DALLAS SEMICONDUCTOR CORP 35E >) 2614130 O0041282 1 MMDAL DALLAS SEMICONDUCTOR a T*S243-(7 DS2160 DES PROCESSOR FEATURES e Performs voice/data encryption and decryp- tion according to the Data Encryption Stan- dard (DES) * Full duplex operation; one encrypt channel, one decrypt channel * Each channel can process up to 64K bits per second * Connects directly to combo-codec devices Simple key entry Uses Cipher Feedback Mode (CFB) of the DES standard * Can encrypt/decrypt either 8 bits, 7 bits, 6 bits, or 4 bits * Single +5V supply; low-power CMOS technol- ogy * Available in 24-pin DIP and 28-pin PLCC DESCRIPTION The DS2160 is a dedicated Digital Signal Proc- essing (DSP) CMOS chip optimized for the National Bureau of Standards Data Encryption Standard (DES) algorithm. The DS2160 has two channels: one for encryption and one for decryp- tion. The chip performs encipher/decipher op- erations on 64-bit words at a rate of up to 64K bits per second perchannel. To provide security PIN CONNECTIONS RST 1] |_| 24 VDD TO 2 [] 23 DEIN 1 3 |] 22 DECLK cPH 4[] Y | 21 DEFS KEYCLK 5 (J |] 20 DEOUT DFO 6 C] T] 19 ENIS cPH 7(] | 18 DEIS KEYDATA 8 [| [117 CPL DF1 9 |] 16 ENOUT mE | 15 ENFS MCLK 11 (4 Y | 14 ENCLK vss 12 [ T} 13 ENIN as specified in DES, a 64-bit key is necessary. The key is entered into the DS2160 through a simple serial port and cannot be accessed ex- ternally. The DES algorithm is used in both gov- ernmental and commercial applications where sensitive information is passed though unse- cured media. 64 032990 1/12DALEAS SEMICONDUCTOR CORP DS2160 BLOCK DIAGRAM Figure 1 S5E D Ba 2634130 0004123 3 MMDAL 0S2160 T+ F2.33-)7 C CC ENIN > ENCRYPTOR ce >. INTERFACE ENOUT <~ RST > DFO > CONTROL OF1> LocIC KEYCLK > AND KEYDATA > KEY eNIS > PORT DEIS >| DEIN DECRYPTOR | ers me INTERFACE DEOUT < DES PROCESSING "ENGINE" MCLK 7 VDD VSS TT 65 032990 2/12T- 9-33-17 082160 DALLAS SEMICONDUCTOR CORP 35E D 2644130 O0041e4 5 DAL PIN SYMBOL TYPE | DESCRIPTION 1 RST I Reset. A high-low transition resets the algorithm. The de- vice should be reset on power-up. 2 TMO { Test Modes 0 and 1. Tie to VSS for normai operation. 3 T1 4 CPH | Configure Pin High. Tie to VDD for normal operation. 5 KEYCLK I Key Clock. Used in conjunction with the KEYDATA pin to enter the 64-bit DES key. 6 DFO I Data Format 0. Used in conjunction with the DF1 pin to select whether the device will encrypt/decrypt 8 bits, 7 bits, 6 bits, or 4 bits. See Table 2. 7 CPH | Configure Pin High. Tie to VDD for normal operation. 8 KEYDATA I Key Data. Used in conjunction with the KEYCLK pin to enter the 64-bit DES key. 9 DF1 I Data Format 1. Used in conjunction with the DFO pin to select whether the device will encrypt/decrypt 8 bits, 7 bits, 6 bits, or 4 bits. See Table 2. 10 CPL | Configure Pin Low. Tie to VSS for normal operation. 11 MCLK { Master Clock. 12MHz clock for the DES processing engine; may be asynchronous to ENCLK and DECLK. 12 vss - Signal Ground. 0.0 volts. 13 ENIN l Encrypt Channel Data Input. Input PCM word is sampled on the first eight falling edges of ENCLK after the ENFS signal. 14 ENCLK I Encrypt Channel Clock. Data I/O clock for the encryption channel; must be tied to DECLK. 15 ENFS | Encrypt Channel Frame Sync. Frame syne for the en- cryption channel; must be tied to DEFS. A two ENCLK wide pulse here indicates a 64-bit word boundary. 16 ENOUT oO Encrypt Channel Data Output. Updated on the first eight rising edges of ENCLK after the ENFS signal. 17 CPL I Configure Pin Low. Tie to VSS for normal operation. 18 DEIS | Decrypt Channel Idle Select. High state will idle the de- cryption channel causing the DEOUT pin to 3-state. 032990 9/12 66DALLAS SEMICONDUCTOR CORP T+ 5Q33:17 J5E Dd 26141430 0004125 7 BADAL DS2160 19 ENIS i Encrypt Channel Idle Select. High state will idle the en- , cryption channel causing the ENOUT pin to 3-state. 20 DEOUT 0 Decrypt Channel Data Output. Updated on the first eight rising edges of DECLK after the DEFS signal. 21 DEFS i Decrypt Channel Frame Sync. Frame sync for the decryp4 tion channel; must be tied to ENFS. A two DECLK wide pulse here indicates a 64-bit word boundary. 22 DECLK i Decrypt Channel Clock. Data /O clock fo the decryption channel; must be tied to ENCLK. 23 DEIN i Decrypt Channel Data Input. Input PCM word is sampled on the first eight edges of DECLK after the DEFS signal. 24 VDD - Positive Supply. 5.0 volts. RESET AND CONTROL BITS The RST pin must be held fow for at least 1 millisecond on system power-up after the mas- ter clock (MCLK) Is stable to Insure proper Initialization of the device. The control bits on the DS2160 (ENIS, DEIS, DFO, and DF1) can be changed without a reset being issued. If both ENIS and DEIS pins are tied high, then the DS2160 will enter a power-down state that con- sumes much less current. When either ENIS or DEIS is taken low, the DS2160 will exit the power-down condition in less than 200 millisec- onds, DATA FORMAT The DS2160 has four separate data formats. The chip can be configured via the DFO and DF1 pins to encrypt/decrypt either 4 bits, 6 bits, 7 bits, or 8 bits of the PCM word. (See Table 2). For example, if DFO is strapped low and the DF1 pin is strapped high, then the DES processor will be in the 7-bit mode. In this mode, the encrypt channel of the processor will only encrypt the seven most significant bits of the PCM word that it receives, or in other words, the first seven bits of each 8-bit PCM word that it receives. The remaining bit, which is the least significant bit, will pass through the processor untouched. {In the 7-bit mode, the decrypt channel! knows that only the seven most significant bits are en- crypted and it will decode the incoming en- crypted PCM word accordingly. As with the encrypt channel, the LSB of the encrypted PCM word will pass though the decrypt channel unaf- fected. 032990 4/12DALLAS SEMICONDUCTOR CORP DS2160 DATA FORMATS Table 2 bS2160 39E D BM 2614130 OO04leb 9 BMDAL Data Format DFO (pin6) | DF1 (pin 9) T-Q33-/7 8-Bit 0 0 7-Bit 0 1 6-Bit 1 0 4-Bit { 1 When bits are to pass through the DS2160 unaffected, the processor handles the transfer as follows: 1. The one, two, or four bits in each PCM word that are not to be touched are extracted. Their bit positions are replaced by logical ones. oN positions. PCM INTERFACE The DS2160 operates directly with a standard PCM type interface. (See Figure 2.) The proc- essor samples the PCM data to be processed (encrypted or decrypted) on the first eight falling edges of ENCLK/DECLK after the ENFS/DEFS signal. All other data on ENIN and DEIN is ignored. The output of the encrypting or de- crypting is placed on the ENOUT and DEOUT pins, respectively, on the first eight rising edges DS2160 PCM INTERFACE Figure 2 ENCLK The encrypt/decrypt algorithm is performed. The extracted bits are replaced into their original of ENCLK/DECLK after the ENFS/DEFS signal. The ENOUT and DEOUT pins are 3-stated except for the 8-bit period when they are output- ting data. The /O clocks ENCLK and DECLK on the DS2160 can operate at speeds from 256KHz to 4.096 MHz. The DS2160 interprets a two-bit wide frame sync pulse to indicate a DES word boundary. More on this issue is covered in the DES word synchronization section. ENFS _. a, a extra pulse for DES boundary indication pers _ [| |: ENIN DEIN Z/77X XX XXX XXX LLL LLL LLL MSB ENOUT (MSB) LSB ( ) 3state DEQUT {_X_ xX XX XX Xp 032990 5/12DALLAS SEMICONDUCTOR CORP 39 D MM 2624230 0004227 O BMDAL . T- F2-33-17 ps2160 DS2160 CONNECTION TO COMBO CODEC Figure 3 TP3054/TP3057 DS2160 DX ENIN ENOUT }-> y VEX UNENCRYPTED DATA OA TeO . DR DEOUT DEIN } ANALOG GSX INTERFACE VERO BCLKR c MCLK }# 12MHz CLOCK BCLKX J CI ENCLK MCLKX DECLK = KEYCLK } DES KEY FSR ENFS KEYDATA } PORT im MCLKR FSX DEFS FRAME SYNC > am CPH CLOCK > CPH FRAME SYNC AND. > DES BOUNDRY INFO CPL BES TO __ DFO T1 RST DF1 ; 0 \O \0 RESET i CIRCUITRY (DS1231) NOTE: TP3054 and TP3057 are National Semiconductor Combo Codecs. KEY MANAGEMENT The 64-bit key (56 bits plus eight parity bits) is entered into the DS2160 through a simple two- pin serial port. Figure 4 details the operation of the DES key port. To enter a key into the DS2160, the KEYDATA pin must be held low during and after a Reset. Once the RST pin is returned high, then the key can begin to be entered after a wait time of at least 10 us. (NOTE: the DS2160 will wait indefinitely after a reset for a key to be entered.) After the wait period, data is clocked in using the KEYCLK pin. The key data has a minimum setup and hold time of 1 us and the key clock must be held high and low for at least 2 us. The DS2160 expects that 68 bits of data will be clocked in: the 64-bit key plus a leading 4 bit header that must be all zeros. The header is clocked in first, followed by the key. If a reset is to be issued, and the user wishes not to disturb to the key currently in the DS2160, then the KEYDATA pin must be held high during and after the reset. (See Figure 5.) In order to maintain the highest level of security possible, the DES key cannot be accessed in any manner once it is clocked Into the DS2160. Also, the key is not stored in the DS2160 in its original form. 69 032990 6/12DALLAS SEMICONDUCTOR CORP _ ,DS2160 39E D MM 26141350 o004128 2 MEDAL DS2160 KEY ENTRY SEQUENCE Figure 4 T- 52-33-17 MT test (>1ms) tH =e mie (>2us} (>2us) e we KEYCLK ne nn ae {kos (>1us)- eH EKDH (> tus) KEYDATA \ \ [Key Bit 67 Ys key sites =X * teow (>10us) RESET OF DS2160 WITHOUT DISTURBANCE OF THE DES KEY Figure 5 wi yy je {RST (>1ms) KEYCLK TT TT TLL LLL LL ont cre J PILL ILL LL LL KEYDATA [ / LALA AAA AAA AAA tow (>10us) > DES 64-BIT WORD BOUNDARY SYNCHRO- NIZATION The DES algorithm encrypts/decrypts 64-bit words. InaDES system, it is necessary that the encryptor and decryptor realize where in a con- tiguous data stream the 64-bit words begin and end so that they can properly encode and de- code the data. Inthe PCM environment In which the DS2160 operates, the data stream is made up of a continuing series of 8-bit samples. The DS2160 will combine eight consecutive PCM samples to create a single DES word. in the DS2160, the user defines the boundaries of the 64-bit DES words via the ENFS and DEFS pins. The beginning of a 64-bit DES word are indicated by a frame sync pulse that is two bits wide instead of its normal width of one bit. When the DS2160 receives a two-bit wide frame sync pulse at ENFS and DEFS, it realizes that the next eight PCM words that it receives make up the 64-bit DES word. (See Figure 6.) 70 032990 7/12DALLAS SEMICONDUCTOR CORP DS2160 DES WORD FRAMEWORK Figure 6 082160 39 D MM 2614130 0004129 4 MMDAL T- 533-17 i ONE 64-BIT DES WORD +! ENFS an iL__Il * wo bit wide frame sync | ENIN DEIN oh Pee oe Wa Wl Wl a < EIGHT 8-BIT PCM SAMPLES _ The DS2160 contains an internal counter that eliminates the need to have double-wide ENFS and DEFS signals every eighth frame. Hence, the wide frame sync pulse can be applied at any multiple of eight from zero to Infinity. DES SYNCHRONIZATION USING T1/CEPT MULTIFRAMES If the DS2160 Is used to encrypt voice or data that Is to be transmitted over T1 or CEPT lines, the user can take advantage of an existing multiframe arrangement to provide the neces- sary synchronizaton of the 64-bit DES words between the encryptor and the decryptor. InT1, multiframes are made up of either 12 or 24 frames depending on whether the framing mode is Superframe (D4) or Extended Superframe (ESF), respectively. In CEPT environments, the multiframe is always made up of 16 frames. If each of these frames per multiframe numbers is multiplied by two, they become candidates for the indication of DES word boundaries needed by the DS2160 because they will be multiples of elght. Figure 7 shows an arrangement that could use the existing multiframe scheme for DES syn- chronization. Either the DS2180A or DS2181 transcelver will synchronize to the T1 or CEPT data stream at both the multiframe and frame level. The frame sync signal is sent to a Time Slot Assignment Circuit (TSAC) where it will be moved in time to allow numerous DS2160s to connect to the same PCM highway. The multi- frame signal Is divided by two to create a signal that is a multiple of eight. This signal will be used to establish DES word boundaries on the DS2160. The output of the TSAC and the divide by two are combined to create a signal that will provide a one-bit wide frame sync pulse every frame, along with a two-bit wide frame sync pulse at some multiple of eight frames. CIPHER FEEDBACK MODE The DS2160 uses the Cipher Feedback Mode (CFB) as described by the Data Encryption Standard to encode and decode data. The CFB mode uses a DES encryptor to both encrypt and decrypt data. (See Figure 8.) Datais encrypted by logically exclusive-ORing the input data with the pseudorandom output of a DES encryptor. This XORed output is the ciphered data and on the DS2160 it is output through the ENOUT pin. The XORed output is also fed back to the DES encryptor where it serves as input to generate another pseudorandom bit code that will be XOR'ed with the next input sample. To decode the ciphered data, the Input 64-bit word is XORed with the pseudorandom output of a DES encryptor. The ciphered input is also fed to the input of the DES encryptor where it serves at input to generate a pseudorandom bit code that will be used to decode the next cl- phered input. 71 032990 8/12T 5-33-17 Ds2160 DALLAS SEMICONDUCTOR CORP 39E D HM 2614130 0004130 O MMDAL USE OF MULTIFRAME TO ESTABLISH DES SYNCHRONIZATION Figure 7 | DUAL PCM HIGHWAY DS2160 SYNC SIGNAL GENERATION + DIVIDE BY 2 FRAME SYNC 7 MULTIFRAME SYNC DS2180A or DS2181 LINE INTERFACE | or CEPT LINE DS2160 CIPHER FEEDBACK MODE Figure 8 __ENGRYPTOR CHANNEL DEGRYPTOR CHANNEL | 64 BITS : : 64 BIS | es : : DES : ENcrveTOR | | : ENCRYPTOR ENCRYPTOR -~~=ENCRYPTOR DECRYPTOR ~~~=~S*S*S*COECRYPTOR INPUT OUTPUT INPUT OUTPUT 032990 9/12 72DALLAS SEMICONDUCTOR: CORP 35E D MM 2614130 0004131 2 MMDAL DS2160 More information on CFB and the DES algorithm can be found in the Federal Information Process- ing Standards Publications or FIPS PUBs for short. The relevant documents are FIPS PUB 46-1, FIPS PUB 74, and FIPS PUB 81. ABSOLUTE MAXIMUM RATINGS* l- 52-33/7 Voltage on any Pin Relative to Ground -1.0V to +7.0V Operating Temperature 0C to 70C Storage Temperature -55C to +125C Soldering Temperature 260C for 10 seconds * This is a stress rating only and functional operation of the device at these or any other conditions outside those indicated in the operation sections of this specification is not implied. Exposure to absolute maximum rating conditions for extended periods of time may affect reliability. RECOMMENDED DC OPERATING CONDITIONS (0C to 70C) -| PARAMETER | SYMBOL MIN TYP MAX UNITS | NOTES Logic 1 VIH 2.0 VCC+0.3 | V Logic 0 VIL -0.3 +0.8 Vv Supply Voo 4.5 5.5 V CAPACITANCE (t,=25C) PARAMETER | SYMBOL MIN TYP MAX UNITS | NOTES Input Gy 5 pF Capacitance Output Cour 10 pF Capacitance DC ELECTRICAL CHARACTERISTICS (0C to 70C; V,,=5V +/- 10%) PARAMETER | SYMBOL MIN TYP MAX UNITS | NOTES Active Supply | top, 30 mA 1,2 Current Idle Supply looep 1 mA 1,2,3 Current Input Leakage | |, -1.0 +1.0 uA Output Leakage} |, -1.0 +1.0 vA 4 Output Current | [, -1.0 mA (2.4V) Output Current | I, +4.0 mA (0.4V) NOTES:: 1. ENCLK = DECLK = 1.544MHz; MCLK = 12MHz 2. Outputs open; inputs swinging full supply levels ( 3. ENIS = DEIS = 5V 4, ENOUT and DEOUT are 3-stated 032990 10/12 73 F- 59-33717 . . . _. 82160 DALLAS SEMICONDUCTOR CORP J34E D MM 2634130 0004132 4 MMDAL PCM INTERFACE AC ELECTRICAL CHARACTERISTIC (0C to 70C, Voc = 5V+/- 10%) PARAMETER SYMBOL MIN TYP MAX UNITS NOTES ENCLK, DECLK]| t.., 244 3906 ns 1 Perlod ENCLK, DECLK Pulse Width ENCLK, DECLK Rise Fall Times Hold Time from ENCLK, DECLK to ENFS, DEFS SetUp Time top 50 ns 2 from ENFS, DEFS high to ENCLK, DECLK low Hold Time from | tie 100 ns 2 ENCLK, DECLK low to ENFS, DEFS low SetUp Time t for ENIN, DEIN to ENCLK, DECLK low Hold Time for t ENIN, DEIN to ENCLK, DECLK low Delay Time from ENCLK, DECLK to Valid ENOUT, DEOUT Delay Time from) tyepz 20 150 ns 2,3, 4 ENCLK, DECLK to ENOUT, DEOUT 3-stated WEDL 100 ns WEOH ce mt RED 10 20 ns FED HOLD 0 ns 2 SD 50 ns 2 HD 50 ns 2 tooo 10 150 ns 3 NOTES:: 1. Maximum width of ENFS and DEFS is one ENCLK or DECLK period (except for frames where edge boundaries for the 64-bit DES words are defined). 2, Measured at V,, = 2.0V, V, = 0.8V, and 10ns maximum rise and fall times. 3. Load = 150pF + 2 LSTTL loads. 4. For LSB of PCM byte. 032990 11712 74DALLAS SEMICONDUCTOR CORP 359E D Ml 2614130 00041333 & MEDAL 0S2160 - - 3- } MASTER CLOCK/RESET T 52 3 @ AC ELECTRICAL CHARACTERISTIC (0C to 70C, V., = 5V+/- 10%) PARAMETER | SYMBOL MIN TYP MAX | UNITS | NOTES MCLK Period ton 83.3 ns 1 MCLK Pulse t 33 50 ns Width tout MCLK Rise/ tam 10 ns Fall Times tens RST Pulse t 1 ms Width et NOTE: 1. MCLK = 12MHz +/- 500ppm PED tHoLo treo tFeD twep twepL + > ENCLK { * DECLK C KY a ENFS DEFS > tur ENFS DEFS Ke jt tor tHE be tsp | typ ENIN L on L/S SLL LM K ENOUT We DEOUT f x SS - mt toepo pez tem trem tem twMH 1). twat MCLK NT LL ESS trst 75 032990 12/12