Flexible and high‐throughput structures of Camellia block cipher for security of the Internet of Things

IET Computers & Digital TechniquesVolume 15, Issue 3 p. 171-184 ORIGINAL RESEARCH PAPEROpen Access Flexible and high-throughput structures of Camellia block cipher for security of the Internet of Things Bahram Rashidi, Corresponding Author b.rashidi@abru.ac.ir Department of Electrical Engineering, Ayatollah Boroujerdi University, Boroujerd, Iran Correspondence Bahram Rashidi, Department of Electrical Engineering, Ayatollah Boroujerdi University, Boroujerd, 69199-69411, Iran. Email: b.rashidi@abru.ac.irSearch for more papers by this author Bahram Rashidi, Corresponding Author b.rashidi@abru.ac.ir Department of Electrical Engineering, Ayatollah Boroujerdi University, Boroujerd, Iran Correspondence Bahram Rashidi, Department of Electrical Engineering, Ayatollah Boroujerdi University, Boroujerd, 69199-69411, Iran. Email: b.rashidi@abru.ac.irSearch for more papers by this author First published: 12 March 2021 https://doi.org/10.1049/cdt2.12025AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onEmailFacebookTwitterLinked InRedditWechat Abstract The advancements in wireless communication have created exponential growth in the Internet of Things (IoT) systems. Security and privacy of the IoT systems are critical challenges in many data-sensitive applications. Herein, high-throughput and flexible hardware implementations of the Camellia block cipher for IoT applications are presented. In the proposed structures, sub-blocks of the ciphers are implemented based on optimised circuits. The proposed structures for Camellia are designed and shared for implementing the encryption process and generating some intermediate key values in the two separate times. The most complex block in these ciphers is the substitution box (S-box). The S-boxes are implemented based on area-optimised logic circuits. The Camellia S-boxes consist of a field inversion over F 2 8 and two affine transformations over F 2 . The inversion operation is implemented over the composite field F ( 2 4 ) 2 instead of an inversion over F 2 8 which is an important factor to reduce area consumption. A large number of gates, in the structure, have been implemented by 2-input NAND and 2-input NOR gates to reduce delay and area. Also, the flexible structure for Camellia that can do various configurations of this cipher to support variable key sizes 128, 192 and 256 bits was proposed. Implementation results of the proposed architectures in 180 nm CMOS technology for different key sizes are achieved. The results show improvements in terms of execution time, throughput and throughput/area compared to the other related works. 1 INTRODUCTION The increasing number of services provided by the Internet has generated a huge increase in the number of connected devices. There are many Internet of Things (IoT) applications such as e-health, e-commerce, smart home, smart city, smart hospital, etc. [1]. The IoT is a network used to interconnect embedded devices, such as sensors, which can generate, communicate and share data [2]. In the IoT systems, we have many new security and privacy challenges [1, 3]. With the exponential growth in IoT systems, security and privacy issues have emerged as critical challenges in many sensitive applications such as e-health and e-commerce. For example, the IoT in the e-health improve the quality of healthcare services as well as reduce the healthcare cost. The healthcare field is remodelling by the IoT to improve the social benefits by offering continuous monitoring of patients and services as well as updating healthcare medical records [4]. The healthcare data provide real sensitive information that should be protected [5]. Therefore, there is an urgent need to address these challenges. In recent years, many cryptographic algorithms have been used to provide the security of transmitted data in the IoT [6]. Cryptographic algorithms proposed for IoT applications can be categorised into the symmetric and asymmetric (public key) algorithms. Public key algorithms are time-consuming. Therefore, most of the applications in IoT networks use symmetric algorithms to provide security of the transmitted information [7, 8]. Lightweight block ciphers as one of the most important symmetric algorithms are used to providing the security of IoT communication. These ciphers are easy to implement, use fewer computational resources with low overhead. Many lightweight block ciphers have been proposed to reduce the costs of hardware consumption [9]. Block ciphers are used for data protection in the cryptosystems as a good candidate for resource-constrained cryptographic applications. These cryptographic primitives have been the important area of cryptographic researches [9]. Camellia [10] is suitable block cipher for hardware implementations in the embedded cryptographic systems. Camellia [10, 11] cipher has 128 bits data block size and 128, 192 and 256 bits key lengths. This block cipher was jointly developed by Nippon Telegraph and Telephone Corporation (NTT) and Mitsubishi Electric Corporation (Mitsubishi) to provide flexibility and security in cryptographic applications [10]. The Camellia block cipher is standardized in the International Organization for Standardisation (ISO) and the International Electrotechnical Commission (IEC) (ISO/IEC 18,033) [12]. It has been recognized by CRYPTREC (Cryptography Research and Evaluation Committee) [13] and NESSIE (New European Schemes for Signatures, Integrity, and Encryption) [14] projects as a cryptographic algorithm for use on the Internet. The security and robustness of Camellia are investigated in [10, 15, 16] by testing resistance against different attacks such as Linear attack, Differential attack, Boomerang attack, Higher-order differential attack, Interpolation attack, Impossible differential attack, Improved zero-correlation attack, Square/Collision attack, and Cache trace attack. Different ASIC implementations of the Camellia algorithm have been reported in [10, 13-24]. In [18] compact and high-speed hardware2 architectures for the 128-bit AES and Camellia block ciphers are presented. The composite field arithmetic is used to reduce the size of the S-Boxes in this work. In [19] error detection approaches for the Camellia block cipher taking into account its linear and non-linear sub-blocks are proposed. In [20] a loop architecture based on one round function block is presented. The S-boxes are implemented based on both lookup table (LUT) and composite field arithmetic. The flexibility, throughput, execution time and area consumption are the main design dimensions (challenges) of secure digital systems. A good design should consider the trade-offs between these dimensions. The flexibility is the ability to the reconfiguration of the system parameters such as key size. It is even more important especially for applications with a diverse set of requirements [28]. IoT applications are an outstanding example of this scenario. The level of security required by IoT devices and their supporting solutions will vary depending on the specific functions they are performing. A common practice of flexibility is to implement adaptive security for IoT applications such as smart control system based on a collection of the sensors for example, temperature sensor, humidity sensor, light sensor, presser sensor, heart sensor, flow metre sensor, etc. In the flexible structure, the key size varies in an acceptable range depending on the trust level of the sensors. An encryption process with a lower level of security (shorter key) allows high-speed computations in an application with less important information. On the other hand, the sensitive data within the network such as healthcare IoT applications is encrypted with a higher security level (longer key). The IoT systems are constrained in terms of execution time and computational resources; the problem is compounded when dealing with multimedia contents. Therefore, a flexible cryptographic structure can be reconfiguration based on the requirement with the best performance. The previous works have focussed less on improving the design parameters, especially flexibility. Herein, we proposed high throughput and flexible hardware structures for Camellia block cipher for secure hardware IoT applications. Due to flexibility, they can be used for different types of IoT applications with multiple levels of security strengths. A unified circuit with resources sharing is implemented for Camellia cipher to compute the encryption process and some intermediate key values. The proposed flexible structures can do various configurations of Camellia to support variable key sizes (128, 192 and 256 bits). Implementation results of the proposed structures in 180 nm CMOS technology for different key sizes are achieved. The results show that the proposed structures have high-throughput and low computation time with acceptable hardware consumption compared to related works. The contributions of this study are as follows: A unified circuit with resources sharing is implemented for Camellia cipher to compute the encryption process and some intermediate key values. The substitution boxes (S-boxes) in the Camellia cipher are implemented based on area-optimised circuits. The number of logic gates and critical path delay of field multiplier and field inversion over F 2 4 are reduced by using the simplification of logic terms. Also, a large number of gates, in these structures, have been implemented by the 2-input NAND and NOR gates to reduce delay and area. The proposed flexible structures can do various configurations of Camellia to support variable key sizes (128, 192 and 256 bits). Herein, Section 2 recalls the Camellia block cipher and the proposed hardware structures are described. Section 4 shows a comparison between our works and related works. Finally, Section 5 gives conclusions. 2 DESCRIPTION OF THE CAMELLIA BLOCK CIPHER AND PROPOSED HARDWARE STRUCTURE The Camellia cryptographic algorithm is a block cipher that can process 128 bits data blocks, using 128, 192 and 256 bits secret keys. In this case, we have a flexible key size. It has better efficiency in both software and hardware implementations when compared to other ciphers [10]. The Camellia cipher uses an 18-round Feistel architecture for 128-bit keys and a 24-round Feistel architecture for 192-and 256-bit keys. Two main parts of the Camellia are the data processing part and key scheduling part. Algorithms 1 and 2 show the encryption procedure of Camellia for 128-bit and 192/256-bit keys, respectively. In the Camellia cipher, FL and FL−1 functions are inserted every six rounds in the algorithms. Algorithm 1. Camellia Encryption Algorithm for 128-bit keys Input: 128-bit plaintext P = PL‖PR, whitening keys kw1 to kw4, round keys k1 to k18 and subkeys kl1 to kl4. Output: 128-bit ciphertext C. L0 = kw1 ⊕ PL, R0 = kw2 ⊕ PR; 2. For i from 1 to 6 do 3. Li = Ri−1 ⊕ F(Li−1, ki), Ri = Li−1; 4. End For; 5. L6 = FL(L6, kl1), R6 = FL−1(R6, kl2); 6. For i from 7 to 12 do 7. Li = Ri−1 ⊕ F(Li−1, ki), Ri = Li−1; 8. End For; 9. L12 = FL(L12, kl3), R12 = FL−1(R12, kl4); 10. For i from 13 to 18 do 11. Li = Ri−1 ⊕ F(Li−1, ki), Ri = Li−1; 12. End For; 13. CL = kw3 ⊕ R18, CR = kw4 ⊕ L18; 14. Return C = CL‖CR; Algorithm 2. Camellia Encryption Algorithm for 192/256-bit keys Input: 128-bit plaintext P = PL‖PR, whitening keys kw1 to kw4, round keys k1 to k24 and subkeys kl1 to kl6. Output: 128-bit ciphertext C. L0 = kw1 ⊕ PL, R0 = kw2 ⊕ PR; 2. For i from 1 to 6 do 3. Li = Ri−1 ⊕ F(Li−1, ki), Ri = Li−1; 4. End For; 5. L6 = FL(L6, kl1), R6 = FL−1(R6, kl2); 6. For i from 7 to 12 do 7. Li = Ri−1 ⊕ F(Li−1, ki), Ri = Li−1; 8. End For; 9. L12 = FL(L12, kl3), R12 = FL−1(R12, kl4); 10. For i from 13 to 18 do 11. Li = Ri−1 ⊕ F(Li−1, ki), Ri = Li−1; 12. End For; 13. L18 = FL(L18, kl5), R18 = FL−1(R18, kl6); 14. For i from 19 to 24 do 15. Li = Ri−1 ⊕ F(Li−1, ki), Ri = Li−1; 16. End For; 17. CL = kw3 ⊕ R24, CR = kw4 ⊕ L24; 18. Return C = CL‖CR; Camellia encryption structures for 128-bit keys (a), 192/256-bit keys are shown in Figure 1 (a) and (b), respectively. For cases 128-bit and 192/256-bit keys, the structures are constructed based on (Three 6-round blocks, four 64-bit XOR operations, and four FL and FL−1 functions) and (Four 6-round blocks, four 64-bit XOR operations, and six FL and FL−1 functions), respectively. The six rounds of Camellia encryption process are performed by the 6-round block. In each round, we have a F-function and a 64-bit XOR operation. FIGURE 1Open in figure viewer Camellia encryption structures for 128-bit keys (a), 192/256-bit keys (b) 2.1 F function The F-function is the most important block in the Camellia cipher computations. The structure and computations of F-function are shown in Figure 1. The F-function uses a Substitution-Permutation Network (SPN) structure. As seen from this figure, the function is constructed based on an 8-bit S-boxes S1, S2, S3 and S4 (S-function layer) and sixteenth 8-bit bit-wise XOR operations (P-function layer). The S-function part is a non-linear layer and the P-function part is a linear layer. 2.1.1 S-boxes S1, S2, S3 and S4 The S-function layer consists of eight S-boxes, and four different S-boxes, S1, S2, S3 and S4 are used. All of them are equal to the field inversion operation over finite field F 2 8 . The data of S2, S3 and S4 can be generated from the S-box S1. The 8-bit S-box S1, for input x and output y1, is defined as follows: S1 : y1 = S1(x) = h(g(f(0xc5 ⊕ x)))⊕ 0x6e. Also, for the S-boxes S2, S3 and S4 we have: S2 : y2 = S1(x) ⋘ 1, S3 : y3 = S1(x) ⋙ 1, S4 : y4 = S1(x ⋘ 1). Where x ⋘ j denotes left cyclically shift of x by j-bit and ⊕ is bit-wise XOR. The f and h functions can be presented based on the following computations: f : b7 = (a6 ⊕ a2), b6 = (a7 ⊕ a1), b5 = (a3 ⊕ a5 ⊕ a0), b4 = (a5 ⊕ a0), b3 = (a4 ⊕ a1), b2 = (a6 ⊕ a3), b1 = (a7 ⊕ a0), b0 = (a4 ⊕ a4) h : b7 = (a6 ⊕ a3 ⊕ a2), b6 = (a6 ⊕ a2), b5 = (a4 ⊕ a1), b4 = (a6 ⊕ a0), b3 = (a5 ⊕ a1), b2 = (a7 ⊕ a0), b1 = (a7 ⊕ a3), b0 = (a5 ⊕ a2) The hardware resources for implement two functions f and h are equal to 18 2-input XOR gates. The main block in the S-box S1 is a field inversion over F 2 8 (g function) [10]. Figure 2 shows the proposed structure of S-box S1. The inverse function is performed in F 2 8 defined by a primitive polynomial f1(z) = z8 + z6 + z5 + z3 + 1. Implementation of inversion operation over the composite field instead of an inversion over F 2 8 is an important factor to reduce area consumption [29]. Here, for the proposed implementation we use the composite field F ( 2 4 ) 2 defined by the following irreducible polynomials: F 2 4 : f 2 ( z ) = z 4 + z + 1 F ( 2 4 ) 2 : q ( z ) = z 2 + z + λ ( λ = ω 3 ) FIGURE 2Open in figure viewer Proposed structure of S-box S1 (a), structures of two functions FL (b) and FL−1 (c) where ω is a root of f2(z). In the following, we present the proposed hardware structure of the field inversion over the composite field F ( 2 4 ) 2 . Let n1β + n0 is an arbitrary element in F ( 2 4 ) 2 , where n 1 , n 0 ∈ F 2 4 , the inversion m1β + m0 = ( n 1 β + n 0 ) − 1 ( m 1 , m 0 ∈ F 2 4 ) can be calculated as follows: m 1 = n 1 Δ − 1 , m 0 = ( n 1 + n 0 ) Δ − 1 , where Δ = ( n 1 + n 0 ) n 0 + λ n 1 2 and vector representation of λ is equal to (1, 0, 0, 1) [10]. Figure 3 (a) shows the structure of field inversion operation over composite field F ( 2 4 ) 2 . This operation is constructed based on four sub-blocks consisting of multiplication by constant λ, four field multiplications, one field inversion, one field squaring, and two field additions. The sub-blocks multiplication, inversion, and squaring are defined over F 2 4 with primitive polynomial f2(z) = z4 + z + 1. The multiplication and inversion, squaring operations over F 2 4 are implemented based on [30, 31]. But, in the proposed implementation we applied further optimization in the structures of multiplication and inversion over F 2 4 to reduce critical path delay and area consumption. The squaring of element K = ( k 3 k 2 k 1 k 0 ) 2 , S = ( s 3 s 2 s 1 s 0 ) 2 = K 2 , in field F 2 4 with irreducible polynomial f(x) = x4 + x + 1 is equal to s3 = k3, s2 = k3 ⊕ k1, s1 = k2, s0 = k2 ⊕ k0. Also, the formula for multiplication with constant L = ( l 3 l 2 l 1 l 0 ) 2 = Y × λ in F 2 4 are as l3 = y0, l2 = y3, l1 = y2, l0 = y1 ⊕ y0. The proposed merged formula of squaring and multiplication with constant λ, H = (A2) × λ we have: FIGURE 3Open in figure viewer The proposed structures of (a) S-box S1, (b) combined squaring and multiplication by constant λ, (c) multiplication in F 2 4 , (d) inversion in F 2 4 m3 = s0 = a2 ⊕ a0 m2 = s3 = a3, m1 = s2 = a3 ⊕ a1, m0 = s1 ⊕ s0 = a2 ⊕ a2 ⊕ a0 = a0. The low-cost structure of merged squaring and multiplication with constant λ in the proposed S-box is shown in Figure 3 (b). In this case, the computations of squaring and multiplication by constant λ are implemented by only two XOR logic gates with CPD equals TX, where TX is gate delay of the 2-input XOR gate. Figure 3 (c) shows the proposed efficient hardware structure of field inversion over F 2 4 . After further simplifications on i0, i1, i2, and i3 terms, the hardware consumption, and critical path delay are equal to 8 2-input XOR gates, 3 2-input XNOR gates, 11 2-input NAND gates, 1 2-input NOR gate and three NOT gates and 2TX + TXN + TNA, respectively. A large number of gates, in the structure, have been implemented by 2-input NAND and 2-input NOR gates to reduce delay and area. Table 1 shows the hardware results of the proposed structure of 8-bit S-box S1 and other related works. As seen from the table, the proposed 8-bit S-box S1 has acceptable hardware resources and timing characteristics compared to other 8-bit S-boxes. TABLE 1. Hardware results of the proposed structure of 8-bit S-box S1 and other related works Works # AND (or OR) # NAND (or NOR) # XOR (or XNOR) # NOT CPD Ref. [33] S0 127 — 6 16 3TX + 4TA + 4TO Ref. [33] S1 57 3 83 5 9TX + 3TA + TN Ref. [34] — 41 68 1 — Ref. [35] Case 1 58 — 89 9 15TX + 4TA + 2TN Ref. [35] Case 7 35 — 113 9 19TX + 4TA + 2TN Ref. [35] Case 13 58 — 94 9 14TX + 4TA + 2TN Ref. [36] PN 58 — 98 9 17TX + 4TA + 2TN Ref. [36] NN 58 — 100 9 16TX + 4TA + 2TN TW — 59 88 12 8TX + TXN + 3TNA + TN TW: This work; Normal-Normal (NN); Polynomial-Normal (PN); TA, TNA, TX, TXN, TO, TNO, TN denote the time delay of a 2-input AND gate, 2-input NAND gate, 2-input XOR gate, 2-input XNOR gate, 2-input OR gate, 2-input NOR gate, and NOT gate, respectively. 2.2 FL and FL−1 functions In the Camellia cipher, two functions FL and FL−1 are used in the data processing part. These logical functions are inserted every six rounds. Let kli = kliL‖kliR be an intermediate key and also X = XL‖XR and Y = YL‖YR be 128-bit input and output, respectively. Therefore, two functions FL and FL−1 are defined as follows: FL : YL = XL ⊕ ((XR ⊕ (XL ∧ kliL) ⋘ 1) ∨ kliR), Y R = X R ⊕ ( ( X L ∧ k l i L ) ⋘ 1 ) . FL−1 : YL = XL ⊕ (XR ∨ kliR), YR = XR ⊕ ((XL ⊕ (XR ∨ kliR)) ∧ kliL) ⋘ 1. where, ∧ and ∨ are bit-wise AND and OR operations, respectively. Figure 2 (b) and (c) shows the structures of two functions FL and FL−1, respectively. 2.3 The proposed hardware structures for 128-bit, 192-bit and 256-bit keys In this section, we present the hardware structures for implementation of the Camellia block cipher. Figure 4 shows the proposed block diagram of Camellia block cipher. The structure is designed based on the merged hardware for computing the data processing and KA and KB variables, where the KA and KB are two modified keys which are used in key scheduling part (these variables are discussed in the next subsection). The proposed structure of the Camellia block cipher is shown in Figure 5 for 192/256-bit keys. The three 2-to-1 multiplexers with control signal Sel3 are used for configuration of two modes of data processing and generating the KA and KB variables. In this case, if the control signal Sel3 is equal to '1' the structures are configured for computing the KA and KB variables and for case Sel3 = '0' we have the configuration of the structures for data processing part computations. Two control signals Sel1 and Sel2 are used for control of the encryption process. In the structure, the control signal Sel2 is set to '1' (in the first clock cycles) and values kw1 ⊕ PL, kw2 ⊕ PR, subkeys k1 to kn and kl1, kl2 are applied to the structure. In other clock cycles, the control signal Sel2 is set to '0' and other subkeys are used for computation. This structure computes n rounds of computations at each clock cycle, where 1 ≤ n ≤ 6. Therefore, generating the ciphertext C, after computing the KA and KB, required to r/n+1 clock cycles for both 128-bit and 192/256-bit keys. FIGURE 4Open in figure viewer Proposed block diagram of Camellia block cipher FIGURE 5Open in figure viewer Proposed structure of Camellia block cipher for case 192/256-bit keys 2.4 Key schedules of Camellia block cipher and the proposed hardware structures The key schedule part generates 64-bit whitening keys kwt (t = 1, 2, 3, 4), round keys ku (u = 1, 2, …, r) for round functions and kli (i = 1, 2, …, r/3 − 2) for FL and FL1 functions from the main key K, where r is the number of rounds. In the key schedule part of Camellia block cipher, two 128-bit variables KL = KLL‖KLR and KR = KRL‖KRR are introduced, which are defined as follows: For 128-bit main key K → KL = K, KR = 0. For 192-bit main key K → K L ‖ K R L = K , K R R = ( K R L ) ′ . For 256-bit main key K → KL‖KR = K. Two 128-bit variables KA and KB are generated based on KL and KR, where for the 128-bit key we use only KA and for 192/256-bit keys, both KA and KB are used for key schedule part. The structure for generating the KA and KB is presented in work [11] (Figure 8). In this figure the 64-bit constants ∑i (i = 1, 2, …, 6) are used as keys in the structure (Feistel network). These constants are presented in [10]. The KA and (KA and KB) variables, for 128-bit and 192/256-bit keys, are computed in five and seven clock cycles, respectively. The control signals L1, L2 and L3 are used for control of the 64-bit constants ∑i, 1 ≤ i ≤ 6 and intermediate results. In the first round block, multiplexers with control signal L1, L2, L3 and 128-bit XOR operation are used for implementation of KA and (KA and KB) computations. In the proposed structures, we first compute the variables KA and KB then the key scheduling and the data processing are started. Control signals of the proposed structure for computing the KA, KB variables in the case (192/256-bit keys and n = 2, where n is the number of computed rounds at each clock cycle and 1 ≤ n ≤ 6) are presented in Table 2. TABLE 2. Control signals of the proposed structure for computing the KA, KB variables in the case (192/256-bit keys and n = 2) # Clock Cycles L1 L2 L3 Sel3 1 0 1 0 0 2 1 0 0 0 3 2 1 0 0 4 0 0 1 0 5 1 1 1 0 6 2 0 1 0 7 - 0 - 0 The 64-bit subkeys kwt (1 ≤ t < 4), ku (1 ≤ u < r), and kli (0 ≤ i < r/3 − 2) are generated by rotating KL, KR, KA, and KB and taking the left-half or right-half of them. The computations of 64-bit subkeys for 128-bit and 192/256-bit keys are shown in Table 3. The proposed structures (for case n = 2) to generation of round keys for case 192/256-bit main key is shown in Figure 6. The number of clock cycles for this case (n = 2) are equal to 9 and 12 for 128-bit and 192/256-bit main keys, respectively. The control signals Se1, Se2, d[1 : 0] and c[1 : 0] are used for control and application of the generated subkeys into the data processing part. The subkeys are stored into registers Reg1 and Reg2 based on control signal Se1, Se2. The register Reg1 is used for storing of the generated subkeys k1, k2, …, kr based on rotate blocks. Also, the subkeys kl1, kl2, …, kw4 are stored into the register Reg2. The proposed structures generate the subkeys (k1, k2), (k3, k4), (k5, k6, kl1, kl2), …, (k23, k24, kw3, kw4) at the first, second, …, and last clock cycles, respectively. The rotate blocks, in the structures, are implemented by wired cyclic shift without extra hardware. TABLE 3. Subkeys for 128-bit and 192/256-bit keys Sub key Value for 128-bit keys Value for 192/256-bit keys Sub key Value for 128-bit keys Value for 192/256-bit keys kw1 KLL KLL k7 ( K L ⋘ 45 ) L ( K B ⋘ 30 ) L kw2 KLR KLR k8 ( K L ⋘ 45 ) R ( K B ⋘ 30 ) R k1 KAL KBL k9 ( K A ⋘ 15 ) L ( K L ⋘ 45 ) L k2 KAR KBR k10 ( K L ⋘ 60 ) R ( K L ⋘ 45 ) R k3 ( K L ⋘ 15 ) L ( K R ⋘ 15 ) L k11 ( K A ⋘ 60 ) L ( K A ⋘ 45 ) L k4 ( K L ⋘ 15 ) R ( K R ⋘ 15 ) R k12 ( K A ⋘ 60 ) R ( K A ⋘ 45 ) R k5 ( K A ⋘ 15 ) L ( K A ⋘ 15 ) L kl1 ( K A ⋘ 30 ) L ( K R ⋘ 30 ) L k6 ( K A ⋘ 15 ) R ( K A ⋘ 15 ) R kl2 ( K L ⋘ 77 ) L ( K L ⋘ 60 ) L kl3 ( K L ⋘ 77 ) L ( K L ⋘ 60 ) L kl5 — ( K A ⋘ 77 ) L kl4 ( K L ⋘ 77 ) R ( K L ⋘ 60 ) R kl6 — ( K A ⋘ 77 ) R k13 ( K L ⋘ 94 ) L ( K R ⋘ 60 ) L k19 — ( K R ⋘ 94 ) L k14 ( K L ⋘ 94 ) R ( K R ⋘ 60 ) R k20 — ( K R ⋘ 94 ) R k15 ( K A ⋘ 94 ) L ( K B ⋘ 60 ) L k21 — ( K A ⋘ 94 ) L k16 ( K A ⋘ 94 ) R ( K B ⋘ 60 ) R k22 — ( K A ⋘ 94 ) R k17 ( K L ⋘ 111 ) L ( K L ⋘ 77 ) L k23 — ( K L ⋘ 111 ) L k18 ( K L ⋘ 111 ) R ( K L ⋘ 77 ) L k24 — ( K L ⋘ 111 ) R kw3 ( K A ⋘ 111 ) L ( K B ⋘ 111 ) L kw4 ( K A ⋘ 111 ) R ( K B ⋘ 111 ) R FIGURE 6Open in figure viewer The proposed structures for generating the round keys (n = 2) for case 192/256-bit keys Table 4 shows the control signals of the proposed structure, n = 2, for case 192/256-bit key at the begin of encryption process (Figure 6 as key scheduling part and Figure 5, for n = 2, as data processing part). For example, in the first clock cycle, we have computation of the first two rounds of data processing. In this case, for computation of these operations, the control signals Se1 Se2, c[1 : 0], d[1 : 0], Sel1 and Sel2 are equal to ″01″, 0, 0, '0' and '1', respectively. Also, the computations in the next clock cycles are implemented by the proposed structure based on Table 4. Therefore, the ciphertext is generated with latency 13 clock cycles. TABLE 4. Control signals of the proposed structure for case (192/256-bit keys and n = 2) #Clock Cycles Se1 Se2 c[1:0] d[1:0] Sel1 Sel2 Sel3 1 01 0 0 0 1 1 2 10 0 0 0 0 1 3 00 0 0 0 0 1 4 01 0 0 1 0 1 5 10 1 1 0 0 1 6 00 1 1 0 0 1 7 01 1 1 1 0 1 8 10 2 2 0 0 1 9 00 2 2 0 0 1 10 01 2 2 1 0 1 11 10 3 3 0 0 1 12 00 3 3 0 0 1 13 00 3 3 0 0 1 2.5 The proposed flexible structures of Camellia block cipher In this section, we present a flexible structure for implementation of the Camellia block cipher. As mentioned before, the Camellia block cipher has three key sizes consisting of 128-bit, 192-bit, and 256-bit. The flexible architecture is used to implementing the Camellia cipher with different security levels. The proposed structure supports the key sizes 128, 192 and 256. Figure 7 shows the proposed flexible structure for implementation of the Camellia cipher for the case n = 2. The width of the registers and multiplexers in the encryption part and the round keys generator part are equal to 64-bit and 128-bit, respectively. The structure is configured based on the control signals Se1, Se2, d[1 : 0], c[1 : 0], L1 to L3, Sel1 to Sel3 and Sel128_192/256. In the first step of computations, the control signal Sel2 is equal to '0' and we have computing the KA and KB parameters based on data processing part (KA and (KA and KB) parameters are generated in five and seven clock cycles for 128-bit and 192/256-bit keys, respectively). Then, in the second step, after computing