Area, Delay, and Power Characteristics of Standard-Cell Implementations of the AES S-Box

  • Stefan Tillich
  • Martin Feldhofer
  • Johann Großschädl
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4017)


Cryptographic substitution boxes (S-boxes) are an integral part of modern block ciphers like the Advanced Encryption Standard (AES). There exists a rich literature devoted to the efficient implementation of cryptographic S-boxes, whereby hardware designs for FPGAs and standard cells received particular attention. In this paper we present a comprehensive study of different standard-cell implementations of the AES S-box with respect to timing (i.e. critical path), silicon area, power consumption, and combinations of these cost metrics. We examined implementations which exploit the mathematical properties of the AES S-box, constructions based on hardware look-up tables, and dedicated low-power solutions. Our results show that the timing, area, and power properties of the different S-box realizations can vary by more than an order of magnitude. In terms of area and area-delay product, the best choice are implementations which calculate the S-box output. On the other hand, the hardware look-up solutions are characterized by the shortest critical path. The dedicated low-power implementations do not only reduce power consumption by a large degree, but they also show good timing properties and offer the best power-delay and power-area product, respectively.


Power Consumption Sensor Node Critical Path Advance Encryption Standard Total Power Consumption 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Bertoni, G., Macchetti, M., Negri, L., Fragneto, P.: Power-efficient ASIC Synthesis of Cryptographic Sboxes. In: Proceedings of the 14th ACM Great Lakes Symposium on VLSI (GLSVLSI 2004), pp. 277–281. ACM Press, New York (2004)CrossRefGoogle Scholar
  2. 2.
    Canright, D.: A very compact S-box for AES. In: Rao, J.R., Sunar, B. (eds.) CHES 2005. LNCS, vol. 3659, pp. 441–455. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  3. 3.
    Chodowiec, P., Gaj, K.: Very compact FPGA implementation of the AES algorithm. In: D.Walter, C., Koç, Ç.K., Paar, C. (eds.) CHES 2003. LNCS, vol. 2779, pp. 319–333. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  4. 4.
    Daemen, J., Rijmen, V.: The Design of Rijndael. Springer, Heidelberg (2002)zbMATHGoogle Scholar
  5. 5.
    Feldhofer, M., Wolkerstorfer, J., Rijmen, V.: AES implementation on a grain of sand. IEE Proceedings Information Security 152(1), 13–20 (2005)CrossRefGoogle Scholar
  6. 6.
    Hodjat, A., Hwang, D.D., Lai, B.-C., Tiri, K., Verbauwhede, M.: A 3.84 Gbits/s AES crypto coprocessor with modes of operation in a 0.18-μm CMOS technology. In: Proceedings of the 15th ACM Great Lakes Symposium on VLSI (GLSVLSI 2005), pp. 351–356. ACM Press, New York (2005)Google Scholar
  7. 7.
    Lidl, R., Niederreiter, H.: Finite Fields, 2nd edn. Cambridge University Press, Cambridge (1996)zbMATHCrossRefGoogle Scholar
  8. 8.
    Macchetti, M., Bertoni, G.: Hardware implementation of the Rijndael SBOX: A case study. ST Journal of System Research, 84–91 (2003)Google Scholar
  9. 9.
    Mentens, N., Batina, L., Preneel, B., Verbauwhede, I.M.: Systematic evaluation of compact hardware implementations for the Rijndael S-box. In: Menezes, A. (ed.) CT-RSA 2005. LNCS, vol. 3376, pp. 323–333. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  10. 10.
    Morioka, S., Satoh, A.: An optimized S-box circuit architecture for low power AES design. In: Kaliski Jr., B.S., Koç, Ç.K., Paar, C. (eds.) CHES 2002. LNCS, vol. 2523, pp. 172–186. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  11. 11.
    National Institute of Standards and Technology (NIST). Advanced Encryption Standard (AES). Federal Information Processing Standards (FIPS) Publication 197 (November 2001)Google Scholar
  12. 12.
    Pramstaller, N., Wolkerstorfer, J.: A universal and efficient AES co-processor for field programmable logic arrays. In: Becker, J., Platzner, M., Vernalde, S. (eds.) FPL 2004. LNCS, vol. 3203, pp. 565–574. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  13. 13.
    Satoh, A., Morioka, S., Takano, K., Munetoh, S.: A compact rijndael hardware architecture with S-box optimization. In: Boyd, C. (ed.) ASIACRYPT 2001. LNCS, vol. 2248, pp. 239–254. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  14. 14.
    Tillich, S., Großschädl, J., Szekely, A.: An Instruction Set Extension for Fast and Memory-Efficient AES Implementation. In: Dittmann, J., Katzenbeisser, S., Uhl, A. (eds.) CMS 2005. LNCS, vol. 3677, pp. 11–21. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  15. 15.
    Wolkerstorfer, J., Oswald, E., Lamberger, M.: An ASIC implementation of the AES sBoxes. In: Preneel, B. (ed.) CT-RSA 2002. LNCS, vol. 2271, pp. 67–78. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  16. 16.
    Zhang, X., Parhi, K.K.: High-speed VLSI architectures for the AES algorithm. IEEE Transactions on Very Large Scale Integration (VLSI) Systems 12(9), 957–967 (2004)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Stefan Tillich
    • 1
  • Martin Feldhofer
    • 1
  • Johann Großschädl
    • 1
  1. 1.Institute for Applied Information Processing and CommunicationsGraz University of TechnologyGrazAustria

Personalised recommendations