Vitis Security Library

Vitis Security Library is an open-sourced Vitis library written in C++ for accelerating security applications in a variety of use cases.

It now covers L1 level primitives. In this level, it provides optimized hardware implementation of most common relational security algorithms. Such as, Synmmetric Block Cipher, Symmetirc Stream Cipher, Asymmetric Cryptography, Cipher Modes of Operations, Message Authentication Code, and Hash Function.

Since all the primitive code is developed in HLS C++ with the permissive Apache 2.0 license, advanced users can easily tailor, optimize or assemble property logic. Benchmarks of 4 different acceleration applications are also provided with the library for easy on-boarding and comparison.

Library Contents

Library Class Description Layer
aesEnc implementation of AES block cipher encrpytion part L1
aesDec implementation of AES block cipher decrpytion part L1
rsa implementation of RSA encryption / decryption part L1
dsa implementation of DSA sign / verify part L1
Library Function Description Layer
desEncrypt desEncrypt is the basic function for encrypt one block with one cipher key using DES L1
desDecrypt desDecrypt is the basic function for decrypt one block with one cipher key using DES L1
des3Encrypt des3Encrypt is the basic function for encrypt one block with three cipher keys using 3DES L1
des3Decrypt des3Decrypt is the basic function for decrypt one block with three cipher keys using 3DES L1
desCbcEncrypt desCbcEncrypt is CBC encryption mode with DES single block cipher L1
desCbcDecrypt desCbcDecrypt is CBC decryption mode with DES single block cipher L1
aes128CbcEncrypt aes128CbcEncrypt is CBC encryption mode with AES-128 single block cipher L1
aes128CbcDecrypt aes128CbcDecrypt is CBC decryption mode with AES-128 single block cipher L1
aes192CbcEncrypt aes192CbcEncrypt is CBC encryption mode with AES-192 single block cipher L1
aes192CbcDecrypt aes192CbcDecrypt is CBC decryption mode with AES-192 single block cipher L1
aes256CbcEncrypt aes256CbcEncrypt is CBC encryption mode with AES-256 single block cipher L1
aes256CbcDecrypt aes256CbcDecrypt is CBC decryption mode with AES-256 single block cipher L1
aes128CcmEncrypt aes128CcmEncrypt is CCM encryption mode with AES-128 single block cipher L1
aes128CcmDecrypt aes128CcmDecrypt is CCM decryption mode with AES-128 single block cipher L1
aes192CcmEncrypt aes192CcmEncrypt is CCM encryption mode with AES-192 single block cipher L1
aes192CcmDecrypt aes192CcmDecrypt is CCM decryption mode with AES-192 single block cipher L1
aes256CcmEncrypt aes256CcmEncrypt is CCM encryption mode with AES-256 single block cipher L1
aes256CcmDecrypt aes256CcmDecrypt is CCM decryption mode with AES-256 single block cipher L1
desCfb1Encrypt desCfb1Encrypt is CFB1 encryption mode with DES single block cipher L1
desCfb1Decrypt desCfb1Decrypt is CFB1 decryption mode with DES single block cipher L1
aes128Cfb1Encrypt aes128Cfb1Encrypt is CFB1 encryption mode with AES-128 single block cipher L1
aes128Cfb1Decrypt aes128Cfb1Decrypt is CFB1 decryption mode with AES-128 single block cipher L1
aes192Cfb1Encrypt aes192Cfb1Encrypt is CFB1 encryption mode with AES-192 single block cipher L1
aes192Cfb1Decrypt aes192Cfb1Decrypt is CFB1 decryption mode with AES-192 single block cipher L1
aes256Cfb1Encrypt aes256Cfb1Encrypt is CFB1 encryption mode with AES-256 single block cipher L1
aes256Cfb1Decrypt aes256Cfb1Decrypt is CFB1 decryption mode with AES-256 single block cipher L1
desCfb8Encrypt desCfb8Encrypt is CFB8 encryption mode with DES single block cipher L1
desCfb8Decrypt desCfb8Decrypt is CFB8 decryption mode with DES single block cipher L1
aes128Cfb8Encrypt aes128Cfb8Encrypt is CFB8 encryption mode with AES-128 single block cipher L1
aes128Cfb8Decrypt aes128Cfb8Decrypt is CFB8 decryption mode with AES-128 single block cipher L1
aes192Cfb8Encrypt aes192Cfb8Encrypt is CFB8 encryption mode with AES-192 single block cipher L1
aes192Cfb8Decrypt aes192Cfb8Decrypt is CFB8 decryption mode with AES-192 single block cipher L1
aes256Cfb8Encrypt aes256Cfb8Encrypt is CFB8 encryption mode with AES-256 single block cipher L1
aes256Cfb8Decrypt aes256Cfb8Decrypt is CFB8 decryption mode with AES-256 single block cipher L1
desCfb128Encrypt desCfb128Encrypt is CFB128 encryption mode with DES single block cipher L1
desCfb128Decrypt desCfb128Decrypt is CFB128 decryption mode with DES single block cipher L1
aes128Cfb128Encrypt aes128Cfb128Encrypt is CFB128 encryption mode with AES-128 single block cipher L1
aes128Cfb128Decrypt aes128Cfb128Decrypt is CFB128 decryption mode with AES-128 single block cipher L1
aes192Cfb128Encrypt aes192Cfb128Encrypt is CFB128 encryption mode with AES-192 single block cipher L1
aes192Cfb128Decrypt aes192Cfb128Decrypt is CFB128 decryption mode with AES-192 single block cipher L1
aes256Cfb128Encrypt aes256Cfb128Encrypt is CFB128 encryption mode with AES-256 single block cipher L1
aes256Cfb128Decrypt aes256Cfb128Decrypt is CFB128 decryption mode with AES-256 single block cipher L1
aes128CtrEncrypt aes128CtrEncrypt is CTR encryption mode with AES-128 single block cipher L1
aes128CtrDecrypt aes128CtrDecrypt is CTR decryption mode with AES-128 single block cipher L1
aes192CtrEncrypt aes192CtrEncrypt is CTR encryption mode with AES-192 single block cipher L1
aes192CtrDecrypt aes192CtrDecrypt is CTR decryption mode with AES-192 single block cipher L1
aes256CtrEncrypt aes256CtrEncrypt is CTR encryption mode with AES-256 single block cipher L1
aes256CtrDecrypt aes256CtrDecrypt is CTR decryption mode with AES-256 single block cipher L1
desEcbEncrypt desEcbEncrypt is ECB encryption mode with DES single block cipher L1
desEcbDecrypt desEcbDecrypt is ECB decryption mode with DES single block cipher L1
aes128EcbEncrypt aes128EcbEncrypt is ECB encryption mode with AES-128 single block cipher L1
aes128EcbDecrypt aes128EcbDecrypt is ECB decryption mode with AES-128 single block cipher L1
aes192EcbEncrypt aes192EcbEncrypt is ECB encryption mode with AES-192 single block cipher L1
aes192EcbDecrypt aes192EcbDecrypt is ECB decryption mode with AES-192 single block cipher L1
aes256EcbEncrypt aes256EcbEncrypt is ECB encryption mode with AES-256 single block cipher L1
aes256EcbDecrypt aes256EcbDecrypt is ECB decryption mode with AES-256 single block cipher L1
aes128GcmEncrypt aes128GcmEncrypt is GCM encryption mode with AES-128 single block cipher L1
aes128GcmDecrypt aes128GcmDecrypt is GCM decryption mode with AES-128 single block cipher L1
aes192GcmEncrypt aes192GcmEncrypt is GCM encryption mode with AES-192 single block cipher L1
aes192GcmDecrypt aes192GcmDecrypt is GCM decryption mode with AES-192 single block cipher L1
aes256GcmEncrypt aes256GcmEncrypt is GCM encryption mode with AES-256 single block cipher L1
aes256GcmDecrypt aes256GcmDecrypt is GCM decryption mode with AES-2562 single block cipher L1
desOfbEncrypt desOfbEncrypt is OFB encryption mode with DES single block cipher L1
desOfbDecrypt desOfbDecrypt is OFB decryption mode with DES single block cipher L1
aes128OfbEncrypt aes128OfbEncrypt is OFB encryption mode with AES-128 single block cipher L1
aes128OfbDecrypt aes128OfbDecrypt is OFB decryption mode with AES-128 single block cipher L1
aes192OfbEncrypt aes192OfbEncrypt is OFB encryption mode with AES-192 single block cipher L1
aes192OfbDecrypt aes192OfbDecrypt is OFB decryption mode with AES-192 single block cipher L1
aes256OfbEncrypt aes256OfbEncrypt is OFB encryption mode with AES-256 single block cipher L1
aes256OfbDecrypt aes256OfbDecrypt is OFB decryption mode with AES-256 single block cipher L1
aes128XtsEncrypt aes128XtsEncrypt is XTS encryption mode with AES-128 single block cipher L1
aes128XtsDecrypt aes128XtsDecrypt is XTS decryption mode with AES-128 single block cipher L1
aes256XtsEncrypt aes256XtsEncrypt is XTS encryption mode with AES-256 single block cipher L1
aes256XtsDecrypt aes256XtsDecrypt is XTS decryption mode with AES-256 single block cipher L1
aes128Gmac The GMAC using AES-128 block cipher L1
aes192Gmac The GMAC using AES-192 block cipher L1
aes256Gmac The GMAC using AES-256 block cipher L1
hmac compute hmac value according to specific hash function and input data L1
chacha20 CHACHA20 algorithm implementation L1
poly1305 POLY1305 algorithm implementation L1
rc4 RC4, also known as ARC4 algorithm implementation L1
md4 MD4 algorithm implementation L1
md5 MD5 algorithm implementation L1
sha1 SHA-1 algorithm implementation L1
sha224 SHA-224 algorithm implementation L1
sha256 SHA-256 algorithm implementation L1
sha384 SHA-384 algorithm implementation L1
sha512 SHA-512 algorithm implementation L1
sha512_t SHA-512/t algorithm implementation L1
sha3_224 SHA-3/224 algorithm implementation L1
sha3_256 SHA-3/256 algorithm implementation L1
sha3_384 SHA-3/384 algorithm implementation L1
sha3_512 SHA-3/512 algorithm implementation L1
shake128 SHAKE-128 algorithm implementation L1
shake256 SHAKE-256 algorithm implementation L1
blake2b BLAKE2B algorithm implementation L1

Shell Environment

Setup the build environment using the Vitis and XRT scripts, and set the PLATFORM_REPO_PATHS to installation folder of platform files.

source <Vitis 2021.1 install path>/settings64.sh
source /opt/xilinx/xrt/setup.sh
export PLATFORM_REPO_PATHS=/opt/xilinx/platforms

Design Flows

The common tool and library pre-requisites that apply across all design flows are documented in the requirements section above.

Recommended design flows are decribed as follows:

L1

L1 provides the basic primitives which cover the most common algorithms in security.

The recommend flow to evaluate and test L1 components is described as follows using Vivado HLS tool. A top level C/C++ testbench (typically algorithm_name.cpp) prepares the input data, passes them to the design under test, then performs any output data post processing and validation checks.

A Makefile is used to drive this flow with available steps including CSIM (high level simulation), CSYNTH (high level synthesis to RTL) and COSIM (cosimulation between software testbench and generated RTL), VIVADO_SYN (synthesis by Vivado), VIVADO_IMPL (implementation by Vivado). The flow is launched from the shell by calling make with variables set as in the example below:

. /opt/xilinx/xrt/setup.sh
export PLATFORM_REPO_PATHS=/opt/xilinx/platforms
cd L1/tests/specific_algorithm/
# Only run C++ simulation on U250 card
make run CSIM=1 CSYNTH=0 COSIM=0 VIVADO_SYN=0 VIVADO_IMPL=0 DEVICE=u250_xdma_201830_1

As well as verifying functional correctness, the reports generated from this flow give an indication of logic utilization, timing performance, latency and throughput. The output files of interest can be located at the location of the test project where the path name is correlated with the algorithm. i.e. the callable function within the design under test.

To run the Vitis projects for benchmark evaluation and test, you may need the example below:

./opt/xilinx/xrt/setup.sh
export PLATFORM_REPO_PATHS=/opt/xilinx/platforms
d L1/benchmarks/specific_algorithm/
# Run software emulation for correctness test
make run TARGET=sw_emu DEIVCE=u250_xdma_201830_1
# Run hardware emulation for cycle-accurate simulation with the RTL-model
make run TARGET=hw_emu DEIVCE=u250_xdma_201830_1
# Run hardware to generate the desired xclbin binary
make run TARGET=hw DEIVCE=u250_xdma_201830_1
# Delete xclbin and host excutable program
make cleanall

Benchmark

Index