AES in P 4 using scrambled lookup tables

AES in P 4 using scrambled lookup tables Xiaoqi Chen

Secure Apps Need Secure Crypto • “Never roll your own crypto”! • CRC-32 is likely not secure enough… • Data plane: many computational constraints • Short pipeline, simple arithmetic • Is standardized crypto still possible? • Maybe?

AES: An Intro NS A Ap pro • NIST standard encryption algorithm ved • “Block cipher”, encrypt data 16 bytes at a time • Uses 10, 12, or 14 encryption rounds • Each round: • • Add. Round. Key Sub. Bytes Shift. Rows Mix. Columns

An AES Round 16 -byte round key k 0, 0 k 1, 0 k 2, 0 k 3, 0 Substitution box (S-box) k 0, 1 k 1, 1 k 2, 1 k 3, 1 k 0, 2 k 1, 2 k 2, 2 k 3, 2 k 0, 3 k 1, 3 k 2, 3 k 3, 3 a 0, 0 a 1, 0 a 2, 0 a 3, 0 a 0, 1 a 1, 1 a 2, 1 a 3, 1 (1) Add. Round. Key: using XOR b 0, 0 b 1, 0 b 2, 0 b 3, 0 b 0, 1 01 b 2, 1 b 3, 1 In 00 01 02 03 04 05 … Out 63 7 B 77 7 B F 2 6 B … (2) Sub. Bytes: lookup in S-box c 0, 0 c 1, 0 c 2, 0 c 3, 0 c 0, 1 7 B c 2, 1 c 3, 1 a 0, 2 a 1, 2 a 2, 2 a 3, 2 b 0, 2 b 1, 2 b 2, 2 b 3, 2 c 0, 2 c 1, 2 c 2, 2 c 3, 2 a 0, 3 a 1, 3 a 2, 3 a 3, 3 b 0, 3 b 1, 3 b 2, 3 c 0, 3 c 1, 3 c 2, 3 04 F 2

An AES Round c 0, 0 c 1, 0 c 2, 0 c 3, 0 c 0, 1 c 1, 1 c 2, 1 c 3, 1 c 0, 2 c 1, 2 c 2, 2 c 3, 2 c 0, 3 c 1, 3 c 2, 3 c 3, 3

An AES Round (4) Mix. Columns: Polynomial Multiplication under GF(28), modulus (x 4+1) a(x) = 3 x 3+x 2+x+2 b(x) = c 1, 0 x 3+c 2, 1 x 2+c 3, 2 x+c 0, 3 (3) Shift. Rows: each row cyclically shifted by 0, 1, 2, or 3 positions d(x) = a(x)⊗b(x) mod (x 4+1) = d 1, 0 x 3+d 1, 1 x 2+d 1, 2 x+d 1, 3 c 0, 0 c 1, 0 c 2, 0 c 3, 0 d 0, 0 d 1, 0 d 2, 0 d 3, 0 c 0, 1 c 1, 1 c 2, 1 c 3, 1 c 0, 1 d 1, 1 d 2, 1 d 3, 1 c 0, 2 c 1, 2 c 2, 2 c 3, 2 c 0, 2 c 1, 2 d 0, 2 d 1, 2 d 2, 2 d 3, 2 c 0, 3 c 1, 3 c 2, 3 c 3, 3 c 0, 3 c 1, 3 c 2, 3 d 0, 3 d 1, 3 d 2, 3 d 3, 3

An AES Round a 0, 0 a 1, 0 a 2, 0 a 3, 0 Rinse and repeat! AES-128: 10 rounds AES-192: 12 rounds AES-256: 14 rounds d 0, 0 d 1, 0 d 2, 0 d 3, 0 a 0, 1 a 1, 1 a 2, 1 a 3, 1 d 0, 1 d 1, 1 d 2, 1 d 3, 1 a 0, 2 a 1, 2 a 2, 2 a 3, 2 d 0, 2 d 1, 2 d 2, 2 d 3, 2 a 0, 3 a 1, 3 a 2, 3 a 3, 3 d 0, 3 d 1, 3 d 2, 3 d 3, 3

Different Optimization Objectives Embedded system P 4 switch • Very small memory • Relatively larger memory • Don’t use large lookup tables • For routing tables • Sequential computation • Parallel data flow • Run many cycles • Challenge: limited # stages

Solution: Scrambled Lookup Table 12 k 1, 0 k 2, 0 k 3, 0 34 k 1, 1 k 2, 1 k 3, 1 71 k 1, 2 k 2, 2 k 3, 2 55 k 1, 3 k 2, 3 k 3, 3 a 0, 1 a 1, 1 a 2, 1 a 3, 1 75 a 1, 2 a 2, 2 a 3, 2 a 0, 3 a 1, 3 a 2, 3 a 3, 3 … In 00 01 02 03 04 05 … In XOR k 0, 0 12 13 10 11 16 17 … In XOR k 34 35 36 37 30 31 … In XOR k 0, 21, 0 71 70 73 72 75 74 … … Out 63 7 B 77 7 B F 2 6 B … … a 0, 0 a 1, 0 a 2, 0 a 3, 0 Pre-computed Scrambled Lookup Tables 16 tables per round, one for each ki, j c 0, 0 c 1, 0 c 2, 0 c 3, 0 c 0, 1 c 1, 1 c 2, 1 c 3, 1 F 2 c 1, 2 c 2, 2 c 3, 2 c 0, 3 c 1, 3 c 2, 3 c 3, 3

Solution: Scrambled Lookup Table • Use 160 x~224 x memory space to save XORs • Input block -> Lookup -> XOR -> Output block • Theoretical minimum: 2 stage per round • Each table costs 1 KB • Justifiable in switches: short pipeline, MBs of memory

Evaluation • Does it actually fit? • Theoretically SLTs costs 160~224 KB of memory in total • In practice, occupied <15% of SRAM on Tofino v 1 • Other resource utilization are negligible • So, what is the real-world performance? • 10 Gbit/s @ two rounds per pass (200 Gbps recirculation limit) • 122% improvement compared with baseline (one round per pass)

Evaluation

Evaluation =0. 3 x =1. 3 x Tofino Wedge 100 -32 x, $8000 =2. 4 x Use 50% ports for recirculation Mac. Book Air 13” 2017, $1200 Intel i 7 (AES-NI), 2. 2 Ghz 2 cores =11 x Mac. Book Pro 16” 2019, $2400 Intel i 7 (AES-NI), 2. 6 Ghz 6 cores

Conclusion & Future Directions • AES runs on P 4 switches! • Please, avoid hand-rolled crypto • Scrambled Lookup Table: save XORs using 160~224 KB memory • Two rounds per pass, improves throughput by 122% • Tofino v 1 is not the best device to run AES • Other algorithms? Is Feistel Cipher more PISA-friendly? • Fewer rounds? • Dedicated crypto co-processor in switches? Our P 4 code is open-source! github. com/Princeton-Cabernet/p 4 -projects