M2

E

Ci = Mi AES(IV+i) for i=0..N

MN-1 MN

. . .

E E E E. . .

C1 C2 C3 CN-1 CN

IV IV+1 IV+2 IV+N-1 IV+N

Increasing speed by parallel processing

Encryption/decryption

unit

Encryption/decryption

unit

Encryption/decryption

unit

Encryption/decryption

unit

Encryption/decryption

unit

Encryption/decryption

unit

Increasing speed using pipelining

Cipher 1 Cipher 2

round 1round 1

round 2

round 10

. . .

round 16

. . .

Throughput =target_clock_period

block size

targetclock period,e.g., 20 ns

CFB (Cipher FeedBack) Mode

Cipher Feedback Mode - CFBEncryption

m1 m2 m3

E

mN-1 mN

. . .

E E E E. . .

c1 c2 c3 cN-1 cN

IV

ci = mi ki

ki =EK(ci-1) for i=1..N, and c0 = IV

k1 k2 k3 kN-1kN

Cipher Feedback Mode - CFBDecryption

m1 m2 m3

E

mN-1 mN

. . .

E E E E. . .

c1 c2 c3 cN-1 cN

IV

mi = ci ki

ki =EK(ci-1) for i=1..N, and c0 = IV

k1 k2 k3 kN-1kN

Cipher Feedback Mode – CFB(simplified block diagram)

EK

IN

OUT

ci

mi

EK

IN

OUT

ci

mi

IV

IS1 = IV

ci = EK(ISi) mi

ISi+1 = ci

IV

ISi ISi

register register

CBC (Cipher Block Chaining) Mode

Cipher Block Chaining Mode - CBCEncryption

m1 m2 m3

E

IV

ci = EK(mi ci-1) for i=1..N c0=IV

mN-1 mN

. . .

E E E E. . .

c1 c2 c3cN-1

cN

Cipher Block Chaining Mode - CBCDecryption

mi = DK(ci) ci-1 for i=1..N c0=IV

m1 m2 m3 mN-1 mN

IV . . .

D D D D D. . .

c1 c2 c3cN-1

cN