../src/lowrisc_ip_aes_0.6/rtl/aes_sbox_canright_pkg.sv Cov: 100%

   1: // Copyright lowRISC contributors.
   2: // Licensed under the Apache License, Version 2.0, see LICENSE for details.
   3: // SPDX-License-Identifier: Apache-2.0
   4: //
   5: // AES Canright SBox package
   6: //
   7: // For details, see the following documents:
   8: // - Canright, "A very compact Rijndael S-box", technical report
   9: //   available at https://hdl.handle.net/10945/25608
  10: // - Canright, "A very compact 'perfectly masked' S-box for AES (corrected)", paper
  11: //   available at https://eprint.iacr.org/2009/011.pdf
  12: 
  13: package aes_sbox_canright_pkg;
  14: 
  15:   // Multiplication in GF(2^2), using normal basis [Omega^2, Omega]
  16:   // (see Figure 14 in the technical report)
  17:   function automatic logic [1:0] aes_mul_gf2p2(logic [1:0] g, logic [1:0] d);
  18:     logic [1:0] f;
  19:     logic       a, b, c;
  20:     a    = g[1] & d[1];
  21:     b    = (^g) & (^d);
  22:     c    = g[0] & d[0];
  23:     f[1] = a ^ b;
  24:     f[0] = c ^ b;
  25:     return f;
  26:   endfunction
  27: 
  28:   // Scale by Omega^2 = N in GF(2^2), using normal basis [Omega^2, Omega]
  29:   // (see Figure 16 in the technical report)
  30:   function automatic logic [1:0] aes_scale_omega2_gf2p2(logic [1:0] g);
  31:     logic [1:0] d;
  32:     d[1] = g[0];
  33:     d[0] = g[1] ^ g[0];
  34:     return d;
  35:   endfunction
  36: 
  37:   // Scale by Omega = N^2 in GF(2^2), using normal basis [Omega^2, Omega]
  38:   // (see Figure 15 in the technical report)
  39:   function automatic logic [1:0] aes_scale_omega_gf2p2(logic [1:0] g);
  40:     logic [1:0] d;
  41:     d[1] = g[1] ^ g[0];
  42:     d[0] = g[1];
  43:     return d;
  44:   endfunction
  45: 
  46:   // Square in GF(2^2), using normal basis [Omega^2, Omega]
  47:   // (see Figures 8 and 10 in the technical report)
  48:   function automatic logic [1:0] aes_square_gf2p2(logic [1:0] g);
  49:     logic [1:0] d;
  50:     d[1] = g[0];
  51:     d[0] = g[1];
  52:     return d;
  53:   endfunction
  54: 
  55:   // Multiplication in GF(2^4), using normal basis [alpha^8, alpha^2]
  56:   // (see Figure 13 in the technical report)
  57:   function automatic logic [3:0] aes_mul_gf2p4(logic [3:0] gamma, logic [3:0] delta);
  58:     logic [3:0] theta;
  59:     logic [1:0] a, b, c;
  60:     a          = aes_mul_gf2p2(gamma[3:2], delta[3:2]);
  61:     b          = aes_mul_gf2p2(gamma[3:2] ^ gamma[1:0], delta[3:2] ^ delta[1:0]);
  62:     c          = aes_mul_gf2p2(gamma[1:0], delta[1:0]);
  63:     theta[3:2] = a ^ aes_scale_omega2_gf2p2(b);
  64:     theta[1:0] = c ^ aes_scale_omega2_gf2p2(b);
  65:     return theta;
  66:   endfunction
  67: 
  68:   // Square and scale by nu in GF(2^4)/GF(2^2), using normal basis [alpha^8, alpha^2]
  69:   // (see Figure 19 as well as Appendix A of the technical report)
  70:   function automatic logic [3:0] aes_square_scale_gf2p4_gf2p2(logic [3:0] gamma);
  71:     logic [3:0] delta;
  72:     logic [1:0] a, b;
  73:     a          = gamma[3:2] ^ gamma[1:0];
  74:     b          = aes_square_gf2p2(gamma[1:0]);
  75:     delta[3:2] = aes_square_gf2p2(a);
  76:     delta[1:0] = aes_scale_omega_gf2p2(b);
  77:     return delta;
  78:   endfunction
  79: 
  80:   // Basis conversion matrices to convert between polynomial basis A, normal basis X
  81:   // and basis S incorporating the bit matrix of the SBox. More specifically,
  82:   // multiplication by X2X performs the transformation from normal basis X into
  83:   // polynomial basis A, followed by the affine transformation (substep 2). Likewise,
  84:   // multiplication by S2X performs the inverse affine transformation followed by the
  85:   // transformation from polynomial basis A to normal basis X.
  86:   // (see Appendix A of the technical report)
  87:   parameter logic [7:0] A2X [8] = '{8'h98, 8'hf3, 8'hf2, 8'h48, 8'h09, 8'h81, 8'ha9, 8'hff};
  88:   parameter logic [7:0] X2A [8] = '{8'h64, 8'h78, 8'h6e, 8'h8c, 8'h68, 8'h29, 8'hde, 8'h60};
  89:   parameter logic [7:0] X2S [8] = '{8'h58, 8'h2d, 8'h9e, 8'h0b, 8'hdc, 8'h04, 8'h03, 8'h24};
  90:   parameter logic [7:0] S2X [8] = '{8'h8c, 8'h79, 8'h05, 8'heb, 8'h12, 8'h04, 8'h51, 8'h53};
  91: 
  92: endpackage
  93: