Oriental Journal of Computer Science & Technology Vol.

3(1), 83-88 (2010)

Analysis of AES hardware and software implementation

R. VELAYUTHAM¹ and D. MANIMEGALAI²

Department of Computer Science and Engineering, Einstein College of Engineering, Tirunelveli, (India).
Department of IT, National Engineering College, Kovilpatti, (India).

(Received: April 12, 2010; Accepted: June 04, 2010)

ABSTRACT

In November 2001 NIST published Rijndael as the proposed algorithm for AES(Advanced
Encryption Standard). The result of new attack methods shows that there may be some missing part in
the design of S-box and key schedule with AES algorithm. The problem is the weakness of linearity
existing in the S-box and key schedule. In order to keep away from the new attacks and implement the
AES in software and hardware provides higher level of security and faster encryption speed; we analyze
in detail the AES algorithm and propose a new implementation scheme for increasing complexity of
nonlinear transformation in design of S-box. Implementation scheme with Java and the use of
reconfigurable coprocessor as a cryptography hardware is proposed.

Keywords: AES Hardware, Software implementation.

INTRODUCTION Rijndael Algorithm

Rijndael algorithm is a symmetric block
Initially the AES algorithm was believed of cipher with a block length of 128 bits and supports
much more security and of no weakness in the ideas key lengths of 128, 192 and 256 bits. The minimum
of most people. However, recently cryptanalysts key length is 128 bits. Both block length and key
have also obtained some breaking methods on the length can be extended very easily to multiples of
AES. This paper first analyzes the AES algorithm 32 bits. The procedures of AES encryption and
and point out the weakness of linearity existing in decryption in Cipher Block Chaining (CBC) Mode
the design of S-box and key schedule from the [14] are shown in Figure 1 and 2, respectively. In
standpoint of new attack methods. Secondly, it CBC (Cipher Block Chaining) mode the input to the
proposes to improve the design of S-box to increase encryption algorithm is the XOR of the next 64 bits
its nonlinearity and complexity in the implementation of plaintext and the preceding 64 bits of cipher text.
scheme for AES. The S-box used in this scheme It finds its application in general purpose block
has stronger resistance against the new attacks oriented transmission and authentication.
than the standard one. Thirdly, this scheme is used
in the LAN for secured communication. Fourthly, it In Figure 1, the block size is 128 bits
proposes hardware design of AES where parallel according to AES specification at present. The
processing and pipelining is possible. Hardware number of rounds (Nr) depends on the length of
systems offer superior performance with higher main keys (Nk) and the number of block columns
throughput. Helion Technology claims that speed (Nb), i.e. Nr = Nk + Nb + abs (Nk-Nb), where Nk =
exceeding 16 Gbps for FPGA and 25 Gbps for ASIC 4. e.g. if Nk = 4 and Nb = 8, then Nr = 14. The round
design is available. transformation is composed of four different
transformations.
84 Velayutham & Manimegalai, Orient. J. Comp. Sci. & Technol., Vol. 3(1), 83-88 (2010)

· SubBytes Transformation: Uses an S-box form Square. The original Square attack can break
to perform a byte-by-byte substitution of the round-reduced variants of Rijndael up to 6 or 7
block. rounds (i.e. AES-128 and AES-192) faster than an
· Shift rows: A simple permutation. exhaustive key search .
· Mix columns: A substitution. (2) Weakness of the existing S-box and key
· Add round key: A simple bitwise XOR of the schedule
current block with a portion of the expanded S-box is only one component to implement
key. nonlinear transformation in the AES. The
cryptographic strength of the AES depends strongly
In the Rijndael algorithm, all steps are on the choice of S-box. Many cryptographists have
invertible. The decryption is shown in Figure 2. It is discovered that there are some weaknesses in the
classified in to the straightforward decryption design of the existing S-box. For example, Y. B. Wang
algorithm and the equivalent decryption algorithm. proved that the S-box has the properties of short
For SubBytes transformation, ShiftRows periods and bad distribution, which may be a fatal
transformation, MixColumns transformation and weakness for AES. The new way of equivalent
AddRoundKey addition, an inverse function is used generating the S-box was found by Y. A. Zhang and
in the decryption algorithm. Decryption algorithm D. G. Feng . It may be a great help to the algebraic
make use of the expanded key in the reverse order. attack. In order to make up the weakness of the
existing S-box and improve the nonlinearity of S-
The Problem of Aes Security box, W. Millan proposed to use the iterated hill
Rijndael has been designed to have very climbing be used for self-inverse S-box[15] . J. M.
strong resistance against the classical Liu, etc thought that the algebraic expression of AES
approximation attacks, such as linear cryptanalysis, S-box is very simple and fewer terms are involved
differential cryptanalysis etc. However since Rijndael [16]. They proposed to adopt a new algebraic
is derived form Square algorithm, and is very method to design the S-box. In comparison with
algebraic, new algebraic and improved differential the cipher itself, the Rijndael key schedule appears
attacks have appeared. to be more of a linear design. It has a much slower
diffusion structure than the cipher, and contains
(1) Strength against Known Attacks relatively few nonlinear elements. It can almost be
The AES specifies three key sizes, 128, described as a collection of 32 linear feedback shift
192 and 256 bits. Their number of possible keys is registers LFSRs, working in parallel. This implies
3.4 x 1038, 6.2 x 1057, and 1.1 x 1077, respectively. that for related keys, i.e., pairs of unknown keys
In comparison, DES keys are 56 bits long, which with known differences, one can in part predict the
means there are approximately 7.2 x 1016 possible differences of the individual round keys.
DES keys. Thus, there are on the order of 1021
times more AES 128-bit keys than DES 56-bit keys. Proposed Methodology
AES with 128-bit keys has stronger resistance to i) Software
an exhaustive key search than DES. Although In order to reduce the cost of
classic differential and linear attacks are invalid for implementation, we adopt the method of software
the AES, they have been extended in several ways to implement AES algorithm. In addition, Java is an
for recent years and new attacks have been object oriented programming language with many
published that are relative to them. The newest interesting security features (e.g. sandbox
attack combined boomerang and the rectangle paradigm, byte code verification) [17]. Hence, it is
attack with related-key differentials uses the proposed to implement AES in Java. Apart from its
weaknesses of few nonlinear transformations in the security, the efficiency of AES is of main interest
key schedule algorithm of ciphers, and can break for application developers. In this scheme, the
some reduced-round versions of AES. For example, speeds of data encryption and decryption are
it can break 192-bit 9-round AES by using 256 selected as the performance indices to evaluate the
different related keys. The Square attack is also valid efficiency of AES. The speed of data encryption is
for Rijndael, as Rijndael inherits many properties defined as the quotient obtained by dividing the bit
 Velayutham & Manimegalai, Orient. J. Comp. Sci. & Technol., Vol. 3(1), 83-88 (2010) 85

number of plaintext input by corresponding

encryption time in second. So is the speed of data
decryption. The scheme of the proposed
implementation uses ten data members as shown
in Fig. 3. The cipher system involves three important
methods, i.e. Key expansion shown in Fig. 4, Cipher
and InvCipher shown in Fig. 5. They implement the
function of the key schedule, data encryption and
data decryption, respectively.

Fig. 2 Decryption

Scheme:

Public void KeyExpansion()

{
this.w=new byte[Nb*(Nr+1),4];
for (int row=0;row<Nk;++row)
{
this.w[row,0]=this.key[4*row];
this.w[row,1]=this.key[4*row+1};
this.w[row,2]=this.key[4*row+2];
this.w[row,3]=this.key[4*row+3];
Fig. 1 Encryption }
byte[] temp=new byte[4];
public enum KeyLength {128 bits,i92 bits,256 bits} for (int row=Nk;row<Nb*(Nr+1);++row)
//Select the length of cipher key {
private int Nb;//Block size in word temp [0]=this.w[row-1,0];
private int Nk;//Key size in word temp [1]=this.w[row-1,1];
private int Nr;//Number of rounds temp [2]=this.w[row-1,2];
temp [3]=this.w[row-1,3];
private byte[] Key;//Cipher Key array if (row%Nk==0)
private byte[,] Sbox;//S-Box {
private byte[,] InvSbox;//Inverse S-Box temp=SubWord(RotWord(temp));
private byte[,] w;//Key schedule table temp [0]=
private byte[,] Rcon;//Round constants table (byte)((int)temp[0]^(int)this.Rcon
private byte[] State;// Intermediate Cipher result [row/Nk,0]);
pictured as array temp [1]=
(byte)((int)temp[1]^(int)this.Rcon
Fig. 3 Data Members Used in the Proposed [row/Nk,1]);
86 Velayutham & Manimegalai, Orient. J. Comp. Sci. & Technol., Vol. 3(1), 83-88 (2010)

temp [2]= (byte)((int)temp[2]^(int)this.Rcon [row/ There are two S-boxes to be designed in

Nk,2]); the proposed implementation scheme. Users can
temp [3]= (byte)((int)temp[3]^(int)this.Rcon select either of the two according to their will. Where,
[row/Nk,3]); one of them is a standard S-box described in. The
} other is an implemented S-box. In order to increase
else if (Nk>6 && (row%Nk==4)) the nonlinearity and computational complexity of S-
{ box, the improved S-box is designed by using the
temp=SubWord(temp); combination of the iterated hill climbing algorithm
} and a new algebraic method. It may have stronger
this.w[row,0]= (byte)((int) this.w[row- resistance against new attacks than the standard
Nk,0]^(int) temp[0]); S-box. How to increase the nonlinearity of key
this.w[row,1]= (byte)((int) this.w[row-Nk,1]^(int) schedule is one of the important problems that we
temp[1]); want to solve in the future. The default algorithm in
this.w[row,2]= (byte)((int) this.w[row-Nk,2]^(int) our scheme is AES with 256 bits keys. AES with
temp[2]); 256 bits keys has the highest security margin among
this.w[row,3]= (byte)((int) this.w[row-Nk,3]^(int) three standard AES variants. Users can also
temp[3]); customize an AES by using an improved S-box or /
} and expanded rounds [18]. Adding more rounds to
} Rijndael may increase the security margin to protect
from new attacks. The speed of data encryption for
Fig. 4 Method of Key Expansion in the Proposed AES using Java implementation is over that of RSA
Scheme (45.8kb/s) using hardware implementation. The
public void Encrypt(byte[] input,byte[] output) experimental results of Java implementation that
{ our scheme is feasible, and has a good performance
this.State= new byte[4,Nb]; //state=input of encryption and decryption speed.
for(int i=0;i<(4*Nb);++i)
{ ii) Hardware:
this.State[i%4,i/4]=input[i]; Currently, several hardware
} implementation methods have been designed and
AddRoundKey(0); published. There are many design choices
for(int round=1; round<=(Nr-1); ++round) encountered during hardware implementation of
{ AES. In reality, these choices will be limited to its
SubBytes(); applications and budget. From the perspective of
ShiftRows(); performance, major decision lies in the tradeoff
MixColumns(); between area and speed. For example, fast system
AddRoundKey(round); is obtained at a cost of increased area, and vice
} versa. Before looking into different hardware
SubBytes(); architectures, basic hardware concepts are defined.
ShiftRows();
AddRoundKey(Nr); Pipelining: Replicating rounds and placing registers in
for(int i=0;i<(4*Nb);++i) //output=state between - Increases throughput.
{ Iterative Looping: One round of hardware design, which
output[i]=this.state[i%4,i/4]; forces the algorithm to reuse the same hardware.
} Loop unrolling: Refers to the process of unrolling multiple
} rounds.
Latency: An elapsed time between start to finish of
Fig. 5 Methods of Data Encryption and encryption.
Decryption in the Proposed Scheme
 Velayutham & Manimegalai, Orient. J. Comp. Sci. & Technol., Vol. 3(1), 83-88 (2010) 87

Although efficiency of hardware control signals, and handling of crossing data needs
implementation was one of the evaluation criteria to be developed. Second, debugging and simulating
for choosing AES, only few hardware designs are the coprocessor design should suppor t the
presented for FPGA or ASIC platforms [9]. Analysis combination of software and hardware. Lastly,
of routing was not mentioned in most papers. For limited speed of the bus, connecting CPU and FPGA
FPGA target, routing placement is predetermined should be efficiently utilized. Designer should avoid
within the FPGA architecture and this is the cause degrading the overall system’s performance by
for greater area in FPGAs compared to ASIC analyzing these parameters. Speed of the bus is
designs. On contrary, area of ASIC designs would the major bottleneck imposed on coprocessor
be greatly affected by routing overhead, where the systems. This is similar to the memory gap between
minimum bus length is 128 bit. ASIC’s floorplan in processor and memory in the PC industry. For
[9] reports that the area estimations of routing were dividing the AES system, one idea would be to allow
off by a factor of two. Previous experience with layout the processor to compute shift operation and assign
CAD tools helped me to realize the complexity of rest to the FPGA.
routing problems and its effect on chip area. In order
to achieve optimized ASIC hardware design of AES, CPU - ShiftRow and Control
efficient routing algorithm is mandatory. FPGA - SubByte, MixColumn, and KeyAddition
Shift operations in hardware represent
FPGA Coprocessor mere wiring. Moving this function may benefit the
Previous sections examined stand alone hardware implementation due to reduced amount
AES hardware implementations. Following section of wire interconnects. In other words, decreased
describes the design which supports a coprocessor. wire parasitic and smaller routing overhead.
Organization of this architecture consists of a CPU Moreover, most of the AES function would operate
with an aid of a FPGA coprocessor. Coprocessor on the FPGA and thus minimal communication
design integrates software and hardware into a occurs between the CPU and the FPGA.
single system, along with the reconfigurable
capability of FPGA. Generally, the CPU controls the Conlusion
overall system operations while FPGA is responsible AES is a new cryptographic algorithm that
for calculations involving extensive computations. can be used to protect electronic data. Its security
Moreover, FPGA is reconfigurable that can be has attracted cryptographist’s attentions. The
reprogrammed in few milliseconds. As an example, methods of new attacks welled that the design of
consider an embedded system with a coprocessor, existing S-box some weaknesses. The principal
connected over a network using an Ethernet. weakness is the problem of linearity in the S-box
Depending on different situations, the FPGA can and key schedule. It is necessary to improve
be reprogrammed dynamically according to the real- nonlinear transformations in the design of S-box
time status [11]. This allows FPGA to dynamically and key schedule in order to protect from new
adjust to satisfy its surrounding requests. attacks. Some measures against new attacks were
adopted by improving the complexity of nonlinear
Hardware platform that was researched is transformation of S-box in the proposed
an embedded system by Wind River. The physical implementation scheme such that it increases the
setup of this board includes an IBM PowerPC and security. To increase the data encryption and
Xilinx FPGA daughter card connected through a decryption time the implemented software design
custom peripheral bus [12]. Many issues arise for is embedded with FPGA. Such that the proposed
the mixed system. First, communication between work mix of software and hardware design
the processor and the FPGA must be managed. generates an acceptable speed of data encryption
Type of communication protocol, management of and decryption and also provides security.
88 Velayutham & Manimegalai, Orient. J. Comp. Sci. & Technol., Vol. 3(1), 83-88 (2010)

REFERENCES

1. A. Elbirt, Reconfigurable Computing for serpent: A comparative analysis,” in

Symmetric-Key Algorithms, Ph.D. thesis, Cryptographic Hardware and Embedded
Depar tment of Electrical Engineering, Systems - CHES 2002, C_ . K. Ko_c and C.
Worcester Polytechnic Institute, 2002. Paar, Eds. Aug 13-15, 2002, For th
2. P.Gutmann, “An open-sourcecryptographic International Workshop, Redwood Shores,
coprocessor,” USA, pp. 144-158, Springer-Verlag.
3. K. Gaj and P. Chodowiec, \Hardware 10. J. Golic and C. Tymen, Multiplicative masking
performance of the AES finalists-Survey and and power analysis of aes,” in Cryptographic
Analysis of results,” . Hardware and Embedded Systems - CHES
4. Helion Technology,” Tech. Rep., Helion, 2003 2002, C_ . K. Ko_c and C. Paar, Eds. Aug
5. W. Trappe and L. Washington, Introduction 13-15,2002, Forth International Workshop,
to Cryptography with Coding Theory, Prentice Redwood Shores, USA, pp. 198-212,
Hall, New Jersey, 2002. Springer-Verlag.
6. S. Morioka and A. Satoh, “An optimized s- 11. “Re-Configurable Computing,” Tech. Rep.,
box circuit architecture for low power aes Wind River, August 2002, White Paper.
design,” in Cryptographic Hardware and 12. “Hardware Reference Designs for
Embedded Systems - CHES 2002, C . K. SBC405GP,” Tech. Rep., Wind River, 2001.
Koc and C. Paar, Eds. Aug 13-15, 2002, Forth 13. “Real World Experiences Designing For
International Workshop, Redwood Shores, Mixed CPU + FPGA Systems,” Tech. Rep.,
USA, pp. 172-186, Springer-Verlag. Celoxica, August 2002, White Paper.
7. B. Megarajan and S. Park, “Hardware 14. William Stallings, “Cryptography and network
implementation of aes (rijndael),” 2002, Security”, Third Edition.
Webpage. 15. W. Millan, “How to Improve the Nonlinearity
8. J.V. McCanny M. McLoone, “High of Bijective S-boxes,” Lecture Notes in
performance single-chip fpga rijndael Computer Science, vol. 1438, pp.181 - 192,
algorithm implementation,” in Cryptographic Berlin: Springer-Verlag, 1998.
Hardware and Embedded Systems - CHES 16. J. M. Liu, B. D. Wei, and X.G. Cheng,, “An
2001, C.K.Koc and C. Paar, Eds. May 14- AES S-Box to Increase Complexity and
16, 2001, Third International Workshop, Cryptographic Analysis,”..Proc. of the 19th
Paris, France, pp. 65-76, Springer-Verlag. International Conference on Advanced
9. A. Lutz, J. Treichler, F. Frkaynak, H. Kaeslin, Information Networking and Applications, pp.
G. Basler, A. Erni, S. Reichmuth, P. 724-728., Taiwan, China, 2005.
Rommens, S. Oetiker, and W. Fichtner, 17. www.wikipedia.org
“2gbit/s hardware realizations of rijndael and 18. www.csrc.nist.gov/publications