The ICE-IP-338 (EIP-338) Inline Cipher Engine is a scalable, high-performance, multi-stream inline cryptographic engine that offers XTS and GCM modes of operation on bulk data for the AES and optionally SM4 algorithms. Its flexible data path is suitable to scale from 50 Gbps to 2 Tbps providing a tailored engine with minimal area for your application.
The flexible interface makes it possible to perform processing for many different applications and protocols, including inline memory encryption, inline disk encryption, MACsec, IPsec and OTN security. The multi-stream architecture allows interleaved data processing for many independent data streams simultaneously. Switching between streams can be done every clock cycle without loss of performance. Data is processed without flow control and with fixed latency, dependent on the static configuration selected.
The ICE-IP-338 data path can be scaled to widths that are multiples of 128 bit to allow a tradeoff between area and performance that best fits the target application. Configuration options include or exclude support for CipherText Stealing (CTS), the GCM mode, and the SM4 algorithm and/or Datapath Integrity logic. The cryptographic AES and SM4 primitives can be provided with or without side channel attack DPA countermeasures.
On-chip SRAM external to the ICE-IP-338 is used to store the key database as well as various precomputes and state information for each of the streams the engine is processing in interleaved fashion.
The ICE-IP-338 is a data-processing engine and contains input/output data interfaces and interfaces intended for supplying key material that is stored in the engine’s local SRAM.
Before cryptographic processing can start, the Host CPU transfers the key material, together with the algorithm and mode of operation to use, to one of the key slots in the engine. Key material can be shared between multiple streams and many blocks while the key remains available in local SRAM.
The Tweak (for XTS) or IV (for GCM) is provided prior to or at the same time as the first data word, together with a reference to the Key slot and the direction of processing in case of GCM. After processing, the ICE-IP-338 outputs the result data and, in case of GCM mode, authentication tag together with the last output data word.
The external system is responsible for the following items:
Separate IP cores can be provided to assist with Tweak or Decrypt Key generation.
File encryption, file system encryption and full disk encryption (FDE) are methods offered by the industry to allow users to protect their data stored on non-volatile storage devices, such as Solid State Disks (SSD). The main feature of FDE is to protect stored system and user date from unauthorized reading, writing, alteration, moving or rolling back. However, extended security features are key to securing FDE implementation.
Performance and Configuration
Low Latency with Zero Variation
Control Plane Interface
External Memory Interface