The Advanced Encryption Standard (AES-Rijndael) cores for ASICs and FPGAs are available for licensing from George Mason University. The cores are based on a fully synthesizable RTL VHDL code and the GMU developers have optimized the cores for ASICs and FPGAs respectively, using techniques and figures of merit specific for these technologies. The code is fully compatible with the most recent version of the draft Federal Information Processing Standard (FIPS) published by NIST.

The GMU-AES design can be used in any application that requires protection of data during transmission through the communication network, including applications such as electronic commerce transactions, ATM machines, wireless communication, Virtual Private Networks (VPN), and many others. Our AES cores can be used as a part of the hardware or hybrid implementation of all major security protocols, including IPSec, SSL, IEEE 802.11a, and the ATM Forum Security Specification.

Features

• Support for three different key sizes specified in the NIST FIPS standard: 128, 192, and 256 bits.

Versions

Three basic versions of the hardware AES-Rijndael core have been developed.

1. Basic iterative architecture - ideal for applications with the modest speed requirements (< 500 Mbit/s for FPGA implementations), and limitations on the circuit area and power consumption. It operates equally well in all cipher modes.

This architecture executes one cipher round per each master clock period. Only one block of data is processed at a time. The number of clock cycles necessary to encrypt or decrypt a block of data is equal to the number of cipher rounds.

2. Inner-round pipelined architecture - ideal for applications with relatively high speed requirements (~ 1 Gbit/s for FPGA implementations) and limitations on the circuit area and cost.

An extension of the basic iterative architecture, in which additional pipelined registers are introduced inside of the cipher round. As a result, two blocks of data can be processed simultaneously at the increased clock frequency. The encryption and decryption throughputs almost double compared to the basic architecture, at the cost of only a small increase in the circuit area. To exploit all the features of this architecture in feedback cipher modes, such as CBC, CFB, or OFB, two independent streams of data (two different messages or packets) must be available for encryption at any point in time.

3. Fully pipelined architecture - ideal for applications with very high encryption and decryption throughputs (> 10 Gbit/s), and relaxed requirements on the circuit area, cost, or power consumption.

In this architecture, all rounds are unrolled and registers introduced between any two consecutive rounds, and inside the cipher rounds. The characteristic feature of this architecture is that in every clock cycle, the encryption/decryption of one block of data is completed.

To exploit all the features of this architecture in feedback cipher modes, such as CBC, CFB, or OFB, multiple independent streams of data must be available for encryption at any point in time.

Choice and Customization

Based on the features of the three preselected versions of the AES-Rijndael architecture, the user can choose the architecture that best matches the requirements of the intended application. These versions can be further customized to meet specific requirements of a given application.

In particular, the following features can be added or modified:

• modes of operation of a block cipher (e.g., counter mode, OCB mode),

• number of internal pipeline stages,

• separation between encryption and decryption (e.g., an encryption only or decryption only unit).

Performance

^*    No key scheduling, 128-bit key, 10 round version of the design.
^** Three XCV-1000 devices are necessary to implement this circuit.

Performance characteristics of our two architectures of AES-Rijndael, implemented using Virtex E family of Xilinx FPGA devices are given below:

 *   No key scheduling, 128-bit key, 10 round version of the design.

Comparison with results of other groups

• for the basic iterative architecture implemented using Xilinx Virtex 1000-6, compared to the next best result reported in the literature by a group from the University of Southern California, the GMU design encryption/decryption throughput is better by over 60%.

• for the fully pipelined architecture implemented using Xilinx Virtex E family of devices, compared to the next best result reported in the literature by a group from the Queen's University of Belfast, the GMU design throughput is better by a factor of 2.3 for encryption and 5.0 for decryption.

Testing and tools

The GMU AES cores have been thoroughly verified using a combination of simulation and experimental testing. First, functional verification was performed using Aldec Active-HDL and the Monte Carlo test. Second, the designs were processed using Xilinx tools for logic synthesis, mapping, placing and routing. These tools generated reports describing the area of implementations, a netlist used for timing simulations, and a bitstream used to configure actual FPGA devices. The maximum clock frequency was obtained using static timing analysis and confirmed using timing simulation. Finally, selected designs were tested experimentally using the SLAAC-1V FPGA accelerator board developed by the University of Southern California Information Sciences Institute (shown in the photograph below).

 

 

 

• Fully synthesizable RTL VHDL code or FPGA target specific netlist
   

• VHDL testbench
   

• Description of tests, and results of static timing analysis and experimental testing for selected target FPGA devices
   

• User documentation with a full description of the external interface.

Cores for other ciphers

• DES

• Triple DES

• Mars

• RC6

• Twofish

• Serpent.