Twofish Hardware Tradeoffs
| Gate count | h blocks | Clocks per Block | Interleave Levels | Clock Speed | Throughput (Mbits/sec) | Startup clocks | Notes |
|---|---|---|---|---|---|---|---|
| 8000 | 0.25 | 324 | 1 | 80 MHz | 32 | 20 | (1) |
| 14000 | 1 | 72 | 1 | 40 MHz | 71 | 4 | (2) |
| 19000 | 1 | 32 | 1 | 40 MHz | 160 | 40 | |
| 23000 | 2 | 16 | 1 | 40 MHz | 320 | 20 | |
| 26000 | 2 | 32 | 2 | 80 MHz | 640 | 20 | |
| 28000 | 2 | 48 | 3 | 120 MHz | 960 | 20 | |
| 30000 | 2 | 64 | 4 | 150 MHz | 1200 | 20 | |
| 80000 | 2 | 16 | 1 | 80 MHz | 640 | 300 | (3) |
Notes:
(1) A “byte serial” implementation. It uses one clock per S-box lookup, and four clocks per h function (including the MDS). We allow two clocks for the PHT and key addition. With four h functions per round, each round requires 18 clock cycles.
(2) Uses a fully wired h function, but still computes the round keys on the fly. The other versions all precompute the round subkeys.
(3) A version that precomputes the S-boxes into dedicated RAM instead of computing the S-boxes on the fly.
up to Twofish
Sidebar photo of Bruce Schneier by Joe MacInnis.