1. RTL Design Methodology Transition from Pseudocode & Interface
Lecture 2B
RTL Design Methodology
Transition from
Pseudocode & Interface
to a Corresponding Block Diagram

2. Structure of a Typical Digital System
Data Inputs
Control & Status Inputs
Control
Signals
Datapath
(Execution
Unit)
Controller
(Control
Unit)
Status
Signals
Data Outputs
Control & Status Outputs

3. Hardware Design with RTL VHDL
Pseudocode
Interface
Datapath
Controller
ASM
chart
Block
diagram
VHDL code
VHDL code

4. Steps of the Design Process Introduced in Class Today
Text description
Interface
Pseudocode
Block diagram of the Datapath
Interface divided into Datapath and Controller
ASM chart of the Controller
RTL VHDL code of the Datapath, Controller, and Top-level Unit
Testbench for the Datapath, Controller, and Top-Level Unit
Functional simulation and debugging
Synthesis and post-synthesis simulation
Implementation and timing simulation
Experimental testing using FPGA board

5. Class Exercise 2
CIPHER

6. Pseudocode
Split input I into four words, I3, I2, I1, I0, of the size of w bits each
A = I3; B = I2; C = I1; D=I0
B = B + S[0]
D = D + S[1]
for i = 1 to r do {
T = (B*(2B + 1)) <<< k
U = (D*(2D + 1)) <<< k
A = ((A ⊕ T) <<< U) + S[2i]
C = ((C ⊕ U) <<< T) + S[2i + 1]
(A, B, C, D) = (B, C, D, A) }
A = A + S[2r + 2]
C = C + S[2r + 3]
O = (A, B, C, D)

7. Notation w: word size, e.g., w=8 (constant) k: log2(w) (constant)
A, B, C, D, U, T: w-bit variables
I3, I2, I1, I0: Four w-bit words of the input I
r: number of rounds (constant)
O: output of the size of 4w bits
S[j] : 2r+4 round keys stored in two RAMs.
Each key is a w-bit word.
The first RAM stores values of S[j=2i], i.e., only round keys
with even indices. The second memory stores values of
S[j=2i+1], i.e., only round keys with odd indices.

8. Operations ⊕ : XOR + : addition modulo 2w – : subtraction modulo 2w
* : multiplication modulo 2w
X <<< Y : rotation of X to the left by the number of positions
given in Y
X >>> Y : rotation of X to the right by the number of positions
(A, B, C, D) : Concatenation of A, B, C, and D.

9. Circuit Interface CIPHER clk reset O I write_I DONE Sj Write_Sj j 4wm

10. Interface Table
Note:
m is a size of index j. It is a minimum integer, such that 2m -1  2r+3.

11. Protocol (1) An external circuit first loads all round keys
S[0], S[1], S[2], …, S[2r+2], [2r+3]
to the two internal memories of the CIPHER unit.
The first memory stores values of S[j=2i], i.e., only round
keys with even indices. The second memory stores values of
S[j=2i+1], i.e. only round keys with odd indices.
Loading round keys is performed using inputs: Sj, j, write_Sj, clk.
Then, the external circuits, loads an input block I to the
CIPHER unit, using inputs: I, write_I, clk.
After the input block I is loaded to the CIPHER unit,
the encryption starts automatically.

12. Protocol (2)
When the encryption is completed, signal DONE becomes active,
and the output O changes to the new value of the ciphertext.
The output O keeps the last value of the ciphertext at the output,
until the next encryption is completed. Before the first encryption
is completed, this output should be equal to zero.

13. Assumptions
• 2r+4 clock cycles are used to load round keys to internal RAMs
one round of the main for loop of the pseudocode executes in one clock cycle
• you can access only one position of each internal memory of round keys per clock cycle
As a result, the encryption of a single input block I
should last r+2 clock cycles.

14. Typical Internal Structure of a Secret-Key Block Cipher
Round Key[0]
Initial Transformation
i:=1
Round Key[i]
Cipher Round
i:=i+1
#rounds
times
i<#rounds?
Round Key[#rounds+1]
Final Transformation

15. (no Initial Transformation, no Final Transformation)
Basic iterative architecture
(no Initial Transformation, no Final Transformation)
input
multiplexer
register
round
key
combinational
logic
one
round
output

16. Basic architecture: Timing
CLK P1 P2 P3 IN C1 C2
OUT
#rounds · clock_period

17. Primary parameters of hardware implementations
of secret-key block ciphers
Latency
Throughput
Mi+2 Mi
Mi+1 Mi
Time to
encrypt/decrypt
a single block
of data
Encryption/
decryption
Encryption/
decryption
Number of bits
encrypted/decrypted
in a unit of time
Ci+2 Ci
Ci+1 Ci

18. Advanced Encryption Standard
AES

19. AES Encryption

20. AES Decryption

21. Basic Iterative Architecture of AES (Encryption and Decryption)
Data input
round key
Encryption circuit
Decryption circuit R1
SubBytes
&
InvSubBytes
ShiftRows
InvShiftRows
round key
MixColumns
round key
round key
InvMixColumns
Data output

22. Initial Transformation
Data input
Initial Transformation
round key
Encryption
input
Decryption
input
round
key
round
key
Encryption round
Decryption round
Encryption
feedback
output
Encryption
final
output
Decryption
final
output
Decryption
feedback
output
Data output

23. Top Level Block Diagram
control
input
key
input interface
Control
unit
key
scheduling
encryption/decryption
memory of
round keys
output interface
output

24. Modes of Operation

25. Block vs. stream ciphers
M1, M2, …, Mn
m1, m2, …, mn
Internal state - IS
Block
cipher K K
Stream
cipher
C1, C2, …, Cn
c1, c2, …, cn
Ci=fK(Mi)
ci = fK(mi, ISi) ISi+1=gK(mi, ISi)
Every block of ciphertext
is a function of the current block
of plaintext and the current internal state
of the cipher
Every block of ciphertext
is a function of only one
corresponding block of plaintext

26. Typical stream cipher Sender Receiver initialization vector (seed)
key
key
Pseudorandom
Key
Generator
Pseudorandom
Key
Generator ki
keystream ki
keystream mi ci ci mi
plaintext
ciphertext
ciphertext
plaintext

27. turned into a stream ciphers
Standard modes of operation of block ciphers
Block cipher
Block cipher
turned into a stream ciphers
ECB mode
Counter mode
CFB mode
CBC mode

28. ECB (Electronic CodeBook) mode

29. Electronic CodeBook Mode – ECB
Encryption M1 M2 M3
MN-1 MN K K K K K E E E E E
. . . C1 C2 C3
CN-1 CN
Ci = EK(Mi) for i=1..N

30. Electronic CodeBook Mode – ECB
Decryption C1 C2 C3
CN-1 CN K K K K K D D D D D
. . . M1 M2 M3
MN-1 MN
Ci = EK(Mi) for i=1..N

31. Counter Mode

32. Counter Mode - CTR EncryptionIV
IV+1
IV+2
IV+N-2
IV+N-1
. . . K K K K K E E E E E
. . . k1 k2 k3
kN-1 kN m1 m2 m3
mN-1 mN c1 c2 c3
cN-1 cN
ci = mi  ki
ki = EK(IV+i-1) for i=1..N

33. Counter Mode - CTR DecryptionIV
IV+1
IV+2
IV+N-2
IV+N-1
. . . K K K K K E E E E E
. . . k2 kN k1 k3
kN-1 c1 c2 c3
cN-1 cN m1 m2 m3
mN-1 mN
mi = ci  ki
ki = EK(IV+i-1) for i=1..N

34. (simplified block diagram)
Counter Mode – CTR
(simplified block diagram) IV IV
counter
counter
ISi
ISi IN IN K E K E
OUT
OUT ci ci
IS1 = IV
ci = EK(ISi)  mi
ISi+1 = ISi+1 mi mi

35. Counter Mode – Potential for Parallel ProcessingIV
IV+1
IV+2
IV+N-1
IV+N
. . . E E E E E
. . . M0 M1 M2
MN-1 MN C1 C2 C3
CN-1 CN
Ci = Mi  AES(IV+i) for i=0..N

36. Increasing speed by parallel processing
Encryption/
decryption
unit
Encryption/
decryption
unit
Encryption/
decryption
unit
Encryption/
decryption
unit
Encryption/
decryption
unit
Encryption/
decryption
unit

37. Increasing speed using pipelining
Cipher 1
Cipher 2
round 1
round 1
round 2
. . .
target
clock
period,
e.g., 20 ns
. . .
round 10
round 16
block size
Throughput =
target_clock_period

38. CFB (Cipher FeedBack) Mode

39. Cipher Feedback Mode - CFB
Encryption IV
. . . E E E E E
. . . k1 k2 k3
kN-1 kN m1 m2 m3
mN-1 mN c1 c2 c3
cN-1 cN
ci = mi  ki
ki =EK(ci-1) for i=1..N, and c0 = IV

40. Cipher Feedback Mode - CFB
Decryption IV
. . . E E E E E
. . . k1 k2 k3
kN-1 kN m1 m2 m3
mN-1 mN c1 c2 c3
cN-1 cN
mi = ci  ki
ki =EK(ci-1) for i=1..N, and c0 = IV

41. Cipher Feedback Mode – CFB (simplified block diagram)IV IV
register
register
ISi
ISi IN IN K E K E
IS1 = IV
ci = EK(ISi)  mi
ISi+1 = ci
OUT
OUT ci ci mi mi

42. CBC (Cipher Block Chaining) Mode

43. Cipher Block Chaining Mode - CBC
Encryption m1 m2 m3
mN-1 mN
. . . IV E E E E E
. . . c1 cN c2 c3
cN-1
ci = EK(mi  ci-1) for i=1..N c0=IV

44. Cipher Block Chaining Mode - CBC
Decryption c1 c2 c3
cN-1 cN D D D D D
. . .
. . . IV m1 m2 m3
mN-1 mN
mi = DK(ci)  ci-1 for i=1..N c0=IV