The CBC Shell is designed to work as an (optional) interface to the DES Core. It preserves all input/output signals of the DES core, while adding some extra data and control signals specific to the CBC operation modes.
The CBC Shell comes in two variants: the fully featured variant of the shell accommodates the hardware logic required to handle the special case of frame-ending data blocks shorter than a 64-bit data word; the simple (stripped down) version has this control logic removed, together with the corresponding control signal (the SBC input).
The following is a description of the fully-featured variant; the simple variant should be derived by considering the SBC signal to be always inactive.

 

Figure 1: CBC Shell Interface Signals

 

Signal Description:

Following is the list of the new signals that are specific to the CBC Shell interface (fig. 1):
CBC: Cipher Block Chaining mode. This is an input control signal specifying whether the next Encryption / Decryption operation will be performed in CBC or ECB mode;
IVC: Initialization Vector Cycle. This is an input control signal specifying that the data to be processed during the next cycle is the first data block within a frame; it is only meaningful when CBC mode is selected (the CBC signal is asserted). If the IVC is asserted, the IV will be read in the next cycle (together with the Data-IN and the KEY).
SBC: Short Block Cycle. This is an input control signal specifying that the data to be processed during the next cycle is a short data block (less than 64 bits). This typically occurs at the end of a data frame whose length is not a multiple of 64 bits. In this case there is a special way of dealing with the last block of bits and this should be indicated to the CBC Shell by asserting the SBC control signal. The SBC is only meaningful when CBC mode is selected. It can be active together with the IVC, in this case the data to be processed during the next cycle is typically specified to be both the first and the last block in the data frame, i.e. the next frame only contains one data block whose length is less than 64 bits. In typical applications, if the last data block in a frame is a full 64-bit block, the SBC is not asserted during its processing; this signal is thus typically reserved only for specifying the short trailing data blocks in a frame (less than 64 bits).
IV: Initialization Vector input. This is a 64-bit input data bus.

 

Shell Functionality:

The CBC Shell inherits the basic behavior of the DES Core, while adding some new CBC-mode features. Responsible for these new features are the three CBC Shell-specific control signals CBC, IVC, and SBC, together with the IV Data Input. The CBC, IVC, and SBC inputs are a natural extension of the OPC control signal of the DES Core; together with the OPC they instruct the DES (Core + Shell ensemble) what operation to perform starting after the current operation is completed (table 1).

 

OPC	IVC	SBC	CBC	Operation
NOP	X	X	X	No Opeartion
ENC	X	X	OFF	ECB Encryption
DEC	X	X	OFF	ECB Decryption
ENC	ON	OFF	ON	CBC Initial Data-Block Encryption (IV Input is read)
ENC	OFF	OFF	ON	CBC Mid-frame Data-Block Encryption
DEC	ON	OFF	ON	CBC Initial Data-Block Decryption (IV Input is read)
DEC	OFF	OFF	ON	CBC Mid-frame Data-Block Decryption
ENC	ON	ON	ON	CBC Single Short-Data-Block Encryption (IV Input is read)
ENC	OFF	ON	ON	CBC End-of-frame Short-Data-Block Encryption
DEC	ON	ON	ON	CBC Single Short-Data-Block Decryption (IV Input is read)
DEC	OFF	ON	ON	CBC End-of-frame Short-Data-Block Decryption

Table 1: DES Operation according to the Control Signals.

The initial and mid-frame full-size (64 bits) data blocks encryption/decryption in CBC mode is done according to the CBC standard:
For encryption: each input data block is xor-ed before entering the DES encryption with the previous encrypted data block; for the first data block (when a "previous" encrypted data is not yet available) the IV vector is xor-ed with the input data.
For decryption: each DES-decrypted output data block is xor-ed with the previous encrypted data block to provide the final result; for the first block to be decrypted (when a "previous" encrypted data block is not available) the IV vector is xor-ed with the DES-decrypted data to provide the output.
The case of the short (less than 64 bits) end-of-frame trailing data blocks is handled in the following way (hereafter N designates the number of bits in the trailing data block):
At encryption: the previous encrypted full 64-bit data block is DES-re-encrypted, and bits 1-N of the result are xor-ed with the short data block's bits 1-N to provide the final result (N bits); when the short data block is also the only one in the frame, and thus no "previous" encrypted data block is available, the IV vector is used instead. (it is DES-encrypted, and the resulting bits 1-N are xor-ed with the short data block's bits 1-N).
At decryption, the previous encrypted full 64-bit data block is DES-encrypted, and bits 1-N of the result are xor-ed with the short data block's bits 1-N to provide the final result (N bits); when the short data block is also the only one in the frame, and thus no "previous" encrypted data block is available, the IV vector is used instead. (it is DES-encrypted and the resulting bits 1-N are xor-ed with the short data block's bits 1-N).

 

Timing:

The timing of the new (CBC-specific) signals follow the same guidelines as the DES Core's OPC control signals. They are sampled on the rising edge of the CLK together with OPC, and are ignored in the cycles when the OPC signal is ignored (see the DES Core timing).
The IV input is also sampled on the rising edge of CLK, together with the Data-IN and KEY inputs; it is ignored in the cycles when the Data-IN and KEY inputs are ignored.