LM-AES-XTS is a cryptographic IP core for hardware offloading of storage encryption in FPGA and SoC designs.

The engine implements AES in XTS mode according to IEEE Std 1619-2007, with the AES block cipher of FIPS 197 at 128-bit and 256-bit key sizes. It performs encryption and decryption of data units of any length, with ciphertext stealing for units that are not a whole number of blocks, and also offers electronic codebook mode.

The cipher is fully unrolled: one 128-bit block enters and one leaves every clock cycle. The tweak cipher runs on its own engine, so consecutive sectors pipeline without a gap. The core is delivered as vendor-neutral SystemVerilog and builds from one source on AMD, Altera and Efinix devices, and ANSI C drivers are provided for fast integration.

Measured FPGA results

Product top, out of context, constrained at the target clock. AMD and Efinix report LUTs, Altera reports ALMs; the two are never combined.

Device	Configuration	Logic	FF	Memory	Fmax
Altera Agilex 3A3CW135BM16AE6S · quartus-pro 26.1.1	DU_BLOCKS_W=32, PIPES=2	12,665 ALM	18,695	1,838 Kb M20K	250.8 MHztarget 250
AMD Kintex UltraScale+xcku3p-ffva676-1-e · vivado 2026.1	DU_BLOCKS_W=32, PIPES=2	17,604 LUT	13,655	234 BRAM	261.6 MHztarget 250
Efinix Titanium Ti375Ti375N1156 · efinity 2026.1	DU_BLOCKS_W=32, PIPES=2	28,804 LUT	21,260	468 RAM	300.3 MHztarget 250

Features

Storage encryption

AES-XTS encryption and decryption, IEEE Std 1619-2007
Ciphertext stealing for data units that are not a multiple of 16 bytes
Data units of any length
ECB mode for key-wrapping and test use

Key sizes

XTS-AES-128 and XTS-AES-256 — that is, two 128-bit or two 256-bit cipher keys
Both key schedules expanded in hardware, once per key change

Engine

Fully unrolled cipher: one 128-bit block per clock, sustained
PIPES = 2 configuration processes two blocks per clock
Separate tweak engine — sector setup does not steal a pipeline slot
Shared MixColumns network serving both directions

Integration

AMBA AXI4-Lite control and four AXI4-Stream data interfaces
Keys arrive on their own stream; no register holds key material
No start strobe in the register map — a completed tweak starts a data unit
Direction on a port, not a register
Two delivery tops: complete AXI product, or bare cipher for a custom fabric
ANSI C driver, UVM RAL, IP-XACT, SystemRDL register description

Applications

Self-encrypting drives and storage controllers
NVMe, SATA and SAS inline encryption
Data-at-rest protection in embedded and industrial systems
Encrypted file systems and volume managers
Secure logging and archival

Block diagram

Interfaces

Interface	Type	Width	Carries
`s_axil`	AXI4-Lite slave	32-bit data, 6-bit address	capability, control, length, status, counter, interrupts
`s_axis_key`	AXI4-Stream sink	32-bit	Key1 then Key2, most significant word first
`s_axis_tweak`	AXI4-Stream sink	32-bit	the tweak, least significant word first; `tlast` starts the data unit
`s_axis`	AXI4-Stream sink	128 × `PIPES` bits	payload in
`m_axis`	AXI4-Stream source	128 × `PIPES` bits	payload out
`enc_dec`	input	1-bit	direction, sampled at data-unit start
`enable`	input	1-bit	payload gate
`status`	output	7-bit	the status register's bits, for a controller that would rather not poll
`irq`	level	1-bit	completion and error events

A storage controller issuing sector after sector writes no registers between them. The tweak stream's completion starts the unit and the direction comes from a port, so the AXI4-Lite interface is used at configuration time and then left alone.

Throughput

throughput  =  128 x PIPES x f_clk    bits per second

At 250 MHz, PIPES = 1 gives 32 Gbit/s and PIPES = 2 gives 64 Gbit/s.

Sector setup is hidden. The tweak cipher runs on its own engine rather than borrowing a slot from the unrolled pipeline, so offering the next sector's tweak while the current one is still streaming costs no payload cycles at all.

Security properties

No key material is readable. Keys arrive on their own AXI4-Stream and no register holds one — there is no address a key could be read back from, because no register exists to hold it. A DMA engine can deliver a key on the datapath rather than a processor writing sixteen words through the bus.

A key goes live only if all of it arrived. The expected word count follows from the configured key size and mode; a key whose tlast falls anywhere else is discarded rather than used, so a producer that ends a key stream early cannot silently install a key that is part new and part previous.

Power analysis is not addressed. No masking, no randomised schedule and no constant-power substitution is implemented. An application facing an attacker with physical access and trace-collection capability requires countermeasures above this core.

Configuration

Parameter	Type	Effect
`PIPES`	elaboration	1 = one block per clock; 2 = two blocks per clock
key size	run time	128 or 256 bits per cipher key
mode	run time	XTS or ECB
data unit length	run time	any, with ciphertext stealing
top choice	elaboration	full AXI product, or bare cipher

Resources and performance

Resource utilisation and maximum clock frequency for each target device are measured out of context and published per target in the measured results on this page. AMD and Efinix rows report LUTs; Altera rows report ALMs, and the two are never combined. Latency is published with all three endpoints named — start to first input accepted, first input to first output, and start to first output — because the key expander runs between the first two.

Deliverables

Item	Contents
RTL	parameterised SystemVerilog, vendor-neutral
Model	bit-accurate C++ model
Registers	SystemRDL source plus six generated exports
Verification	UVM RAL, formal property wrappers, IEEE 1619 vector drivers
Software	ANSI C reference driver with generated header and JSON
Packaging	IP-XACT, IEEE 1685-2022
Implementation	runnable flow script per FPGA vendor, file list, SDC
Documentation	integration guide