AES Hardware Macro Specification
VersionUpdate

Description

0.1

2007/09/04

Initial version is created

0.2

2007/09/25

Decryption part is added

1. Overview
The features of this AES hardware macro were summarized in Table 1. Detailed algorithm
designed based on the FIPS 197 [1] specification. Only the ECB (Electronic Code Book) mode issupported, but the other modes such as CBC (Cipher Block Chaining) can be easily supported byusing additional data buffers and a control circuit.
Table 1
Algorithm
Data block size
Key size
Mode of operationSource file name
Description language
Top module nameThroughput
Round keys

AES hardware macro overview
AES
128 bits
128 bits
Electronic Code Book (ECB)
AES2.v
Verilog-HDL
AES
128 bit / 10 clock
Pre-calculation and On-the-fly

2. I/O ports
I/O ports of the AES macro are summarized in Table 2.
Table 2
Port name
Kin
Din
Dout

DirectionInIn
Out

Width

Description

128
128
128

Key input
Data input
Data output

Krdy

In1

Drdy

In1

I/O ports

When Krdy=1, a secret key is latched in internal register,and initial key scheduling process is executed. If Drdy andKrdy assigned to be ‘1’ at the same time, Krdy=1 haspriority.
When Drdy=1, a plaintext (or ciphertext) data is latched in1

EncDecIn1

RSTnIn1ENIn

1

CLKIn

1BSYOut

1

Kvld

Out

1

Dvld

Out

1

internal register, and encryption (or decryption) process isstarted.
Encryption and decryption are executed when EncDec=0
and EncDec=1, respectively. Bit data on the port EncDec isstored in an internal register when encryption or decryption
starts in response to Drdy=1.
Reset signal. Sequencer logic and internal registers are reset
when this signal is assigned to 0. Reset can be executed any
time when the clock signal CLK is input, even if the enable
signal EN=0.
Enable signal. When EN=1, this macro is activated.
System clock. All registers are synchronized with the risingedge of this signal.
Busy status flag. This signal is assigned to 1 during
encryption, decryption, or key generation process isexecuted. When this signal is 1, signals Drdy and Krdy areignored.
When round-key generation process is completed, this signal
becomes 1 during the next one clock cycle, and then it goes
0. Soon after that, encryption and decryption processes areready to start.
When encryption or decryption process is completed andcipher text or plain text are ready on the data output port
Dout, this signal becomes 1 during the next one clock cycle,
and then it goes 0.

3. Hardware ArchitectureThis hardware macro consists of two data processing modules, which are encryption anddecryption modules. The hardware architectures of the modules are shown in Fig.1 and Fig.2,respectively. In this hardware macro, an S-box is defined as an 8-bit input/output look-up table. The
Verilog-HDL code AES.v also contains other type of S-box implementations where a composite field
inverter [2] and the three-stage Reed-Muler logic [3] are used. A user can simply replace the S-box
block in the source code.

2

Encryption BlockDin[127:0]
32

32

32

Key Scheduler
Key[127:0]

32

32

32

AddRoundKey

3232

Key
Registers

Data
RegisterDout[127:0]

2:1

2:1

32

32

2:1

32

2:1

32

ShiftRows<<8SubBytes

SubBytes
MxCo

2:1

2:1

2:1

2:1

32-bit 32-bit 32-bit
Slice Slice Slice

Rcon [ i ]Temporary
Key Register

2:1

AddRoundKey

Fig.1

Hardware architecture of the AES encryption module.

Key Scheduler

Encryption BlockDin[127:0]
32

32

Key[127:0]

3232

32

32

AddRoundKey
2:1

2:1

2:1

2:1

32

2:1

32

2:1

2:1
KeyRegisters

2:1

DataRegister
Dout[127:0]

32

32

32

<<832

2:1

32-bit 32-bit 32-bit
Slice Slice Slice

-1

MxCo

2:1

2:1
2:1

2:1
2:1

2:1
2:1

2:1
InvShiftrows

Rcon [ i ]Temporary
Key Register

InvSubBytes

AddRoundKey

Fig.2

SubBytes

Hardware architecture of the AES decryption module.

34. Timing Chart
Fig. 3 shows the timing chart of the encryption process of the AES macro in the minimum cycles
for the control signals. The operations are performed as follows.
CLK1: The sequencer logic is initialized by resetting the signal RSTn to 0.
CLK2: By asserting Krdy=1, the 128-bit secret key on the port Kin is stored to an internal register.
CLK3: The signal Drdy is set to 1, and the 128-bit plaintext is stored into an internal register.
CLK4: The encryption process is started in accordance with EncDec=0, and BSY is set to 1.
CLK5~12: The encryption takes 10 clocks, and thus it is completed in CLK13. The ciphertext isoutput from the 128-bit port Dout. The flag BSY goes to 0, and Dvld goes to 1.

CLK012345678

910111213

1415

RSTn
EN
Kin
Krdy
Kvld
Din
Drdy
EncDecBSY

10 clockDout
Dvld

Fig. 3

Timing Chart of the encryption process.

Fig. 4 shows the timing chart of the decryption process of the AES macro in the minimum cycles
for the control signals. The operations are performed as follows.
CLK1: The sequencer logic is initialized by resetting the signal RSTn to 0.
CLK2: By asserting Krdy=1, the 128-bit secret key on the port Kin is stored to an internal register.
CLK3: Key scheduling is started in accordance with EncDec=1, and the flag BSY goes to 1.
4

CLK14: Key scheduling is finished. The flag Krdy is set to 0, Kvld goes to 1, and BSY goes to 0.
The signal Drdy is set to 1, and the 128-bit ciphertext on the port Din is stored into an internalregister.
CLK15: The decryption process is started in accordance with EncDec=1, and BSY is set to 1.
CLK16~23: The encryption takes 10 clocks, and thus it is completed in CLK24. The plaintext isoutput from the 128-bit port Dout. The flag BSY goes to 0, and Dvld goes to 1.

CLK0

12

3

11

12

13

14

15

22

23

24

25

26

RSTn
EN
Kin
Krdy
Kvld
Din
Drdy
EncDecBSY

11 clock

10 clock

Dout
Dvld

Fig. 4

Timing Chart of the decryption process.

5. Reference[1] National Institute of Standards and Technology, “FIPS PUB 197: ADVANCED ENCRYPTIONSTANDARD (AES),” Nov. 2001.
[2] Satoh, A., Morioka, S. Takano, K. and Munetoh, S., “A Compact Rijndael Hardware Architecturewith S-Box Optimization,” Advances in Cryptography - ASIACRYPT 2001, LNCS 2248, pp.239-254,
Dec. 2001.
[3] Morioka, S. and Satoh, A., “An Optimized S-Box Circuit Architecture for Low Power AES
Design,” in Proc. CHES 2002, LNCS 2523, pp.271-295, 2003.
5