MISTY1 Hardware Macro Specification
VersionUpdate

Description

0.1

2007/09/16

Initial version is created

0.1.1

2007/09/21

Timing chart (Fig. 6) is fixed

0.2

2007/09/25

Translated

1. Overview
1.1.

Hardware macro overview

The features of this MISTY1 hardware macro are summarized in Table 1. Only the ECB(Electronic Code Book) mode is supported, but the other modes such as CBC (Cipher Block
Chaining) can be easily supported by using additional data buffers and a control circuit.
Table 1CAST-128 hardware macro overview
MISTY1Algorithm
64 bits
Data block size128 bits
Key size
Electronic Code Book (ECB)
Mode of operation
MISTY1_1clk.v
Source file name
Description Language Verilog-HDLMISTY1Top module name128 bit / 9 clock
Throughput
On-the-fly
Round keys
8
Round number

1.2

Algorithm overview

MISTY1 is a Feistel-type 64-bit block cipher with a 128-bit key. The detailed algorithm isdescribed in the specification [1]. In the following, we describe the 8-round version which isrecommended in the specification.
Fig. 1 shows data randomization block. MISTY1 employs FL/FL-1 functions in the every 2
rounds of Feistel Network. The internal functions FO and FIij have nested structures based onFeistel Network.
Before an encryption/decryption process, intermediate keys K’1~K’8 are generated from secretkeys K1~K8 in key-scheduling block. Fig. 2 shows the intermediate-key generation. Round keys
KOi, KIi, and KLi are selected from K1~K8 and K’1~K’8 according to Table 2.

1

Input
128

FO

Flij
916
7

FL132

FL2
FO1

KOi1
KIi1

S9

Fli1

KIij1

FO31616

FL-1
32

FL7

FL816161616

FO7

KOi3

S93216

Fli2

KIij2

KIi37FL4

KOi2
KIi2

16

FO2
FL3

S7FL

Fli3

FO8FL99FL101632128

OutputFig. 1MISTY1 encryption algorithm

K1

K2

K3

K4

K5

K6

K7

K81616161616161616

FI

FI

FI

FIFI

FIFI

161616161616

16

K’1

K’2

K’3

K’4

K’5

K’6

K’7

K’8

Fig. 2

Intermediate key generation

Table 2KeyFI16

MISTY1 round keys

KOi1

KOi2

KOi3

KOi4

KIi1

KIi2

KIi3

KLi1

KLi2

Ki

Ki+2

Ki+7

Ki+4

K’i+5

K’i+1

K’i+3

K(i+1)/2 (odd i)K’(i+13)/2 (odd i)K’i/2+1 (even i)

Ki/2+4 (even i)22. I/O ports
I/O ports of the MISTY1 macro are summarized in Table 3.
Table 3
Port name Direction
KinDinDout

InIn
Out

WidthDescription

128
6464

Key input
Data input
Data output

Krdy

In

1

Drdy

In

1

EncDec

In

1

RSTn

In

1

ENIn

1

CLKIn

1

BSY

Out

1

Kvld

Out

1

Dvld

Out

1

I/O ports

When Krdy=1, a secret key is latched in an internal register,and the initial key generation process get started. If bothDrdy and Krdy assigned to be ‘1’ at the same time, Krdy=1
has priority.
When Drdy=1, a plaintext (or ciphertext) data is latched in
an internal register and the encryption (or decryption)
process is started.
Encryption and decryption are executed when EncDec=0
and EncDec=1, respectively. The input data should be kept
while encryption/decryption process is running.
Reset signal. Sequencer logic and internal registers are reset
when this signal is assigned to 0. The reset can be executed
any time when the clock signal CLK is input, even if theenable signal EN=0.
Enable signal. When EN=1, this macro is activated.
System clock. All registers are synchronized with the risingedge of this signal.
Busy status flag. This signal is assigned to 1 while anencryption, decryption, or key generation process isexecuted. When this signal is 1, both Drdy and Krdy areignored.
When round-key generation process is completed, this signal
becomes 1 during the next one clock cycle, and then it goes
0. Soon after that, encryption and decryption processes areready to start.
When encryption or decryption process is completed andcipher text or plain text are ready on the data output port
Dout, this signal becomes 1 during the next one clock cycle,
and then it goes 0.

3

3. Hardware Architecture
3.4

Datapath

A datapath of the MISTY1 macro is shown in Fig. 3. This macro executes 1-round operation in 1 clock
cycle. A 128-bit block of data is encrypted / decrypted in 9 clocks. The datapath consists ofkey-scheduling block and data randomization block.
A secret key is set to an internal register K through a 128-bit port Kin in key-scheduling block. Soon
after that, the intermediate key generation is started in the data randomization block. The obtainedintermediate key is contained in an internal register K’ after 8 clocks. Round keys are selected from the Kand K’ in the encryption / decryption process.
An input data (plaintext for encryption, ciphertext for decryption) is set to an internal register data_reg
through a 64-bit port Din in the data randomization block. Six operations are shown in Fig. 4. One ofthem are selected and executed in one clock cycle. An output data (ciphertext for encryption, plaintext fordecryption) is obtained from a 64-bit port Dout.

Fig. 34Datapath

Type1FL

Type2FLFO

Type4FL

Type5FL

FO

3.2

FL

FL

FO-1Fig. 4

Type3-1

Type6FL

-1

FL-1

FO

Operation types in the data randomization process

State Diagram

The state diagram of the CAST-128 sequencer and its description are shown in Fig. 5 and Table 4,
respectively. Note that the sequencer state is set to ”IDLE” when the reset signal is asserted.

StateKEY_SCHEDENCRYPTDECRYPT
IDLE

Table 4 Sequencer StatesDescription
Key scheduling for round key generation is executed.
Encryption is performedDecryption is performed
Idle stateFig. 5

State diagram of sequencer logic5

4. Timing Chart
Fig. 6 shows the timing chart of the key scheduling, encryption, and decryption process for theMISTY1 macro in the minimum cycles for the control signals. The operations are performed asfollows.
CLK1: The sequencer logic is initialized by resetting RSTn to 0. The sequencer goes to “IDLE”
CLK2: By asserting Krdy=1, the 128-bit secret key on Kin is stored to an internal register. Soon
after that, the key scheduling process is started, and BSY is set to 1. The sequencer state is set to“KEY_SCHED.”
CLK3~10: The key scheduling takes 8 clocks, and thus Kvld and BSY are set to 1 and 0 in CLK10,respectively. The sequencer state goes to “IDLE”.
CLK10: Drdy is set to 1, and the 64-bit input data (plaintext) is stored into an internal register at therising edge in CLK11.
CLK11: The encryption process is started in accordance with EncDec=0, and BSY is set to 1. The
sequencer state is set to “ENCRYPT.”CLK12~20: The encryption takes 9 clocks, and thus it is completed in CLK20. The output data(ciphertext) is output from Dout and Dvld is set to 1 only in the 9th clock of the process (i.e.,CLK19). The sequencer is set to “IDLE,” and BSY goes 0 in CLK20.
CLK21: By asserting Drdy=1, the next operation is started. The 64-bit input data (ciphertext) is
stored into an internal register. The decryption process is started in accordance with EncDec=1,and BSY is set to 1. The sequencer state is set to “DECRYPT.”CLK22~30: The decryption also takes 9 clocks. and thus it is completed in CLK30. The output data(plaintext) is output from Dout and Dvld is set to 1 only in the final clock of the process(CLK29). The sequencer is set to “IDLE,” and BSY goes 0 in CLK30.

CLK0123891011121718

1920

21

2227

RSTn
EN
Kin
Krdy
Kvld
Din
Drdy
EncDecBSY
8 clock (Key schedule)

9 clock (Encryption)

9 clock (Decryption)

Dout
Dvld

Fig. 6

Timing Chart

5. Reference[1] M. Matsui, “Specification of MISTY1 – a 64-bit Block Cipher,” NESSIE Project.
https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions.html

6282930