Hardware architectures for PRESENT block cipher and their FPGA implementations

IET Circuits, Devices & SystemsVolume 13, Issue 7 p. 958-969 Research ArticleFree Access Hardware architectures for PRESENT block cipher and their FPGA implementations Jai Gopal Pandey, Corresponding Author jai@ceeri.res.in orcid.org/0000-0001-9937-7438 Integrated Systems Laboratory, CSIR – Central Electronics Engineering Research Institute (CEERI), Pilani, 333 031 India Cyber Physical Systems Area, Academy of Scientific & Innovative Research (AcSIR), CSIR-CEERI, Pilani, 333 031 IndiaSearch for more papers by this authorTarun Goel, Cyber Physical Systems Area, Academy of Scientific & Innovative Research (AcSIR), CSIR-CEERI, Pilani, 333 031 IndiaSearch for more papers by this authorAbhijit Karmakar, Integrated Systems Laboratory, CSIR – Central Electronics Engineering Research Institute (CEERI), Pilani, 333 031 India Cyber Physical Systems Area, Academy of Scientific & Innovative Research (AcSIR), CSIR-CEERI, Pilani, 333 031 IndiaSearch for more papers by this author Jai Gopal Pandey, Corresponding Author jai@ceeri.res.in orcid.org/0000-0001-9937-7438 Integrated Systems Laboratory, CSIR – Central Electronics Engineering Research Institute (CEERI), Pilani, 333 031 India Cyber Physical Systems Area, Academy of Scientific & Innovative Research (AcSIR), CSIR-CEERI, Pilani, 333 031 IndiaSearch for more papers by this authorTarun Goel, Cyber Physical Systems Area, Academy of Scientific & Innovative Research (AcSIR), CSIR-CEERI, Pilani, 333 031 IndiaSearch for more papers by this authorAbhijit Karmakar, Integrated Systems Laboratory, CSIR – Central Electronics Engineering Research Institute (CEERI), Pilani, 333 031 India Cyber Physical Systems Area, Academy of Scientific & Innovative Research (AcSIR), CSIR-CEERI, Pilani, 333 031 IndiaSearch for more papers by this author First published: 15 October 2019 https://doi.org/10.1049/iet-cds.2018.5273Citations: 7AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onEmailFacebookTwitterLinked InRedditWechat Abstract Data security is essential for the proliferation of the Internet of things and cyber-physical system technologies. Data security can be efficiently achieved by incorporating lightweight cryptography techniques. In this study, a set of high-performance hardware architectures for PRESENT lightweight block cipher are proposed that perform encryption, decryption and integrated encryption/decryption operations. Datapath of the architectures is of 64 bit width that supports standard 80 and 128 bits key lengths. The architectures are synthesised on Xilinx Virtex-5 XC5VLX110T (ff1136-1) field-programmable gate array device of ML-505 platform. To perform functional verification, a large number of test vectors are used. Performance measurement is performed by evaluating maximum frequency, throughput, power dissipation and energy consumption. Experimentally, it is found that the proposed architectures are resource-efficient, high-performance and suitable for lightweight, latency-critical and low-power applications in comparison with existing architectures. 1 Introduction In the emerging Internet of things (IoT) and cyber-physical systems based applications, data security is very essential [1-4]. Some of the prevailing applications using these technologies include e-gadgets, audio/video communication and voice over Internet protocol communication etc. With ever-increasing field deployment, the applications bring a widespread demand for smart sensing, control and computation over a range of data. Here, the data can be obtained from our most private and close activities including our health, location, social contacts, purchase, browsing patterns and many more [3, 5]. The data can be efficiently secured by incorporating the science of cryptography [4]. Recently, lightweight cryptographic algorithms are getting popular for resource-constrained environments [6-9]. Some of the popular lightweight block ciphers are summarised in Table 1. Table 1. Lightweight block ciphers Cipher Year Key size Block size Rounds Tech. (nm) Area (GE) Power consumption (μW) Throughput (kb/s) at 100 kHz mCrypton 2005 96 64 12 130 2420 — 482.3 Hight 2006 128 64 32 250 3048 — 188.2 PRESENT 2007 80|128 64 31 180 1075 1.4 11.7 CLEFIA 2007 128|192|256 128 18|22|26 90 4940 — 355.6 LED 2011 64|128 64 32|48 180 966 5.1 — TWINE 2011 80|128 64 36 90 1799 — 178 PRINCE 2012 128 64 12 90 3286 4.5 529.9 LEA 2013 128|192|256 128 24|28|32 — — — — SKINNY 2016 64|128|192 64 32|36|40 180 1223 — 200 128|256|384 128 40|48|56 2391 — 320 Detailed taxonomy, related discussion on lightweight ciphers can further be found in [9-12]. A survey on lightweight ciphers with their software and hardware implementations is provided in [13]. In the survey, it has been emphasised that efficient implementations of the ciphers are closely dependent on the selection of appropriate architecture that results in low implementation complexity and high-performance when the architectures are realised in the actual hardware. A comparative study related to software and hardware implementations has been done in [14]. In the implementation, a reconfigurable soft core microprocessor on Xilinx Kintex-7 field-programmable gate array (FPGA) device has been used. Here, it has been reported that the average energy-per-bit of the custom hardware implementations is lesser than the average of software by a factor of 300 [14]. PRESENT is one of the lightweight ciphers that are most popular and widely used for processing of 64 bit blocks with 80/128 bit key. The cipher has been standardised by ISO/IEC 29192-2 in the year 2012 [15]. The algorithm when implemented in hardware consumes a low amount of resource and provides an adequate level of data security [14, 16]. Some of the hardware architectures of the PRESENT cipher that have been recently proposed include [17-21]. In the literature, it has been pointed out that efficient architectures for IoT security are needed that satisfy the design metrics of: latency, throughput, area, throughput-to-area ratio, power, energy and efficiency. FPGA devices provide suitable platforms for rapid prototyping of custom architectures and their performance estimation. The proposed work exhibits a set of hardware architectures and their FPGA implementations for the lightweight PRESENT block cipher. The work provides an experimental study on area-performance trade-offs in terms of FPGAs slices, throughput, power consumption and efficiency for implementing standalone encryption, decryption or integrated encryption/decryption with their independent datapath and associated controller. Here, two solutions are provided for the static and variable key scenarios. With static keys, intermediate round keys are computed and stored in a memory for its subsequent usage. This architecture is called as storage-mode (ST) architecture. With variable keys, on-the-fly (OTF) architecture is provided that computes intermediate keys along with performing encryption/decryption operation. Three architectures and their respective controllers are provided to efficiently perform encryption, decryption and integrated encryption/decryption operations and they work with 64 bit data and support both 80/128 bit keys. Datapath of the architectures is optimised by incorporating sharing of functional resources. The choice of 64 bit datapath helps in designing simple controllers for efficient routeing and controls. The proposed architectures are synthesised for four different FPGA devices. Hardware implementation of the proposed architectures is done on Xilinx ML-505 FPGA prototyping platform. For performing functional verification and performance measurements, 200 test vectors are applied to the designs. The architectures are validated with a set of plaintext/ciphertext and user key on ML-505 FPGA platform by using Xilinx ChipScope Pro Logic Analyser tool. Furthermore, the architectures are compared with [19, 20, 22] for Xilinx Virtex-5 XC5VLX50T (ff1136-3) FPGA device and with [23] for Spartan-III xc3s400 (fg456-5) FPGA device. In these architectures, the substitution box (S-box) is realised by optimised combinational logic elements. For 80 bit encryption operation, in comparison with [22], the proposed architecture consumes 36% lesser and in comparison with [20] 18% lesser FPGA slices. The reduction in FPGA slices with the 128 bit key size is 12 and 10%. Similarly, for performing both 80/128 bit encryption/decryption, the architecture consumes 14/10% lesser slices when compared with [23]. A detailed comparison on latency, throughput, efficiency, power and energy is provided at maximum clock frequencies as well as at the radio-frequency identification (RFID) clock frequency for all three implementations. Rest of this paper is organised as follows: an overview of the PRESENT cipher is provided in Section 2. Some of the existing works are discussed and detailed in Section 3. Proposed architectures along with detail descriptions of various basic building blocks are given in Section 4. Experimental results and comparison with established architectures are provided in Sections 5 and 6, respectively. Finally, a conclusion is drawn in Section 7. 2 PRESENT lightweight block cipher PRESENT lightweight symmetric block cipher algorithm is based on substitution–permutation network and operates on the 64 bit block. It supports two key lengths of 80 and 128 bit. The algorithm requires 31 rounds, each round consists of an exclusive OR (XOR) operation with a round key . The round key is used for post-whitening operation [17]. In addition, there is a linear bit-wise permutation layer and a non-linear substitution layer. The non-linear layer uses a 4 bit S-box. The pseudocode of the algorithm for performing encryption and decryption is given in Fig. 1. The main functions of the cipher are as follows. Fig. 1Open in figure viewerPowerPoint Pseudocode for the PRESENT block cipher algorithm(a) Encryption operation, (b) Decryption operation 2.1 Key-schedule operation The cipher requires a unique round key () in each round of 80 bit () or 128 bit () key lengths. With the 80 bit key, the following three steps are performed for key scheduling: The output of key register is rotated by 61 bits to left, i.e. First, 4 bit is passed through S-box as A count value is XORed with 5 bit of the key round_constant. Similarly, with a 128 bit key, the key-scheduling operation is as below: The output of the key register is rotated by 61 bits to left, i.e. . First, 8 bit is passed through two S-boxes as . A count value is XORed with 5 bit of the key round_constant. 2.2 Add round key operation With current state and leftmost 64 bit of round key or (); AddRoundKey operation is defined as for [17]. 2.3 Substitution box layer The cipher requires a 4 bit S-box (S) as [17, 24]. The 64 bit current state is taken as 16 4 bit words , where for i . provides updated state value [17]. S-box is used in each round and key-scheduling operation. The S-box does not satisfy ; therefore, an inverse S-box is needed for decryption, which is related as . 2.4 Bit permutation (p-layer) and inverse bit permutation (inv-p-layer) operations Bit permutation layer is used to move bit i of State to bit position [17] and is given by (1) Similarly, for inverse bit permutation operation (2) Some of the related works are provided below. 3 Related work Architectures are classified as per the trade-offs on resource, latency and power consumption [25]. To obtain low-resource and high latency, the serial variant is a good choice. In it, each round is performed in multiple cycles. In contrast, with a limited constraint on resources, the rounds can be performed in a few clock cycles with parallel architecture. Advantage of both the architectures can be obtained by mixing both the design approaches, which can be further classified as iterative and fixed-key types. To discuss advantages and limitations, a representative architecture from the respective category is taken from [17, 19, 20, 22]. 3.1 Serial architecture Serial architecture is a suitable choice for saving hardware resources. However, the advantage of low-resource count comes at the cost of performance. A serial architecture given by [22] is redrawn in Fig. 2. It requires two S-boxes and 16 clock cycles for loading 64 bit plaintext and 80/128 bits user key. To perform intermediate rounds, each round needs nine clock cycles. Therefore, 31 rounds of the cipher clock cycles are required. In addition, to produce final output, eight more cycles are needed. Thus, the latency of the serial architecture is , i.e. 303 clock cycles. A rough estimate for gate count of the design is 1093 gate equivalent (GE), where GE refers to 2-input NAND gates [20]. Fig. 2Open in figure viewerPowerPoint Serial architecture for the PRESENT cipher [22 3.2 Parallel architecture Architectures given in [17, 18] bring 64 bit plaintext and 80 bit encryption key concurrently. The architecture is shown in Fig. 3; two features of this architecture can be easily noted. The first is associated with the datapath and the second one is with the latency. As the size of the datapath varies internally, so, the architecture needs an additional level of control and routeing resources. This area overhead limits the architectural performance for processing of intermediate rounds. Similarly, as the architecture has been designed with two S-boxes, it impacts on the speed of the operation. The architecture requires eight clock cycles to perform the substitution operation. Thus, with full input/output (I/O) pins, one clock cycle is needed to bring in the input data and eight clock cycles for the substitution operation. Additionally, , i.e. 248 clock cycles for 31 rounds are required to complete the substitution operation. In addition, one clock cycle is needed for output, by this, a total of 250 clock cycles are needed. Gate count of the design is around 1105 GE. A similar amount of logic resources are needed for the decryption operation [18, 20]. Fig. 3Open in figure viewerPowerPoint Parallel architecture for the PRESENT cipher [17 3.3 Mixed serial/parallel architecture Two specific subcategories of this architecture are iterative and fixed-key architectures that are being discussed here. 3.3.1 Iterative type of architecture An application-specific integrated circuit (ASIC) implementation of iterative architecture has been given in [18]. Furthermore, the architecture has been investigated by Hanley and ONeill [22] and it is shown in Fig. 4. Primarily, the architecture is based on 8 bit datapath. To bring 80 bit plaintext and 128 bit key, 16 clock cycles are needed. To process intermediate state for encryption operation, 31 clock cycles are required and 8 clock cycles for producing output. Thus, total latency of the architecture is 55 clock cycles. As reported in [18, 20], a rough estimate of GE is around 1800 GE. Fig. 4Open in figure viewerPowerPoint Iterative architecture of the PRESENT cipher [22 3.3.2 Fixed-key architecture The user key can be fixed which results in a reduction of 80/128 input pins. One such implementation is shown in Fig. 5 [19]. It is based on 16 bit datapath requiring four clock cycles for bringing 64 bit input data. To process State, each round takes four clock cycles; therefore, for 31 rounds, 124 clock cycles are required. Additionally, with a 16 bit output port, four clock cycles are needed. Thus, latency is , i.e. 132 clock cycles. As we can see, the key register is 16 bit; therefore, with 80 bit key the architecture needs five clock cycles and with a 128 bit key, clock cycle count raises to eight clocks. In addition, for generating the intermediate round keys, a key generation circuit or read-only memory (ROM) is needed. Fig. 5Open in figure viewerPowerPoint Architecture with fixed user key [19 3.4 Some of the existing FPGA implementation An FPGA implementation of the PRESENT cipher that uses 117 slices of Xilinx Spartan-3 XC3S50 FPGA device has been done in [7]. Here, a throughput of 28.46 Mbps at 114 MHz frequency has been obtained. Two random-access memory (RAM)-based implementations of PRESENT cipher have been provided in [26]. In the first implementation, S-box has been realised in look-up tables (LUTs), whereas in the second implementation it has been integrated in RAMs. Xilinx Spartan XC3S50 device implementations occupy 83 and 85 slices, and produce a throughput of 6.03 and 5.13 kbps at 100 kHz system clock, respectively. An implementation of the cipher with 8 bit datapath has been done in [27]. This design utilises 62 slices of Xilinx Virtex-5 XC5VLX50 device and provide a latency of 295 clock cycles with a throughput of 51.32 Mbps at 236.574 MHz frequency. The encryption-only implementations of [19, 20] use 74 slices of Xilinx Spartan-6 XC6SLX16 (CSG324C-3) FPGA device. At a maximum of 221.63 MHz clock frequency, 33 clock latency and throughput of 221.63 Mbps have been obtained. The design of [18] provides a cryptographic co-processor with encryption/decryption capabilities. The decryption operation is a bit compute intensive in comparison with the encryption operation. This is due to the fact that decryption operation requires the last round key at the beginning. An implementation for encryption/decryption operations has been done in [23]. Here, it has been considered that the last round key is available at the starting of decryption operation and the key is static in nature throughout all the encryption and decryption operations for all the input blocks. In [21], Xilinx Virtex-5 XC5VFX70T FPGA device uses 57/69 slices that run at a frequency of 307 MHz and provide 595 Mbps throughput for both 80/128 bit cipher key. To perform both encryption and decryption operations, FPGA implementations have been provided in [23, 28, 29]. In the implementation of [23], Spartan-III FPGA has been used for encryption/decryption operations. It requires a total of 373 and 423 slices for the 80/128 bit key lengths, respectively. On the same FPGA device, the implementations of [29] take a total of 343/349 slices for the 80/128 bit key lengths, respectively. In [28], Xilinx Virtex-5 xc5vfx70 FPGA device has been used that consumes 126/150 slices and provide throughput of 417.79/411.41 Mbps for 80/128 bit key, respectively. As discussed, Pandey , et al. [21] provide the architecture for encryption-only operation and its hardware implementation, whereas Pandey , et al. [28] provide the integrated encryption/decryption architecture and its hardware realisation. With respect to Pandey , et al. [21, 28], the proposed work extends it by providing detailed architectural views and their implementations, along with updated results for performing encryption, decryption and integrated encryption and decryption operations. In the next section, these architectures are proposed. 4 Proposed architectures for FPGA implementations The proposed architectures are described at the register-transfer level. A 64 bit datapath is selected that supports computation of a round in one clock cycle and also simplifies permutation operation that works efficiently with 64 bit. In the proposed architectures for the decryption operation, keys can be obtained OTF or it can be precomputed and stored in memory. Here, in the architectures support for both static and dynamic keys have been provided. The sboxlayer is realised by an area-optimised combinational logic circuit. 4.1 Architecture for performing encryption-only operation Architecture for encryption operation is shown in Fig. 6. Here, an iterative type of architecture is considered for saving hardware resources. The 64 bit datapath is chosen that provides optimal trade-off in terms of area, power and latency. Three main components of the architecture are: encryption engine, key scheduling and controller. The key-scheduling block requires 80/128 bit input key and generates 31 round keys for individual rounds of the cipher. The key scheduling is done OTF with the encryption operation. Fig. 6Open in figure viewerPowerPoint Proposed architecture for the encryption operation 4.1.1 Datapath of the encryption-only architecture The architecture shown in Fig. 6 performs encryption operation for 64 bit plaintext and 80 bit (or 128 bit) key. The architecture consists of a 64 bit encryption register that is used to store intermediate states of the encryption operation. In addition, one 64 bit multiplexer is used to switch data between the load phase and round computation phase. There is one 64 bit XOR gate which intermixes the State with round key, generated by the key-scheduling unit. The datapath contains sboxlayer (16 S-boxes) and p-layer. Along with this, one 5 bit up counter known as round_counter is used to generate the value of current round that is used by the key-scheduling unit for generating the next round key, as 5 bit of the intermediate key are XORed with round_counter value. Here, a 64 bit register is used to provide computed ciphertext at the output. The latency of the architecture can further be reduced by one clock cycle if we do not need registered output. However, an output register is added to reduce control logic and for synchronisation of output with last round. After completion of all the rounds, the registered output is available after 33 clock cycles. In the first clock cycle, plaintext and user key are loaded. In the next clock cycle, the multiplexer is used to switch data and then for the next 31 cycles all intermediate states are computed. Data is available at the encryption register and XORed with first 64 bit of the round key. Furthermore, the mixed State is passed to sboxlayer for processing that provides 64 bit data concurrently to p-layer and subsequently it is passed to the encryption register through a multiplexer. In the last clock cycle, the ciphertext is available at the output register. Thus, a total of clock cycles are required to encrypt a single block of 64 bit plaintext. A controller for the key generation unit and the encryption engine is explained below. 4.1.2 Design of a controller for encryption-only operation A controller for the encryption-only architecture is shown in Fig. 7. There are three control states and four control signals which are: en, enc_gen, mux_sel and out_ready. In the first state, Start(S0), the counter is enabled through en signal and plaintext with key are loaded into encryption engine and key-scheduling unit, respectively, for mux_sel = 0. In the second state, Encrypt (S1), multiplexers of both units are switched as the mux_sel signal is at logic 1. Here, the enc_gen signal is used to start the intermediate operations by enabling the encryption and key registers. The state remains in the S1 until the counter value reaches 31. Then, it switches to Reg_out (S2), where the counter is disabled by en = 0 signal and the out_ready signal is switched to logic 1 which enables the output register. In the next clock cycle, 64 bit ciphertext is available at the output register. Fig. 7Open in figure viewerPowerPoint Controller for the encryption operation 4.2 Architecture for performing decryption-only operation In case there is a need to perform a decryption-only operation such as, where sensors can send data in encrypted form and in the case of the receiver side decryption-only operation is required. In this concern, architecture for decryption operation is shown in Fig. 8. Here, an iterative approach is chosen to perform a decryption operation. This architectural approach provides a balance between area and time. Three main parts of the architecture are a decryption engine, key-scheduling unit and controller. For 64 bit datapath, 16 inverse S-boxes are used with inverse permutation layer. Here, key scheduling is done by both the ways, i.e. OTF and in the storage mode. A controller for the decryption operation is shown in Fig. 9. This controller is used when the key-scheduling operation is done using storage mode and the block RAM is used to store the round keys. Fig. 8Open in figure viewerPowerPoint Proposed architecture for the decryption operation Fig. 9Open in figure viewerPowerPoint Integrated architecture of the PRESENT cipher for encryption and decryption operations Fig. 10Open in figure viewerPowerPoint Controller for the decryption operation Fig. 11Open in figure viewerPowerPoint Merged S-box and inverse S-box 4.2.1 Datapath for the decryption-only operation A 64 bit decryption register is used to store the intermediate State that is intermixed with the round key through an XOR gate. After that, the inverse permutation operation is performed on the State and the data is passed through an inverse sboxlayer consisting of 16 inverse S-boxes. As shown in Fig. 8, intermixed State is first passed through inv-p-layer, and then to invsboxlayer. Here, computation of round keys is done to find the last round key, i.e. , and after that it goes back from round 31 to 0. To decrypt the first block of data, 64 clock cycles are required. In the first clock cycle, user key and ciphertext are loaded into the key-scheduling unit and decryption engine, respectively. Then for the next 31 cycles, intermediate round keys are computed. During this, the decryption engine does not work. As is computed by the key-scheduling unit, the decryption engine comes into action and for the next 31 clock cycles, it is used to compute the intermediate states. In the final clock cycle, 64 bit decrypted data is available at the output register. Thus, a total of clock cycles are required to decrypt the first block of data. A number of clock cycles required to decrypt other blocks of data is dependent on the key-scheduling method. If the OTF method is used, 64 clock cycles are required to decrypt all remaining blocks, whereas with stored round keys, 33 clock cycles are needed. 4.2.2 Controller for the decryption operation To perform the decryption operation, a controller is designed which requires five states that are shown in Fig. 10. The states are: Start, Compute round keys, Load ciphertext, Decrypt and Reg_out. The controller performs the key-scheduling operation in storage mode. In Start (S0) state, the user key is loaded into the key-scheduling unit and round_counter is enabled by en = 1 signal. The counter works as an up counter by making an up_down signal to logic 1. In Compute round keys (S1) state, all the intermediate round keys are computed and simultaneously stored in a block random-access memory (BRAM). It will remain in S1 state, until the counter value reaches at 30, where the state switches to S2. In Load ciphertext (S2) state, the ciphertext is loaded into decryption engine and now up_down signal switches from logic 1 to logic 0 to make the counter as a down counter, as states are computed in reverse order, i.e. from round = 31 down to 0. The fourth state, Decrypt (S3), is used to start the decryption process by enabling signal dec_gen to logic 1. It remains in state S3 until the round value becomes 0, after that the state switches to the final state. In the last state, Reg_out (S4), the out_ready signal becomes logic 1 and output (plaintext) is available through output register. When reset = 1, the controller switches to default state S0. After completing decryption of the first block of ciphertext, it goes to S2 state. This is due to the reason that the state S0 is used to load the user key and the second state is used for computing round keys. After decryption of the first block, remaining blocks do not require the key-scheduling unit for the round keys as they are already stored in the BRAM. If there is any requirement to decrypt data with a new key, reset should be at logic 1 for one clock cycle. The controller implemented in our work is used for key scheduling in storage mode. 4.3 Architecture for performing integrated encryption/decryption operations Architecture for an integrated encryption/decryption operation is shown in Fig. 9. Here, the architecture is presented using storage mode and 33 clock cycles are required in decryption (64 clock cycles for the first block of ciphertext). 4.3.1 Datapath of integrated PRESENT architecture There are three main blocks, namely scheduling unit, controller and encryption/decryption engine. In this architecture, an extra input enc_dec is used to select encryption/decryption operation. If enc_dec is high then encryption otherwise decryption operation is performed. In this architecture, two extra multiplexers are needed. The first multiplexer is required after intermixing of State with a round key. It provides intermixed State to layer for encryption or to inv-p-layer for decryption operation. The second multiplexer is required for state register input, as for the decryption the output of layer is directly provided to the state register; whereas, for encryption, it passes to the p-layer, then to the state register. In Fig. 11, S-box and inverse S-box are merged into one box and is denoted by . The new box is shown in Fig. 11. 4.3.2 Controller for the integrated encryption/decryption A controller for the integrated encryption/decryption is given in Fig. 12. The controller facilitates the processing of multiple blocks of data for the same or different user keys. There are total of nine states in the controller, out of which two st