1 / 51

CprE / ComS 583 Reconfigurable Computing

CprE / ComS 583 Reconfigurable Computing. Prof. Joseph Zambreno Department of Electrical and Computer Engineering Iowa State University Lecture #9 – Applications II. Recap – FPGA-Based Router (FPX). FPX module contains two FPGAs NID – network interface device Performs data queuing

karly-mcintyre
Download Presentation

CprE / ComS 583 Reconfigurable Computing

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CprE / ComS 583Reconfigurable Computing Prof. Joseph Zambreno Department of Electrical and Computer Engineering Iowa State University Lecture #9 – Applications II

  2. Recap – FPGA-Based Router (FPX) • FPX module contains two FPGAs • NID – network interface device • Performs data queuing • RAD – reprogrammable application device • Specialized control sequences CprE 583 – Reconfigurable Computing

  3. Recap – Classification Architecture 16 bits 112 bits Flow ID [1] CAM MASK [1] CAM VALUE [1] Flow ID [2] CAM MASK [2] CAM VALUE [2] 16 bits - - CAM Table - - Flow ID Flow ID [3] CAM MASK [3] CAM VALUE [3] . . . Resulting Flow Identifier . . . . . . Flow ID [N] CAM MASK [N] CAM VALUE [N] Bits in IP Header Flow List Priority Encoder Source Port Protocol Payload Match Bits Mask Matchers Dest. Port Source Address Destination Address Value Comparators CprE 583 – Reconfigurable Computing

  4. Recap – The Wrapper Concept App Wrapper Wrapper CprE 583 – Reconfigurable Computing

  5. Outline • Recap • Cryptography on FPGA Platforms • Introduction to cryptography • Motivation • Applications • Secure hashing • Symmetric-key cryptography • Random number generation CprE 583 – Reconfigurable Computing

  6. Plaintext Ciphertext Plaintext Encryption Decryption Introduction to Cryptography • Encryption is the process of encoding a message such that its meaning is not obvious • Decryption is the reverse process, i.e., transforming an encrypted message to its original form • We denote plaintext by P and ciphertext by C • C = E(P), P = D(C) and P = D(E(P)), where E() is the encryption function (algorithm) and D() the decryption function CprE 583 – Reconfigurable Computing

  7. Terminology • Encrypt, encode, encipher are interchangeable in the context of cryptography • Same with decrypt, decode, and decipher • Cryptographer – goal is to use encryption to conceal information • Cryptanalyst – goal is to break the encryption • Cryptologist – researches into both encryption and decryption (both cryptography and cryptanalysis) • An encryption algorithm is breakable if given enough time/memory a cryptanalyst can determine the algorithm • Algorithm in this context includes the key • Is all encryption breakable? CprE 583 – Reconfigurable Computing

  8. Kerckhoff’s Principle • How do you prevent an eavesdropper from computing P, given C? • Keep the encryption algorithm E() secret • Is this a good idea? • Choose E() (and corresponding D()) from a large collection, based on secret key • Kerckhoff’s principle: assume that the potential cryptanalyst knows everything but the key C = E(K, P) and P = D(K, C) Secret Key Plaintext Ciphertext Plaintext Encryption Decryption CprE 583 – Reconfigurable Computing

  9. Motivation • Cryptography is a powerful tool for protecting systems against many types of security threats • Cryptographic functionality is needed for almost every type of computing platform: • From embedded devices to parallel machines • Wide range of area and performance requirements • FPGA technology has become a popular target for implementing cryptographic ciphers • Hardware can greatly accelerate the performance of the individual operations required • More effective development process than that for ASICs (faster, cheaper) • Reconfigurable nature offers additional advantages (algorithmic agility, upload, modification) CprE 583 – Reconfigurable Computing

  10. Application – Authentication Codes • Authentication codes provide assurance that message has not been tampered with and has indeed originated from a specific source • Independent of encryption • Impersonation Attack:Oscar introduces a message into the channel, hoping to have it accepted as authentic by Bob • Substitution Attack:Oscar observes a message Y’ in the channel which he intercepts and replaces by another message Z’ hoping to have it accepted as authentic by Bob Authentication Key Verification Key X Alice (Transmitter) Y Oscar Y’ Bob (Receiver) X’ Authentic? CprE 583 – Reconfigurable Computing

  11. m || m H Compare H E D E(H(m)) Private Key Public Key Signing With Message Digests • A message digest (or hash) function is a one-way function which produces a fixed length vector of an input block x of arbitrary length • A fixed length “fingerprint” of a message • Instead of signing message, sign the message digest CprE 583 – Reconfigurable Computing

  12. Hash Algorithm Structure CprE 583 – Reconfigurable Computing

  13. Secure Hash Algorithm (SHA) • SHA originally designed by NIST & NSA in 1993 • Revised in 1995 as SHA-1 (NIST FIPS 180-1) • Based on design of MD4 • Produces 160-bit hash values • Recent 2005 analysis on security of SHA-1 have raised concerns on its use in future applications • NIST issued revision FIPS 180-2 in 2002 • Adds 3 additional versions of SHA (SHA-256, SHA-384, SHA-512) • Designed for compatibility with increased security provided by the AES cipher • Structure and detail is similar to SHA-1 CprE 583 – Reconfigurable Computing

  14. SHA-512 Overview CprE 583 – Reconfigurable Computing

  15. SHA-512 Compression Function • Heart of the algorithm • Processing message in 1024-bit blocks • Consists of 80 rounds • Updating a 512-bit buffer • Using a 64-bit value Wt derived from the current message block • A round constant Kt that represents the first 64 bits of the fractional parts of the cube root of first 80 prime numbers CprE 583 – Reconfigurable Computing

  16. SHA-512 Round Function CprE 583 – Reconfigurable Computing

  17. 1 Gbps SHA-512 Implementation • Partial unrolling (5 rounds), pipelining • 1 Gbps on Virtex-E FPGAs • See [LieGre04A] for details CprE 583 – Reconfigurable Computing

  18. Application – Private-Key Crypto • The Advanced Encryption Standard (AES) is becoming the block cipher of choice for private-key cryptography • Implementing AES on FPGA hardware has been looked at in some depth: • Approximately 50 unique research implementations! • Various commercial cores (Actel, Helion Tech, Amphion, etc.) • Approach taken – an exploration of the decisions that lead to area/delay tradeoffs in an AES FPGA implementation • End result – pareto optimal designs in terms of throughput, latency, and area efficiency CprE 583 – Reconfigurable Computing

  19. Rn Inter-round Layout Rn1 Rn2 T1 T2 T3 T5 Throughput Latency T4 Intra-round Layout T3 T1 T2 T5 T4a T4b T4c ROM32x1 select_rom RAMB4_S16 SelectRAM+ Logic gates Technology Mapping Area Efficiency General Approach [ZamNgu04A] • Top-down design methodology incorporates decisions at several levels: • Inter-round layout • Intra-round layout • Technology mapping CprE 583 – Reconfigurable Computing

  20. General Approach (cont.) • General approach applied to an AES FPGA design targeting the Xilinx Virtex-II architecture • Familiarity with architecture and toolflow • All designs fit on Xilinx XC2V4000 or better • Implemented using a single VHDL core with user directives driving the optimizations • Results presented for AES-128E • Longer keys only require additional rounds • Decryption algorithm very similar to encryption CprE 583 – Reconfigurable Computing

  21. Overview of AES • In 1997 NIST announced an open competition for cipher designers to replace the aging Data Encryption Standard (DES) • 15 submissions • Publicly evaluated based on security, simplicity, and suitability for implementing in hardware and software • Rijndael algorithm developed by Vincent Rijmen and Joan Daemen – selected as winner in 2000 • AES is Rijndael restricted to 128-bit blocks and keys of 128, 192, or 256 bits CprE 583 – Reconfigurable Computing

  22. AES-128E Algorithm Round Transformation round++ KeyExpansion 128-bit key ShiftRows MixColumns AddRoundKey SubBytes 128-bit plaintext No round = 10? Yes 128-bit ciphertext CprE 583 – Reconfigurable Computing

  23. 51 ca 0 b7 d0 09 ba e1 cd 60 e7 53 04 63 70 8c e0 7c c8 25 98 1 83 32 89 b5 c7 ef a3 81 d1 0c 82 fd 23 37 77 aa 4f 3a 11 13 40 c9 00 b5 2c 2 93 0d 25 fb 1a 6d ec 0d dc 7d 7b 2e 8f c3 3 0a 66 26 11 ed a6 d5 06 82 43 f2 2a fa 40 4 20 18 1b 56 5f 36 92 09 00 fa 6b 5 42 3f 43 1b af 2c 12 4a c7 4a cc 6f 1b dd 20 6 41 b5 46 ed 6f 21 34 ba 25 12 25 3a 35 4a 25 a6 7 81 c5 99 45 a6 60 8c b5 8c dc 3a bb af 97 e1 6d 46 fa 20 23 c5 4f 30 55 43 4f b5 8 b5 fc 0d 9 43 43 c3 e1 00 09 aa f2 95 63 b5 01 a6 12 ee 44 ee 88 ff c7 a cb 36 aa 25 dc 1b 17 8c c3 67 b5 33 5a 0c 4a bc 1e 6d ef 57 4f ed 2b 2a 0d b b5 60 a6 0d 60 51 a6 8e 00 4a 67 33 fe 69 6f 19 04 c bc 48 b5 d 13 00 3b 84 d7 25 e1 1f 4f fd 25 2a fa 3a ba 15 1b 89 0f 43 77 ed 00 ab 60 e 09 b5 60 6f 8c 09 ba dc aa f dc 4a 73 49 20 76 51 4f a6 4a 22 5d e c 8 a 2 0 6 4 9 f 1 3 5 b 7 d x y Overview of AES (cont.) • 128-bit input is copied into a two-dimensional (4x4) byte array referred to as the state • Round transformations operate on the state array • Final state copied back into 128-bit output • AES makes use of a non-linear substitution function that operates on a single byte • Can be simplified as a look-up table (S-box) S-box CprE 583 – Reconfigurable Computing

  24. Round Transformation round++ KeyExpansion 128-bit key ShiftRows MixColumns S'0,0 S'0,1 S'0,2 S'0,3 S0,0 S0,1 S0,2 S0,3 S'1,0 S'1,2 S'1,3 S1,0 S1,2 S1,3 S'r,c Sr,c AddRoundKey SubBytes 128-bit plaintext S'2,0 S'2,1 S'2,2 S'2,3 S2,0 S2,1 S2,2 S2,3 S'3,0 S'3,1 S'3,2 S'3,3 S3,0 S3,1 S3,2 S3,3 No round = 10? Yes 128-bit ciphertext AES-128E Modules: SubBytes SubBytes • S-box transformation performed independently on each byte of the state S-box state[i] state'[i] CprE 583 – Reconfigurable Computing

  25. Round Transformation round++ KeyExpansion 128-bit key ShiftRows MixColumns AddRoundKey SubBytes 128-bit plaintext No round = 10? Yes 128-bit ciphertext AES-128E Modules: ShiftRows ShiftRows • Bytes in the last three rows of the state are shifted cyclically over variable offsets S0,0 S0,1 S0,2 S0,3 S'0,0 S'0,1 S'0,2 S'0,3 S1,0 S1,1 S1,2 S1,3 S'1,1 S'1,2 S'1,3 S'1,0 state[i] state'[i] S2,0 S2,1 S2,2 S2,3 S'2,2 S'2,3 S'2,0 S'2,1 S3,0 S3,1 S3,2 S3,3 S'3,3 S'3,0 S'3,1 S'3,2 CprE 583 – Reconfigurable Computing

  26. Round Transformation round++ KeyExpansion 128-bit key ShiftRows MixColumns AddRoundKey SubBytes 128-bit plaintext No round = 10? S'0,0 S0,0 S0,2 S'0,2 S0,3 S'0,3 S'0,1 S0,1 S'1,0 S1,0 S'1,2 S1,2 S1,3 S'1,3 S1,1 S'1,1 Yes S2,0 S'2,0 S2,2 S'2,2 S'2,3 S2,3 S2,1 S'2,1 128-bit ciphertext S'3,0 S3,0 S'3,2 S3,2 S'3,3 S3,3 S'3,1 S3,1 AES-128E Modules: MixColumns MixColumns • Modulo polynomial-basis multiplication performed on each column of the state • Can be simplified as series of AND and XOR operations {03h} state[i] state'[i] {02h} CprE 583 – Reconfigurable Computing

  27. Round Transformation round++ KeyExpansion 128-bit key ShiftRows MixColumns AddRoundKey SubBytes 128-bit plaintext No round = 10? Yes 128-bit ciphertext AES-128E Modules: AddRoundKey AddRoundKey • Words from the round-specific key are XORed into columns of the state S0,0 S0,2 S0,3 S'0,0 S'0,2 S'0,3 S0,1 S'0,1 S1,0 S1,2 S1,3 S'1,0 S'1,2 S'1,3 S1,1 S'1,1 state[i] state'[i] S2,0 S2,2 S2,3 S'2,0 S'2,2 S'2,3 S2,1 S'2,1 S3,0 S3,2 S3,3 S'3,0 S'3,2 S'3,3 S3,1 S'3,1 w[1] w[0] w[2] w[3] Rkey[i] CprE 583 – Reconfigurable Computing

  28. Round Transformation round++ KeyExpansion 128-bit key ShiftRows MixColumns AddRoundKey SubBytes 128-bit plaintext No round = 10? Yes 128-bit ciphertext AES-128E Modules: KeyExpansion KeyExpansion • Initial 128-bit key is converted into separate keys for each of the 10 required rounds • Consists of Sbox transformations and some XORs Rkey[1] Rkey[2] w[0] S w[4] Rkey[3] Rkey[4] w[1] S w[5] 128-bit key Rkey[5] Rkey[6] w[2] S w[6] Rkey[7] w[3] S w[7] Rkey[8] Rkey[9] Rkey[10] rcon CprE 583 – Reconfigurable Computing

  29. Design Decisions • Online/offline key generation • Inter-round layout decisions • Round unrolling • Round pipelining • Intra-round layout decisions • Transformation pipelining • Transformation partitioning • Technology mapping decisions • S-box synthesis as Block SelectRAM, distributed ROM primitives, or logic gates CprE 583 – Reconfigurable Computing

  30. Round Unrolling / Pipelining • Unrolling replaces a loop body (round) with N copies of that loop body • AES-128E algorithm is a loop that iterates 10 times – N є [1, 10] • N = 1 corresponds to original looping case • N = 10 is a fully unrolled implementation • Pipelining is a technique that increases the number of blocks of data that can be processed concurrently • Pipelining in hardware can be implemented by inserting registers • Unrolled rounds can be split into a certain number of pipeline stages • These transformations will increase throughput but increase area and latency CprE 583 – Reconfigurable Computing

  31. Round Unrolling / Pipelining (cont.) Unrolling factor = 10 Unrolling factor = 2 Unrolling factor = 1 Unrolling factor = 5 Round pipelining = ON R1 R2 R3 R4 R5 Input plaintext Output Ciphertext R10 R9 R8 R7 R6 CprE 583 – Reconfigurable Computing

  32. Transformation Partitioning • FPGA maximum clock frequency depends on critical logic path • Inter-round transformations can’t improve critical path • Individual transformations can be pipelined with registers similar to the rounds • Transformations that are part of the maximum delay path can be partitioned and pipelined as well • Can result in large gains in throughput with only minimal area increases CprE 583 – Reconfigurable Computing

  33. Partitioning / Pipelining (cont.) Transformation pipelining = ON Transformation partitioning = ON SubBytes ShiftRows MixColumns AddRoundKey KeyExpansionA KeyExpansionB KeyExpansion KeyExpansionC CprE 583 – Reconfigurable Computing

  34. S-box Technology Mapping • With synthesis primitives, can map the S-box lookup tables to different hardware components • Two S-boxes can fit on a single Block SelectRAM constantSSYNROMSTYLE: string:= “select_rom”; -- {logic, select_rom} entity Sboxis port(BYTE_IN: in std_logic_vector(7 downto 0); BYTE_OUT: out std_logic_vector(7 downto 0)); attribute syn_romstyle:string; attribute syn_romstyle of BYTE_OUT: signal is SSYNROMSTYLE; end Sbox; ... Sample VHDL code CprE 583 – Reconfigurable Computing

  35. Experimental Setup • FPGA target – Xilinx XC2V4000 • Medium-sized member of the Virtex-II device family • 5760 CLBs (equivalent to 23040 slices) • 120 Block SelectRAM modules, each can hold up to 18 Kbits of data • Synplify Pro 7.2.1 from Synplicity used for synthesis • ISE 5.2i from Xilinx used for the place-and-route and timing analysis CprE 583 – Reconfigurable Computing

  36. Experimental Setup (cont.) • For each design we measured: • Maximum possible clock rate – fclk • Number of utilized slices – Nslice • Number of utilized SelectRAMs – Nbram • From these base statistics we calculated maximum throughput (Tput) and the latency to encrypt a single block (Lat) • Some idea about the area efficiency can be obtained by analyzing the following metric: Eff = Tput / Nslice , measured in throughput rate (bps) per slice CprE 583 – Reconfigurable Computing

  37. Area and Performance Results • Each design is labeled UFX-PPYZ: • X – unrolling factor, X є {1, 2, 5, 10} • Y – amount of transformation partitioning and pipelining: • For Y = 0 the design has no pipelining • For Y = 1 each unrolled round is pipelined • For Y = 2 each round is split into two stages • For Y = 3 each round is split into three stages • Z – the S-box technology mapping • Z = [B] uses Block SelectRAMs • Z = [D] uses distributed ROM primitives • Z = [L] instantiates logic gates CprE 583 – Reconfigurable Computing

  38. Results: Observed Trends • Unrolling increases the number of slices by a significant amount • For the S-boxes, Block SelectRAMs perform slightly worse than the distributed ROM primitives, but there is a considerable savings in slice usage • Aggressive transformation partitioning is effective in increasing throughput CprE 583 – Reconfigurable Computing

  39. R1 Input plaintext Output Ciphertext SubBytes ShiftRows MixColumns AddRoundKey KeyExpansion Results: UF1-PP0B CprE 583 – Reconfigurable Computing

  40. R1 R2 R3 R4 R5 Input plaintext Output Ciphertext SubBytes ShiftRows MixColumns AddRoundKey KeyExpansion Results: UF5-PP0B CprE 583 – Reconfigurable Computing

  41. R1 R2 R3 R4 R5 Input plaintext SubBytes ShiftRows MixColumns AddRoundKey R10 R9 R8 R7 R6 Output Ciphertext KeyExpansion Results: UF10-PP2B CprE 583 – Reconfigurable Computing

  42. R1 R2 R3 R4 R5 Input plaintext SubBytes ShiftRows MixColumns AddRoundKey R10 R9 R8 R7 R6 Output Ciphertext KeyExpansion Results: UF10-PP3D CprE 583 – Reconfigurable Computing

  43. Application – Random Number Generation • Cryptographic applications often require good sources of random numbers: • Key generation • Initialization vectors • Types of random number generators: • Pseudo-Random Number Generators (PRNG) – appear to be random, initialized with an externally generated sequence (deterministic) • Cryptographically Secure PRNGs (CSPRNG) – a PRNG where prediction of the next input bit given a previously-generated sequence is computationally intractable • True Random Number Generators (TRNG) – output is based on some underlying physical random process CprE 583 – Reconfigurable Computing

  44. The Method [KohGaj04A] • Make use of the clock jitter in a circuit: • Variation of the significant instants of the clock • Nondeterministic, may have many sources: • Semiconductor noise • Crosstalk • Power supply variations • Electro-magnetic fields CprE 583 – Reconfigurable Computing

  45. Overall Design CprE 583 – Reconfigurable Computing

  46. Ring Oscillators Uses Propagation Delay – 130 MHz CprE 583 – Reconfigurable Computing

  47. Sampler Circuit One of the clock signals is used to sample the other signal CprE 583 – Reconfigurable Computing

  48. Sampler Output • Clock Skew(jitter) in between two clock signals is used (e.g. sampled) to generate a totally random bit • The output clock skew: • Will never be uniform • Is not simple out-out-phase behavior CprE 583 – Reconfigurable Computing

  49. Good Speed Ratios • Ring oscillators with closely matched frequencies require that a desired speed ratio must be achieved • What factors affect this achievement? • Variation in CLB speed • 7% difference between the slowest CLB and the fastest one • Sensitive to temperature and difficult for measurement • Variation in the frequency of an oscillator with the chip temperature • Close placement • To use a large number of oscillators CprE 583 – Reconfigurable Computing

  50. CLB Speed / Temperature Variation CprE 583 – Reconfigurable Computing

More Related