SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. ARCHITECTURES WITH PRECOMPUTATION <s> Hash functions are among the most widespread cryptographic primitives, and are currently used in multiple cryptographic schemes and security protocols such as IPSec and SSL. In this paper, we compare and contrast hardware implementations of the newly proposed draft hash standard SHA-512, and the old standard, SHA-1. In our implementation based on Xilinx Virtex FPGAs, the throughput of SHA-512 is equal to 670 Mbit/s, compared to 530 Mbit/s for SHA-1. Our analysis shows that the newly proposed hash standard is not only orders of magnitude more secure, but also significantly faster than the old standard. The basic iterative architectures of both hash functions are faster than the basic iterative architectures of symmetric-key ciphers with equivalent security. <s> BIB001 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. ARCHITECTURES WITH PRECOMPUTATION <s> Hash functions are among the most widespread cryptographic primitives, and are currently used in multiple cryptographic schemes and security protocols, such as IPSec and SSL. In this paper, we investigate a new hardware architecture for a family of dedicated hash functions, including American standards SHA-1 and SHA-512. Our architecture is based on unrolling several message digest steps and executing them in one clock cycle. This modification permits implementing majority of dedicated hash functions with the throughput exceeding 1 Gbit/s using medium-size Xilinx Virtex FPGAs. In particular, our new architecture has enabled us to speed up the implementation of SHA-1 compared to the basic iterative architecture from 544 Mbit/s to 1 Gbit/s using Xilinx XCV1000. The implementation of SHA-512 has been sped up from 717 to 929 Mbit/s for Virtex FPGAs, and exceeded 1 Gbit/s for Virtex-E Xilinx FPGAs. <s> BIB002 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. ARCHITECTURES WITH PRECOMPUTATION <s> This paper proposes a set of new techniques to improve the implementation of the SHA-2 hashing algorithm. These techniques consist mostly in operation rescheduling and hardware reutilization, allowing a significant reduction of the critical path while the required area also decreases. Both SHA256 and SHA512 hash functions have been implemented and tested in the VIRTEX II Pro prototyping technology. Experimental results suggest improvements to related SHA256 art above 50% when compared with commercial cores and 100% to academia art, and above 70% for the SHA512 hash function. The resulting cores are capable of achieving the same throughput as the fastest unrolled architectures with 25% less area occupation than the smallest proposed architectures. The proposed cores achieve a throughput of 1.4 Gbit/s and 1.8 Gbit/s with a slice requirement of 755 and 1667 for SHA256 and SHA512 respectively, on a XC2VP30-7 FPGA. <s> BIB003 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. ARCHITECTURES WITH PRECOMPUTATION <s> We propose an improved implementation of the SHA-2 hash family, with minimal operator latency and reduced hardware requirements. We also propose a high frequency version at the cost of only two cycles of latency per message. Finally we present a multi-mode architecture able to perform either a SHA-384 or SHA-512 hash or to behave as two independent SHA-224 or SHA-256 operators. Such capability adds increased flexibility for applications ranging from a server running multiple streams to independent pseudorandom number generation. We also demonstrate that our architecture achieves a performance comparable to separate implementations while requiring much less hardware. <s> BIB004 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. ARCHITECTURES WITH PRECOMPUTATION <s> A design approach to create small-sized high-speed implementation of the new version of secure hash algorithm is proposed. The resulted design can be easily embedded to operate in HMAC IP cores, providing a high degree of security. The proposed implementation does not introduce significant area penalty, compared to other competitive designs. However the achieved throughput presents an increase compared to commercially available IP cores that range from 48%-1912%. <s> BIB005 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. ARCHITECTURES WITH PRECOMPUTATION <s> This paper presents a new set of techniques for hardware implementations of secure hash algorithm (SHA) hash functions. These techniques consist mostly in operation rescheduling and hardware reutilization, therefore, significantly decreasing the critical path and required area. Throughputs from 1.3 Gbit/s to 1.8 Gbit/s were obtained for the SHA implementations on a Xilinx VIRTEX II Pro. Compared to commercial cores and previously published research, these figures correspond to an improvement in throughput/slice in the range of 29% to 59% for SHA-1 and 54% to 100% for SHA-2. Experimental results on hybrid hardware/software implementations of the SHA cores, have shown speedups up to 150 times for the proposed cores, compared to pure software implementations. <s> BIB006 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. ARCHITECTURES WITH PRECOMPUTATION <s> The security hash algorithm 512 (SHA-512), which is used to verify the integrity of a message, involves computation iterations on data. The huge computation delay generated in that iteration limits the entire throughput of the system, and makes it difficult to pipeline the computation. To shorten the computation time in an iteration of the main loop, we used the data forwarding method. Here we introduce an architecture that simultaneously does data computation of an iteration and data movement of the next one. Then the computations are broken into two stages for one operand and three stages for another operand. The implementation occupies 1,520 hardware slices on Xilinx Virtex-4 family FPGA chip, and achieves nearly 2.2 Gbps. Thus, the implementation achieved a better area performance rate (throughput/area) in comparison with the related work. <s> BIB007 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. ARCHITECTURES WITH PRECOMPUTATION <s> Cryptographic algorithms are used to enable security services that are the core of modern communication systems. In particular, Hash functions algorithms are widely used to provide services of data integrity and authentication. These algorithms are based on performing a number of complex operations on the input data, thus it is important to count with novel designs that can be efficiently mapped to hardware architectures. Hash functions perform internal operations in an iterative fashion, which open the possibility of exploring several implementation strategies. In the paper, two different schemes to improve the performance of the hardware implementation of the SHA-2 family of algorithms are proposed. The main focus of the proposed schemes is to reduce the critical path by reordering the operations required at each iteration of the algorithm. Implementation results on an FPGA device show an improvement on the performance on the SHA-256 algorithm when compared against similar previously proposed approaches. <s> BIB008 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. ARCHITECTURES WITH PRECOMPUTATION <s> Hash function algorithms are widely used to provide security services of integrity and authentication, being SHA-2 the latest set of hash algorithms standardized by the US Federal Government. The main computation block in SHA-2 algorithms is governed by a loop with high data dependence for which several implementation strategies are explored in this work as well as designs efficiently mapped to hardware architectures. Four new different hardware architectures are proposed to improve the performance of SHA-256 algorithms, reducing the critical path by reordering some operations required at each iteration of the algorithm and computing some values in advance, as possible as data dependence allows. The proposed designs were implemented and validated in the FPGA Virtex-2 XC2VP-7. The achieved results show a significant improvement on the performance of the SHA-256 algorithm compared to similar previously proposed approaches, obtaining a throughput of 909Mbps and an improved efficiency of 0.713Mbps/slice. <s> BIB009
The architecture proposed in BIB001 precomputes the sum K t + W t outside the main operational block, in order to shorten the critical path. Moreover, it employs a 5-to-3 parallel adder to compute A t+1 . The architecture is further optimised in BIB002 , where loop unrolling by a factor 5 is used. Values required later in the unrolled chain of operations are precomputed as soon as possible. Variable precomputation is employed in BIB003 to shorten the critical path at the iteration t. Taking into account that H t = G t−1 due to Equation (IV.1), and that the values K t and W t are available in advance, the quantity can be precomputed during round t − 1, leading to the following computation during round t: This architecture is further improved in BIB006 with two optimised variants for the Expander, relying upon BRAMs and FIFOs respectively The work in BIB008 pushes this approach further, proposing another precomputation based on the fact that D t = C t−1 again due to Equation (IV.1). The quantity τ t defined in Equation (V.1) can be precomputed during round t − 1 as 5 The computation of round t can therefore be reduced to In BIB008 three architectures are compared against the straightforward implementation of Equations (II.6) to (II.11) with a common platform, which employs a rolling loop to perform the whole SHA-256 computation. The three architectures considered in BIB008 include the scheme resulting from Equations (V.1) and (V.2) originally proposed in BIB003 , the one resulting from Equations (V.3) and (V.4), and the one resulting from Equations (V.5) and (V.6). The architectures are further optimised in BIB009 by employing Carry-Save Adders. Moreover, the common evaluation platform is improved by inserting two registers to break the critical path without requiring any additional clock cycle. These additional registers are located after the K constant ROM memory and before the DM feedback loop multiplexer. The multi-mode architecture proposed by BIB004 also exploits the precomputation of δ t and τ t , computing these two in parallel as While the first equation is the same as Equation (V.3), the second equation is implemented by computing G t−1 + C t−1 in parallel with the sum K t + W t , and the result of the latter is added, in parallel, to both the former and G t−1 . The architecture presented in BIB007 exploits variable precomputation even further, in order to introduce a form of pipelining within the transformation round. In the first stage, Equation (V.3) is computed and the output is stored into a register, while the second stage computes Equation (II.6). A similarly aggressive precomputation is performed in BIB005 in the context of a two-unrolled architecture.