Twofish Hardware Tradeoffs

Gate counth blocksClocks per BlockInterleave LevelsClock SpeedThroughput (Mbits/sec)Startup clocksNotes
8000 0.25 324 1 80 MHz 32 20 (1)
14000 1 72 1 40 MHz 71 4 (2)
19000 1 32 1 40 MHz 160 40
23000 2 16 1 40 MHz 320 20
26000 2 32 2 80 MHz 640 20
28000 2 48 3 120 MHz 960 20
30000 2 64 4 150 MHz 1200 20
80000 2 16 1 80 MHz 640 300 (3)

Notes:

(1) A "byte serial" implementation. It uses one clock per S-box lookup, and four clocks per h function (including the MDS). We allow two clocks for the PHT and key addition. With four h functions per round, each round requires 18 clock cycles.

(2) Uses a fully wired h function, but still computes the round keys on the fly. The other versions all precompute the round subkeys.

(3) A version that precomputes the S-boxes into dedicated RAM instead of computing the S-boxes on the fly.

up to Twofish

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Resilient, an IBM Company.