This article proposes highly efficient Advanced Encryption Standard (AES) hardware architectures that support encryption and both encryption and decryption. New operation-reordering and register-retiming techniques presented in this article allow us to unify the inversion circuits in SubBytes and InvSubBytes without any delay overhead. In addition, a new optimization technique for minimizing linear mappings, named multiplicative-offset, further enhances the hardware efficiency. We also present a shared key scheduling datapath that can work on-the-fly in the proposed architecture. To the best of our knowledge, the proposed architecture has the shortest critical path delay and is the most efficient in terms of throughput per area among conventional AES encryption/decryption and encryption architectures with tower-field S-boxes. The proposed round-based architecture can perform AES encryption where block-wise parallelism is unavailable (e.g., cipher block chaining (CBC) mode); thus, our techniques can be globally applied to any type of architecture including pipelined ones. We evaluated the performance of the proposed and some conventional datapaths by logic synthesis with the NanGate 45-nm open-cell library. As a result, we can confirm that our proposed architectures achieve approximately 51-64 percent higher efficiency (i.e., higher bps/GE) and lower power/energy consumption than the other conventional counterparts.

In this study, we propose a formal design system for tamper-resistant cryptographic hardwares based on Generalized Masking Scheme (GMS). The masking scheme, which is a state-of-the-art masking-based countermeasure against higher-order differential power analyses (DPAs), can securely construct any kind of Galois-field (GF) arithmetic circuits at the register transfer level (RTL) description, while most other ones require specific physical design. In this study, we first present a formal design methodology of GMS-based GF arithmetic circuits based on a hierarchical dataflow graph, called GF arithmetic circuit graph (GF-ACG), and present a formal verification method for both functionality and security property based on Gröbner basis. In addition, we propose an automatic generation system for GMS-based GF multipliers, which can synthesize a fifth-order 256-bit multiplier (whose input bit-length is 256 × 77) within 15 min.

In this brief, we present a high-speed AES IP-core, which runs at 880 MHz on a 0.13-/spl mu/m CMOS standard cell library, and which achieves over 10-Gbps throughput in all encryption modes, including cipher block chaining (CBC) mode. Although the CBC mode is the most widely used and important, achieving such high throughput was difficult because pipelining and/or loop unrolling techniques cannot be applied. To reduce the propagation delays of the S-Box, the slowest function block, we developed a special circuit architecture that we call twisted-binary decision diagram (BDD), where the fanout of signals is distributed in the S-Box circuit. Our S-Box is 1.5 to 2 times faster than the conventional S-Box implementations. The T-Box algorithm, which merges the S-Box and another primitive function (MixColumns) into a single function, is also used for an additional speedup.

In this paper, we present a high-speed AES IP-core, which runs at 780 MHz on a 0. 13 /spl mu/m CMOS standard cell library, and which achieves 10 Gbps throughput in all encryption modes, including CBC mode. Although the CBC mode is the most widely used and important, achieving such high throughput was difficult because pipelining techniques cannot be applied. To reduce the propagation delays of the S-Box, the most critical function block, we developed a special circuit architecture that we call twisted-BDD, where the fanout of signals is distributed in the S-Box circuit. Our S-Box is 1.5 to 2 times faster than the conventional S-Box implementations. The T-Box algorithm, which merges the S-Box and another primitive function (MixColumns) into a single function, is also used for an additional speedup.

This paper presents a scheme of ultra-fast one-shot Reed-Solomon decoding (prototyped (40-34,32,8) soft-IP demonstrating over 7 Gb/s using 0.35 /spl mu/m ASIC technology) and discusses its application to future dependable computer systems, taking a redundant array memory system as an example. We compare different memory configurations and identify improved fault-tolerance to single-bit failures as well as chip and card failures for smaller system overheads when random quad-byte one-shot Reed-Solomon decoding is used. We also discuss an alternative use of the powerful coding gain, i.e., an application to the dynamic refresh interval control of DRAMs, in order to optimize the refresh overheads in performance and power consumption. We believe that the one-shot Reed-Solomon decoding offers an advanced error correction capability for various parts of future high-performance computer systems, where system-level reliability can suffer because of rapidly increasing data size and speed.

The design methodology for a high-performance and compact one-shot Reed-Solomon encoder/decoder realized as a combinational circuit is presented. Under a two-level optimization approach, a combination of new encoding/decoding algorithms enabling highly parallel, yet shared architecture, and logic optimization methods tuned for huge-scale Galois field arithmetic operations, improves the circuit size and speed significantly. The higher level optimization not only can be entirely independent of the gate level optimization, but also further augments the advantages in the gate level optimization. As a result a (40-34,32)RS encoders/decoder soft IP-core achieving 45 ns latency and >7 Gb/s peak throughput without pipelining is realized using <90 K cells under 0.35 um CMOS gate-array technology.