Flexible architecture and instruction for advanced encryption standard (AES)

• US 20080240426A1
• Filed: 03/28/2007
• Published: 10/02/2008
• Est. Priority Date: 03/28/2007
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Feghali, Wajdi K., Gopal, Vinodh, Dixon, Martin G., Gueron, Shay, Kounavis, Michael E., Raghunandan, Makaram, Chennupaty, Srinivas
• Granted Patent: US 8,538,015 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: G06F 12/0862 with prefetch
• CPC Class Codes: G06F 12/0875 with dedicated cache, e.g. instruction or stack
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: G06F 2212/452 Instruction code
• CPC Class Codes: G06F 2212/454 Vector or matrix data
• CPC Class Codes: G06F 2212/602 Details relating to cache prefetching
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0665 at area level, e.g. provisioning of virtual or logical volumes
• CPC Class Codes: G06F 3/0689 Disk arrays, e.g. RAID, JBOD
• CPC Class Codes: G06F 9/30007 to perform operations on data operands
• CPC Class Codes: G06F 9/30036 Instructions to perform operations on packed data, e.g. vector, tile or matrix operations
• CPC Class Codes: G06F 9/30047 Prefetch instructions; cache control instructions
• CPC Class Codes: G06F 9/30145 Instruction analysis, e.g. decoding, instruction word fields
• CPC Class Codes: G06F 9/30178 of compressed or encrypted instructions
• CPC Class Codes: G06F 9/3802 Instruction prefetching
• CPC Class Codes: G06F 9/3818 Decoding for concurrent execution
• CPC Class Codes: G06F 9/3887 controlled by a single instruction for multiple data lanes [SIMD]
• CPC Class Codes: G06F 9/3895 : for complex operations, e.g. multidimensional or interleaved address generators, macros
• CPC Class Codes: G11C 7/1072 : for memories with random access ports synchronised on clock signal pulse trains, e.g. synchronous memories, self timed memories
• CPC Class Codes: H04L 2209/12 : Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/24 : Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0631 : Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0816 : Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

A flexible aes instruction set for a general purpose processor is provided. The instruction set includes instructions to perform a “one round” pass for aes encryption or decryption and also includes instructions to perform key generation. An immediate may be used to indicate round number and key size for key generation for 128/192/256 bit keys. The flexible aes instruction set enables full use of pipelining capabilities because it does not require tracking of implicit registers.

Claims

1. An apparatus comprising:

a key scheduler, the key scheduler to generate a round key for an aes round associated with an aes round key operation based on a received key and

aes round logic to perform one of a plurality of aes round operations to compute a result of an aes operation on an input to the aes round and the round key for the aes round to provide a next input to a next aes round or the result of the aes operation.

2. The apparatus of claim 1, wherein the round key is stored in a data cache.

3. The apparatus of claim 2, wherein the key scheduler to pre-compute all round keys for the aes operation and to store all round keys in the data cache prior to starting the aes operation and the aes round logic to perform each aes round operation using the pre-computed round keys stored in the data cache.

4. The apparatus of claim 2, wherein an aes round operation to cause the execution unit to:

perform an exclusive OR (XOR) operation on an input to the round and the round key for the aes round to produce an intermediate value;

perform a substitution operation for each byte in the intermediate value based on values stored in a lookup table; and

pass results of the substitution operation through a bit-linear transform that shifts rows in the intermediate value.

5. The apparatus of claim 1, wherein an aes round operation for a number of aes rounds-1 to cause the execution unit to:

perform an exclusive OR (XOR) operation on the input to the aes round and the round key for the aes round to produce an intermediate value;

perform a substitution operation for each byte in the intermediate value based on values stored in a lookup table;

pass results of the substitution operation through a bit-linear transform that shifts rows in the intermediate value; and

pass results of the substitution operation through bit linear transform that mixes columns in the intermediate value.

6. The apparatus of claim 5, wherein an aes round operation for a last round to cause the execution unit to:

perform an exclusive OR (XOR) operation on an input to the round and the round key for the aes round to produce an intermediate value;

perform a substitution operation for each byte in the intermediate value based on values stored in a lookup table; and

pass results of the substitution operation through a bit-linear transform that shifts rows in the intermediate value.

7. The apparatus of claim 1, wherein the result is an encrypted value.

8. The apparatus of claim 1, wherein the result is a decrypted value.

9. The apparatus of claim 1, wherein the key and the input for the first aes round are stored in a register file.

10. The apparatus of claim 9, wherein the register file includes a plurality of 128-bit registers.

11. A method comprising:

generating a round key for an aes round associated with an aes round key operation based on a received key;

performing the aes round operation on an input to the aes round and the round key for the aes round to provide a next input to a next aes round or the result of the aes operation.

12. The method of claim 11, further comprising:

storing the generated round key in a data cache

13. The method of claim 11, wherein generating the round key further comprising:

pre-computing all round keys for the aes operation;

storing all round keys in the data cache prior to starting the aes operation; and

performing each aes round operation using the pre-computed round keys stored in the data cache.

14. The method of claim 13, wherein performing the aes round operation comprises:

performing an exclusive OR (XOR) operation on an input to the round and the round key for the aes round to produce an intermediate value;

performing a substitution operation for each byte in the intermediate value based on values stored in a lookup table; and

passing results of the substitution operation through a bit-linear transform that shifts rows in the intermediate value.

15. The method of claim 11, wherein performing the aes round operation for the number of rounds-1 comprises:

performing an exclusive OR (XOR) operation on the input to the aes round and the round key for the aes round to produce an intermediate value;

performing a substitution operation for each byte in the intermediate value based on values stored in a lookup table;

passing results of the substitution operation through a bit-linear transform that shifts rows in the intermediate value; and

passing results of the substitution operation through bit linear transform that mixes columns in the intermediate value.

16. The method of claim 14, wherein performing the aes round operation for a last aes round comprises:

performing an exclusive OR (XOR) operation on an input to the round and the round key for the aes round to produce an intermediate value;

performing a substitution operation for each byte in the intermediate value based on values stored in a lookup table; and

passing results of the substitution operation through a bit-linear transform that shifts rows in the intermediate value.

17. The method of claim 11, wherein the result is an encrypted value.

18. The method of claim 11, wherein the result is a decrypted value.

19. The method of claim 11, wherein the key and the input for a first aes round are stored in a register file.

20. The method of claim 20, wherein the register file includes a plurality of 128-bit registers.

21. An article including a machine-accessible medium having associated information, wherein the information, when accessed, results in a machine performing:

generating a round key for an aes round associated with an aes round key operation based on a received key; and

performing the aes round operation on an input to the aes round and the round key for the aes round to provide a next input to a next aes round or the result of the aes operation.

22. The article of claim 21, further comprising:

storing the generated round key in a data cache

23. The article of claim 21, wherein if the number of aes rounds is equal to 1, prior to performing the sequence of aes round operations, loading a pre-computed round key for the aes round based on the key.

24. A system comprising:

a dynamic random access memory to store data and instructions; and

a processor coupled to said memory to execute the instructions, the processor comprising;

a key scheduler, the key scheduler to generate a round key for an aes round associated with an aes round key operation based on a received key; and

aes round logic to perform one of a plurality of aes round operations to compute a result of an aes operation on an input to the aes round and the round key for the aes round to provide a next input to a next aes round or the result of the aes operation.

25. The system of claim 24, wherein the round key is stored in a data cache.

26. The system of claim 24, wherein the key scheduler to pre-compute all round keys for the aes operation and to store all round keys in the data cache prior to starting the aes operation and the aes round logic to perform each aes round operation using the pre-computed round keys stored in the data.