Patent ID: 7295671
Filing Date: 2007-11-13
Classification: H04L

Abstract:
1. In a key generator configured to perform a key expansion routine according to the Advanced Encryption Standard (AES)—Rijndael block cipher algorithm so as to generate, from a given cipher key of Nk words, a key schedule of Nb(Nr+1) round-key words w[i], where Nb is the cipher block size in words and Nr is the number of rounds employed by the cipher algorithm, the key generator configured to generate the round-key words w[i] “on-the-fly” as needed on a round-by-round basis, the improvement comprising a method for generating round-key words “on-the-fly” in a reverse direction for use in a decrypt operation of the cipher algorithm, the method including the steps of: providing memory for storing a final set of Nk round-key words; performing the key expansion routine in a forward direction during an encrypt operation to obtain said final set of Nk round-key words and storing the same in said memory provided therefor; setting the key generator for the decrypt operation; deriving preceding round-key words w[i−Nk] “on-the-fly” by an XOR logic operation involving stored round-key words w[i] and w[i−1], wherein w[i−1] is first modified by a transformation sequence prior to applying the XOR logic operation whenever i mod Nk=0 and also whenever both Nk>6 and i mod Nk=4, the transformation sequence involving a cyclic byte shift, an S-box byte substitution and an XOR operation with a round constant when i mod Nk=0, the transformation sequence involving only an S-box byte substitution when Nk>6 and i mod Nk=4, said transformation sequence upon w[i−1] being identical in the forward and reverse directions of the key expansion routine and in accord with the AES—Rijndael block cipher algorithm; and wherein the key generator is implemented as a hardware circuit and multiple S-boxes are provided to carry out the S-box byte substitutions, each S-box having the same functionality, as specified for AES—Rijndael, but with different hardware implementations characterized by different power consumption signatures, and wherein a pseudo-random generator selects variable pathways to the different S-boxes for the various bytes to be substituted in the key expansion routine.