Camellia Hardware Macro Specification
VersionUpdate

Description

0.1

2007/09/16

Initial version is created

0.1.1

2007/09/21

Timing chart (Fig. 7) is fixed

0.2

2007/09/25

Translated

1. Overview
1.1Hardware macro overview

The features of this Camellia hardware macro are summarized in Table 1. Only the ECB(Electronic Code Book) mode is supported, but the other modes such as CBC (Cipher Block
Chaining) can be easily supported by using additional data buffers and a control circuit.
Table 1CAST-128 hardware macro overview
Camellia
Algorithm
128 bits
Data block size128 bits
Key size
Electronic Code Book (ECB)
Mode of operation
Camellia.v
Source file name
Description Language Verilog-HDL
Camellia
Top module name128 bit / 23 clock
Throughput
On-the-fly
Round keys

1.2

Algorithm overview

Camellia is a Feistel-type block cipher jointly developed by NTT (Nippon Telegraph andTelephone Corp.) and Mitsubishi Electric. Camellia supports 128-, 192-, and 256-bit keys. In thefollowing, we describe 128-bit version. The detailed algorithm is described in the specification [1].
Fig. 1 shows the data randomization block including 18-round Feistel Network with functions Fand FL/FL-1. A 64-bit round function F consists of eight 8-bit S-boxes and an XOR network. Two
64-bit linear functions FL and FL-1 are given by AND, OR, XOR, and 1-bit rotation.
Round keys kw1~kw4, kl1~kl4, and k1~k18 are used in initial/final key addition, F function, andFL/FL-1 functions. The round keys are generated from a secret key KL and an intermediate key KA
according to Table 1. KA is generated from KL using Feistel Network and F-function as shown in Fig.
2,1Fig. 1

Table 2Camellia encryption algorithm

Generation rule for round keys

Initial XOR
F (Round 1)
F (Round 2)
F (Round 3)
F (Round 4)
F (Round 5)
F (Round 6)
FL
FL -1
F (Round 7)
F (Round 8)
F (Round 9)
F (Round 10)
F (Round 11)
F (Round 12)
FL
FL -1
F (Round 13)
F (Round 14)
F (Round 15)
F (Round 16)
F (Round 17)
F (Round 18)
Final XOR

kw 1(64)kw 2(64)
k 1(64)k 2(64)
k 3(64)k 4(64)
k 5(64)
k 6(64)kl 1(64)kl 2(64)
k 7(64)
k 8(64)
k 9(64)k 10(64)k 11(64)k 12(64)kl 3(64)kl 4(64)k 13(64)k 14(64)k 15(64)
k 16(64)
k 17(64)
k 18(64)kw 3(64)kw 4(64)(K L <<<0)L (64)
(K L <<<0)R (64)
(K A <<<0)L (64)
(K A <<<0)R (64)
(K L <<<15)L (64)
(K L <<<15)R (64)
(K A <<<15)L (64)
(K A <<<15)R (64)
(K A <<<30)L (64)
(K A <<<30)R (64)
(K L <<<45)L (64)
(K L <<<45)R (64)
(K A <<<45)L (64)
(K L <<<60)R (64)
(K A <<<60)L (64)
(K A <<<60)R (64)
(K L <<<77)L (64)
(K L <<<77)R (64)
(K L <<<94)L (64)
(K L <<<94)R (64)
(K A <<<94)L (64)
(K A <<<94)R (64)
(K L <<<111)L (64)
(K L <<<111)R (64)
(K A <<<111)L (64)
(K A <<<111)R (64)Fig. 2

2

Intermediate key generation.

2. I/O ports
I/O ports of the Camellia macro are summarized in Table 3.
Table 3
Port name Direction
KinDinDoutInIn
Out

WidthDescription128128128

Key input
Data inputData output

Krdy

In1Drdy

In1

EncDec

In1RSTnIn1ENIn1

CLKIn1

BSYOut1

KvldOut1

Dvld

Out

1

I/O ports

When Krdy=1, a secret key is latched in an internal register,and the intermediate key generation process is executed. If
Drdy and Krdy assigned to 1 at the same time, Krdy=1 haspriority.
When Drdy=1, a plaintext (or ciphertext) data is latched in
an internal register and the encryption (or decryption)
process is started.
Encryption and decryption are executed when EncDec=0
and EncDec=1, respectively. Bit data on the port EncDec isstored in an internal register when encryption or decryption
starts in response to Drdy=1.
Reset signal. Sequencer logic and internal registers are reset
when this signal is assigned to 0. The reset can be executed
any time when the clock signal CLK is input, even if theenable signal EN=0.
Enable signal. When EN=1, this macro is activated.
System clock. All registers are synchronized with the risingedge of this signal.
Busy status flag. This signal is assigned to 1 while anencryption, decryption, or key generation process isexecuted. When this signal is 1, both Drdy and Krdy are
ignored.
When round-key generation process is completed, this signal
becomes 1 during the next one clock cycle, and then it goes
0. Soon after that, encryption and decryption processes areready to start.
When encryption or decryption process is completed andcipher text or plain text are ready on the data output port
Dout, this signal becomes 1 during the next one clock cycle,and then it goes 0.

3

3. Hardware Architecture
3.1

Datapath

A datapath of the Camellia macro is shown in Fig. 3. This macro executes 1-round operation in 1 clock
cycle. A 128-bit block of plaintext are encrypted / decrypted in 16 clocks.
A secret key is contained in an internal register kl through a 128-bit port Kin in the key-scheduling.
Then the intermediate key generation is started in the data randomization block. The obtainedintermediate key is set to an internal register ka after 6 clocks. Round keys are generated from the values
in kl and ka on the fly.
An input data (plaintext for encryption, ciphertext for decryption) is set to an internal register Dout_reg
through a 128-bit port Din in the data-randomization block, An output data (ciphertext for encryption,plaintext for decryption) is obtained from a 128-bit port Dout.
Kin
Din

128

Key Scheduler

128

128

128

ka

128

kl

128

128>>>15>>>17<<<15<<<17>>>15>>>17
<<<15
<<<17

Dout_reg
128

Dout

64

128

FL/FL-1

64

64

128

64

64

64

128

64

cross

fl_minus
128

128

Fig.3

3.2

64

f_func64 64

fl_plus64

Feistel

cross
128

128

Σ1Σ2
Σ3
Σ4

128

Datapath

State Diagram

The state diagram of the Camellia sequencer and its description are shown in Fig. 4 and Table 4,
respectively.

4RESETRANDOMIZEGETIDLEif (key_rdy=1)

KEY
GET

if (key_rdy=1)

round←0

RANDOMIZEINITIAL_XOR

RANDOMIZE
FL_1

if (data_rdy=1)
IDLE
READY

RANDOMIZEF_FUNC
if (round=12)

round←0
RANDOMIZEFINAL_XOR
KEY
F_FUNC

if (round=6)

if (round=18)

RANDOMIZE
FL_2

if (round=4)
if (round=2)

KEY
XOR

Fig. 4

Table 4

State diagram of sequencer

State diagram of sequencer logic

State
IDLE
IDLE_READY
KEY_GET
KEY_F_FUNC
KEY_XORRANDOMIZE_GETRANDOMIZE_INITIAL_XOR
RANDOMIZE_F_FUNC
RANDOMIZE_FL_1
RANDOMIZE_FL_2
RANDOMIZE_FINAL_XOR

Description
Initial state. Only key input is accepted.
Idling state where intermediate-key generation isfinished. Both data input and key input are accepted.
States for intermediate-key generation.

States for data randomization (in encryption ordecryption).

4. Timing Chart
Fig. 5 shows the timing chart of the key scheduling, encryption, and decryption process for theCamellia macro in the minimum cycles for the control signals. The operation are performed asfollows.
CLK1: The sequencer logic is initialized by resetting RSTn to 0.
CLK2: By asserting Krdy=1, the 128-bit secret key on Kin is stored to an internal register. Soon
after that, the key scheduling process is started, and BSY is set to 1.
CLK3~CLK8: The key scheduling process takes 6 clocks, and thus Kvld and BSY are set to 1 and 05

in CLK8, respectively. The sequencer goes to the idling state “IDLE_READY.”
CLK9: By asserting Drdy=1, the 128-bit input (plaintext) and the control signal EncDec are stored
into internal registers. The encryption process is started in accordance with EncDec=0, and BSYis set to 1.
CLK10~32: The encryption takes 23 clocks, and thus it is completed in CLK32. The output data(ciphertext) is output from Dout and Dvld is set to 1 only in the 23rd clock (i.e., CLK32). The
sequencer is set to “IDLE_READY,” and BSY goes to 0 in CLK32.
CLK33: By asserting Drdy=1, the next operation is started. The 128-bit input (ciphertext) and thecontrol signal EncDec are stored into internal registers. The decryption process is started inaccordance with EncDec=1, and BSY is set to 1.
CLK34~57: The decryption also takes 23 clocks. and thus it is completed in CLK57. The output
data (plaintext) is output from Dout and Dvld is set to 1 only in the 23rd clock (i.e., CLK56).
The sequencer is set to “IDLE_READY,” and BSY goes 0 in CLK57.

CLK01

2

3

67

8

91030

31

32

33

34

54

55

56

57

58

RSTnENKin
Krdy
KvldDinDrdy
EncDecBSY
6 clock (Key schedule)23 clock (Encryption)

23 clock (Decryption)

Dout
Dvld

Fig. 5

Timing Chart

5. Reference[1] K.Aoki, T. Ichikawa, M. Kanda, M. Matsui, S. Moriai, J. Nakajima, T. Tokita, “Specification ofCamellia – a 128 -bit Block Cipher,” Sep. 2001, http://info.isl.ntt.co.jp/crypt/camellia/dl/01espec.pdf

6