Why Crypto in Hardware?

Software executes sequentially on general-purpose ALUs. Cryptographic algorithms expose massive data-level parallelism and fixed dataflow — ideal for dedicated circuits.

Accelerator Taxonomy

AES-128 Round Architecture

Each AES round applies four transformations to a 128-bit state matrix. Hardware maps each to a combinational block.

S-Box Implementation Strategies

SubBytes dominates AES area and critical path. The S-Box computes the multiplicative inverse in GF(2⁸) followed by an affine transformation.

AES-GCM Hardware

Galois/Counter Mode combines AES-CTR encryption with GHASH authentication. The GHASH unit requires a GF(2¹²⁸) multiplier — a second major hardware block alongside AES.

SHA-3 (Keccak) Hardware

Keccak operates on a 1600-bit state (5×5×64) through 24 rounds of θ, ρ, π, χ, ι permutations. Its structure maps naturally to hardware — no S-Box lookup tables needed.

RSA Hardware Architecture

RSA's core operation is modular exponentiation: C = M^e mod n. This reduces to hundreds of modular multiplications over 2048–4096 bit operands.

ECC Scalar Multiplication

ECC computes Q = k·P via repeated point addition and doubling over a 256-bit prime field. The hierarchy of operations creates a natural hardware decomposition.

Edwards25519 hardware: unified point add/double in 646 cycles, full scalar multiplication in 164,730 cycles at 117 MHz → 1.4 ms per operation on Virtex-5.

NIST PQC Standards & Hardware

NIST finalized three lattice-based standards in 2024. All share a common computational bottleneck: polynomial multiplication, accelerated via the Number Theoretic Transform (NTT).

Number Theoretic Transform (NTT)

NTT is the finite-field equivalent of FFT. It converts O(n²) polynomial multiplication into O(n log n) operations modulo a prime q.

  Cooley-Tukey (CT):    a' = a + ω·b (mod q)
                         b' = a - ω·b (mod q)

  Gentleman-Sande (GS): a' = a + b     (mod q)
                         b' = (a - b)·ω (mod q)

NTT Hardware Architectures

PQC Accelerator SoC Integration

Real deployments integrate NTT engines into RISC-V or ARM SoCs via memory-mapped registers or custom instruction set extensions (ISEs).

Architecture based on CRYSTALS-Dilithium post-quantum SoC designs for wired-communication critical systems.

Side-Channel Attack Taxonomy

Algorithmically secure crypto can be broken by observing physical leakage during computation. Hardware designers must defend against all channels simultaneously.

Hardware Countermeasures

Threshold Implementation (TI)

TI splits every sensitive variable into d+1 shares that are processed independently. Even if an attacker observes glitch-induced transient leakage, no single share reveals information.

// 2-share TI for AES S-Box (simplified concept)
// Each share never sees the complete unmasked value

module ti_sbox (
  input  [7:0] x_share1, x_share2,  // Masked input shares
  input  [7:0] fresh_random,          // Fresh randomness per clock
  output [7:0] y_share1, y_share2    // Masked output shares
);
  // Non-linear layer uses cross-domain terms with fresh masks
  // Linear layers (affine transform) applied to each share independently
  // Area: ~6,000 GE vs ~350 GE unmasked — ~17× overhead
endmodule

ASIC vs. FPGA Trade-offs

Crypto Instruction Set Extensions

Rather than a fully separate accelerator, ISEs add crypto-specific instructions to the CPU pipeline. They offer a middle ground between pure software and dedicated hardware.

Inline Encryption Engines

Modern network SoCs embed crypto engines directly in the data path. The CPU never touches plaintext packets — the engine encrypts/decrypts at wire speed.

SystemVerilog: AES Round

module aes_round (
  input  logic [127:0] state_in,
  input  logic [127:0] round_key,
  input  logic         is_last_round,  // Skip MixColumns on round 10
  output logic [127:0] state_out
);
  logic [127:0] after_sub, after_shift, after_mix;

  // SubBytes: 16 parallel S-Box instances (composite field)
  genvar i;
  generate
    for (i = 0; i < 16; i++) begin : gen_sbox
      aes_sbox_cf u_sbox (
        .in  (state_in[8*i +: 8]),
        .out (after_sub[8*i +: 8])
      );
    end
  endgenerate

  // ShiftRows: fixed byte permutation (zero-cost in hardware — just wiring)
  assign after_shift = {
    after_sub[127:120], after_sub[ 87: 80], after_sub[ 47: 40], after_sub[  7:  0],
    after_sub[ 95: 88], after_sub[ 55: 48], after_sub[ 15:  8], after_sub[103: 96],
    after_sub[ 63: 56], after_sub[ 23: 16], after_sub[111:104], after_sub[ 71: 64],
    after_sub[ 31: 24], after_sub[119:112], after_sub[ 79: 72], after_sub[ 39: 32]
  };

  // MixColumns: GF(2^8) matrix multiply per column
  generate
    for (i = 0; i < 4; i++) begin : gen_mixcol
      aes_mixcolumn u_mix (
        .in  (after_shift[32*i +: 32]),
        .out (after_mix[32*i +: 32])
      );
    end
  endgenerate

  // AddRoundKey: 128-bit XOR
  assign state_out = (is_last_round ? after_shift : after_mix) ^ round_key;
endmodule

SystemVerilog: Composite Field S-Box

// AES S-Box via tower field: GF(2^8) → GF((2^4)^2) → GF(((2^2)^2)^2)
// No ROM — pure combinational logic (~300 gates)
module aes_sbox_cf (
  input  logic [7:0] in,
  output logic [7:0] out
);
  logic [7:0] mapped, inv_mapped;
  logic [3:0] hi, lo, inv_hi, inv_lo;
  logic [3:0] sum_hl, sq_scale, prod, inv_d, t;

  // Step 1: Isomorphic mapping GF(2^8) → GF((2^4)^2)
  assign mapped = iso_map(in);     // 8×8 binary matrix multiply
  assign hi = mapped[7:4];
  assign lo = mapped[3:0];

  // Step 2: Compute inverse in GF((2^4)^2)
  assign sum_hl   = hi ^ lo;                        // GF(2^4) add
  assign sq_scale = gf16_sq_scale(hi);               // hi² · λ (combined)
  assign prod     = gf16_mul(sum_hl, lo);             // (hi⊕lo) · lo
  assign t        = sq_scale ^ prod;                  // Norm: hi²λ ⊕ (hi⊕lo)·lo
  assign inv_d    = gf16_inv(t);                      // Inversion in GF(2^4)
  assign inv_hi   = gf16_mul(sum_hl, inv_d);          // (hi⊕lo) · inv_d
  assign inv_lo   = gf16_mul(hi, inv_d);              // hi · inv_d

  // Step 3: Inverse map + affine transformation
  assign inv_mapped = inv_iso_map({inv_hi, inv_lo});
  assign out        = affine_transform(inv_mapped);
endmodule

Each gf16_* function decomposes further into GF(2²) arithmetic — ultimately reducing to AND/XOR gates. The deepest path is ~22 XOR + ~12 AND gate delays.

SystemVerilog: NTT Butterfly

// Cooley-Tukey NTT butterfly for ML-KEM (Kyber)
// q = 3329, coefficients are 12-bit
module ntt_butterfly #(
  parameter Q     = 3329,
  parameter WIDTH = 12
)(
  input  logic                clk, rst_n,
  input  logic [WIDTH-1:0]    a_in, b_in,     // Input coefficients
  input  logic [WIDTH-1:0]    omega,           // Twiddle factor (root of unity)
  output logic [WIDTH-1:0]    a_out, b_out     // Output coefficients
);
  logic [2*WIDTH-1:0] prod;
  logic [WIDTH-1:0]   omega_b, sum_val, diff_val;

  // Modular multiplication: ω · b (mod q) via Montgomery
  assign prod = omega * b_in;                   // Full-width multiply

  // Montgomery reduction: t = prod · q_inv mod R; result = (prod + t·q) >> R
  montgomery_reduce #(.Q(Q), .W(WIDTH)) u_mont (
    .product (prod),
    .result  (omega_b)
  );

  // Butterfly: a' = a + ω·b (mod q),  b' = a - ω·b (mod q)
  mod_add_sub #(.Q(Q), .W(WIDTH)) u_add (
    .a(a_in), .b(omega_b), .sum(sum_val), .diff(diff_val)
  );

  // Pipeline register
  always_ff @(posedge clk or negedge rst_n)
    if (!rst_n) begin a_out <= '0; b_out <= '0; end
    else        begin a_out <= sum_val; b_out <= diff_val; end
endmodule

SystemVerilog: Montgomery Reduction

// Multiplier-less Montgomery reduction for Kyber (q = 3329)
// Exploits q = 13·256 + 1 structure for efficient constant multiply
module montgomery_reduce #(
  parameter Q     = 3329,
  parameter Q_INV = 62209,  // q^(-1) mod 2^16
  parameter W     = 12
)(
  input  logic [2*W-1:0]  product,   // 24-bit input (a × b)
  output logic [W-1:0]    result     // Reduced to [0, q)
);
  logic [15:0] t;
  logic [31:0] u;
  logic signed [W:0] r;

  // Step 1: t = (product mod R) × Q_INV mod R
  //   where R = 2^16
  assign t = product[15:0] * Q_INV[15:0];  // Low 16 bits only

  // Step 2: u = (product + t × Q) >> 16
  assign u = product + (t * Q);
  
  // Step 3: Conditional subtraction
  assign r = u[31:16];
  assign result = (r >= Q) ? (r - Q) : r[W-1:0];
endmodule

Key optimization: For Kyber's q=3329, the constant multiply by Q_INV can be decomposed into shifts and adds, eliminating the need for a hardware multiplier entirely — reducing the butterfly to pure shift-XOR-add logic.

AES Implementation Comparison

Post-Quantum Hardware Benchmarks

Post-quantum hardware is rapidly maturing. Unified Kyber+Dilithium accelerators sharing NTT/Keccak datapaths will become the standard building block for PQC-ready SoCs.

Crypto Accelerator Design Flow

Emerging Hardware Challenges

References & Standards