In AES, the encryption and decryption functions ordered in a symmetric way, I mean the same order of functions are used inside the round structure of both encryption and decryption (subbytes, shiftrows, mixcolumn, addroundkey) (see The Design of Rijndael List 3.8 page 49) but how does it actually make the algorithm better in hardware implementation?

  • $\begingroup$ What I mean is, in encryption we use subbytes, shiftrows, mixcolumn, addroundkey in this order, for the sake of symmetry there is an equivalent decryption is used (The Design of Rijndael List 3.8 page 49). This equivalent version also follows the same order as in encryption. So how does this approach minimizes the area? Because we still use a seperate decryption function, which includes invShiftrows, invMix.. etc $\endgroup$ Sep 11 '19 at 8:44
  • 1
    $\begingroup$ @kelalaka It isn't clear what you mean with "In software, yes. hardware no."; which question are you answering with that? Please do try and put answers in the answer box, not in the comment box. $\endgroup$
    – Maarten Bodewes
    Sep 11 '19 at 10:15

Symmetry is something that is inherent in the design of SPN ciphers. It doesn't explicitly make the layout of the cipher smaller, but it definitely helps. You also see this in AES-NI where you can pipeline AES so each round is an instruction as you can just put latches on the boundaries. For Feistel Ciphers, or Simon at least, I just run the ciphers as asynchronous circuits because they do not integrate as well on a per-round into a traditionally synchronous processors (even if they are much smaller in layout).

In hardware, symmetry is generally desired so that your wires stick on the same layers. You have a stack of metal, and you generally run Metal 1 (M1) one direction and Metal 2 (M2) in the other direction. You just pick a direction for the data to "flow" On smaller processes with metal patterning, you find that you are forced in direction, also M1A and M1B need to go to M2 to make connections.

This "flow" is what helps AES implement nicer in hardware because of the nature of 8 in to 8 out bits of the S-Box and MixColumns.

The layout of an XOR in 14nm SOI looks like the following:

enter image description here

The two different colours of blue are the metal 1 lines for the tile (M1A is light blue, M1B is dark blue). I use this same layout for all of my cells, so I have the data flow from the top of the tile down. I interrupt the M1A lines to go to M2A, and M2B (they are thicker because of M3 via rules in case I go M1->M2->M3)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.