進階加密標準(AES)是新一代資料加解密標準，公布至今已有許多相關的研究，提出多種硬體實作的改良方法，但如何根據不同的使用需求找出適合的設計方式，就成為一項重要的問題。因此我們參考目前相關研究所提出的不同改良方法，以 parameterized IP Generator 的型式，對 AES的硬體電路設計進行 Design Space Exploration 。我們選擇能提供較高安全性的 non-feedback mode AES 架構，以 SubBytes/InvSubBytes、MixColumns/ InvMixColumns、KeyExpansion 等submodule 作為不同的設計參數，SubBytes/InvSubBytes和 MixColumns/ InvMixColumns module 分為 Integrated 與 Separate Encryption/Decryption module 兩種不同的架構，而 KeyExpansion module則分為 on the fly與 Store in Rom 兩種不同的架構，再配合 128、192、256三種不同的 KeyLength形成不同的架構，藉此組合出多種的 AES 硬體電路設計，以獲得的合成結果，對於採取不同架構設計出來的 AES IP，提供電路面積、運算效能與能源消耗三者之間的相關資訊，透過我們提供的相關合成數據，我們實作的不同設計架構的 AES IP，可以提供不同需要的使用者進行選擇，可以有效的解決上述問題。另外也提供我們在驗證過程中所使用的可自動化產生測試樣本的工具，使得 AES IP 的使用者能夠更加快速便利的進行驗證工作，使得我們設計的 AES Soft IP 能夠更快速地被進行整合使用。實驗的結果顯示，Encryption/Decryption module採用 Integrated 架構的設計，在 Throughput 低於 700MHz~1300MHz時(視KeyLength 組合不同而有變化)，會使用較少的電路面積，但隨著使用者對於 Throughput 要求的提高，電路面積上升的幅度會比 Encryption/ Decryption module 採用 Separate 架構的設計來得大。在 Power consumption 部分的情況亦相同。而在 Throughput 方面，KeyExpansion module採用 Store in Rom 架構的設計可達到的最大 Throughput，高於 KeyExpansion module 採用 On the fly 的設計。

Advanced Encryption Standard is new standard for data encryption and decryption.There is a lot of relevant research so far, but how to find out the suitable design according to the demand has become an important question. So we consult different improvement methods from relevant research, do the design space exploration of AES hardware circuit design with the modeling of parameterized IP Generator.We choose non-feedback mode AES design, which can offer higher security. Using the submodule as different design parameter such as SubBytes/InvSubBytes、MixColumns/InvMixColumns、KeyExpansion to form many kinds of AES hardware circuit. SubBytes/InvSubBytes、MixColumns/InvMixColumns module include two different structure, Integrated and Separate Encryption/Decryption module. KeyExpansion module include two different structure, on the fly and Store in Rom.There are three different keylength 128、192、256, which can form forteen different structure. We provide circuit gate count、throughput、power consumption information of different AES hardware citcuit design by the synthesis and gate-level simulation result. According to our implementation, the user can choose the suitable AES hardware circuit design method and which can solve the problem above. We also provide an automatic test pattern generator for our design verification, it makes our design can be integrated efficiently. Our experiment result show that, the design which Encryption/Decryption module use integrated structure have less circuit gate count than which Encryption/Decryption module use separate structure while throughput constraint is between 700MHz to 1300MHz (It’s depend on different keylength combination). But while the throughput constraint become higher, the circuit gate count of integrated structure rise faster than separate structure. And the situation is the same with power consumption.The maximum throughput of KeyExpansion module use store in Rom structure is higher than whcich use on the fly structure.

Chapter 1 論文簡介 1
1.1 研究背景 1
1.2 研究動機 1
1.3 研究方法 2
1.4 主要貢獻 2
Chapter 2 相關研究 4
2.1 AES Algorithm 4
2.1.1 AES Encryption 6
2.1.2 Key Expansion 8
2.1.3 AES Decryption 10
2.2 Non-feedback mode AES 設計改良探討 10
2.3 feedback mode AES 設計改良探討 14
2.3.1 Implementation of SubBytes / InvSubBytes 14
2.3.2 Implementation of MixColumns/InvMixColumns 20
2.3.3 Implementation of KeyExpansion 25
Chapter 3 AES IP Generator 設計與實作 28
3.1 AES submodule 改良方法實作比較 28
3.1.1 MixColumns / InvMixColumns module 改良方法實作比較 28
3.1.2 SubBytes / InvsubBytes module 改良方法實作比較 29
3.2 AES Encryption / Decryption module & KeyExpansion
module 設計架構 29
3.2.1 Separate Encryption / Decryption module 30
3.2.2 Integrated Encryption / Decryption module 30
3.2.3 AES KeyExpansion module 設計架構 31
3.3 AES IP 架構定義 32
3.4 The Complete AES algorithm Circuit 33
3.4.1 Using on the fly KeyExpansion module 33
3.4.2 Using store in Rom KeyExpansion module 35
3.5 Structrue of the AES IP Generator 36
3.5.1 Design Methodology 36
3.5.2 User Interface 37
Chapter 4 AES 設計空間探討 43
4.1 各種 AES IP 合成資訊整理 43
4.1.1 KeyLength_128 設計綜合分析 43
4.1.2 KeyLength_128/192 設計綜合分析 50
4.1.3 KeyLength_128/192/256 設計綜合分析 56
4.2 AES IP 特性分析 62
4.2.1 KeyExpansion module using store in Rom
架構設計特性討論 62
4.2.2 KeyExpansion module using on the fly
架構設計特性討論 63
Chapter 5 系統驗證環境 64
5.1 Provided Verification Models 64
5.2 AES IP Generator 的基本驗證策略 64
5.2.1 Random Testing 65
5.2.2 Corner Case Testing 65
5.2.3 Real Code Testing 66
5.2.4 Code Coverage Testing 66
5.2.5 Coding Style 67
5.3 FPGA Prototyping 實作與驗證 68
5.3.1 AES coprocessor Architecture 68
5.3.2 ARM coprocessor Instruction design 69
5.3.3 電路驗證的相關軟硬體工作環境 71
5.3.4 輸入/輸出介面規格 72
5.3.5 展示系統的操作程序 73
Chapter 6 應用方法與實例 75
6.1 Smart Handheld Device 75
6.2 802.11i standard 76
Chapter 7 結論與未來研究方向 77
7.1 結論 77
7.2 未來研究方向 78
參考文獻 (References) 79
Appendix A AES IP 完整合成資訊整理 81
Appendix B ESLab nLint Rules 103

參考文獻 (References)
[1].“Advanced Encryption Standard(AES)”, Federal Information Processing Standards Publication 197, November 26,2001.
[2]. Xinmiao Zhang and Keshab K. Parhi, “Implementation Approaches for the Advanced Encryption Standard Algorithm”, Circuits and Systems Magazine, IEEE , Volume: 2 , Issue: 4 , pp. 24-46, 2002.
[3]. A. Hodjat and I. Verbauwhede, “Minimum Area Cost for a 30 to 70 Gbits/s AES processor”, Proceedings. IEEE Computer society Annual Symposium on VLSI, Feb 19-20, 2004, pp.83-88.
[4]. T. F. Lin, C. P. Su, C. T. Huang and C. W. Wu, “A High-Throughput Low-Cost AES Cipher Chip”, Proceedings. IEEE Asia-Pacific Conference on ASIC, Aug. 6-8, 2002, pp.85-88.
[5]. C.C. Lu and S. Y. Tseng, “Integrated Design of AES (Advanced Encryption Standard) Encrypter and Decrypter”, IEEE Transactions on Information Theory, vol. 37, no. 5, Pages: 1241-1260, September, 2002.
[6]. Vincent Rijmen, “Efficient Implementation of the Rijndael S-box”, Available at http://www.east.kuleuven.ac.be/~rijmen/rijndael.
[7]. Xinmiao Zhang and Keshab K. Parhi, “High-Speed VLSI Architectures for the AES algorithm”, IEEE Transaction on Very Large Scale Integration (VLSI) Systems, vol. 12, no. 9, pp. 957-967, September 2004.
[8]. H. Kuo and I. Verbauwhede, “Architectural Optimization for a 1.82 Gbits/sec VLSI Implementation of the AES Rijndael Algorithm”,Proceedings CHES 2001,Paris,France,May 2001, pp.51-64.
[9]. V.Fischer, “Realization of the Round 2 Candidates Using Altera FPGA”, Proceedings. The Third AES Conference (AES3), New York, Apr. 2000.
[10]. J.H. Shim, D.W. Kim, Y.K. Kang, T.W. Kwon and J.R. Choi, “A Rijndael cryptoprocessor using shared on-the-fly key scheduler”, Proceedings of IEEE Asia-Pacific Conference on ASIC, 2002, pp. 89-92.
[11]. 鍾國煌, 針對高效能SoC 應用之資訊安全及網路協同處理器設計與實作,碩士論文,國立中山大學資訊工程學系, 2002.
[12]. Paulo Barreto and Vincent Rijmen “Rijndael ANSI C Reference Code”, Available at http://csrc.nist.gov/cryptval/.
[13]. ARM7TDMI Data Sheet , ARM Ltd., 1995.
http:// www.arm.com/pdfs/DDI0086B_710.zip
[14]. IEEE 802.11i standard, IEEE, 2004. http://ieeexplore.ieee.org/iel5/9214/29229/01318903.pdf?isnumber=29229&prod=STD&arnumber=1318903&arSt=+0_1&ared=+175&arAuthor=
[15] Verbauwhede, I.,Schaumont, P. and Kuo, H.”Design and Performance Testing of a 2.29-GB/s Rijndael Processor”, IEEE Journal of Solid-State Circuits, Volume: 38 , Issue: 3 , pp. 569-572, March 2003.
[16]. A.Rudra, P.K. Dubey, C.S. Jutla, V. Kumar, J. R. Rao, and P. Rohatgi, “Efficient Implementation of Rijndael Encryption with Composite Field Arithmetic”, Proceedings CHES 2001, Paris, France, May 2001, pp. 171-184.
[17] V. Fischer and M. Drutarovsky, “Two Methods of Rijndael Implementation in Reconfigurable Hardware”, Proceedings CHES 2001, Paris, France, May 2001, pp. 77-92.
[18] Saqib N.A., Rodriguez-Henriquez, F., and Diaz-Perez A.,”AES Algorithm Implementation – an efficient approach for sequential and pipeline architectures”, Proceedings of the Fourth Mexican International Conference Sept 8-12, 2003, pp. 126-130.
[19] A. Hodjat and I. Verbauwhede, “Speed-area trade-off for 10 to 100 Gbits/s throughput AES processor”, Conference Record of the Thirty-Seventh Asilomar Conference on Signals, Systems and Computers, Nov 9-12, 2003 pp.2147-2150.
[20] Mangard S., Aigner M. and Dominikus S., “A highly regular and scalable AES hardware architecture”, IEEE Transactions on Computers, Volume 52, Issue 4, pp. 483-491, April 2003.
[21] Panato A., Barcelos M. and Reis R., “A low device occupation IP to implement Rijndael algorithm”, Proceddings, Design, Automation and Test in Europe Conference and Exhibition, 2003 pp. 20 - 25