1. ECE 448 – FPGA and ASIC Design with VHDLGeorge Mason University ECE 448: Lab 2 Implementing Sequential Logic in VHDL

2. Part 1: Introduction to Experiment 2: Stream Cipher Trivium Part 2: Example: Programmable LFSR-based Pseudorandom Number Generator Part 3: Hands-on Session: Simulation using ModelSim Agenda for today

3. Part 1 Introduction to Experiment 2 Stream Cipher Trivium

4. Secret-Key Ciphers key of Alice and Bob - K AB Alice Bob Network Encryption Decryption

5. Cipher Message / Ciphertext Ciphertext / Message Cryptographic Key m bits k bits Encrypt/Decrypt 1 bit

6. Block vs. stream ciphers Stream cipher memory Block cipher KK M 1, M 2, …, M n m 1, m 2, …, m n C 1, C 2, …, C n c 1, c 2, …, c n C i =f K (M i ) c i = f K (m i, m i-1, …, m 2, m 1 ) Every block of ciphertext is a function of only one corresponding block of plaintext Every block of ciphertext is a function of the current and all proceeding blocks of plaintext

7. Typical stream cipher SenderReceiver Pseudorandom Key Generator mimi plaintext cici ciphertext kiki keystream Key - K Initialization Vector - IV Pseudorandom Key Generator mimi plaintext cici ciphertext kiki keystream Key - K Initialization Vector - IV

8. Example c i = m i  k i mikicimikici 01110110101001010110101 11011101110110101110110 10101011011111111000011 message keystream ciphertext m i = c i  k i cikimicikimi 10101011011111111000011 11011101110110101110110 01110110101001010110101 ciphertext keystream message

9. Common Building Blocks of Pseudorandom Key Generators Linear Feedback Shift Register (LFSR) Non-linear Feedback Shift Register (NFSR)

10. LFSR = Linear Feedback Shift Register Example of a simple 5-stage LFSR sisi s i+1 s i+2 s i+3 s i+4 s i+5 s i+5 = s i + s i+1 + s i+3 + is used to denote XOR Notation: 1 register stage = D flip-flop

11. NFSR = Non-Linear Feedback Shift Register Example of a simple 5-stage NFSR bibi b i+1 b i+2 b i+3 b i+4 b i+5 b i+5 = b i b i+1 + b i+3 + is used to denote XOR b m b n is used to denote b m AND b n

12. eSTREAM - Contest for a new stream cipher standard, 2004-2008 PROFILE 1 Stream cipher suitable for software implementations optimized for high speed Minimum key size - 128 bits Initialization vector – 64 bits or 128 bits PROFILE 2 Stream cipher suitable for hardware implementations with limited memory, number of gates, or power supply Minimum key size - 80 bits Initialization vector – 32 bits or 64 bits

13. One of the 3 winners of the contest 80 Bit Key and IV Hardware Oriented Very simple (“trivial”) internal structure Parallelizable up to 64 bits/clock cycle Trivium Stream Cipher

14. Trivium – Internal Structure t3t3 t2t2 t1t1 s 91 s 92 s 171 s 175 s 176 s 264 s 286 s 287 s 69 Shift Register AND XOR u3u3 u1u1 u2u2

15. Pseudocode of the Keystream Generation for i = 1 to N do t1 ← s66 + s93 t2 ← s162 + s177 t3 ← s243 + s288 zi ← t1 + t2 + t3 u1 ← t1 + s91 · s92 + s171 u2 ← t2 + s175 · s176 + s264 u3 ← t3 + s286 · s287 + s69 (s1, s2,..., s93) ← (u3, s1,..., s92) (s94, s95,..., s177) ← (u1, s94,..., s176) (s178, s279,..., s288) ← (u2, s178,..., s287) end for

16. Initialization Key is placed in registers s1-s80 IV is placed in registers s94-174 Remaining bits are 0 except for 286-288 which are 1 Run for 4 complete cycles discarding keystream

17. Pseudocode of the Initialization

18. Requested Interface & Control Unit

19. Extra Credit Parallelized Architecture of Trivium

20. Parallelization of Trivium Approach: Duplicate logic in feedback loops (XOR and AND gates) Shift by two (or more) positions per clock cycle Goal: Encrypt two (or more) bits of a message per clock cycle Requires generating two (or more) bits of the corresponding keystream per clock cycle

21. Pseudocode of the Keystream Generation in a parallelized version of Trivium A 2-bit output per clock cycle for i = 1 to N/2 do t1 <- s66 + s93 t2 <- s162 + s177 t3 <- s243 + s288 t1_1 <- s65 + s92 t2_1 <- s161 + s176 t3_1 <- s242 + s287 zi <- (t1 + t2 + t3) || (t1_1 + t2_1 + t3_1) u1 <- t1 + s91 + s92 + s171 u2 <- t1 + s175 + s176 + s264 u3 <- t1 + s286 + s287 + s69 u1_1 <- t1_1 + s90 + s91 + s170 u2_1 <- t2_1 + s174 + s175 + s263 u3_1 <- t3_1 + s285 + s286 + s68 (s1,s2,...,s93) <- (u3_1,u3,s1,...,s91) (s94,s95,...,s177) <- (u1_1,u1,s94,...,s175) (s178,s279,...,s288) <- (u2_1,u2,s178,...,s286) end for

22. Part 2 Example: Programmable LFSR-based Pseudorandom Number Generator

23. c0c0 c1c1 c L-2 c L-1 sin Current_state LFSR with the Programmable Feedback Logic See source codes available on the lab web page

24. Part 3 Hands-on Session on Simulation using ModelSim