High-speed VLSI implementation of Digit-serial Gaussian normal basis Multiplication over GF(2 m )

Transcription

1 High-speed VLSI ipleentation of igit-serial Gaussian noral basis Multiplication over GF(2 ) Bahra Rashidi, Sayed Masoud Sayedi 2, Reza Rezaeian Farashahi 3,2 ept. of Elec. & Cop. Eng., Isfahan University of Technology, Isfahan , Iran 3 ept. of Matheatical Sciences, Isfahan University of Technology, Isfahan , Iran 3 The School of Matheatics, Institute for Research in Fundaental Sciences (IPM), P.O. Box , Tehran, Iran b.rashidi@ec.iut.ac.ir, 2 _sayedi@cc.iut.ac.ir, 3 farashahi@cc.iut.ac.ir Abstract-- In this paper, by eploying the logical effort technique an efficient and high-speed VLSI ipleentation of the digit-serial Gaussian noral basis ultiplier is presented. It is constructed by using AN, XOR and XOR tree coponents. To have a low-cost ipleentation with low nuber of transistors, the block of AN gates are ipleented by using NAN gates based on the property of the XOR gates in the XOR tree. To optially decrease the delay and increase the drive ability of the circuit the logical effort ethod as an efficient ethod for sizing the transistors is eployed. By using this ethod and also a 4-input XOR gate structure, the circuit is designed for iniu delay. The digit-serial Gaussian noral basis ultiplier is ipleented over two binary finite fields GF(2 63 ) and GF(2 ) in.8μ CMOS technology for three different digit sizes. The results show that the proposed structures, copared to previous structures, have been iproved in ters of delay and area paraeters. Keywords: Cryptography, Logical Effort, Gaussian Noral Basis ultiplication, digit-serial, VLSI ipleentation. Introduction Several well-known cryptographic algoriths such as Elliptic Curve Cryptography (ECC), Advanced Encryption Standard (AES), and soe essage authentication codes are based on the properties of finite fields. In ECC the use of elliptic curves defined over finite fields is proposed for cryptography schees, including key exchange, encryption, and digital signature. A hierarchy process is used for hardware ipleentation of ECC. The finite field arithetic operations such as field ultiplication, field squaring, and field inversion are involved in the ipleentation process. The ost iportant coponent in this cryptosyste is field ultiplication. The binary finite fields, denoted by GF(2 ), are well suited for hardware ipleentation, where the addition operation is perfored by odulo 2 without carry bit. The eleents in binary fields are represented by a basis. Two practical bases are polynoial basis (PB) and noral basis (NB). The efficient noral basis for ipleentation is denoted by Gaussian noral basis (GNB) []. The GNB is considered in several standards such as IEEE P363 [2] and NIST [3]. For exaple, five NIST recoended fields GF(2 63 ), GF(2 ), GF(2 283 ), GF(2 49 ) and GF(2 57 ) are respectively corresponded to the even types T={4,2,6,4, and } of GNB. In the noral basis representation the powers of two of the field eleent are ipleented only by cyclic shift operation. In the special case, the squaring operation is perfored by only one-bit cyclic shift to left. This feature can be useful in the hardware ipleentation of the field ultiplier over noral basis. Many different architectures of the noral basis and GNB ultiplications are presented in previous works [4]- [29]. In [6], a novel scalable ultiplication algorith for a type- T Gaussian noral basis by using Hankel Matrix-Vector representation is presented. In [7] a odified digit-level GNB ultiplier over GF(2 ) is proposed. Also for types T bigger than 2, a coplexity reduction algorith is proposed to reduce the nuber of XOR gates without increasing the gate delay of the digit-level ultiplier. In [9] a low-coplexity digit-level serial input parallel output (SIPO) GNB ultiplier, also an iproved digit-level parallel input serial output (PISO) ultiplier architecture, and a hybrid architecture by connecting the output of the digit-level PISO ultiplier to the input of the digit-level SIPO ultiplier are presented. In [] a new noral basis ultiplication algorith based on a divide-and-conquer and a unifor shift ethod is used to ipleent an efficient ultiplexer-based architecture. A bit-parallel GNB ultiplier based on one pipelined XOR tree is designed in [7]. In [2] a novel algorith for GNB binary finite field ultiplication by using Toeplitz atrix-vector representation is proposed. Multipliers with systolic and sei-systolic architecture are presented in [5], [4], [6], [8], [9], [2] and [22]. The ain proble in the systolic structures is their very high hardware consuption and high nubers of clock cycles. In [22] the nuber of clock cycles is reduced. The focus of this work is on the efficient VLSI ipleentation of the digit-serial GNB ultiplication. Our previously reported digit-serial Gaussian noral basis ultiplier [3] is used for ipleentation. The ultiplier has a highly regular structure with low critical path delay and low hardware resources, and it is well suited to hardware ipleentations. In the ultiplier, an XOR tree for suation of partial products exists. A structural VLSI ipleentation of the XOR tree based on logical effort technique is presented. In the ultiplier structure, the generated partial products by AN gates blocks are added to each other by XOR tree, because in the binary field, addition is perfored by odulo 2 using XOR gates. Accordingly, the blocks of AN gates are

2 ipleented by NAN gates based on the property of the XOR tree in the ultiplier structure. Also, an optiized 4-input XOR gate is used for ipleentation of the XOR tree. The rest of the paper is organized as follows. Section 2 provides a brief background on Gaussian noral basis ultiplication over GF(2 ) and the structure of digit-serial GNB ultiplier. Section 3 describes the proposed VLSI ipleentation of the digit-serial GNB ultiplier over GF(2 ). Section 4 gives a coparison between this work and other previously related works. The paper is concluded in section Gaussian noral basis ultiplication over GF(2 ) and the structure of digit-serial ultiplier Let β be a noral eleent of the binary finite field GF(2 ). Then, the set of eleents {β, β 2,, β 2 } in GF(2 ) is a basis for the space GF(2 ) over GF(2). This eans each eleent A GF(2 ) can be represented by A = i= a i β 2i = (a β 2 + a β 2 + a 2 β a 2 β a β 2 ), where a i are or. And, for the siplicity, the eleent A is represented by a vector A = [a, a 2,, a 2, a, a ]. The addition of two eleents in GF(2 ) is coputed by bitwise XOR gates. Also the squaring of the eleent A is perfored as follows: A 2 = [a 2, a 3,, a, a ]. One iportant property of using noral basis representation, as shown in above forula, is perforing the squaring operation very efficiently by a siple one-bit cyclic shift to left. In general case for the positive integer n, the coputation of 2 n -th power of the eleent A is perfored via n-bit cyclic shift to left, i.e., A 2n = [a n, a n 2,, a, a, a,, a n+, a n ]. Also 2 n -th power is coputed by n-bit cyclic shift to right, A 2 n = [a n, a n 2,, a, a, a, a 2,, a n+, a n ]. The Gaussian noral basis (GNB) is special class of noral basis for low coplexity noral basis []-[2]. For the binary finite field GF(2 ), where > and is not divisible by 8, and for a positive integer T, let p = T + be a prie nuber such that gcd( T,) =, where k is the ultiplication order of 2 odule p. Then there exists k a noral basis over GF(2 ) called the GNB of type T. In GNB the nuber of nonzero entries of ultiplication atrix is less or equal to (T-). The tie and area coplexity of the ultiplication operation depends on the type of the noral basis with respect to that basis. In this work, we consider the GNBs with odd values of which are applicable for cryptography applications, and it iplies that T is an even nuber. Here, we briefly discuss the structure of digit-serial Gaussian noral basis ultiplier presented in [3]. Let A, B be two eleents in GF(2 ). The eleent B = [b, b 2,, b 2, b, b ] is divided into d words of w bits where d = w. Then, we have = B d w i= i, where B i = k= b (k )w i β 2 (k )w i for i =,, w. Here, we set b i = if i. The ultiplication of eleents A, B in GF(2 ) is written by In other words, we have where for i =,, w, d w C = AB = A B i w i= C = C i 2 w i = i= w d = ( b (k )w i A 2 (w i) β 2 kw ) i= k= (( ((C 2 + C 2 ) 2 + C 3 ) ) + C w ), )2 ( kw) β)2 kw C i = b (k )w i A 2 (w i) β 2 kw = b (k )w i (((A 2 (w ) ) 2(i ). k= d k= 2 w i. To have a low-coplexity and regular architecture of ultiplication by β 2( kw), the coputation of xβ 2( kw) is perfored as ((x 2 ( kw) ) β)2 ( kw) in three steps; first the exponentiation of the input x by 2 ( kw) is done, then ultiplication by β is perfored, and finally the exponentiation of the result by 2 ( kw) is copleted. The details of ultiplication by β which is the ain part of the ipleentation are given in [3]. In the coputation of C i, the exponentiation by 2 ( kw) is perfored in the following regular for:

3 2 w ((A 2 (w ) ) 2(i ) )2 ( kw) = ( (((A 2 (w ) ) 2(i ) )2 ( w) )2w ). In above equation, first exponentiation by 2 ( w) is coputed, and then for k = 2,3,, d, exponentiations by 2 ( kw) are generated by a d- length sequence of exponentiation by 2 w. The following exaple shows the structure of digit-serial GNB ultiplier over GF(2 7 ) of type T=4 for the case of w=3, d = 7 3 =3. In this case, the eleent B is represented by three words B, B, B 3 by The values C i, for i =,2,3, are given as follows. C = ((A 2 2 ) 2 4 β)24 b 6 + (((A 2 2 ) 2 4 )23 β) B = b 6 β 26 + b 5 β 25 + b 4 β 24, B 2 = b 3 β 23 + b 2 β 22 + b β 2, B 3 = b β. 2 b 3 + ((((A 2 2 ) 2 4 )23 )23 β)2 2 b C 2 = (((A 2 2 ) 2 ) 2 4 β)24 b 5 + ((((A 2 2 ) 2 ) 2 4 )23 β) b 2 + (((((A 2 2 ) 2 ) 2 4)23 )23 β) b C 3 = (((A 2 2 ) 22 )2 4 β)24 b 4 + ((((A 2 2 ) 22 )2 4 )23 β) b + (((((A 2 2 ) 22 )2 4 )23 )23 β) b 2. The bits b and b 2 are set to zero. The product C = AB is coputed by C = ((C 2 + C 2 ) 2 + C 3 ). Fig. shows the structure of the digit-serial GNB ultiplier over GF(2 7 ). The required exponentiation operations in the ultiplier structure are ipleented by wired cyclic shifts. a6 a5 a4 a3 a2 a a b4 b5 b6 i SIC L b b2 b3 i SIC L b i SIC L i SIC L i L Sequential Input Circuit (SIC) Fig.: Structure of the digit-serial GNB ultiplier over GF(2 7 ) with w=3 and d=3 c c c2 c3 c4 c5 c6 The critical data path of the structure of digit-serial GNB ultiplier over GF(2 ) with type T is T A + ( log 2 T + log 2 (d+) )T X, where T A and T X denote the tie delay of a 2-input AN gate and 2-input XOR gate

4 Reg respectively [3]. The digit-serial GNB ultiplier requires d AN gates and less or equal than d+(t-)(- )d XOR gates. More details of the hardware and tie coplexity of this work and other related works are presented in [3]. In Fig.5, the critical data path is T A +( log log 2 (3+) )T X =T A +5T X. In [3] the output signal of the ultiplier is obtained fro flip-flops outputs (see Fig. in [3]), so one clock cycle is added to d clock cycles and the total nuber of clock cycles is d+. In current work, we change the place of flip-flops, and the output signal of ultiplier is obtained fro final XOR gates outputs in the XOR tree, as seen in Fig.. In this case, one clock cycle is reduced and the nuber of clock cycles is d. This leads to reduction of clock cycles by order O() in coputation of point ultiplication for the elliptic curve cryptography. 3. Proposed Ipleentation of igit-serial GNB Multiplier over GF(2 )Based on Logical Effort The proposed ethod here is applicable for all ultipliers in which an XOR tree is used to perfor the su of the partial products. The exaples are bit-serial ONB ultipliers with PISO structure [5], [27], bit-parallel and digit-serial ONB and GNB ultipliers [7]-[4], [28], [3] and bit-parallel and digit-serial PB ultipliers [3]- [34], in the binary finite fields. In these structures to generate partial products, one bit of input operand (for exaple B) is ANed by an -bit vector in the structure of ultipliers. In this work, in the structure of digitserial GNB ultiplier, the nuber of AN blocks are equal to d, and each block includes 2-input AN gates. One straightforward ethod for ipleentation of AN gate is using NAN-NOT structure, in which in CMOS structure, any 2-input AN gate is ipleented by 6 transistors (4 transistors for NAN gate and 2 transistors for inverter gate). By considering the structure of the ultiplier and properties of the XOR gates, the ipleentation of the AN gates can be done only by using NAN gates. As seen in the structure of ultiplier, the output of AN blocks in the suation part are bit-wise XORed by XOR tree. We use the following equation: a k a k a a = a k a k a a () which is true if k is an even nuber and a i {, }, for i k. Based on this equation XORing of even nubers of input bits is equal to XORing of the copleented of sae input bits. In the case that k is an odd nuber, since k- is even, based on above equation we have: a k a k a a = a k a k a a (2) Fig.2 shows configuration of the AN blocks and XOR tree in the ultiplier structure. Output signal of register Reg is S and the -bit output of each AN block is called AP i where i d. Input to AN-Part AN-Part AP AP 2 AP 3 AP d XOR-Tree S Output(-:) Fig.2: Configuration of the AN part and XOR tree in the ultiplier structure For each output bit, there are following cases, if d is an even nuber: Output(j) = AP d (j) AP d (j) AP (j) S(j) = AP d(j) AP d (j) AP (j) S(j) (3) and if d is an odd nuber we have: Output(j) = AP d (j) AP d (j) AP (j) S(j) = AP d(j) AP d (j) AP (j) S (j)(4) where Output(j) is j th bit of the ultiplier output. The scheatic of the circuit (for the case of even d) for one bit of the ultiplier output is shown in Fig.3. Original structure of the AN blocks and XOR tree is shown in

5 Fig.3 (a). Also Fig.3 (b) shows the ipleentation of the AN blocks based on the proposed ethod by NAN gates. Fro SIC Blocks Input to AN-Part Fro SIC Blocks Input to NAN-Part S(j) S(j) AP(j) AP2(j) AP3(j) AP4(j) APd-2(j) APd-(j) APd(j) AP(j) AP2(j) AP3(j) AP4(j) APd-2(j) APd-(j) APd(j) Output(j) (a) Output(j) Fig.3: (a) original structure of the AN blocks and XOR tree, (b) and ipleentation of the AN blocks based on the proposed ethod by NAN gates, for j th bit of the ultiplier output. In the ipleentation of the AN blocks by using only NAN gates the nuber of inverter gates is reduced by d. The proposed approach for ipleentation of the AN part is applicable for other GNB and polynoial basis ultipliers. As seen in Fig. for generation of partial products in the structure of ultiplier, one bit of input operand, for exaple b i, is ANed by an -bit vector. Therefore, one of the input pins of each AN gate ust be connected to b i input. Fig.4 (a) shows this concept. Here the b i signal ust drive NAN gates, since we have changed the AN gates by NAN gates. If C in-nan is the input capacitance of each NAN gate, then b i signal has a capacitance load equal to C in-nan. In elliptic curve cryptography, the range of is bigger than 6, so this capacitance load is very big and it can considerably increase the delay of the circuit. To decrease the delay the b i signal is buffered in Fig.4 (b). b i In(-:) b i Buffer In(-:) (b) (a) Fig.4: (a) NAN block, (b) NAN block when b i is buffered Supper buffers are used to drive large capacitance loads for iniu delay. In the following, we discuss the design of a buffer based on a cascade of N inverters to drive a capacitance load, C load [35]. Each inverter in the chain is larger than the previous one by a factor α. Fig.5 (a) shows this structure. The factor α is calculated as follows: α=[ C load N ] C in where C in here is the input capacitance of one NAN gate. For iniu delay the nuber of inverters N is calculated by: N=ln C load C in (6) Equations (5) and (6) are used for the design of the buffer. As an exaple, the buffer design for field GF(2 ) is presented next. In the proposed structure C in =4.263fF and C load = C in-nan= (3.282fF)=765fF. N=ln C load = ln 765 = 5.2~6. So we have 6 inverter stages in the structure of the buffer. The value α is: C in (b) (5)

6 α=[ C load ] C in N = [ ] 6 =2.38 The structure of the buffer that drives one NAN block in the digit-serial GNB ultiplier over GF(2 ) is shown in Fig.5 (b). (Wp/Wn) α(wp/wn) α 2 (Wp/Wn) α N- (Wp/Wn) (a) Cload (.44μ /.22μ) 2.38(.44μ /.22μ) (.44μ /.22μ) (.44μ /.22μ) (.44μ /.22μ) (.44μ /.22μ) Cload (b) Fig.5: (a) structure of supper buffer, (b) structure of the buffer for drive of one NAN block over GF(2 ) Another part of the ultiplier that needs buffering is the output of flip-flops connected to β blocks. Fig.6 shows the structure after applying the changes for the ipleentation over GF(2 7 ). As seen in the figure, the digit size d is odd, so based on Eq. (4), for ipleentation of AN blocks by NAN gates the outputs of flip-flops (S signals) are inverted. a6 a5 a4 a3 a2 a a b4 b5 b6 i SIC L b b2 b3 i SIC L b i SIC L i SIC L i L Sequential Input Circuit (SIC) Fig.6: Proposed structure for GF(2 7 ) after applying changes for VLSI ipleentation c c c2 c3 c4 c5 c6 In Fig.6 the structure of the digit-serial GNB ultiplier is constructed by XOR Tree, β blocks, NAN gates, flip-flops and ultiplexers. The ain eleent of the circuit is XOR gate. A brief discussion on different lowcost full swing circuits of the XOR gates is presented in [36]. In [37] a 6 transistors XOR circuit is designed. In this circuit, for two states of A=, B= and A=, B= the level of output voltage depends on voltage level of input signals. In [36], a odified version of XOR gate is presented, in which this liitation is eliinated. Fig.7 (a) shows the odified 2-input XOR structure in which two iniu size pull-up PMOS transistors are added to the previous circuit. In this circuit the XOR output (X) and XNOR output (X ) signals are produced siultaneously. This is an iportant property of the structure for construction of the 4-input XOR gate. Fig.7 (b) shows the ipleented layout of the 2-input XOR gate in.8μ CMOS technology.

7 A B X (a) (b) Fig.7: (a) 2-input XOR structure in [36], (b) layout of this gate The 4-input XOR gate is constructed by two odified 2-input XOR gates, pass transistors and one inverter at the output node [36]. Fig.8 (a) shows the circuit, and the layout of the gate is shown in Fig.8 (b). As seen in the figure two output signals X and X of the 2-input XOR gates are used for construction of the 4-input XOR gate. Voltage level and driving capability is restored by using an inverter at the output node. The effect of process variations and isatch on the delay of the circuit was evaluated through the Monte Carlo analysis. Fig.9 shows the result for 5 iterations and for load capacitance of 3fF. As the figure shows the ean value of the delay is 225.9ps. A B X C (a) (b) Fig.8: (a) the structure of the 4-input XOR gate in [36], (b) layout of this gate Fig.9: Monte Carlo result for the delay of the 4-input XOR circuit Another coponent used in the ultipliers structure is flip-flop. ifferent static flip-flop topologies have been proposed in the past. Based on a coparative study, soe of the widely used topologies have been shown in Fig. (a)-(c). A full characterization of these flip-flops can be found in the literature [38]-[4]. Here, a brief description of each flip-flop is presented. Fig. (a) shows a conventional Transission Gate Flip-Flop (TGFF). This structure requires a large nuber of transistors for ipleentation. A Push Pull Flip-Flop (PPFF) is shown in Fig. (b) in which an inverter and a transission gate between the outputs of the aster and slave latches

8 accoplish a push pull effect at the slave latch. Fig. (c) shows a Clocked CMOS (C²MOS) flip-flop. In the figure, the second and fourth C 2 MOS latches are used to aintain the charge levels at output nodes. These latches are weak feedback latches with low driving capability. There are 2 transistors used in this circuit, which is high copared to that of two other circuits. Q Q (a) (b) Q (c) Fig.: Three different structures of flip-flop presented in literature. The Transission Gate Master-Slave flip-flop (TG-MSFF) [42] shown in Fig. (a) is used in current work for ipleentation of digit-serial GNB ultiplier. In the circuit when the clock signal is high, the first transission gate in the aster part becoes functional saples and transfers input data at node to the inverter output node. When the clock goes, the second transission gate in the slave part becoes functional transfers the data fro interediate inverter output node to the output node Q. This structure is one of the fastest classical structures [43]. It has a short direct path (low latency direct path) and a low power feedback, which are constructed by cascading two identical pass gate latches. Based on siulation results presented in [39], [43], [44], [45], the best power-perforance trade-off with total delay (clock-to-output + setup tie) is achieved for this structure. As entioned before, in this paper, we use this flip-flop in the proposed ipleentation of the digit-serial GNB ultiplier. Fig. (b) shows the ipleented layout of the TG-MSFF in.8µ CMOS technology. Based on above structures, ipleentations of the ultiplier over two practical fields GF(2 63 ) and GF(2 ) for three digit sizes d=3, d=5 and d=59 are done. In the following, ipleentations of the GNB ultiplier over field GF(2 ) based on logical effort technique is presented. The logical effort technique, describes capability of one logic gate relative to that of a reference inverter gate [46]. The logical effort of a logic gate is defined as the ratio of its input capacitance to that of an inverter that delivers equal output current. The logical effort paraeters are presented briefly in [36]. Here, the logical effort is applied to get least overall delay by balancing the delay aong the stages. First ipleentation of ultiplier for (d=59, w=4) is described. In the general case as shown in Fig.2 the XOR tree is ipleented in six stages by using 2-input XOR gates. The low-cost 4-input XOR gate with iniu nuber of transistors is used to ipleent the XOR tree. The 6- stage XOR tree in the digit-serial GNB for case (d=59, w=4) over GF(2 ) is ipleented by three levels of 4- input XOR gates. Each 4-input XOR gate constructed by two logic stages including an inverter and a 2-input XOR gate and pass transistors. The sizes of transistors are coputed for different electrical effort by using logical effort technique. The process for the 6-stage structure of the XOR tree in the digit-serial GNB ultiplier (d=59, w=4) over GF(2 ) which is shown in Fig.3 for H= is described in details in the following.

9 ... Q (a) (b) Fig.: (a) the structure of the Transission Gate Master-Slave flip-flop circuit, (b) the ipleented layout of TG-MSFF Inputs fro AN Blocks -2input XOR Output(232:) Fig.2: General 6-stage structure of the XOR tree in the digit-serial GNB ultiplier (d=59, w=4) over GF(2 ) based on 2- input XOR gates For the 6-stage structure, the path logical effort is the product of logical efforts of three inverters and three XOR gates, calculated as G=g g 2 g 6=( )3 () 3 =(.682) 3 = The branching effort is B=, because there is no branching along the path; so the path effort is F=GBH=.5942 = Miniu delay can be realized if the transistors sizes in each stage are chosen properly. To that end first the stage effort is coputed asf = =.588. Since H is equal to, C L=C in= C x=4.252ff where C x is the input capacitance of the 4-input XOR gate. The input capacitance of each gate is coputed by Eq. () in [36]. It can be started with the load capacitance at the output node of the path. The ethod is a backward approach as follows: Cin-6 = Cout-6 g 6 f =4.252fF ( )=8.98fF =>Wn-2=.62μ, Wp-2 = 3.24μ,.588 Cin-5 = Cin-6 g 5 f =8.98fF (.682 ) = 6.6fF => Wn-5 = Wn2-5 =Wp-5 =Wp2-5 =μ,.588 Cin-4 = Cin-5 g 4 f =6.6fF ( ) = 4.64fF => Wn-4 =.75μ, Wp-4 =.5μ,.588

10 ... Cin-3 = Cin-4 g 3 f =4.64fF (.682 ) = 3.65fF => Wn-3 = Wn2-3 =Wp-3 =Wp2-3 =.47μ,.588 Cin-2 = Cin-3 g 2 f =3.65fF ( ) =.93fF => Wn-2 =.35μ, Wp-2 =.7μ,.588 Cin- = Cin-2 g f =.93fF (.682 ) =.422fF = Cin=> Wn- = Wn2- =Wp- =Wp2- =.22μ..588 Inputs fro NAN Blocks Output(232:) -4input XOR Fig.3: Proposed 6-stage structure of the XOR tree for digit-serial GNB ultiplier (d=59, w=4) over GF(2 ) based on 4- input XOR gate As it was expected, the size of the coputed first stage input capacitance is equal to the input capacitance of 4- input XOR gate at first stage. W n-i, W n2-i, W p-i and W p-i are the sizes of input nmos and pmos transistors in the 4-input XOR gate. Also W n-i and W p-i are the sizes of nmos and pmos transistors of the inverter in the 4- input XOR. Based on above calculations transistors of output stages are wider, which enable the to drive current into large output loads. For the case (d=5, w=6) over GF(2 ) as seen in Fig.4 (a), the proposed XOR tree is ipleented by two levels 4-input XOR gate in 4 logic stages. Fig.4 (b) shows ipleentation of the circuit by using 2-input XOR gates in a general 4 logic stages. The path logical effort of the proposed 4-stage XOR tree structure for this case is G=g g 2 g 6=( )2 () 2 =(.682) 2 =.365, and for the electrical effort of H=5 the value of path effort is coputed as F=GBH= The sizes of transistors for iniu delay are calculated as follows. The stage 4 effort is f = = Starting with the output load 5C x=7.26ff, Eq. () in [36] is applied to copute input capacitances of the stages as follows: Cin-4 = Cout-4 g 4 f =7.26fF ( ) = 24.8fF => Wn-4 = 4.5μ, Wp-4 = 9μ, =24.8fF (.682 Cin-3 = Cin-4 g 3 f Cin- = Cin-2 g f ) =.8fF => Wn-3 = Wn2-3 =Wp-3 =Wp2-3 =.57μ, Cin-2 = Cin-3 g 2 f =.8fF ( ) =.93fF => Wn-2 =.64μ, Wp-2 =.28μ, =3.5fF (.682) =.426fF = Cin=> Wn- = Wn2- =Wp- =Wp2- =.22μ. To evaluate the perforance of the circuit, the layout of the digit-serial GNB ultiplier (d=3, w=78) over GF(2 ) with 2-stage XOR tree was ipleented and post-layout siulation applied. Fig.5 shows the structure of ultiplier for this case.

11 Inputs fro NAN-Part Inputs fro AN-Part Output(232:) Output(232:) (a) (b) Fig.4: (a) ipleentation of the XOR tree for digit-serial GNB ultiplier (d=5, w=6) over GF(2 ) by the 4-input XOR gate in 4 logic stages, (b) by using 2-input XOR gates in general 5 logic stages. In the layout design, proper distribution of the clock signal is an iportant subject. Here, the ain ai in clock distribution is transitting the clock signal siultaneously to all flip-flops. There are different clock distribution ethods such as tree buffer, esh, H-tree and soe cobinations of the [47]-[49] that are used to achieve zero clock skewing. In H-tree clock distribution approach, which is a coon zero skew routing ethod, by atching the length of each path, fro clock source to flip-flop, zero skew clock routing is achieved. This is perfored by creating a series of routes with H shape. At the corners of each H the nearly identical clock signals, provide the inputs to the next level of saller H routes. To iniize reflections, the ipedance of interconnects are scaled. For an H-tree network, each route leaving a junction ust have twice the ipedance of the source route. This is accoplished by decreasing the interconnect width of each route. This continues until the final points of the H-tree structure are used to drive either the flip-flops, or local buffers that drive the flip-flops. In this work, we consider H-tree distribution for clock signal. Fig.6 shows the topology of clock distribution network based on H-tree ethod for the proposed structure of the digit-serial GNB ultiplier (d=3, w=78) over GF(2 ). A(232:) β β β b55 i78 b77 i78 i78 b23 b232 i SIC L b53 b75 b54 i b76 i SIC L SIC L Output(232:) Fig.5: Structure of the digit-serial GNB ultiplier (d=3, w=78) over GF(2 ) for layout ipleentation

12 CLK Mux_FFs Buffers Beta_NAN- SIC- & Buffer Beta_NAN-2 SIC-2 & Buffer Beta_NAN-3 SIC-3 & Buffer 4-input XOR Gates FFs & Inverters Fig.6: Topology of clock distribution network based on H-tree in the structure of the digit-serial GNB ultiplier (d=3, w=78) over GF(2 ) The layout of the proposed structure of the digit-serial GNB ultiplier (d=3, w=78) over GF(2 ) for the case of H=, C L=4.252fF is shown in Fig.7. The area of the layout is 79µ*798µ. Result of Monte Carlo analysis for the delay of the circuit is shown in Fig.8. The nuber of iterations is N=3. As the figure shows the ean value of delay is 58.48ps. Mux_FFs, Buffers & Routings Beta_NAN- SIC- & Buffer Beta_NAN-2 SIC-2 & Buffer Beta_NAN-3 SIC-3 & Buffer 4-input XOR gates & Routings FFs, Inverters & Routings Fig.7: Layout of the proposed structure of the digit-serial GNB ultiplier (d=3, w=78) over GF(2 ) for the case of H=, CL=4.252fF.

13 Fig.8: Result of Monte Carlo analysis for the delay of the proposed digit-serial GNB ultiplier (d=3, w=78) over GF(2 ) for the case of H=, CL=4.252fF and for 3 iterations. 4. Results and Coparison The proposed structures were successfully ipleented in.8μ CMOS technology. The paraeters of proposed structures and a coparison between present work and other ipleentations of the ultiplier over GF(2 ) are presented in Tables and 2. The coparisons are based on paraeters of critical path delay, calculation tie and area. The ipleentations are presented for different electrical efforts, naely, H=, 5 and 25. Table shows the results for the proposed ipleentation of digit-serial GNB ultiplier over GF(2 63 ) and GF(2 ) for both cases of applying the logical effort technique and without applying it. Table 2 copares tie and area of the proposed structures and soe previously reported structures. The reported siulation results are based on scheatic structures. The areas are estiated by suation of transistors area without considering the routing and the buffers in clock distribution. Only for the case of 2-stage structure of the digitserial GNB ultiplier (d=3, w=78) for H= and C L=4.252fF the results are obtained fro post layout siulation. Table : Critical path delay, tie and area results for the proposed ipleentation of digit-serial GNB ultiplier Methods Field Critical Path Tie (ns) C L/ H elay (ns) Area(μ 2 ) 6-stage, d=59 GF(2 63 ) 4.252fF/ stage, d=59 GF(2 63 ) 7.26fF/ stage, d=59 GF(2 63 ) 356.3fF/ stage, d=5 GF(2 63 ) 4.252fF/ stage, d=5 GF(2 63 ) 7.26fF/ stage, d=5 GF(2 63 ) 356.3fF/ stage, d=59 GF(2 ) 4.252fF/ stage, d=59 GF(2 ) 7.26fF/ stage, d=59 GF(2 ) 356.3fF/ stage, d=5 GF(2 ) 4.252fF/ stage, d=5 GF(2 ) 7.26fF/ stage, d=5 GF(2 ) 356.3fF/ stage, d=3 GF(2 ) 4.252fF/ Proposed 6-stage with LE, d=59 GF(2 63 ) 4.252fF/ Proposed 6-stage with LE, d=59 GF(2 63 ) 7.26fF/ Proposed 6-stage with LE, d=59 GF(2 63 ) 356.3fF/ Proposed 4-stage with LE, d=5 GF(2 63 ) 4.252fF/ Proposed 4-stage with LE, d=5 GF(2 63 ) 7.26fF/ Proposed 4-stage with LE, d=5 GF(2 63 ) 356.3fF/ Proposed 6-stage with LE, d=59 GF(2 ) 4.252fF/ Proposed 6-stage with LE, d=59 GF(2 ) 7.26fF/ Proposed 6-stage with LE, d=59 GF(2 ) 356.3fF/ Proposed 4-stage with LE, d=5 GF(2 ) 4.252fF/ Proposed 4-stage with LE, d=5 GF(2 ) 7.26fF/ Proposed 4-stage with LE, d=5 GF(2 ) 356.3fF/ Proposed 2-stage with LE,d=3 GF(2 ) 4.252fF/ Proposed 2-stage with LE,d=3 GF(2 ) 4.252fF/ In this case, results are achieved for post-layout siulation.

14 Table 2: Coparison of tie and area of the proposed structure and other ipleentations of the ultiplier Methods Field Technology C L/ H Tie (ns) Area(μ 2 ) [9] d=, GNB, L-SIPO GF(2 63 ) 65n [9] d=55, GNB, L-SIPO GF(2 63 ) 65n [9] d=, GNB, L-PISO GF(2 63 ) 65n [9] d=55, GNB, L-PISO GF(2 63 ) 65n [23] GNB, d=28 GF(2 63 ) 65n Proposed 6-stage with LE, d=59 GF(2 63 ) 8n 4.252fF/ Proposed 4-stage with LE, d=5 GF(2 63 ) 8n 4.252fF/ Proposed 6-stage with LE, d=59 GF(2 ) 8n 4.252fF/ Proposed 4-stage with LE, d=5 GF(2 ) 8n 4.252fF/ Proposed 2-stage with LE, d=3 GF(2 ) 8n 4.252fF/ Proposed 2-stage with LE, d=3 GF(2 ) 8n 4.252fF/ In this case, results are achieved for post-layout siulation. In [9] and [23] results of tie and area are obtained by autoatic synthesis tool esign Vision without layout. As the results show the proposed structures presented in this work when applying the logical effort technique and the 4-input XOR gate have better results copared to the general structures. 5. Conclusions An efficient VLSI ipleentation of the digit-serial Gaussian noral basis ultipliers was presented. The proposed ethods are general and applicable for high-speed hardware ipleentation of the ultiplication operation over binary finite fields. In the proposed structures by using, logical effort technique, 4-input XOR gate, and ipleentation of the AN gate blocks by using NAN gates, speed and area of the ultiplier over GF(2 63 ) and GF(2 ) have been iproved. The proposed ipleentation is applicable for ASIC ipleentation of the elliptic curves cryptosystes. References [] Ash,.W., Blake, I.F., and Vanstone, S.A., Low Coplexity Noral Bases, iscrete Applied Math., 25, 989, pp [2] IEEE P363: Editorial Contribution to standard for Public Key Cryptography, 23. [3] Federal Inforation Processing Standards Publications (FIPS) 86-2, U.S. epartent of Coerce/NIST: igital Signature Standard (SS), 2. [4] Horng, J.S., Jou, I.C. and Lee, C.Y., On coplexity of noral basis ultiplier using odified Booth s algorith, Proc. of the 7th WSEAS International Conference on Applied Inforatics and Counications, Athens, Greece, August 24-26, 27, pp.2-7. [5] Chiou, C.W., Chang, H.W., Liang, W.Y., Lee,C.Y., Lin, J.M., Yeh, Y.C., Low-coplexity Gaussian noral basis ultiplier over GF(2 ), IET Inf. Secur., Vol. 6, No. 4, 22, pp [6] Lee C.Y., Chiou, C.W., Scalable Gaussian Noral Basis Multipliers over GF(2 ) Using Hankel Matrix-Vector Representation, J Sign Process Syst, Vol. 69, No. 2, 22, pp [7] Azarderakhsh, R., and Reyhani-Masoleh, A., A Modified Low Coplexity igit-level Gaussian Noral Basis Multiplier, Proc. Third Int l Workshop Arithetic of Finite Fields (WAIFI), June 2, pp [8] Reyhani-Masoleh, A., Efficient Algoriths and Architectures for Field Multiplication Using Gaussian Noral Bases, IEEE Trans. Coputers, Vol. 55, No., Jan. 26, pp [9] Azarderakhsh, R., and Reyhani-Masoleh, A., Low-Coplexity Multiplier Architectures for Single and Hybrid-ouble Multiplications in Gaussian Noral Bases, IEEE Trans. Coput., Vol. 62, No. 4, Apr. 23, pp [] Koc C.K. and Sunar, B., An Efficient Optial Noral Basis Type II Multiplier over GF(2 ), IEEE Trans. Coputers, Vol. 5, No., Jan. 2, pp [] WunChiou, C., Lin, J.M., Li, Y.K., Lee, C.Y., Chuang, T.P., and Yeh, Y.C., Pipeline esign of Bit-Parallel Gaussian Noral Basis Multiplier over GF(2 ), Advances in Intelligent Systes and Coputing, Springer, Vol. 238, 24, pp [2] Sukcho, Y., Yeon Choi, J., A new Word-parallel bit-serial Noral basis ultiplier over GF(2 ), International Journal of control and Autoation, Vol. 6, No. 3, June 23, pp [3] Horng, J.S., Jou, I.C. and Lee, C.Y., Low-coplexity ultiplexer-based noral basis ultiplier over GF(2 ), J Zhejiang Univ Sci, Vol., No.6, 29, pp [4] Chuang, T.P., Wun Chiou, C., Lin, S.S., Lee, C.Y., Fault-tolerant Gaussian noral basis ultiplier over GF(2 ), IET Inf. Secur., 22, Vol. 6, No. 3, pp [5] Reyhani-Masoleh, A., and Hasan, M.A., Efficient igit-serial Noral Basis Multipliers over Binary Extension Fields, ACM Trans. Ebedded Coputing Systes, Vol. 3, No. 3, Aug. 24, pp [6] Wun Chiou, C., Lee, C.Y., and Yeh, Y.C., Sequential Type-I Optial Noral Basis Multiplier and Multiplicative Inverse in GF(2 ), Takang Journal of Science and Engineering, Vol. 3, No. 4, 2,pp [7] Reyhani-Masoleh, A. and Hasan, M.A., Low Coplexity Word-Level Sequential Noral Basis Multipliers, IEEE Trans. Coput., Vol. 54, No. 2, Feb. 25, pp [8] Wang, Z., Wang, X., and Fan, S., Concurrent Error etection Architectures for Field Multiplication Using Gaussian Noral Basis, Proc. of Inforation Security, Practice and Experience (ISPEC), LNCS 647, 2, pp [9] Bayat-Saradi, S., Hasan, M.A, Concurrent Error etection in Finite-Filed Arithetic Operations Using Pipelined and Systolic Architectures, IEEE Trans. Coput., Vol. 58, No., 29, pp [2] Chiou, C.W., Chang, C.C., Lee, C.Y., Lin, J.M., and Hou, T.W., Concurrent error detection and correction in Gaussian noral basis ultiplier over GF(2 ), IEEE Trans. Coput., Vol. 58, No. 6, 29, pp [2] Kwon, S., A low coplexity and a low latency bit parallel systolic ultiplier over GF(2 ) using an optial noral basis of type II, Proc. of 6th IEEE Syp. Coputer Arithetic, June 23, pp

15 [22] Lee, C. and Chang, P., igit-serial Gaussian Noral Basis Multiplier over GF(2 ) Using Toeplitz Matrix-Approach, Proc. Int l Conf. Coputational Intelligence and Software Eng. (CiSE), 29, pp. -4. [23] Azarderakhsh, R., Mozaffari Kerani, M., Bayat-Saradi, S., and Lee, C.Y., Systolic Gaussian Noral Basis Multiplier Architectures Suitable for High-Perforance Applications, IEEE Trans. on Very Large Scale Integration (VLSI) Systes, Vol. 23, No. 9, 24, pp [24] Lee, C.Y., Concurrent error detection architectures for Gaussian noral basis ultiplication over GF(2 ), Integration, the VLSI journal, Vol. 43, No., 2, pp [25] Wang, Z., Fan, S., Efficient Montgoery-based sei-systolic ultiplier for even-type GNB of GF(2 ), IEEE Trans. Coput., Vol. 6, No. 3, 22, pp [26] Hua Li, Chang Nian Zhang, Low-Coplexity Versatile Finite Field Multiplier in Noral Basis, EURASIP Journal on Applied Signal Processing 9, 22, pp [27] A. Reyhani-Masoleh and M. A. Hasan, A new construction of Massey-Oura parallel ultiplier over GF(2 ) IEEE Trans. Coputers, Vol. 5, 22, pp [28] Reyhani-Masoleh, A. and Hasan, M. A., Low Coplexity Word-Level Sequential Noral Basis Multipliers, IEEE Trans. Coputers, Vol. 54, 25, pp [29] W. Tang, H. Wu, and M. Ahadi, VLSI ipleentation of bit-parallel word-serial ultiplier in GF (2 ), Proceedings of the 3rd International EEE-NEWCAS Conference, June 25, pp [3] Bahra Rashidi, Sayed Masoud Sayedi, Reza Rezaeian Farashahi, Efficient and Low-coplexity Hardware Architecture of Gaussian Noral Basis Multiplication over GF(2 ) for Elliptic Curve Cryptosystes, IET Circuits evices Syst., Vol., Iss. 4, 26, pp. -. [3] Huapeng Wu, Bit-Parallel Finite Field Multiplier and Squarer Using Polynoial Basis, IEEE Transactions on Coputers, Vol. 5, No. 7, July 22, pp [32] Arash Reyhani-Masoleh, and M. Anwar Hasan, Low Coplexity Bit Parallel Architectures for Polynoial Basis Multiplication over GF(2 ), IEEE Transactions on Coputers, Vol. 53, No. 8, August 24, pp [33] Bahra Rashidi, Sayed Masoud Sayedi, Reza Rezaeian Farashahi, Efficient ipleentation of bit-parallel fault tolerant polynoial basis ultiplication and squaring over GF(2 ), IET Coput. igit. Tech., 25, pp. -2. [34] Bahra Rashidi, Reza Rezaeian Farashahi, Sayed Masoud Sayedi, Efficient Ipleentation of Low Tie Coplexity and Pipelined Bit-Parallel Polynoial Basis Multiplier over Binary Finite Fields, the ISC Int'l Journal of Inforation Security, Vol.7, No.2, 25, pp. -4. [35] R. Jacob Baker, CMOS Circuit esign, Layout, and Siulation, IEEE Press Series on Microelectronic Systes, John Wiley & Sons, Inc., Hoboken, New Jersey, 3st edn, 2. [36] Bahra Rashidi, Sayed Masoud Sayedi, Reza Rezaeian Farashahi, An efficient and high-speed VLSI ipleentation of optial noral basis ultiplication over GF(2 ), Integration, the VLSI Journal, Vol. 55, 26, pp [37]. Radhakrishanan, Low-voltage low-power CMOS full adder, in Proc. of IEE Circuits evices Syste, Vol. 48, 2, pp [38] Saeeid TahasbiOskuii, Coparative study on low-power high-perforance flip-flops, Master Thesis, Linköping University, 23. [39] Massio Alioto, Elio Consoli, Gaetano Palubo, Flip-Flop esign in Nanoeter CMOS, Springer International Publishing Switzerland 25. [4] U. Ko and P.T. Balsara, High-Perforance Energy-Efficient -Flip-Flop Circuits, IEEE Transaction on Very Large Scale Integration (VLSI) Systes, Vol. 8, No., 2, pp [4] Iran Ahed Khan, Mirza Tariq Beg, A New Area and Power Efficient Single Edge Triggered Flip-Flop Structure for Low ata Activity and High Frequency Applications, Innovative Systes esign and Engineering, Vol.4, No., 23, pp. -2. [42] G. Gerosa, S. Gary, C. ietz,. Pha, K. Hoover, J. Alvarez, H. Sanchez, P. Ippolito, T. Ngo, S. Litch, J. Eno, J. Golab, N. Vanderschaaf, and J. Kathle, 2.2 W, 8 MHz superscalar RISC processor, IEEE J. Solid-State Circuits, Vol. 29, ec. 994, pp [43] V. Stojanovic and V.G. Oklobdzija, Coparative Analysis of Master-Slave Latches and Flip-Flops for High-Perforance and Low- Power Systes, IEEE Journal of Solid-State Circuits, Vol. 34, No. 4, 999, pp [44] K. Singh, S.C. Tiwari and M. Gupta, A Master-Slave Flip Flop for Low Voltage Systes with Iproved Power-elay Product, World Applied Sciences Journal, Vol. 6, 22, pp [45] Veladiir Stojanovic and Vojion G. oklobdzija, Coparative analysis of Master-Slave latches and flip-flops for high-perforance and low-power syste, IEEE Journal of Solid-State circuits, Vol. 34, 999, pp [46] Ivan Sutherland and R.F. Sproull, Logical effort: esigning for speed on the back of an Envelope, IEEE Advanced Research in VLSI, MIT Press, March 99. [47] Hucydides Xanthopoulos, Clocking in Modern VLSI Systes, Series on Integrated Circuits and Systes, Springer, 29. [48] Eby G. Friedan, Clock istribution Networks in Synchronous igital Integrated Circuits, Proceedings of the IEEE, Vol. 89, No. 5, May 2, pp [49] S. Ta, S. Rusu, U. N. esai, R. Ki, J. Zhang, and I. Young, Clock Generation and istribution for the First IA-64 Microprocessor IEEE J. Solid-State Circuits, Vol. 35, 2, pp