CAST-128 Hardware Macro Specification
VersionUpdate

Description

0.1

2007/09/04

Initial version is created

0.2

2007/09/25

Timing chart (Fig. 7) is fixed

1. Overview
The features of this CAST-128 hardware macro are summarized in Table 1. Detailed algorithm is
described in the RFC2144 [1] specification. Only the ECB (Electronic Code Book) mode issupported, but the other modes such as CBC (Cipher Block Chaining) can be easily supported byusing additional data buffers and a control circuit.
Table 1

CAST-128 hardware macro overview
CAST-128
Algorithm
64 bits
Data block size128 bits
Key size
Electronic Code Book (ECB)
Mode of operation
CAST128.v
Source file name
Description Language Verilog-HDL
CAST128
Top module name128 bit / 16 clock
Throughput
Pre calculation & On-the-fly
Round keys

2. I/O ports
I/O ports of the CAST-128 macro are summarized in Table 2.
Table 2 I/O ports
Port name Direction
KinDinDoutInInOut

Width

Description

1286464

Key input
Data input
Data output

KrdyIn1

DrdyIn1

When Krdy=1, a secret key is latched in an internal register,and initial key scheduling process is executed. If Drdy andKrdy assigned to be ‘1’ at the same time, Krdy=1 haspriority.
When Drdy=1, a plaintext (or ciphertext) data is latched inan internal register, and encryption (or decryption) process isstarted.
1

EncDec

In

1

RSTnIn

1EN

In

1

CLKIn

1

BSY

Out

1

Kvld

Out

1

Dvld

Out

1

Encryption and decryption are executed when EncDec=0
and EncDec=1, respectively. Bit data on the port EncDec isstored in an internal register when encryption or decryption
starts in response to Drdy=1.
Reset signal. Sequencer logic and internal registers are reset
when this signal is assigned to 0. Reset can be executed any
time when the clock signal CLK is input, even if the enable
signal EN=0.
Enable signal. When EN=1, this macro is activated.
System clock. All registers are synchronized with the risingedge of this signal.
Busy status flag. This signal is assigned to 1 during
encryption, decryption, or key generation process isexecuted. When this signal is 1, signals Drdy and Krdy areignored.
When round-key generation process is completed, this signal
becomes 1 during the next one clock cycle, and then it goes
0. Soon after that, encryption and decryption processes areready to start.
When encryption or decryption process is completed andcipher text or plain text are ready on the data output port
Dout, this signal becomes 1 during the next one clock cycle,
and then it goes 0.

3. Hardware Architecture
3.1

Top ModuleThis hardware macro consists of sequencer and two data processing modules (a key scheduler andan encryption block) as shown in Fig. 1.

Fig.1

Block Diagram of top module CAST1282

3.2

Key Scheduler

Fig. 2 shows the key scheduler, and the typical steps are described below. The first four steps are
performed with S-boxes S5~S8 and XOR operations as follows.

⎧ z 0 z1z 2 z 3 = x0 x1x 2 x3 ⊕ S 5[ xD] ⊕ S 6[ xF ] ⊕ S 7[ xC ] ⊕ S 8[ xE ] ⊕ S 7[ x8]⎪ z 4 z 5 z 6 z 7 = x8 x9 xAxB ⊕ S 5[ z 0] ⊕ S 6[ z 2] ⊕ S 7[ z1] ⊕ S 8[ z3] ⊕ S 8[ xA]⎪⎨⎪ z8 z 9 zAzB = xCxDxExF ⊕ S 5[ z 7] ⊕ S 6[ z 6] ⊕ S 7[ z 5] ⊕ S 8[ z 4] ⊕ S 5[ x9]⎪⎩ zCzDzEzF = x 4 x5 x6 x7 ⊕ S 5[ zA] ⊕ S 6[ z 9] ⊕ S 7[ zB] ⊕ S 8[ z8] ⊕ S 6[ xB]

(1)
(2)
(3)
(4)

When one equation is performed in one clock, two sets of S-boxes (S5~S8) are required, and thus
we modified Equations (1)~(4) as follows, where only one set of S-boxes are used in each equation.

⎧ z 0 z1z 2 z 3 = x0 x1x 2 x3 ⊕ S 7[ x8]⎪ z 4 z 5 z 6 z 7 = x8 x9 xAxB ⊕ S 8[ xA]⎪⎨⎪ z8 z 9 zAzB = xCxDxExF ⊕ S 5[ x9]⎪⎩ zCzDzEzF = x 4 x5 x6 x7 ⊕ S 6[ xB]

(5)
(6)
(7)
(8)

⎧ z 0 z1z 2 z 3 = z 0 z1z 2 z 3 ⊕ S 5[ xD] ⊕ S 6[ xF ] ⊕ S 7[ xC ] ⊕ S 8[ xE ]⎪ z 4 z 5 z 6 z 7 = z8 z 9 zAzB ⊕ S 5[ z 0] ⊕ S 6[ z 2] ⊕ S 7[ z1] ⊕ S 8[ z3]⎪⎨⎪ z8 z 9 zAzB = zCzDzEzF ⊕ S 5[ z 7] ⊕ S 6[ z 6] ⊕ S 7[ z 5] ⊕ S 8[ z 4]⎪⎩ zCzDzEzF = z 4 z 5 z 6 z 7 ⊕ S 5[ zA] ⊕ S 6[ z 9] ⊕ S 7[ zB] ⊕ S 8[ z8]

Fig.2

(9)
(10)
(11)
(12)

Datapath architecture for key scheduler

Fig. 3 shows the activated datapath of the key scheduler when Equations (5)~(8) are performed.
The four equations can be executed in the same clock because they do not use the same sbox.. Four3

Equations (9)~(12) are executed one by one in each cycle. The activated datapath to perform
Equation (9) is shown in Fig. 4. The following steps are executed similary by changing selection of(i) registers feeding data to Sbox, (ii) registers with which Sbox outputs are XORed, and (ii) registers
to be updated. The selections for (i) and (ii) are controlled by “sbox_selector” and those for (iii) are
done by “sequencer.”z0z1z3z3 = x0x1x3x3 S7[x8]z4z5z6z7 = x4x5x6x7 S8[xA]z8z9zAzB = x8x9xAxB S5[x9]zCzDzEzF = xCxDxExF S6[xB]x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 xA xB xC xD xE xF
8832328832328888S5S6S7S832323232z0 z1 z2 z3 z4 z5 z6 z7 z8 z9 zA zB zC zD zE zF

3.3

Fig.3

Operation of key scheduler

Fig.4

Operation of key scheduler

Encryption Block

The data path architecture of the encryption block is shown in Fig. 5. The CAST-128 hardware
macro The Fiestel-network cipher CAST-128 switches the following three round functions according4

to Table 3.
Type 1:⎧ I = (( Kmi + D) <<< Kri )⎨⎩ f = (( S1[ Ia] ⊕ S 2[ Ib]) − S 3[ Ic]) + S 4[ Id ](13)

Type 2:⎧ I = (( Kmi ⊕ D) <<< Kri )⎨⎩ f = (( S1[ Ia] − S 2[ Ib]) + S 3[ Ic]) ⊕ S 4[ Id ](14)

Type 3:⎧ I = (( Kmi − D) <<< Kri )⎨⎩ f = (( S1[ Ia] + S 2[ Ib]) ⊕ S 3[ Ic]) − S 4[ Id ](15)

Table. 3 Scheduling of round functions
Round Function
Used rounds
Type 1
1，4，7，10，13，16
Type 2
2，5，8，11，14
Type 3
3，6，9，12，15

Fig. 5

Datapath for encryption block

In order to reduce hardware resources, blocks calculating ‘I’ and ‘f’ in Equations (13)~(15) aredesigned separately , and S-boxes are shared between three round function. In Fig. 6, the former
process of ‘I’ is performed by the blocks type1_pre, type2_pre, and type3_pre, and the latter process‘f’ is done by the blocks type1_post, type2_post, and type3_post. The thick lines in Fig. 6 show theactivated datapath when the round function Type 1 is executed.

5

3.4

State Diagram

The state diagram of the CAST-128 sequencer and its description are shown in Fig. 6 and Table 4,
respectively.
done=1RSTn

Dvld=0
Kvld=1
BSY=0

Krdy=1

Drdy=1
EncDec=0

Dvld=0
Kvld=0BSY=0
Drdy=1

Krdy=1

Dvld=0
Kvld =0
BSY=1

Krdy=1

State
InitialKey schedule
Encryption
Decryption
Idle 1Idle 2

Dvld=0
Kvld=1
BSY=1

Dvld=0
Kvld=1
BSY=1
Drdy=1
EncDec=0

Fig. 6

Drdy=1
EncDec=1done=1

done=1

Drdy=1
EncDec=1

Dvld=1
Kvld=1BSY=0State diagram of sequencer logic

Table 4 Sequencer States
Description
Initial stateKey scheduling for round key generation is executed.
Encryption is performed
Decryption is performed
Idle state with invalid data on the port Dout.
Idle state with valid data on the port Dout.

4. Timing Chart
Fig. 7 shows the timing chart of the key scheduling and encryption process of the CAST-128
macro in the minimum cycles for the control signals. The operations are performed as follows.
CLK1: The sequencer logic is initialized by resetting the signal RSTn to 0.
CLK2: By asserting Krdy=1, the 128-bit secret key on the port Kin is stored to an internal register.
Soon after that, the key scheduling process is started, and the signal busy BSY is set to 1.
CLK3~130: The key scheduling takes 128 clocks, and thus the flags Kvld and BSY are set to 1 and0 in CLK130, respectively. The sequencer goes to the idling state “Idle 1.”
CLK131: The signal Drdy is set to 1, and the 64-bit plaintext is stored into an internal register.
CLK132: The encryption process is started in accordance with EncDec=0, and BSY is set to 1.
CLK133~148: The encryption takes 16 clocks, and thus it is completed in CLK148. The ciphertext
is output from the 64-bit port Dout. The flag BSY goes 0, and Dvld goes to 1. The sequencer

6

state is set to “Idle2.”
CLK149: By asserting Drdy=1, another operation is started. The 64-bit input (ciphertext) is stored
into an internal register. The decryption process is started in accordance with EncDec=1. Theflag BSY is set to 1, and Dvld goes 0.
CLK150~165: The decryption also takes 16 clocks. and thus it is completed in CLK165. The output
data (plaintext) is output from the 64-bit port Dout. The flag BSY goes 0, and Dvld is set to 1.

CLK012

128

129

130

131

132

146

147

148

149

150

163

164

RSTn
ENKin
Krdy
KvldDin
Drdy
EncDecBSY
128 clock (Key schedule)

16 clock (Encryption)

16 clock (Decryption)

Dout
Dvld

Fig. 7

Timing Chart

5. Reference[1] C. Adams, “The CAST-128 Encryption Algorithm,” RFC2144 (Informational), May 1997.

7165

166