Accelerating AES Using Instruction Set Extensions for Elliptic Curve Cryptography. Stefan Tillich, Johann Großschädl

Size: px

Start display at page:

Download "Accelerating AES Using Instruction Set Extensions for Elliptic Curve Cryptography. Stefan Tillich, Johann Großschädl"

Blake Jackson
5 years ago
Views:

1 Accelerating AES Using Instruction Set Extensions for Elliptic Curve Cryptography International Workshop on Information Security & Hiding (ISH '05) Institute for Applied Information Processing and Communications () Group Faculty of Computer Science Graz University of Technology

2 Introduction NIST's Advanced Encryption Standard (AES) defines a symmetric-key cipher Lot of focus on efficient implementations (both software and hardware) Pure software vs. pure hardware implementations Our work deals with optimizing AES software implementations on 32-bit platforms with cryptographic extensions Accelerating AES using ISE for ECC 2

3 AES Overview AES_encrypt(byte in[4*4], byte out[4*4], word w[4*(nr+1)]) byte state[4,4]; state = in; AddRoundKey(state, w[0, 3]); // Initial AddRoundKey for round = 1 step 1 to Nr 1 // (Nr-1) rounds SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state, w[round*4, (round+1)*3]); end for // Last round (no MixColumns) SubBytes(state); ShiftRows(state); AddRoundKey(state, w[nr*4, (Nr+1)*3]); out = state; end s 0,0 s 0,1 s 0,2 s 0,3 s 1,0 s 1,1 s 1,2 s 1,3 s 2,0 s 2,1 s 2,2 s 2,3 s 3,0 s 3,1 s 3,2 s 3,3 State matrix Accelerating AES using ISE for ECC 3

4 AES Overview (cont'd) Each round consists of four transformations: SubBytes, ShiftRows, MixColumns, AddRoundKey ShiftRows, AddRoundKey simple to implement in software SubBytes requires a 256-byte lookup table (cannot be calculated efficiently in software on general-purpose processors) MixColumns multiplies two polynomials with coefficients in GF(2 8 ) Accelerating AES using ISE for ECC 4

5 AES Optimization Whole round (SubBytes, ShiftRows, MixColumns as lookup. Requires a lookup-table of at least 1 KB for encryption and decryption each. May be slow on systems with slow memory and no or small cache Calculate transformations: MixColumns complex -> Target for optimization Accelerating AES using ISE for ECC 5

6 32-bit AES Software Implementations Column-wise 32-bit words hold columns of the state Row-wise (Bertoni et al) 32-bit words hold rows of the state MixColumns can be implemented efficiently s 0,0 s 0,1 s 0,2 s 0,3 s 0,0 s 0,1 s 0,2 s 0,3 s 1,0 s 1,1 s 1,2 s 1,3 s 1,0 s 1,1 s 1,2 s 1,3 s 2,0 s 2,1 s 2,2 s 2,3 s 2,0 s 2,1 s 2,2 s 2,3 s 3,0 s 3,1 s 3,2 s 3,3 s 3,0 s 3,1 s 3,2 s 3,3 Accelerating AES using ISE for ECC 6

7 ECC Extensions MixColumns interprets 32-bit words as polynomials of degree 3 over GF(2 8 ) and multiplies two such polynomials ECC extensions for curves over GF(2 m ) perform similar operations efficiently Proposed extensions e.g. ISEC, PAX If ECC extensions already present, AES can be accelerated for free! Accelerating AES using ISE for ECC 7

8 ISEC ECC Extensions Unified hardware multiplier for integers and binary polynomials 72-bit accumulator (8 guard bits for integer multiply-accumulate): ACC Instructions to support arithmetic in the finite fields GF(p) and GF(2 m ) Accelerating AES using ISE for ECC 8

9 ISEC ECC Extensions for GF(2 m ) gf2mul A,B : Multiply A and B as binary polynomials of degree 31 A B ACC.hi ACC.lo gf2mac A,B : Multiply A and B as binary polynomials and add to ACC A B ACC.hi ACC.lo ACC.hi ACC.lo shacr A : shift ACC right by 32 bits, put low word into A ACC.lo ACC.hi A ACC.lo 0 ACC.hi Accelerating AES using ISE for ECC 9

10 Calculating MixColumns Multiplication of two polynomials of degree 3 over GF(2 8 ) modulo (x 4 + 1), where one of the polynomials is constant, the other is a column of the state a(x) = s 3,i x 3 + s 2,i x 2 + s 1,i x + s 0,i b(x) = 03 x x x + 02 c(x) = a(x) b(x) s 0,i s 1,i s 2,i s 3,i MSB LSB Accelerating AES using ISE for ECC 10

11 Fast MixColumns (Column-wise AES) ACC.hi ACC.lo MixColumns using ECC extensions 3 steps: Polynomial multiplication Coefficient reduction Polynomial reduction Accelerating AES using ISE for ECC 11

12 Step 1: Polynomial Multiplication s 0,i s 1,i s 2,i s 3,i s 1,i 2 s 3,i 2 s 0,i 2 s 2,i 3 s 1,i 3 s 3,i 3 s 0,i 3 s 2,i s 0,i s 1,i s 2,i s 3,i s 0,i s 1,i s 2,i s 3,i The coefficients in the state column are ordered from least significant to most significant Therefore we multiply the column by the fixed polynomial (01 x x x + 02) to get the result in the same coefficient order Using gf2mul: Result is put in ACC Accelerating AES using ISE for ECC 12

13 Step 2: Coefficient Reduction B == 01 1A 11B 1B MSBs( s 0,i s 1,i s 2,i s 3,i ) >> 7 r 1,i r 3,i r 0,i r 2,i r 1,i r 3,i r 0,i r 2,i Some of the coefficient summands may not be reduced elements of GF(2 8 ): Exactly then when MSB(s k,i ) == 1 and s k,i has been multiplied with 02 or 03 in step 1 For each of the non-reduced summands the reduction polynomial (0x11B) must be added The reduction values r k,i are calculated from the MSBs of the state bytes s k,i and added to the ACC with gf2mac Accelerating AES using ISE for ECC 13

14 Step 3: Polynomial Reduction 3 s 0,i s 0,i s 1,i s 0,i s 1,i s 2,i s 0,i s 1,i s 2,i s 3,i Polynomial modulo (x 4 + 1) means that x i mod (x 4 + 1) = x (i mod 4) Therefore the coefficients for x 4, x 5, x 6 must be added to the coefficients of x 0, x 1, x 2 respectively This is easily done by adding ACC.hi to ACC.lo Accelerating AES using ISE for ECC 14

15 MixColumns using Extensions word mask, low_word, high_word; mask = column & 0x ; // MSBs of state bytes mask = mask >> 7; // Get bits into LSBs gf2mul(column, 0x ); // Step 1 gf2mac(mask, 0x00011a1b); // Step 2 shacr(low_word); // Coefficients of x 3 -x 0 shacr(high_word); // Coefficients of x 6 -x 4 column = low_word ^ high_word; // Step 3 Accelerating AES using ISE for ECC 15

16 Fast InvMixColumns (Column-wise AES) Similar to Mix Columns A little more complicated because of the higher coefficient values of the constant polynomial (09 x 3 + 0D x 2 + 0B x + 0E) To calculate the reduction values r k,i an additional gf2mac is required Accelerating AES using ISE for ECC 16

17 InvMixColumns using Extensions word red_vals, low_word, high_word; red_vals = column & 0xE0E0E0E0; // 3 MSBs of state bytes gf2mul(red_vals, 0x090D0B0E); // Compute excessive bits shacr(low_word); shacr(high_word); low_word = low_word ^ high_word; high_word = high_word << 24; low_word = low_word >> 8; low_word = low_word ^ high_word; red_vals = low_word & 0x ; // Reduction value calculated gf2mac(column, 0x090D0B0E); // Step 1 gf2mac(red_vals, 0x11B); // Step 2 shacr(low_word); // Coefficients of x 3 -x 0 shacr(high_word); // Coefficients of x 6 -x 4 column = low_word ^ high_word; // Step 3 Accelerating AES using ISE for ECC 17

18 Row-wise AES Implementation Trades off overhead for transposition of the state matrix and a transposed key expansion with a more efficient implementation of MixColumns and InvMixColumns Can also be accelerated with ECC extensions but only minimally Accelerating AES using ISE for ECC 18

19 Practical Results SPARC V8-compatible LEON-2 embedded processor with ECC instruction set extensions (ISEC) (32x16)-bit integer/polynomial multiplier with a 72-bit accumulator gf2mul in 3 cycles, gf2mac 1 cycle with 1 delay slot Area overhead for extensions < 6 kgates Cycle counter for timing measurements Three different AES-128 implementations: Gladman, Column-oriented, Row-oriented Accelerating AES using ISE for ECC 19

20 Precomputed Key Schedule (Execution time in clock cycles) Key expansion Encryption Decryption Gladman NOTABLES* 522 1,860 3,125 Gladman NOTABLES* optimized 522 1,755 1,906 Column-oriented 497 1,672 2,962 Column-oriented optimized 497 1,257 1,576 Row-oriented 738 1,636 1,954 Row-oriented optimized 738 1,502 1,567 Speedup 23.1 % 19.8 % *i.e. No T lookup tables Best implementation without extensions Best implementation with extensions Accelerating AES using ISE for ECC 20

21 On-the-fly Key Expansion (Execution time in clock cycles) Encryption Decryption* Column-oriented 2,254 3,357 Column-oriented optimized 1,674 2,018 Row-oriented 2,328 2,433 Row-oriented optimized 2,230 2,176 Speedup 25.7 % 17.0 % *Last roundkey supplied by caller Best implementation without extensions Best implementation with extensions Accelerating AES using ISE for ECC 21

22 Practical Results (cont'd) Performance gain for AES-192 and AES-256 should be similar to AES-128 Code size between 2.5 and 3.5 KB (plain C except for optimized MixColumns/InvMixColumns); reduced by using extensions Susceptibility to side-channel attacks remains unchanged Accelerating AES using ISE for ECC 22

23 Conclusions Performance gains up to 25% for AES encryption by using ECC extensions If ECC extensions are already present, this speedup is "free" Column-oriented AES can be optimized best Accelerating AES using ISE for ECC 23

24 Further Work Design and evaluation of custom instructions explicitly designed for AES Custom instruction for SubBytes Custom instruction for MixColumns including reduction for GF(2 8 ) Accelerating AES using ISE for ECC 24

Outline. 1 Arithmetic on Bytes and 4-Byte Vectors. 2 The Rijndael Algorithm. 3 AES Key Schedule and Decryption. 4 Strengths and Weaknesses of Rijndael

Outline. 1 Arithmetic on Bytes and 4-Byte Vectors. 2 The Rijndael Algorithm. 3 AES Key Schedule and Decryption. 4 Strengths and Weaknesses of Rijndael Outline CPSC 418/MATH 318 Introduction to Cryptography Advanced Encryption Standard Renate Scheidler Department of Mathematics & Statistics Department of Computer Science University of Calgary Based in