On-the-fly key generation for encryption and decryption

• US 9,544,133 B2
• Filed: 12/26/2009
• Issued: 01/10/2017
• Est. Priority Date: 12/26/2009
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Mathew, Sanu K., Sheikh, Farhana, Krishnamurthy, Ram K., Kounavis, Michael E., Gueron, Shay
• Primary Examiner(s): Holder, Bradley
• Assistant Examiner(s): JACKSON, JENISE E
• Application Number:
  US12/647,459
• Publication Number:
  US 20110158403A1
• Time in Patent Office: 2,572 Days
• Field of Search: 380/44
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

Methods and apparatus to provide on-the-fly key computation for Galois Field (also referred to Finite Field) encryption and/or decryption are described. In one embodiment, logic generates a cipher key, in a second cycle, based on a previous cipher key, generated in a first cycle that immediately precedes the second cycle. Other embodiments are also described.

Claims

1. An apparatus for generating new encrypt or decrypt round keys per machine cycle, the apparatus comprising:

a first logic circuit to generate a second cipher key, in a second cycle, based on a first cipher key, wherein the first cipher key is to be generated by the same first logic circuit in a first cycle that immediately precedes the second cycle, and wherein the first logic circuit is to comprise a plurality of substitution boxes to perform substitute byte operations on portions of the first cipher key to generate corresponding portions of the second cipher key;

a second logic circuit to encrypt or decrypt content data based on the second cipher key, wherein the first logic circuit is to generate the second cipher key without storing data in a shared memory and wherein the shared memory is accessible by more than a producer and a consumer;

logic circuitry to rotate a portion of the first cipher key, wherein a substitution box is to perform a substitute byte operation on the rotated portion of the first cipher key to generate a corresponding portion of the second cipher key; and

a logic block to conditionally perform an inverse mix columns operation to generate the second cipher key during a decrypt mode if the second cipher key is not a first round decrypt key or a last round decrypt key.

2. The apparatus of claim 1, wherein the first logic circuit is to generate the second cipher key in a single cycle.

3. The apparatus of claim 1, wherein the first logic circuit is to generate the second cipher key in accordance with Advanced Encryption Standard (AES).

4. The apparatus of claim 1, wherein the first logic circuit is to generate the second cipher key for one or more of mapped or native composite Galois Field encryption or decryption.

5. The apparatus of claim 1, wherein the first logic circuit is capable to generate the second cipher key in accordance with Advanced Encryption Standard (AES), AES-128, AES-192, and AES-256 modes.

6. The apparatus of claim 1, wherein the initial key is user supplied key.

7. The apparatus of claim 1, further comprising a processor that is to comprise the first logic circuit.

8. The apparatus of claim 7, wherein the processor is to comprise a plurality of processor cores and wherein at least one of the plurality of processor cores is to comprise the first logic circuit.

9. A system for generating new encrypt or decrypt round keys per machine cycle, the system comprising:

a memory to store content data;

a first logic circuit to generate a second cipher key, in a second cycle, based on a first cipher key, wherein the first cipher key is to be generated by the same first logic circuit in a first cycle that immediately follows the second cycle; and

wherein the first logic circuit is to comprise a plurality of substitution boxes to perform substitute byte operations on portions of the first cipher key to generate corresponding portions of the second cipher key;

a second logic circuit to encrypt or decrypt the content data based on the second cipher key, wherein the first logic circuit is to generate the second cipher key without storing data in a shared memory accessible by more than a producer and a consumer;

logic circuitry to rotate a portion of the first cipher key, wherein a substitution box is to perform a substitute byte operation on the rotated portion of the first cipher key to generate a corresponding portion of the second cipher key; and

a logic block to conditionally perform an inverse mix columns operation to generate the second cipher key during a decrypt mode if the second cipher key is not a first round decrypt key or a last round decrypt key.

10. The system of claim 9, further comprising an audio device coupled to the first logic circuit.