Method and apparatus for advanced encryption standard (AES) block cipher

• US 20080240421A1
• Filed: 03/30/2007
• Published: 10/02/2008
• Est. Priority Date: 03/30/2007
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Feghali, Wajdi K., Gopal, Vinodh, Wolrich, Gilbert, Ozturk, Erdinc, Yap, Kirk S.
• Granted Patent: US 8,391,475 B2
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G06F 9/30007 to perform operations on data operands
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms

Abstract

The speed at which encrypt and decrypt operations may be performed in a general purpose processor is increased by providing a separate encrypt data path and decrypt data path. With separate data paths, each of the data paths may be individually optimized in order to reduce delays in a critical path. In addition, delays may be hidden in a non-critical last round.

Claims

1. An apparatus comprising:

an aes encrypt data path to receive data and an encrypt round key for an aes round, the aes encrypt data path to perform a sequence of round operations on the received data using the encrypt round key to provide a next encrypted data to a next aes encrypt round; and

an aes decrypt data path to receive the data and a decrypt round key for the aes decrypt round, the aes decrypt data path to perform a sequence of inverse round operations on the received data using the decrypt round key in parallel with the aes encrypt data path to provide a next decrypted data to a next aes decrypt round.

2. The apparatus of claim 1, further comprising:

a last aes encrypt round separate from the aes encrypt data path to receive a subbytes operation result for the last encrypt round and to perform an exclusive OR (XOR) operation on the subbytes operation result and the last encrypt round key to produce the encrypted result.

3. The apparatus of claim 2, further comprising:

a last aes decrypt round separate from the aes decrypt data path to receive an inverse subbytes operation result for the last decrypt round and to perform an exclusive OR (XOR) operation on the inverse subbytes operation result and the last decrypt round key to produce the decrypted result.

4. The apparatus of claim 3, further comprising:

a selector to select the encrypted result or the decrypted result dependent on a selectable mode.

5. The apparatus of claim 4, wherein the selectable mode is encrypt and the encrypted result is selected as a valid result.

6. The apparatus of claim 4, wherein the selectable mode is decrypt and the decrypted result is selected as a valid result.

7. The apparatus of claim 3, further comprising:

a first register to store the encrypted result; and

a second register to store the decrypted result.

12. The method of claim 11, wherein the selectable mode is encrypt and the encrypted result is selected as a valid result.

8. A method comprising:

in an aes encrypt data path, performing a sequence of round operations on received data using an encrypt round key to provide a next encrypted data to a next aes encrypt round; and

in an aes decrypt data path, performing a sequence of inverse round operations on the received data using a decrypt round key to provide a next decrypted data to a next aes decrypt round, the sequence of inverse round operations to be performed in parallel with the sequence of round operations.

9. The method of claim 8, further comprising:

receiving a subbytes operation result for the last encrypt round by a last aes encrypt round separate from the aes encrypt data path; and

performing an exclusive OR (XOR) operation on the subbytes operation result and the last encrypt round key to produce the encrypted result.

10. The method of claim 9, further comprising:

receiving an inverse subbytes operation result for the last decrypt round by a last aes decrypt round separate from the aes decrypt data path; and

performing an exclusive OR (XOR) operation on the inverse subbytes operation result and the last decrypt round key to produce the decrypted result.

11. The method of claim 10, further comprising:

selecting the encrypted result or the decrypted result as a valid result dependent on a selectable mode.

13. The method of claim 11, wherein the selectable mode is decrypt and the decrypted result is selected as a valid result.

14. The method of claim 10, further comprising:

storing the encrypted result in a first register; and

storing the decrypted result in a second register.

15. A system comprising:

a dynamic random access memory to store data and instructions; and

a processor coupled to said memory to execute the instructions, the processor comprising;

an execution unit to perform a sequence of operations for an aes instruction, the execution unit comprising an aes data path, the aes data path comprising;

an aes encrypt data path to receive data and an encrypt round key for an aes round, the aes encrypt data path to perform a sequence of round operations on the received data using the encrypt round key to provide a next encrypted data to a next aes encrypt round; and

an aes decrypt data path to receive the data and a decrypt round key for the aes decrypt round, the aes decrypt data path to perform a sequence of inverse round operations on the received data using the decrypt round key in parallel with the aes encrypt data path to provide a next decrypted data to a next aes decrypt round.

16. The system of claim 15, further comprising:

a last aes encrypt round separate from the aes encrypt data path to receive a subbytes operation result for the last encrypt round and to perform an exclusive OR (XOR) operation on the subbytes operation result and the last encrypt round key to produce the encrypted result.

17. The system of claim 16, further comprising:

a last aes decrypt round separate from the aes decrypt data path to receive an inverse subbytes operation result for the last decrypt round and to perform an exclusive OR (XOR) operation on the inverse subbytes operation result and the last decrypt round key to produce the decrypted result.

18. The system of claim 17, further comprising:

a selector to select the encrypted result or the decrypted result dependent on a selectable mode.