ctl.vhd 15.7 KB
Newer Older
lwc-tester committed
1 2 3 4 5 6 7 8 9 10
-- This work is licensed under a Creative Commons
-- Attribution-NonCommercial-ShareAlike 4.0 International License.
-- http://creativecommons.org/licenses/by-nc-sa/4.0

-- Mark D. Aagaard
-- Riham AlTawy
-- Guang Gong
-- Kalikinkar Mandal
-- Raghvendra Rohit
-- Marat Sattarov
lwc-tester committed
11 12
-- Nusa Zidaric
-- http://uwaterloo.ca/communications-security-lab/lwc/ace
lwc-tester committed
13 14 15 16 17


-- This is a human-readable summary of (and not a substitute for) the license. 
-- You are free to:

lwc-tester committed
18 19
--     Share:  copy and redistribute the material in any medium or format
--     Adapt:  remix, transform, and build upon the material
lwc-tester committed
20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365

--     The licensor cannot revoke these freedoms as long as you follow
--     the license terms.

-- Under the following terms:

--     Attribution — You must give appropriate credit, provide a link to
--     the license, and indicate if changes were made. You may do so in
--     any reasonable manner, but not in any way that suggests the
--     licensor endorses you or your use.

--     NonCommercial — You may not use the material for commercial
--     purposes.

--     ShareAlike — If you remix, transform, or build upon the material,
--     you must distribute your contributions under the same license as
--     the original.

--     No additional restrictions — You may not apply legal terms or
--     technological measures that legally restrict others from doing
--     anything the license permits.

library ieee;
use ieee.std_logic_1164.all;
use ieee.numeric_std.all;
use work.ace_pkg.all;
  
entity ctl is
  port
    ( clk       : in  std_logic
    ; reset     : in  std_logic
    ; i_mode    : in  mode_ty
    ; i_dom_sep : in  domsep_ty
    ; i_valid   : in  std_logic
    ; i_padding : in  std_logic
    ; o_valid   : out std_logic
    ; o_onehot  : out onehot_ty
    ; o_ready   : out std_logic
    ; o_control : out ace_ctl_ty
   );
end entity;

architecture rtl of ctl is

  type state_ty is (Load, pLoad, iLoad2, iInit, pInit, iProcAD, pProcAD, pEncrypt, pDecrypt, iFinal, pFinal, Tag, iHash, pAbsorb, pSqueeze);
  signal state, state_next   : state_ty;
  signal count, count_next   : count_ty;
  signal onehot, onehot_next : onehot_ty;
  signal permoff, lfsr_c_reset : std_logic;
  constant onehot_reset      : onehot_ty := ( 0 => '1', others => '0' ); --    0001
  constant count_reset       : count_ty  := ( 7 => '1', others => '0' ); -- 1000000
  constant count_zero        : count_ty  := ( others => '0' );           -- 0000000
  constant count_one         : count_ty  := ( 0 => '1', others => '0' ); -- 0000001

begin

---------------- STATE UPDATE ----------------

  o_control ( lfsr_c_reset_idx ) <= lfsr_c_reset;

  lfsr_c_reset   <= '1' when reset = '1' or (count(7) = '0' and count_next(7) = '1' ) --- reset after last ACE permutation
             else '0';

  o_control ( lfsr_c_en_idx )    <= not( permoff ) or lfsr_c_reset;
  o_onehot     <= onehot;

  o_ready      <= '1' when count(7) = '1' and state /= Tag and state_next /= Tag and state /= pSqueeze and state_next /= pSqueeze
             else '0';

  o_valid      <= '1' when ( i_valid = '1' and count(7) = '1' and 
                           ( state_next = pEncrypt or state_next = pDecrypt or state_next = pSqueeze ) )
                            or
                           ( count(7) = '1' and ( state = pSqueeze or state_next = pSqueeze ) )
                            or
                           ( state = Tag or state_next = Tag )
             else '0';

  o_control( absorb_idx )  <= '1' when state_next = pAbsorb or state_next = pEncrypt or state_next = pFinal or
                                       state_next = pDecrypt or state_next = pProcAD or state_next = pInit
                         else '0';

  o_control( replace_idx ) <= '1' when state_next = pDecrypt 
                         else '0';

  o_control( output_idx )  <= '1' when state_next = pEncrypt or state_next = pDecrypt or state = pSqueeze or
                                       state_next = pSqueeze or state = Tag or state_next = Tag
                         else '0';

  o_control( squeeze_idx ) <= '1' when state_next = pSqueeze or state = pSqueeze
                         else '0';

  permoff                  <= '0' when ( count(7) = '0' or ( count(7) = '1' and count_next(0) = '1' ) )
                                       and i_padding = '0'
                         else '1';

  o_control( permoff_idx ) <= permoff;        
  o_control( endstep_idx ) <= count(0) and count(1) and count(2);

  process begin

    wait until rising_edge(clk);
    if reset = '1' then
      state  <= Load;
      onehot <= onehot_reset;
      count  <= count_reset;
    else
      state  <= state_next;
      onehot <= onehot_next;
      count  <= count_next;
    end if;

  end process;

  ------------- NEXT STATE LOGIC ----------------

  process(state, onehot, count, i_valid, i_mode, i_dom_sep, i_padding) is
  begin

    case state is
      when Load =>
        if i_valid = '1' then
          if onehot(3) = '1' or i_mode(1) = '1' then       -- if onehot = 1000 or if HASH mode
            state_next  <= pLoad;
            count_next  <= count_zero;                     -- count goes from 128 to 0
            onehot_next <= onehot_reset;
          else
            state_next  <= Load;
            count_next  <= count_reset;                    -- keep count at 128
            onehot_next <= onehot_rotate( onehot );        -- rotate onehot
          end if;
        else
          count_next  <= count_reset;                      -- keep count at 128
          state_next  <= Load;
          onehot_next <= onehot;                           -- keep onehot unchanged 
        end if;

      when pLoad | iLoad2 =>
        if count < 128 and state = pLoad then
          count_next  <= count + 1;                        -- increment count if less than 128
          state_next  <= pLoad;
          onehot_next <= onehot_reset;                     -- keep onehot at 0001
        elsif i_mode(0) = '1' and i_mode(1) = '1' then
          state_next  <= pSqueeze;
          onehot_next <= onehot_reset;
          count_next  <= count_one;
        elsif i_valid = '1' then
          count_next <= count_one;                         -- count goes from 128 to 1
          if i_mode(1) = '0' then                          -- and i_dom_sep(0) = '0' and i_dom_sep(1) = '0' then
            onehot_next <= onehot_rotate( onehot );        -- rotate onehot from 0001 to 0010
            state_next  <= pInit;
          else                                             -- i_mode(1) = '1' and i_mode(0) = '0' -- and i_dom_sep(0) = '0' and i_dom_sep(1) = '0' then
            onehot_next <= onehot_reset;                   -- keep onehot 0001
            state_next  <= pAbsorb;                
        end if;
      else
        count_next  <= count_reset;                              -- keep count at 128
        state_next  <= iLoad2;
        onehot_next <= onehot_reset;                       -- keep onehot at 0001
      end if;

    when pInit =>
      if count < 128 then
        count_next  <= count + 1;                          -- increment count if less than 128
        state_next  <= pInit;
        onehot_next <= onehot;                             -- keep onehot unchanged
      else
        if onehot(1) = '1' then                            -- if onehot = 0010 (i.e. K0 init is done, K1 is being sampled)
          if i_valid = '1' then
            onehot_next <= onehot_rotate( onehot );        -- rotate onehot from 0010 to 0100
            state_next  <= pInit;
            count_next  <= count_one;                      -- count goes from 128 to 1
          else
            onehot_next <= onehot;                         -- keep onehot unchanged (0010)
            state_next  <= iInit;
            count_next  <= count_reset;                    -- keep count at 128
          end if;
        else                                               -- if onehot = 0100
          onehot_next <= onehot_reset;                     -- reset onehot from 0100 to 0001
          if i_valid = '1' then
            if i_dom_sep(0) = '0' and i_dom_sep(1) = '0' then        -- i_dom_sep = 0
              state_next <= pFinal;
              count_next <= count_one;                     -- count goes from 128 to 1
            elsif i_dom_sep(0) = '1' and i_dom_sep(1) = '0' then     -- i_dom_sep = 1
              state_next <= pProcAD;
              count_next <= count_one;                     -- count goes from 128 to 1
            elsif i_dom_sep(0) = '0' and i_dom_sep(1) = '1' then     -- i_dom_sep = 2
              if i_padding = '0' then
                count_next <= count_one;                   -- count goes from 128 to 1
              else
                count_next <= count_zero;                  -- count goes from 128 to 0 when padding is needed
              end if;
              if i_mode(0) = '0' then
                state_next <= pEncrypt;
              else                                         -- i.e. if i_mode(0) = '1'
                state_next <= pDecrypt;
               end if;
            else                                           -- if i_valid = 1 but i_dom_sep has ILLEGAL value = 3
              state_next <= iProcAD;
              count_next <= count_reset;                   -- keep count at 128
            end if;
          else                                             -- i.e. if i_valid = '0'
            state_next <= iProcAD;
            count_next <= count_reset;                     -- keep count at 128
          end if;
        end if;
      end if;

    when iInit =>
      if i_valid = '1' then
        onehot_next <= onehot_rotate( onehot );            -- rotate onehot from 0010 to 0100
        state_next  <= pInit;
        count_next  <= count_one;                          -- count goes from 128 to 1
      else
        onehot_next <= onehot;                             -- keep onehot at 0010 (staying ready for K1)
        state_next  <= iInit;
        count_next  <= count_reset;                        -- keep count at 128
      end if;

    when iProcAD | pProcAD | pEncrypt | pDecrypt =>
      if count < 128 and state /= iProcAD then
        if i_padding = '0' then
          count_next <= count + 1;                         -- increment count if less than 128 (except if in iProcAD)
        else
          count_next <= count;                             -- stall count when i_padding = 1
        end if;                
        state_next  <= state;
        onehot_next <= onehot_reset;                       -- keep onehot at 0001
      else
        if i_valid = '1' then
          if i_dom_sep(0) = '0' and i_dom_sep(1) = '0' then          -- i_dom_sep = 0
            onehot_next <= onehot_rotate(onehot);          -- rotate onehot to 0010
            state_next  <= pFinal;
            count_next  <= count_one;                      -- count goes from 128 to 1
          elsif i_dom_sep(0) = '1' and i_dom_sep(1) = '0' then       -- i_dom_sep = 1
            state_next  <= pProcAD;
            count_next  <= count_one;                      -- count goes from 128 to 1
            onehot_next <= onehot_reset;                   -- keep onehot at 0001
          elsif i_dom_sep(0) = '0' and i_dom_sep(1) = '1' then       -- i_dom_sep = 2
            if i_padding = '0' then
              count_next <= count_one;                     -- count goes from 128 to 1
            else
              count_next <= count_zero;                    -- count goes from 128 to 0 when padding is needed
            end if;
            onehot_next <= onehot_reset;                   -- keep onehot at 0001
            if i_mode(0) = '0' then
              state_next <= pEncrypt;
            else                                           -- i.e. if i_mode(0) = '1'
              state_next <= pDecrypt;
            end if;
          else                                             -- if i_valid = 1 but i_dom_sep has ILLEGAL value = 3
            state_next <= iProcAD;
            count_next <= count_reset;                     -- keep count at 128
            onehot_next <= onehot;
          end if;        
        else                                               -- i.e. if i_valid = '0'
          state_next <= iProcAD;
          count_next <= count_reset;                       -- keep count at 128
          onehot_next <= onehot;
        end if;
     end if;

    when pFinal =>
      if count < 128 then
        count_next  <= count + 1;                          -- increment count if less than 128 (except if in iProcAD)
        state_next  <= pFinal;
        onehot_next <= onehot;                             -- keep onehot constant (0010 or 0100)
      else        
         if onehot(1) = '1' then                           -- if onehot = 0010
          if i_valid = '1' then
            onehot_next <= onehot_rotate( onehot );        -- rotate onehot from 0010 to 0100
            state_next  <= pFinal;
            count_next  <= count_one;                      -- count goes from 128 to 1
          else
            onehot_next <= onehot;                         -- keep onehot unchanged (at 0010)
            state_next  <= iFinal;
            count_next  <= count_reset;                    -- keep count at 128
          end if;
        else                                               -- if onehot = 0100
          state_next  <= Tag;
          onehot_next <= onehot_rotate( onehot );          -- rotate onehot from 0100 to 1000
          count_next  <= count_reset;                      -- keep count at 128
        end if;
      end if;

    when iFinal =>
      if i_valid = '1' then
        onehot_next <= onehot_rotate( onehot );            -- rotate onehot from 0010 to 0100
        state_next  <= pFinal;
        count_next  <= count_one;                          -- count goes from 128 to 1
      else
        onehot_next <= onehot;                             -- keep onehot at 0010
        state_next  <= iFinal;
        count_next  <= count_reset;                        -- keep count at 128
      end if;

    when Tag =>
        count_next  <= count_reset;                        -- keep count at 128
        onehot_next <= onehot_rotate( onehot );
        state_next  <= Load;

    when iHash | pAbsorb =>
      if count < 128 and state = pAbsorb then
        count_next  <= count + 1;                          -- increment count if less than 128
        state_next  <= pAbsorb;
        onehot_next <= onehot_reset;                       -- keep onehot 0001
      elsif i_mode(0) = '1' and i_mode(1) = '1' then
        state_next  <= pSqueeze;
        onehot_next <= onehot_reset;
        count_next  <= count_one;
      elsif i_valid = '1' then
        count_next  <= count_one;                          -- count goes from 128 to 1
        state_next  <= pAbsorb;
        onehot_next <= onehot_reset;                       -- onehot stays at 0001
      else
        count_next  <= count_reset;                        -- keep count at 128
        onehot_next <= onehot;                             -- onehot remains unchanged
        state_next  <= iHash;        
      end if;
        
    when pSqueeze =>
      if count < 128 then
        count_next  <= count + 1;                          -- increment count if less than 128
        state_next  <= pSqueeze;
        onehot_next <= onehot;                             -- keep onehot
      else
        if onehot(2) = '1' then
          onehot_next <= onehot_reset;                        
          state_next  <= Load;
          count_next  <= count_reset;                      -- keep count at 128
        else
          onehot_next <= onehot_rotate( onehot );          -- onehot goes from 0010 to 0100 for second squeeze
          state_next  <= pSqueeze;
          count_next  <= count_one;                        -- count goes from 128 to 1
        end if;
      end if;

    when others =>
      state_next  <= Load;
      onehot_next <= onehot_reset;
      count_next  <= count_reset;

  end case;

  end process;

end architecture;