../src/lowrisc_ip_aes_0.6/rtl/aes_sbox_canright_pkg.sv Cov: 100%
1: // Copyright lowRISC contributors.
2: // Licensed under the Apache License, Version 2.0, see LICENSE for details.
3: // SPDX-License-Identifier: Apache-2.0
4: //
5: // AES Canright SBox package
6: //
7: // For details, see the following documents:
8: // - Canright, "A very compact Rijndael S-box", technical report
9: // available at https://hdl.handle.net/10945/25608
10: // - Canright, "A very compact 'perfectly masked' S-box for AES (corrected)", paper
11: // available at https://eprint.iacr.org/2009/011.pdf
12:
13: package aes_sbox_canright_pkg;
14:
15: // Multiplication in GF(2^2), using normal basis [Omega^2, Omega]
16: // (see Figure 14 in the technical report)
17: function automatic logic [1:0] aes_mul_gf2p2(logic [1:0] g, logic [1:0] d);
18: logic [1:0] f;
19: logic a, b, c;
20: a = g[1] & d[1];
21: b = (^g) & (^d);
22: c = g[0] & d[0];
23: f[1] = a ^ b;
24: f[0] = c ^ b;
25: return f;
26: endfunction
27:
28: // Scale by Omega^2 = N in GF(2^2), using normal basis [Omega^2, Omega]
29: // (see Figure 16 in the technical report)
30: function automatic logic [1:0] aes_scale_omega2_gf2p2(logic [1:0] g);
31: logic [1:0] d;
32: d[1] = g[0];
33: d[0] = g[1] ^ g[0];
34: return d;
35: endfunction
36:
37: // Scale by Omega = N^2 in GF(2^2), using normal basis [Omega^2, Omega]
38: // (see Figure 15 in the technical report)
39: function automatic logic [1:0] aes_scale_omega_gf2p2(logic [1:0] g);
40: logic [1:0] d;
41: d[1] = g[1] ^ g[0];
42: d[0] = g[1];
43: return d;
44: endfunction
45:
46: // Square in GF(2^2), using normal basis [Omega^2, Omega]
47: // (see Figures 8 and 10 in the technical report)
48: function automatic logic [1:0] aes_square_gf2p2(logic [1:0] g);
49: logic [1:0] d;
50: d[1] = g[0];
51: d[0] = g[1];
52: return d;
53: endfunction
54:
55: // Multiplication in GF(2^4), using normal basis [alpha^8, alpha^2]
56: // (see Figure 13 in the technical report)
57: function automatic logic [3:0] aes_mul_gf2p4(logic [3:0] gamma, logic [3:0] delta);
58: logic [3:0] theta;
59: logic [1:0] a, b, c;
60: a = aes_mul_gf2p2(gamma[3:2], delta[3:2]);
61: b = aes_mul_gf2p2(gamma[3:2] ^ gamma[1:0], delta[3:2] ^ delta[1:0]);
62: c = aes_mul_gf2p2(gamma[1:0], delta[1:0]);
63: theta[3:2] = a ^ aes_scale_omega2_gf2p2(b);
64: theta[1:0] = c ^ aes_scale_omega2_gf2p2(b);
65: return theta;
66: endfunction
67:
68: // Square and scale by nu in GF(2^4)/GF(2^2), using normal basis [alpha^8, alpha^2]
69: // (see Figure 19 as well as Appendix A of the technical report)
70: function automatic logic [3:0] aes_square_scale_gf2p4_gf2p2(logic [3:0] gamma);
71: logic [3:0] delta;
72: logic [1:0] a, b;
73: a = gamma[3:2] ^ gamma[1:0];
74: b = aes_square_gf2p2(gamma[1:0]);
75: delta[3:2] = aes_square_gf2p2(a);
76: delta[1:0] = aes_scale_omega_gf2p2(b);
77: return delta;
78: endfunction
79:
80: // Basis conversion matrices to convert between polynomial basis A, normal basis X
81: // and basis S incorporating the bit matrix of the SBox. More specifically,
82: // multiplication by X2X performs the transformation from normal basis X into
83: // polynomial basis A, followed by the affine transformation (substep 2). Likewise,
84: // multiplication by S2X performs the inverse affine transformation followed by the
85: // transformation from polynomial basis A to normal basis X.
86: // (see Appendix A of the technical report)
87: parameter logic [7:0] A2X [8] = '{8'h98, 8'hf3, 8'hf2, 8'h48, 8'h09, 8'h81, 8'ha9, 8'hff};
88: parameter logic [7:0] X2A [8] = '{8'h64, 8'h78, 8'h6e, 8'h8c, 8'h68, 8'h29, 8'hde, 8'h60};
89: parameter logic [7:0] X2S [8] = '{8'h58, 8'h2d, 8'h9e, 8'h0b, 8'hdc, 8'h04, 8'h03, 8'h24};
90: parameter logic [7:0] S2X [8] = '{8'h8c, 8'h79, 8'h05, 8'heb, 8'h12, 8'h04, 8'h51, 8'h53};
91:
92: endpackage
93: