# Pipelined architecture for secret key block ciphers

I want to implement a pipelined architecture of AES128; and I couldn't figure out the number of the pipline stages. As I undestand, it is possible to make the piepline stages inside the round, or outside it or both. What I don't understand is if the I chose to make them inside a round, why the number of stages must be a divisor of number of rounds? I understand that it must be a divisor if the pipelined stages are between the rounds. Correct me if my understanding is wrong.

I think that since there is 4 operations inside every round then it is possible to make 4 stages? but what about the last round?

Here what I have read: A traditional methodology for design of high-performance implementations of secret-key block ciphers, operating in non-feedback cipher modes is shown in Fig. 21. The basic iterative architecture, shown in Fig. 21a is implemented first, and its speed and area determined. Based on these estimations, the number of rounds K that can be unrolled without exceeding the available circuit area is found. The number of unrolled rounds, K, must be a divisor of the total number of cipher rounds, #rounds. If the available circuit area is not large enough to fit all cipher rounds, architecture with partial outer-round pipelining, shown in Fig. 21b, is applied.

the number of stages must be a divisor of number of rounds

That applies to pipelined and to iterative implementations where one stage implements $$k\ge2$$ rounds out of $$K$$, and we want each of the $$K/k$$ stages needed for a full block cipher strictly identical. That requirement could be waived by making less rounds in the last stage, or in an iterative implementation using an extra multiplexer extracting the output after $$K\bmod k$$ rounds in the last of the $$\lceil K/k \rceil$$ stages. That requirement does not apply at all to implementation with a single round, or less, per pipeline stage.

in AES, since there is 4 operations inside every round then it is possible to make 4 stages?

Yes, with 4 stages per round, thus $$4K$$ stages per block ($$K\in\{10,12,14\}$$ depending on key size). That's useful in an iterative implementation (which goal is reduced silicon area at the expense of throughput). One stage still needs to perform 4 identical byte substitutions (since each 16 bytes of a block go through that at each round) in the SubBytes steps, thus a minimum-area implementation might further subdivide that, for a total of $$16K$$ steps per block.

but what about the last round?

Indeed the last round needs to be special-cased; in a pipeline that's different (simpler) function in the last round, in an iterative implementation that's an extra input to the logic to inhibit MixColumns, held to a different state during the last of the $$K$$ rounds.

• Thankyou for your answer @fgrieu , it is clear to me now. – Balkis Aug 30 at 9:23
• "One stage still needs to perform 4 SubBytes steps" why?, I became a bit confused again. We are talking about pipelining inside a round not between rounds; are we? In one round of AES there is 4 operations ( add key / sub bytes / shift rows and mix columns ) so they are not identical, in that case is it still possible to have 4 stages? – Balkis Aug 30 at 17:59
• @Balkis: I tried to clarify what I mean. Basically, at each round, there are 16 byte substitutions, and that substitution is relatively expensive; thus an iterative implementation might want to have a single instance of that. – fgrieu Aug 30 at 19:34
• I got that, so pipelining should be inter round, in this case, we want to make sure that the stages take the same amount of time? – Balkis Aug 31 at 6:51
• The slowest stage needs to fit the clock period. For optimum performance/lowest clock period, we thus want to equalize the duration of stages. That's not always an issue, e.g. when target is minimum silicon area and performance a non-issue. – fgrieu Aug 31 at 10:24