SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> The rapid developments in the communications industry over the last decade have led to an escalation in the amount of sensitive data being transmitted over the Internet. This has resulted in an increased awareness of the need to provide security measures. Authentication is one such security measure. A novel highly efficient single-chip hardware design of the SHA-384 and SHA-512 authentication algorithms is described in this paper. The compact implementation achieves a throughput of 479 Mbits/sec utilising a shift register design approach and look-up tables (LUTs). This is believed to be the first SHA-384/SHA-512 hardware implementation to be reported in the literature. <s> BIB001 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> Hash functions are among the most widespread cryptographic primitives, and are currently used in multiple cryptographic schemes and security protocols such as IPSec and SSL. In this paper, we compare and contrast hardware implementations of the newly proposed draft hash standard SHA-512, and the old standard, SHA-1. In our implementation based on Xilinx Virtex FPGAs, the throughput of SHA-512 is equal to 670 Mbit/s, compared to 530 Mbit/s for SHA-1. Our analysis shows that the newly proposed hash standard is not only orders of magnitude more secure, but also significantly faster than the old standard. The basic iterative architectures of both hash functions are faster than the basic iterative architectures of symmetric-key ciphers with equivalent security. <s> BIB002 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> Couple to the communications wired and unwired networks growth, is the increasing demand for strong secure data transmission. New cryptographic standards are developed, and new encryption algorithms are designed, in order to satisfy the special needs for security. SHA-2 is the newest powerful standard in the hash functions families. In this paper, a VLSI architecture for the SHA-2 family is proposed. For every hash function SHA-2 (256, 384, and 512) of this standard, a hardware implementation is presented. All the implementations are examined and compared in the supported security level and in the performance by using hardware terms. This work can substitute efficiently the previous SHA-1 standard implementations, in every integrity security scheme, with higher offered security level, and better performance. In addition, the proposed implementations could be applied alternatively in the integrations of digital signature algorithms, keyed-hash message authentication codes and in random numbers generators architectures. <s> BIB003 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> An implementation of the hash functions SHA-256, 384 and 512 is presented, obtaining a high clock rate through a reduction of the critical path length, both in the Expander and in the Compressor of the hash scheme. The critical path is shown to be the smallest achievable. Synthesis results show that the new scheme can reach a clock rate well exceeding 1 GHz using a 0.13um technology. <s> BIB004 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> The continued growth of both wired and wireless communications has triggered the revolution for the generation of new cryptographic algorithms. SHA-2 hash family is a new standard in the widely used hash functions category. An architecture and the VLSI implementation of this standard are proposed in this work. The proposed architecture supports a multi-mode operation in the sense that it performs all the three hash functions (256, 384 and 512) of the SHA-2 standard. The proposed system is compared with the implementation of each hash function in a separate FPGA device. Comparing with previous designs, the introduced system can work in higher operation frequency and needs less silicon area resources. The achieved performance in the term of throughput of the proposed system/architecture is much higher (in a range from 277 to 417%) than the other hardware implementations. The introduced architecture also performs much better than the implementations of the existing standard SHA-1, and also offers a higher security level strength. The proposed system could be used for the implementation of integrity units, and in many other sensitive cryptographic applications, such as, digital signatures, message authentication codes and random number generators. <s> BIB005 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> Hash functions are common and important cryptographic primitives, which are very critical for data integrity assurance and data origin authentication security services. Field programmable gate arrays (FPGAs) being reconfigurable, flexible and physically secure are a natural choice for implementation of hash functions in a broad range of applications with different area-performance requirements. In this paper, we explore alternative architectures for the implementation of hash algorithms of the secure hash standards SHA-256 and SHA-512 on FPGAs and study their area-performance trade-offs. As several 64-bit adders are needed in SHA-512 hash value computation, new architectures proposed in this paper implement modulo-64 addition as modulo-32, modulo-16 and modulo-8 additions with a view to reduce the chip area. Hash function SHA-512 is implemented in different FPGA families of ALTERA to compare their performance metrics such as area, memory, latency, clocking frequency and throughput to guide a designer to select the most suitable FPGA for an application. In addition, a common architecture is designed for implementing SHA-256 and SHA-512 algorithms. <s> BIB006 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> This paper proposes a set of new techniques to improve the implementation of the SHA-2 hashing algorithm. These techniques consist mostly in operation rescheduling and hardware reutilization, allowing a significant reduction of the critical path while the required area also decreases. Both SHA256 and SHA512 hash functions have been implemented and tested in the VIRTEX II Pro prototyping technology. Experimental results suggest improvements to related SHA256 art above 50% when compared with commercial cores and 100% to academia art, and above 70% for the SHA512 hash function. The resulting cores are capable of achieving the same throughput as the fastest unrolled architectures with 25% less area occupation than the smallest proposed architectures. The proposed cores achieve a throughput of 1.4 Gbit/s and 1.8 Gbit/s with a slice requirement of 755 and 1667 for SHA256 and SHA512 respectively, on a XC2VP30-7 FPGA. <s> BIB007 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> We propose an improved implementation of the SHA-2 hash family, with minimal operator latency and reduced hardware requirements. We also propose a high frequency version at the cost of only two cycles of latency per message. Finally we present a multi-mode architecture able to perform either a SHA-384 or SHA-512 hash or to behave as two independent SHA-224 or SHA-256 operators. Such capability adds increased flexibility for applications ranging from a server running multiple streams to independent pseudorandom number generation. We also demonstrate that our architecture achieves a performance comparable to separate implementations while requiring much less hardware. <s> BIB008 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> The main applications of the hash functions are met in the fields of communication's integrity and signature authentication. Many hash algorithms have been investigated and developed in the last years. This work is related to hash functions FPGA implementation. Field programmable gate arrays (FPGAs) being reconfigurable, flexible and physically secure are a natural choice for implementation of hash functions in a broad range of applications with different area-performance requirements. We propose a configurable secure hash algorithm (SHA) processor for extended signature authentication. This paper investigates different optimizations algorithms of recent techniques that have been proposed in the literature. In our implementation based on Xilinx Virtex FPGAs, the throughput of SHA processor is equal to 1296 Mbit/s. Speed/area results from these processors are analyzed and shown to compare favorably with other FPGA-based implementations. A fastest data throughput is achieved by our optimized algorithm <s> BIB009 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> Coupled with the increasing demand for strong secure data transmission in communications, SHA-2 hash family is becoming the newest powerful hash function standard. In this paper, a reconfigurable architecture is proposed. The architecture supports a multi-mode operation in the sense that it performs all the three hash functions algorithms (256,384 and 512) of the SHA-2 standard. Furthermore, the performance of proposed implementation in the term of throughput and resources is higher than other hardware implementations, due to using critical data path optimization and the method of reducing word length. Therefore this work can substitute efficiently the existing MD5 and SHA-1 hash function implementations in every security scheme, also offers a higher security level strength. <s> BIB010 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> This paper presents a new set of techniques for hardware implementations of secure hash algorithm (SHA) hash functions. These techniques consist mostly in operation rescheduling and hardware reutilization, therefore, significantly decreasing the critical path and required area. Throughputs from 1.3 Gbit/s to 1.8 Gbit/s were obtained for the SHA implementations on a Xilinx VIRTEX II Pro. Compared to commercial cores and previously published research, these figures correspond to an improvement in throughput/slice in the range of 29% to 59% for SHA-1 and 54% to 100% for SHA-2. Experimental results on hybrid hardware/software implementations of the SHA cores, have shown speedups up to 150 times for the proposed cores, compared to pure software implementations. <s> BIB011 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> The continued growth of both wired and wireless communications has triggered the revolution for the generation of new cryptographic algorithms. Hash functions are common and important cryptographic primitives, which are very critical for data integrity assurance and data origin authentication security services. Many hash algorithms have been investigated and developed in the last years. This work is related to hash functions FPGA implementation. SHA-2 hash family is a new standard in the widely used hash functions category. An architecture and the FPGA implementation of this standard are proposed in this work. We propose a reconfigurable SHA-2 processor in the sense that it performs the two hash functions (256, and 512) of the SHA-2 standard for extended signature authentication. This paper investigates optimizations techniques that have recently been proposed in the literature. These techniques consist mostly in operation rescheduling and hardware reutilization, allowing a significant reduction of the critical path while the required area also decreases. As several 64-bit adders are needed in SHA-512 hash value computation, investigations on the adders implementations on FPGAs are analyzed and developed, with a view to reduce the chip area. The proposed processor is compared with the implementation of each hash function in a separate FPGA device to demonstrate that our architecture achieves a performance comparable to separate implementations while requiring much less hardware. Two types of FPGAs are evaluated in order to produce realistic results. Speed/area results from this processor are analyzed and are shown to demonstrate that our designs achieves a favorably performances with other FPGA-based implementations. A fastest data throughput is achieved by our optimized design. <s> BIB012 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> We present a compact SHA-256 hardware architecture suitable for the Trusted Mobile Platform (TMP), which requires low-area and low-power characteristics. The built-in hardware engine to compute a hash algorithm in TMP is one of the most important circuit blocks and contributes the performance of the whole platform because it is used as key primitives supporting platform integrity and command authentication. Unlike personal computers, mobile platform have very stringent limitations with respect to available power, physical circuit area, and cost. Therefore, special architecture and design methods for a compact hash hardware module are required. Our SHA-256 hardware can compute 512-bit data block using 8,588 gates on a 0.25μm CMOS process. The highest operation frequency and throughput of the proposed architecture are 136MHz and 142Mbps, which satisfies processing requirement for the mobile application. <s> BIB013 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> Many cryptographic primitives that are used in cryptographic schemes and security protocols such as SET, PKI, IPSec, and VPNs utilize hash functions, which form a special family of cryptographic algorithms. Applications that use these security schemes are becoming very popular as time goes by and this means that some of these applications call for higher throughput either due to their rapid acceptance by the market or due to their nature. In this work, a new methodology is presented for achieving high operating frequency and throughput for the implementations of all widely used-and those expected to be used in the near future-hash functions such as MD-5, SHA-1, RIPEMD (all versions), SHA-256, SHA-384, SHA-512, and so forth. In the proposed methodology, five different techniques have been developed and combined with the finest way so as to achieve the maximum performance. Compared to conventional pipelined implementations of hash functions (in FPGAs), the proposed methodology can lead even to a 160 percent throughput increase. <s> BIB014 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> To accelerate the speed of iterative computation for the existing SHA-256 algorithm, using 7-3-2 array compressor is proposed to reduce the critical path delay in this paper. The frequency of the proposed scheme is 1.7 times higher than other VLSI implementations under the same process. In addition, the paper designs a new universal architecture for implementing SHA-2 algorithms. The design is synthesized with the slow library of Synopsys Design Compiler in SMIC 0.18µm CMOS process. Its function has been verified sufficiently on FPGA. Furthermore, compared with the existing SHA-256 core, the results of the ASIC synthesis and FPGA verification are more preferable. This design is convenient to implant into SoC and embedded system with the versatile architecture and high clock frequency1. <s> BIB015 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> This paper introduces the specialization of a NIOS2 processor targeting the computation of message authentication codes and integrity checks in constrained environments. Several hardware/software partitioning levels are considered, which vary from simple functions implemented as custom instructions to complete algorithms as peripherals. Our experimental results show that functions Sum, Sig, Ch, Maj implemented as custom instructions allows for SHA-256 and HMAC to be accelerated 1.38 and 1.36 times respectively, while keeping a small area footprint. If the entire SHA-256 algorithm is implemented as a peripheral, the hash computation is performed 11 times faster while decreasing the program size in 16%. Furthermore, the HMAC/SHA-256 peripheral accelerates the computation of a message authentication code 19 times with a 26% smaller program. These results allow for the specialization of the computational platform of constrained embedded systems to the processing requirements of cryptographic applications performing message authentication codes and integrity checks. <s> BIB016 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> This paper presents a compact and unified hardware architecture implementing SHA-1 and SHA-256 algorithms that is suitable for the mobile trusted module (MTM), which should satisfy small area and low-power condition. The built-in hardware hash engine in a MTM is one of the most important circuit blocks and dominates the performance of the whole platform because it is used as a key primitive to support most MTM commands concerning to the platform integrity and the command authentication. Unlike the general trusted platform module (TPM) for PCs, the MTM, that is to be employed in mobile devices, has very stringent limitations with respect to available power, circuit area, and so on. Therefore, MTM needs the spatially optimized architecture and design method for the construction of a compact SHA hardware. The proposed hardware for unified SHA-1 and SHA-256 component can compute a sequence of 512-bit data blocks and has been implemented into 12,400 gates of 0.25 μm CMOS process. Furthermore, in the processing speed and power consumption, it shows the better performance in comparison with commercial TPM chips and software-only implementation. The highest operation frequency and throughput of the proposed architecture are 137 MHz and 197.6 Mbps, respectively, which satisfy the processing requirement for the mobile application. <s> BIB017 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> In this study, novel pipelined architectures, optimised in terms of throughput and throughput/area factors, for the SHA-512 cryptographic hash function, are proposed. To achieve this, algorithmic- and circuit-level optimisation techniques such as loop unrolling, re-timing, temporal pre-computation, resource re-ordering and pipeline are applied. All the techniques, except pipeline are applied in the function's transformation round. The pipeline was applied through the development of all the alternative pipelined architectures and implementation in several Xilinx FPGA families and they are evaluated in terms of frequency, area, throughput and throughput/area factors. Compared to the initial un-optimised implementation of SHA-512 function, the introduced five-stage pipelined architecture improves the both the throughput and throughput/area factors by 123 and 61.5%, respectively. Furthermore, the proposed five-stage pipelined architecture outperforms the existing ones both in throughput (3.4× up to 16.9×) and throughput/area (19.5% up to 6.9×) factors. <s> BIB018 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> 1) GENERAL ARCHITECTURE <s> The modern era of Internet-of-Things (IoT) is naturally imposing a tight area/runtime constraint on the computing kernels. Security kernels, as part of the standardized protocols as well as custom defense techniques, are among the most common tasks executed on every digital device. Therefore, low area cost and high performance implementation of security kernels is an important goal of current system designers. In this paper, we revisit the state-of-the-art implementations of SHA-256, a standardized security primitive for authentication and propose novel optimizations. Our optimizations, based on architectural folding and 4-2 adder compressor, are geared toward both lightweight and high performance implementations. Detailed experiments of our optimized architecture on different FPGA fabrics clearly demonstrate their benefits. Our presented design point successfully attained the highest hardware efficiency (throughput/area) figures among the published literature so far. <s> BIB019
The architecture of a SHA-2 accelerator is directly derived from the structure of the algorithm, as described in Section II, and it is shown at a high level in Figure 2 . Prior to hashing, the incoming message needs to be padded. Therefore, a Padding Unit is responsible for producing the PDBs. It is worth noting that the Padding Unit modifies only the last block of a message, leaving the others untouched. Since padding can be performed in software quite efficiently, without affecting the overall security of the system, many implementations BIB014 , BIB015 , BIB017 , BIB019 , BIB007 , BIB011 ,  , BIB004 , BIB016 -  do not include the Padding Unit. These implementations take in already formatted PDBs. On the other hand, other implementations BIB003 -  , BIB009 , BIB012 , BIB001 , BIB010 , BIB008 ,  choose to include a Padding Unit directly in hardware. In this case, the original messages must be provided to the accelerator, while the PDBs will be built internally. When comparing reported results, especially for the area occupation metric, it must be taken into account whether a Padding Unit is included in the hardware design. The PDB enters the Expander, which outputs the words W t according to Equation (II.4). The implementation of the Expander is quite straightforward, and is based on a 16-position shift register to store the required words with the necessary delay. The input of the shift register chain is the result of the computation of Equation (II.4). Since the W t value is not read from the input of the shift register, but from one of the internal delay registers, the Expander is decoupled from the critical path of the Compressor BIB011 . Most implementations adopt this architecture for the Expander, which is explicitly described in BIB005 , BIB001 , BIB010 , BIB008 , BIB016 , BIB006 and shown in Figure 3 . Possible improvements rely on special devices for implementing the shift register, such as block RAMs (BRAMs) or first-in, first-out memory queue (FIFO)s BIB011 , or the shift register mode of the configurable logic blocks (CLBs) of Xilinx R FPGAs BIB002 . A folded implementation of the Expander, employing only one adder, is proposed instead in BIB013 , BIB017 . The unrolled implementation of the Expander is presented in BIB018 ,  . In BIB004 , an architectural optimisation of the Expander is proposed, based on the delay balancing technique. This technique aims to shorten the critical path by placing more combinatorial logic on noncritical paths. The effect of this reordering is that noncritical paths, which do not determine the worst-case delay of the circuit, are stretched, while the critical path is shortened, resulting in a reduction of the circuit delay. A ROM unit is employed to store and supply the K t constants. Multi-mode architectures BIB005 , BIB008 take advantage of the fact that the values for SHA-256 are the most significative halves of the values for SHA-512, therefore the ROM for the SHA-256 constants can be used also in the SHA-512 datapath. The current hash value needs to be retained until the end of the hashing of the current PDB, since it must be added to the value of the working state Z . In a straightforward implementation, eight adders are required to perform the final addition of Equation (II.13) simultaneously. However, in BIB007 , BIB011 an efficient alternative technique is proposed to compute the new intermediate hash value without adding any latency, since it is calculated during the last stages. The actual hash computation is performed within the Compressor, which is also where the critical path is located. The transformation round core is responsible for the computation of Equation (IV.1), and its straightforward implementation is shown in Figure 4 . However, Equation (IV.1) must be computed R times for each PDB. There are different techniques that can be used to perform the whole computation from the transformation round core, which will be described next.