Twofish - Hardware Tradeoffs

Gate count h blocks Clocks per Block Interleave Levels Clock Speed Throughput (Mbits/sec) Startup clocks Notes
8000 0.25 324 1 80 MHz 32 20(1)
14000 1 72 1 40 MHz 71 4(2)
19000 1 32 1 40 MHz 160 40
23000 2 16 1 40 MHz 320 20
26000 2 32 2 80 MHz 640 20
28000 2 48 3 120 MHz 960 20
30000 2 64 4 150 MHz 1200 20
80000 2 16 1 80 MHz 640 300(3)

Notes:

(1) A "byte serial" implementation. It uses one clock per S-box lookup, and four clocks per h function (including the MDS). We allow two clocks for the PHT and key addition. With four h functions per round, each round requires 18 clock cycles.

(2) Uses a fully wired h function, but still computes the round keys on the fly. The other versions all precompute the round subkeys.

(3) A version that precomputes the S-boxes into dedicated RAM instead of computing the S-boxes on the fly.

back to main Twofish page

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..