| US 7,545,928 B1 | ||
| Triple DES critical timing path improvement | ||
| Joon-Kit Goh, Singapore (Singapore) | ||
| Assigned to Advanced Micro Devices, Inc., Sunnyvale, Calif. (US) | ||
| Filed on Dec. 08, 2003, as Appl. No. 10/730,681. | ||
| This patent is subject to a terminal disclaimer. | ||
| Int. Cl. H04L 9/00 (2006.01) | ||
| U.S. Cl. 380—29 [380/28; 380/30; 713/174; 713/172] | 25 Claims |

| 1. An improved security processing circuit for performing 3DES IPsec security processing services for a host system using
a DES engine, the security processing circuit comprising:
the DES engine having a message input, a cipher key input, and a pre-data output, the engine adapted to receive and selectively
process a block of data from the message input of the security processing circuit during a first DES processing operation,
and subsequently to process data from an intermediate result during second and third DES processing operations and store an
intermediate result of the third DES processing operation to the pre-data output;
a security keys circuit having a set of cipher keys input and a key output, the security keys circuit operable to select and
transfer a different cipher key to the key output coupled to the cipher key input of the DES engine selected from the set
of cipher keys associated with each DES processing operation during the first, second and third DES processing operations;
and
a data output circuit having a pre-data input and a data output, the pre-data input of the data output circuit coupled to
the pre-data output of the DES engine, and the data output selectively coupleable to the host system, the data output circuit
operable to further security process data from the pre-data input and to selectively exclusive OR an initialization vector
with the processed data and latch a final third DES result to the data output of the security processing circuit for use by
the host system,
wherein the DES engine comprises:
a permutation block having the message input and a permutation output, the permutation block operable to receive a block of
data at the message input and to perform an initial permutation of the message input data and provide a permutation result
at the permutation output;
a data input multiplexer having a first and second input and a data selection output, the data input multiplexer operable
to select and couple one of the first and second inputs to the data selection output;
an intermediate result register having a data input coupled to the data selection output, a clock input, and a latched data
output, the register operable to store right and left half results of the initial permutation or of an eight round cipher
process based on data present at the data input upon receipt of a clock signal at the clock input;
eight cipher blocks having a data input, a key input, and a cipher output, operable to receive data at the data input and
a key at the key input, to perform the cipher process comprising right and left halves of a sequential eight step cipher process
on the data at the data input employing the key, and to provide a first and second cipher result during a first and second
eight step cycle of each of the three DES processing operations;
a pre-data output multiplexer having a first and second input and a data selection output, the pre-data output multiplexer
operable to select and couple one of the first and second inputs to the data selection output; and
a pre-data output register having a data input, a clock input, and a latched data output,
wherein the permutation output of the permutation block is coupled to the first input of the data input multiplexer, the data
selection output of the data input multiplexer coupled to the data input of the intermediate result register, the latched
data output of the intermediate result register coupled to the data input of the eight cipher blocks having the cipher output
of the eight cipher blocks feedback coupled to the second input of the data input multiplexer and to the first input of the
pre-data output multiplexer, the data selection output of the pre-data output multiplexer coupled to the pre-data output register,
the latched data output of the pre-data output register feedback coupled to the second input of the pre-data output multiplexer
and the pre-data output.
|