This paper presents efficient hardware architectures for the Advanced Encryption Standard (AES) cipher supporting AES-128, AES-192, and AES-256 with On-The-Fly (OTF) key expansion units. The new designs feature low-area, low-latency OTF key expansion units that generate round keys concurrently with the data path, eliminating the need for key storage and reducing hardware overhead. By sharing logic within the key expansion circuitry, the proposed design achieves a 46% reduction in XOR gate count compared to previous works.To optimize the architecture, we analyzed eight state-of-the-art AES S-box designs and evaluated their ASIC implementation results. Four S-boxes were selected for integration, including the most compact and the fastest designs reported in the literature. ASIC synthesis results of the AES-128 architecture shows superior performance, with the fastest design achieving 29%-79% lower Area-Delay-Power Product (ADPP) than prior designs when synthesized using the same standard cell library to ensure a fair comparison.To support AES-192 and AES-256, we scaled the architecture by designing corresponding OTF key expansion units, while keeping the proposed AES-128 data path unchanged. The number of rounds was increased to 12 and 14, respectively. ASIC synthesis shows a proportional increase in ADPP for larger key sizes. Despite the higher hardware cost and reduced throughput for larger key sizes, the Fast architecture consistently delivers the highest performance and lowest ADPP, while the compact architecture minimizes area and power consumption. These results demonstrate flexible design trade-offs suitable for both high-performance and resource-constrained cryptographic applications.

Previous works to secure IoT devices have mainly focused on 8-bit hardware architectures for AES encryption. In this paper, we present a new 16-bit ASIC design for AES encryption optimized for IoT systems. Our design includes a new 16-bit key derivation circuit that generates keys dynamically in parallel with the datapath, enhancing security by avoiding key exposure and protecting against existing attacks. Our design employs column-wise byte ordering for both the datapath and key derivation, eliminating the need for external reordering and reducing hardware resource usage. Additionally, we design a lightweight 16-bit serial MixColumns circuit that supports higher data rates compared to existing designs. ASIC implementation results using a 65nm CMOS technology library demonstrate a 50% increase in throughput with a 21% increase in area over previous 8-bit based designs. Our lightweight and fast AES ASIC design offers a tailored solution for securing IoT systems.

Exponentiation in finite fields is an essential operation used in many applications ranging from error control coding to cryptographic computations, while representation in Gaussian normal basis (GNB) offers low complexity arithmetic, especially in hardware architectures. In this article, we propose several new hardware architectures for binary exponentiation in GNB. The proposed architectures make use of different levels of precomputation and the efficient digit-level parallel-in parallel-out, and hybrid-double multipliers. We support our new designs with novel countermeasures against side-channel analysis that require minimal implementation overhead. Moreover, we obtain implementation results for all architectures and provide realistic and fair comparisons with the previously known works available in the literature. It is shown that our newly proposed architectures outperform the existing hardware architectures in terms of area and time complexities and security.

In this paper, we propose a very fast, yet compact, AES S-box, by applying two techniques to a composite field$GF((2^{4})^{2})$fast AES S-box. The composite field fast S-box has three main components, namely the input transformation matrix, the inversion circuit, and the output transformation matrix. The core inversion circuit computes the multiplicative inverse over the composite field$GF((2^{4})^{2})$and consists of three arithmetic blocks over subfield$GF(2^{{4}})$, namely exponentiation, subfield inverter, and output multipliers. For the first technique, we consider multiplication of the input of the composite field fast S-box by 255 nonzero 8-bit binary field elements. The multiplication constant increases the variety of the input and output transformation matrices of the S-box by a factor of 255, hence increasing the search space of the logic minimization algorithm correspondingly. For the second technique, we reduce the delay of the composite field fast S-box, by combining the output multipliers and the output transformation matrix. Moreover, we modify the architecture of the input transformation matrix and re-design the exponentiation block and the subfield inverter for lower delay and area. We find that 8 unique binary transformation matrices could be used to change from the binary field$GF(2^{8})$to the composite field$GF(({2}^{{4}})^{2})$at the input of the composite field S-box. We use Matla$\mathbf{b}$® to derive all$(255\times 8=2040)$new input transformation matrices. We search the matrices for the fastest and lowest complexity implementation and the minimal one is selected for the proposed fast S-box. The proposed fast S-box is 24% faster (with 5% increase in area) than the composite field fast design and 10% faster (with about 1% increase in area) than the fastest S-box available in the literature, to the best of our knowledge.

The implementation of AES S-boxes is one of the most extensively studied areas of cryptography. In this paper, we propose three new hardware designs for the AES S-box that can serve in the forward, inverse and combined data paths. Each of these designs represents the smallest AES S-box ever proposed in its respective category. We achieve this goal by using new tower field representation over normal bases and optimizing each and every block inside the three proposed architectures. Our complexity analysis and ASIC synthesis results in the CMOS STM 65 nm, as well as the NanGate 15 nm technologies, show that our designs outperform their counterparts in terms of area and power.

The multiplicative inverse over binary fields is one of main arithmetic operations used in cryptography. This paper presents two new inversion architectures. First, an improved architecture for classic inversion scheme using single multiplier is presented. The new improved inverter achieves lower latency through loading input registers during last multiplication cycle, at the expense of higher propagation delay. After this, a novel inversion architecture which uses half the latency to process the classic-based addition chains (or improved ones) is presented. The latter architecture, named Classical-Interleaved, is constructed based on a novel fully-serial-in square-multiply processor (FSISM). The FSISM, squares one operand, and multiply it to the second one, concurrently while the two inputs are absorbed serially digit-by-digit. The new classical inverter and the new classical-interleaved inverter reduce the latency compared to other schemes. In addition, the proposed classical and interleaved inverters outperform the original Itoh-Tsujii algorithm (ITA) and Ternary Itoh-Tsujii / optimal 3-chain algorithms in terms of its higher throughput and improved hardware efficiency for a number of digit sizes. The efficiency of the proposed field inverters are demonstrated by comparisons based on application specific integrated circuits (ASIC) implementations results using the standard 65 nm CMOS technology libraries.

The AES combined S-box/inverse S-box is a single construction that is shared between the encryption and decryption data paths of the AES. The currently most compact implementation of the AES combined S-box/inverse S-box is Canright's design, introduced back in 2005. Since then, the research community has introduced several optimizations over the S-box only, however the combined S-boxlinverse S-box received little attention. In this paper, we propose a new AES combined S-boxlinverse S-box design that is both smaller and faster than Canright's design. We achieve this goal by proposing to use new tower field and optimizing each and every block inside the combined architecture for this field. Our complexity analysis and ASIC implementation results in the CMOS STM 65nm and NanGate 15nm technologies show that our design outperforms the counterparts in terms of area and speed.

Itoh and Tsujii proposed a fast algorithm for computing multiplicative inverses (inversions) over GF(2m) using normal bases by iterating single multiplications and cyclic shifts. Recently, the Itoh-Tsujii algorithm (ITA) has been modified to use two digit-level single multiplications. The improvements of the modified Itoh-Tsujii and its variant algorithms are based on reducing the computational latency at the expense of more area requirements. In this paper, we propose a new inversion architecture based on the classical IT algorithm (or improved one) utilizing a novel interleaved computations of two single multiplications and squarings at the digit-level. The new inverter outperforms previous modified Itoh-Tsujii algorithms (such as the Ternary Itoh-Tsujii and optimal 3-chain algorithms) in terms of its lower latency, higher throughput, and improved hardware efficiency. The efficiency of the proposed field inverter is demonstrated by comparisons based on application specific integrated circuits (ASIC) implementations results using the standard 65nm CMOS technology libraries.

The Galois/Counter Mode (GCM) is a recently adopted mode of operation for symmetric key cryptography to provide both data authenticity and confidentiality. To improve the reliability of hardware implementations of the GCM module, we propose a novel multiple-bit fault detection architecture for hardware implementation of the GCM module using cyclic redundancy check (CRC) codes. By changing the degree of the CRC generating polynomial, one can select the number of parity bits used in the fault detection scheme based on the available resources and required overheads. We derive new formulations for the corresponding fault-detection scheme for the entire GCM loop. Then, we provide FPGA implementation and fault coverage simulation results for different CRC generating polynomials. We show that using six parity bits, one can achieve high fault coverage of close to 100% with the critical path delay overhead of 23% and area overhead of 10.9% while the false alarm is 0.12%.

The Serial-out bit-level multiplication scheme is characterized by an important latency feature. It has an ability to sequentially generate an output bit of the multiplication result in each clock cycle. However, the computational complexity of the existing serial-out bit-level multipliers in GF(2m) using normal basis representation, limits its usefulness in many applications; hence, an optimized serial-out bit-level multiplier using polynomial basis representation is needed. In this paper, we propose new serial-out bit-level Mastrovito multiplier schemes. We show that in terms of the time complexities, the proposed multiplier schemes outperform the existing serial-out bit-level schemes available in the literature. In addition, using the proposed multiplier schemes, we present new hybrid-double multiplication architectures. To the best of our knowledge, this is the first time such a hybrid multiplier structure using the polynomial basis is proposed. Prototypes of the presented serial-out bit-level schemes and the proposed hybrid-double multiplication architectures (10 schemes in total) are implemented over both GF(2163) and GF(2233), and experimental results are presented.

Gaussian normal bases (GNBs) are special set of normal bases (NBs) which yield low complexity$GF\left(2^{m}\right)$arithmetic operations. In this paper, we present new architectures for the digit-level single, hybrid-double, and hybrid-triple multiplication of$GF\left(2^{m}\right)$elements based on the GNB representation for odd values of$m > 1$. The proposed fully-serial-in single multipliers perform multiplication of two field elements and offer high throughput when the data-path capacity for entering inputs is limited. The proposed hybrid-double and hybrid-triple digit-level GNB multipliers perform, respectively, two and three field multiplications using the same latency required for a single digit-level multiplier, at the expense of increased area. In addition, we present a new eight-ary field exponentiation architecture which does not require precomputed or stored intermediate values.

As a result of huge advancements in VLSI technology, more and more complex circuits are being implemented making not only the whole digital system more prone to faults, but also the fault detector itself susceptible to faults resulting in the requirement of concurrent fault detection architecture of the encoders and decoders. In this paper, we present a multiple-bit parity-based fault detection architecture for parallel CRC computation. After analyzing the parallel implementation of CRC, we present a formulation to generate a multiple-bit parity prediction structure to incorporate the fault detection architecture. Using the formulations of digit level CRC architecture, the checksum is divided into few blocks and predicted multiple-bit parity of the blocks are compared with the actual parity bits. Finally, with the help of software simulation and ASIC implementation, we show that the proposed scheme is highly efficient in terms of fault detection capability whereas it involves small area and time overhead. As an example, we have shown that the worst case area overhead is$25.7$percent for CRC$-32$with four parity bits, and corresponding time overhead is$15.6$percent.

The Polynomial basis (PB) representation offers efficient hardware realizations of GF(2m) multipliers. Bit-level serial multiplication over GF(2m) trades-off the computational latency for lower silicon area, and hence, is favored in resource constrained applications. In such area critical applications, extra clock cycles might take place to read the inputs of the multiplication if the data-path has limited capacity. In this paper, we present a new bit-level serial PB multiplication scheme which generates its output bits in parallel after m clock cycles without requiring any preloading of the inputs, for the first time in the open literature. The proposed architecture, referred to as fully-serial-in-parallel-out (FSIPO), is useful for achieving higher throughput in resource constrained environments if the data-path for entering inputs has limited capacity, especially, for large dimensions of the field GF (2m).

The recent advances in mobile technologies have increased the demand for high performance parallel computing schemes. In this paper, we present a new algorithm for evaluating elliptic curve scalar multiplication that can be used on any abelian group. We show that the properties of the proposed algorithm enhance parallelism at both the point arithmetic and the field arithmetic levels. Then, we employ this algorithm in proposing a new hardware design for the implementation of an elliptic curve scalar multiplication on a prime extended twisted Edwards curve incorporating eight parallel operations. We further show that in comparison to the other simple side-channel attack protected schemes over prime fields, the proposed design of the extended twisted Edwards curve is the fastest scalar multiplication scheme reported in the literature.

The WG stream ciphers are based on the WG (Welch-Gong) transformation and possess proved randomness properties. In this paper we propose nine new hardware designs for the two classes of WG(29,11) and WG-16. For each class, we design and implement three versions of standard, pipelined and serial. For the first time, we use the polynomial basis (PB) representation to design and implement the WG(29,11) and WG-16. We consider traditional PB multiplier for the WG(29,11), and, the traditional and Karatsuba multipliers for the WG-16. For efficient field operations, we propose an irreducible trinomial for the WG(29,11). For the WG-16, a new formulation of its permutation which requires only 8 multipliers is introduced. In these designs, the multipliers in the transforms are further reduced by utilizing a novel computation for the trace of the multiplication of two field elements. We have implemented the proposed designs in ASIC using CMOS 65 nm technology. The results show that the proposed standard WG(29,11) consumes less area and slightly enhances the normalized throughput, compared to the existing counterparts. For the WG-16, throughput of the proposed pipelined instance outperforms the previous designs. Moreover, the speed of the proposed WG-16 designs meet the peak bit rates for the 4 G specifications.

The digit-serial systolic double basis multiplier architecture proposed in the above paper does not generate the correct multiplication results as it requires more latches to process digits of inputs in appropriate clock cycles. In this comment, we present the corrected architecture and obtain its time and area complexities. More importantly, we show that the claims made by the authors regarding having significantly lower time and area complexities than its counterpart are not valid.

High-performance and fast implementation of point multiplication is crucial for elliptic curve cryptographic systems. Recently, considerable research has investigated the implementation of point multiplication on different curves over binary extension fields. In this paper, we propose efficient and high speed architectures to implement point multiplication on binary Edwards and generalized Hessian curves. We perform a data-flow analysis and investigate maximum number of parallel multipliers to be employed to reduce the latency of point multiplication on these curves. Then, we modify the addition and doubling formulations and employ a newly proposed digit-level hybrid-double Gaussian normal basis multiplier to remove the data dependencies and hence reduce the latency of point multiplication. To the best of our knowledge, this is the first time that one employs hybrid-double multiplication technique to reduce the computation time of point multiplication. Moreover, we have implemented our proposed architectures for point multiplication on FPGA and obtained the results of timing and area. Our results indicate that the proposed scheme is one step forward to improve the performance of point multiplication on binary Edward and generalized Hessian curves.

The secure hash algorithm (SHA)-3 has been selected in 2012 and will be used to provide security to any application which requires hashing, pseudo-random number generation, and integrity checking. This algorithm has been selected based on various benchmarks such as security, performance, and complexity. In this paper, in order to provide reliable architectures for this algorithm, an efficient concurrent error detection scheme for the selected SHA-3 algorithm, i.e., Keccak, is proposed. To the best of our knowledge, effective countermeasures for potential reliability issues in the hardware implementations of this algorithm have not been presented to date. In proposing the error detection approach, our aim is to have acceptable complexity and performance overheads while maintaining high error coverage. In this regard, we present a low-complexity recomputing with rotated operands-based scheme which is a step-forward toward reducing the hardware overhead of the proposed error detection approach. Moreover, we perform injection-based fault simulations and show that the error coverage of close to 100% is derived. Furthermore, we have designed the proposed scheme and through ASIC analysis, it is shown that acceptable complexity and performance overheads are reached. By utilizing the proposed high-performance concurrent error detection scheme, more reliable and robust hardware implementations for the newly-standardized SHA-3 are realized.

This paper presents two new hardware designs of the Welch-Gong (WG)-128 cipher, one for the multiple output WG (MOWG) version, and the other for the single output version WG based on type-II optimal normal basis representation. The proposed MOWG design uses signal reuse techniques to reduce hardware cost in the MOWG transformation, whereas it increases the speed by eliminating the inverters from the critical path. This is accomplished through reconstructing the key and initial vector loading algorithm and the feedback polynomial of the linear feedback shift register. The proposed WG design uses properties of the trace function to optimize the hardware cost in the WG transformation. The application-specific integrated circuit and field-programmable gate array implementations of the proposed designs show that their areas and power consumptions outperform the existing implementations of the WG cipher.

The extensive rise in the number of resource constrained wireless devices and the needs for secure communications with the servers imply fast and efficient cryptographic computations for both parties. Efficient hardware implementation of arithmetic operations over finite field using Gaussian normal basis is attractive for public key cryptography as it provides free squarings. In this paper, we first present two low-complexity digit-level multiplier architectures. It is shown that the proposed multipliers outperform the existing Gaussian normal basis (GNB) multiplier structures available in the literature. Then, for the first time, using these two architectures, we propose a new digit-level hybrid multiplier which performs two successive multiplications with the same latency as the one for one multiplication. We have studied the efficiency of the proposed hybrid architecture in terms of area and time delay for different digit sizes. The main advantage of this new hybrid architecture is to speed up exponentiation and point multiplication whenever double-multiplication is required and the traditional schemes fail due to the data dependencies. We have investigated the applicability of the proposed hybrid structure to reduce the latency of exponentiation-based cryptosystems. Our analysis and timing results show that the expected acceleration in double-exponentiation is considerable. Prototypes of the presented low-complexity multiplier architectures and the proposed hybrid architecture are implemented and experimental results are presented.

Since its acceptance as the adopted symmetric-key algorithm, the Advanced Encryption Standard (AES) and its recently standardized authentication Galois/Counter Mode (GCM) have been utilized in various security-constrained applications. Many of the AES-GCM applications are power and resource constrained and require efficient hardware implementations. In this paper, different application-specific integrated circuit (ASIC) architectures of building blocks of the AES-GCM algorithms are evaluated and optimized to identify the high-performance and low-power architectures for the AES-GCM. For the AES, we evaluate the performance of more than 40 S-boxes utilizing a fixed benchmark platform in 65-nm CMOS technology. To obtain the least complexity S-box, the formulations for the Galois Field (GF) subfield inversions in GF(24) are optimized. By conducting exhaustive simulations for the input transitions, we analyze the average and peak power consumptions of the AES S-boxes considering the switching activities, gate-level netlists, and parasitic information. Additionally, we present high-speed, parallel hardware architectures for reaching low-latency and high-throughput structures of the GCM. Finally, by investigating the high-performance GF(2128) multiplier architectures, we benchmark the proposed AES-GCM architectures using quadratic and subquadratic hardware complexity GF(2128) multipliers. It is shown that the performance of the presented AES-GCM architectures outperforms the previously reported ones in the utilized 65-nm CMOS technology.

Efficient implementation of point multiplication is crucial for elliptic curve cryptographic systems. This paper presents the implementation results of an elliptic curve crypto-processor over binary fields GF(2m) on binary Edwards and generalized Hessian curves using Gaussian normal basis (GNB). We demonstrate how parallelization in higher levels can be performed by full resource utilization of computing point addition and point-doubling formulas for both binary Edwards and generalized Hessian curves. Then, we employ the ω-coordinate differential formulations for computing point multiplication. Using a lookup-table (LUT)-based pipelined and efficient digit-level GNB multiplier, we evaluate the LUT complexity and time-area tradeoffs of the proposed crypto-processor on an FPGA. We also compare the implementation results of point multiplication on these curves with the ones on the traditional binary generic curve. To the best of the authors' knowledge, this is the first FPGA implementation of point multiplication on binary Edwards and generalized Hessian curves represented by ω-coordinates.

The Sub Bytes (S-boxes) is the only non-linear transformation in the encryption of the Advanced Encryption Standard (AES), occupying more than half of its hardware implementation resources. One important required aspect of the hardware architectures of the S-boxes is the reliability of their implementations. This can be compromised by occurrence of internal faults or intrusion of the attackers. In this paper, we present a high-speed architecture for the S-boxes constructed using mixed bases to counteract these internal/malicious faults. Although using polynomial and normal bases for the S-boxes has been studied extensively, using mixed bases has just been considered very recently in CHES 2010. In the proposed fault detection scheme of this paper, we present formulations for multi-bit parities for the S-boxes using mixed bases. Then, these formulations are utilized in our error simulations and it is shown that the presented architecture reaches very high error coverage. Through our ASIC syntheses utilizing a 65-nm CMOS technology, we show that with comparable hardware complexity, the efficiency of the presented reliable architecture (without sub-pipelining) reaches around 5.02 Mbps/μm2, outperforming other fault detection schemes for composite field architectures.

Multiplication is one of the most important operations in finite field arithmetic. It is used in cryptographic and coding applications, such as elliptic curve cryptography and Reed-Solomon codes. In this paper, we consider the finite field multiplication used in elliptic curve cryptography and design concurrent error detection circuits. It is shown in the literature that the Montgomery multiplication can be used in cryptography to accelerate the scalar multiplication. Here, we use a parity-based concurrent error detection approach to increase the reliability of different Montgomery multipliers available in the literature. First, we consider bit-serial Montgomery multiplication and propose an error detection circuit. Then, we apply the same technique on the digit-serial Montgomery multiplication. Finally, we consider low time-complexity bit-parallel Montgomery multiplication and design the required components to implement the concurrent error detection circuits. ASIC implementations have been completed to analyze the time and area overheads of the proposed schemes. Also, the error detection capability is investigated by software simulations. We show that our approach results in efficient error detection schemes with small time and area overheads.

The high level of security and the fast hardware and software implementations of the Advanced Encryption Standard have made it the first choice for many critical applications. Nevertheless, the transient and permanent internal faults or malicious faults aiming at revealing the secret key may reduce its reliability. In this paper, we present a concurrent fault detection scheme for the S-box and the inverse S-box as the only two nonlinear operations within the Advanced Encryption Standard. The proposed parity-based fault detection approach is based on the low-cost composite field implementations of the S-box and the inverse S-box. We divide the structures of these operations into three blocks and find the predicted parities of these blocks. Our simulations show that except for the redundant units approach which has the hardware and time overheads of close to 100 percent, the fault detection capabilities of the proposed scheme for the burst and random multiple faults are higher than the previously reported ones. Finally, through ASIC implementations, it is shown that for the maximum target frequency, the proposed fault detection S-box and inverse S-box in this paper have the least areas, critical path delays, and power consumptions compared to their counterparts with similar fault detection capabilities.

Finite field multiplication is one of the most important operations in the finite field arithmetic. In this paper, we study semi-systolic and systolic implementations of the shifted polynomial basis multiplication and propose low time complexity semi-systolic and systolic array structures. We show that our proposed semi-systolic multiplier is faster than its existing counterparts available in the literature. Our application-specified integrated circuit (ASIC) implementation of the proposed semi-systolic multiplier demonstrates that reduction in time complexity is achieved without imposing hardware overhead. Furthermore, our proposed systolic array shifted polynomial basis (SPB) multiplier has a low time complexity for general irreducible polynomials.

The faults that accidently or maliciously occur in the hardware implementations of the Advanced Encryption Standard (AES) may cause erroneous encrypted/decrypted output. The use of appropriate fault detection schemes for the AES makes it robust to internal defects and fault attacks. In this paper, we present a lightweight concurrent fault detection scheme for the AES. In the proposed approach, the composite field S-box and inverse S-box are divided into blocks and the predicted parities of these blocks are obtained. Through exhaustive searches among all available composite fields, we have found the optimum solutions for the least overhead parity-based fault detection structures. Moreover, through our error injection simulations for one S-box (respectively inverse S-box), we show that the total error coverage of almost 100% for 16 S-boxes (respectively inverse S-boxes) can be achieved. Finally, it is shown that both the application-specific integrated circuit and field-programmable gate-array implementations of the fault detection structures using the obtained optimum composite fields, have better hardware and time complexities compared to their counterparts.

The Advanced Encryption Standard (AES) has been lately accepted as the symmetric cryptography standard for confidential data transmission. However, the natural and malicious injected faults reduce its reliability and may cause confidential information leakage. In this paper, we study concurrent fault detection schemes for reaching a reliable AES architecture. Specifically, we propose low-cost structure-independent fault detection schemes for the AES encryption and decryption. We have obtained new formulations for the fault detection of SubBytes and inverse SubBytes using the relation between the input and the output of the S-box and the inverse S-box. The proposed schemes are independent of the way the S-box and the inverse S-box are constructed. Therefore, they can be used for both the S-boxes and the inverse S-boxes using lookup tables and those utilizing logic gates based on composite fields. Our simulation results show the error coverage of greater than 99 percent for the proposed schemes. Moreover, the proposed and the previously reported fault detection schemes have been implemented on the most recent Xilinx Virtex FPGAs. Their area and delay overheads have been compared and it is shown that the proposed schemes outperform the previously reported ones.

Multiplication and squaring are main finite field operations in cryptographic computations and designing efficient multipliers and squarers affect the performance of cryptosystems. In this paper, we consider the Montgomery multiplication in the binary extension fields and study different structures of bit-serial and bit-parallel multipliers. For each of these structures, we study the role of the Montgomery factor, and then by using appropriate factors, propose new architectures. Specifically, we propose two bit-serial multipliers for general irreducible polynomials, and then derive bit-parallel Montgomery multipliers for two important classes of irreducible polynomials. In this regard, first we consider trinomials and provide a way for finding efficient Montgomery factors which results in a low time complexity. Then, we consider type-II irreducible pentanomials and design two bit-parallel multipliers which are comparable to the best finite field multipliers reported in the literature. Moreover, we consider squaring using this family of irreducible polynomials and show that this operation can be performed very fast with the time complexity of two XOR gates.

Finite field arithmetic is used in applications like cryptography, where it is crucial to detect the errors. Therefore, concurrent error detection is very beneficial to increase the reliability in such applications. Multiplication is one of the most important operations and is widely used in different applications. In this paper, we target concurrent error detection in the Montgomery multiplication over binary extension fields. We propose error detection schemes for two Montgomery multiplication architectures. First, we present a new concurrent error detection scheme using the time redundancy and apply it on semi-systolic array Montgomery multipliers. Then, we propose a parity based error detection scheme for the bit-serial Montgomery multiplier over binary extension Fields.

The Advanced Encryption Standard, which is used extensively for secure communications, has been accepted recently as a symmetric cryptography standard. However, occurrence of the internal faults by intrusion of the attackers may cause confidential information leak to reveal the secret key. For this reason, several schemes for fault detection of the transformations and rounds in the encryption and decryption of the Advanced Encryption Standard are proposed. In this paper, we present a structure-independent fault detection scheme for the Advanced Encryption Standard. The proposed scheme is independent of the way S- box (inverse S-box) is constructed and can be used for both encryption and decryption. It can be applied to both the S-boxes (and inverse S-boxes) using look-up tables as well as those utilizing logic gate implementations based on composite fields. We have obtained the formulations for the fault detection of the SubBytes (inverse SubBytes) using the relation between the input and output of the S-box (inverse S-box). Then, we have proposed and simulated a signature-based structure-independent fault detection scheme. Moreover, the FPGA implementations of the original and the proposed schemes as well as their overhead are presented.

Recently, implementations of normal basis multiplication over the extended binary field GF(2/sup m/) have received considerable attention. A class of low complexity normal bases called Gaussian normal bases has been included in a number of standards, such as IEEE and NIST for an elliptic curve digital signature algorithm. The multiplication algorithms presented there are slow in software since they rely on bit-wise inner product operations. In this paper, we present two vector-level software algorithms which essentially eliminate such bit-wise operations for Gaussian normal bases. Our analysis and timing results show that the software implementation of the proposed algorithm is faster than previously reported normal basis multiplication algorithms. The proposed algorithm is also more memory efficient compared with its look-up table-based counterpart. Moreover, two new digit-level multiplier architectures are proposed and it is shown that they outperform the existing normal basis multiplier structures. As compared with similar digit-level normal basis multipliers, the proposed multiplier with serial output requires the fewest number of XOR gates and the one with parallel output is the fastest multiplier.

In many cryptographic schemes, the most time consuming basic arithmetic operation is the finite field multiplication and its hardware implementation for bit parallel operation may require millions of logic gates. Some of these gates may become faulty in the field due to natural causes or malicious attacks, which may lead to the generation of erroneous outputs by the multiplier. In this paper, we propose new architectures to detect erroneous outputs caused by certain types of faults in bit-parallel and bit-serial polynomial basis multipliers over finite fields of characteristic two. In particular, parity prediction schemes are developed for detecting errors due to single and certain multiple stuck-at faults. Although the issue of detecting soft errors in registers is not considered, the proposed schemes have the advantage that they can be used with any irreducible binary polynomial chosen to define the finite field

For efficient hardware implementation of finite field arithmetic units, the use of a normal basis is advantageous. In this paper, two classes of architectures for multipliers over the finite field GF(2/sup m/) are proposed. These multipliers are of sequential type, i.e., after receiving the coordinates of the two input field elements, they go through k, 1 /spl les/ k /spl les/ m, iterations (i.e., clock cycles) to finally yield all the coordinates of the product in parallel. The value of k depends on the word size w = /spl lceil/m/k/spl rceil/. For w > 1, these multipliers are highly area efficient and require fewer number of logic gates even when compared with the most area efficient multipliers available in the open literature. This makes the proposed multipliers suitable for applications where the value of m is large but space is of concern, e.g., resource constrained cryptographic systems. Additionally, if the field dimension m is composite, i.e., m = kn, then the extension of one class of the architectures yields a highly efficient multiplier over composite fields.

Representing the field elements with respect to the polynomial (or standard) basis, we consider bit parallel architectures for multiplication over the finite field GF(2m). In this effect, first we derive a new formulation for polynomial basis multiplication in terms of the reduction matrix Q. The main advantage of this new formulation is that it can be used with any field defining irreducible polynomial. Using this formulation, we then develop a generalized architecture for the multiplier and analyze the time and gate complexities of the proposed multiplier as a function of degree m and the reduction matrix Q. To the best of our knowledge, this is the first time that these complexities are given in terms of Q. Unlike most other articles on bit parallel finite field multipliers, here we also consider the number of signals to be routed in hardware implementation and we show that, compared to the well-known Mastrovito's multiplier, the proposed architecture has fewer routed signals. The proposed generalized architecture is further optimized for three special types of polynomials, namely, equally spaced polynomials, trinomials, and pentanomials. We have obtained explicit formulas and complexities of the multipliers for these three special irreducible polynomials. This makes it very easy for a designer to implement the proposed multipliers using hardware description languages like VHDL and Verilog with minimum knowledge of finite field arithmetic.

In this article, two digit-serial architectures for normal basis multipliers over ( GF (2 m )) are presented. These two structures have the same gate count and gate delay. We also consider two special cases of optimal normal bases for the two digit-serial architectures. A straightforward implementation leaves gate redundancy in both of them. An algorithm that can considerably reduce the redundancy is also developed. The proposed architectures are compared with the existing ones in terms of gate and time complexities.

Cryptographic schemes, such as authentication, confidentiality, and integrity, rely on computations in very large finite fields, whose hardware realization may require millions of logic gates. In a straightforward design, even a single fault in such a complex circuit is likely to yield an incorrect result and may be exploited by an attacker to break the cryptosystem. In this regard, we consider computing over finite fields in presence of certain faults in multiplier circuits. Our work reported here deals with errors caused by such faults in polynomial basis multipliers over finite fields of characteristic two and presents a scheme to correct single errors. Towards this, pertinent theoretical results are derived, and both bit-parallel and bit-serial fault tolerant multipliers are proposed.

For efficient hardware implementation of finite field arithmetic units, the use of a normal basis is advantageous. Two architectures for multipliers over the finite field GF(2/sup m/) are proposed. Both of these multipliers are of sequential type - after receiving the coordinates of the two input field elements, they go through m iterations (or clock cycles) to finally yield all the coordinates of the product in parallel. These multipliers are highly area efficient and require fewer number of logic gates even when compared with the most area efficient multiplier available in the open literature. This makes the proposed multipliers suitable for applications where the value of m is large but space is of concern, e.g., resource constrained cryptographic systems. Additionally, the AND gate count for one of the multipliers is /spl lfloor/m/2/spl rfloor/+1 only. This implies that if the multiplication over GF(2/sup m/) is performed using a suitable subfield GF(2/sup n/), where n>1 and n|m, then the corresponding multiplier architecture will yield a highly efficient digit or word serial multiplier.

In cryptographic applications, the use of normal bases to represent elements of the finite field GF(2/sup m/) is quite advantageous, especially for hardware implementation. In this article, we consider an important field operation, namely, multiplication which is used in many cryptographic functions. We present a class of algorithms for normal basis multiplication in GF(2/sup m/). Our proposed multiplication algorithm for composite finite fields requires a significantly lower number of bit level operations and, hence, can reduce the space complexity of cryptographic systems.

For cryptographic applications, normal bases have received considerable attention, especially for hardware implementation. We consider fast software algorithms for normal basis multiplication over the extended binary field GF(2/sup m/). We present a vector-level algorithm, which essentially eliminates the bit-wise inner products needed in the conventional approach to the normal basis multiplication. We then present another algorithm, which significantly reduces the dynamic instruction counts. Both algorithms utilize the full width of the data-path of the general purpose processor on which the software is to be executed. We also consider composite fields and present an algorithm, which can provide further speed-ups and an added flexibility toward hardware-software codesign of processors for very large finite fields.

The Massey-Omura multiplier of GF(2/sup m/) uses a normal basis and its bit parallel version is usually implemented using m identical combinational logic blocks whose inputs are cyclically shifted from one another. In the past, it was shown that, for a class of finite fields defined by irreducible all-one polynomials, the parallel Massey-Omura multiplier had redundancy and a modified architecture of lower circuit complexity was proposed. In this article, it is shown that, not only does this type of multiplier contain redundancy in that special class of finite fields, but it also has redundancy in fields GF(2/sup m/) defined by any irreducible polynomial. By removing the redundancy, we propose a new architecture for the normal basis parallel multiplier, which is applicable to any arbitrary finite field and has significantly lower circuit complexity compared to the original Massey-Omura normal basis parallel multiplier. The proposed multiplier structure is also modular and, hence, suitable for VLSI realization. When applied to fields defined by the irreducible all-one polynomials, the multiplier's circuit complexity matches the best result available in the open literature.