SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. POWER AND ENERGY CONSUMPTION <s> An approach is presented for minimizing power consumption for digital systems implemented in CMOS which involves optimization at all levels of the design. This optimization includes the technology used to implement the digital circuits, the circuit style and topology, the architecture for implementing the circuits and at the highest level the algorithms that are being implemented. The most important technology consideration is the threshold voltage and its control which allows the reduction of supply voltage without significant impact on logic speed. Even further supply reductions can be made by the use of an architecture-based voltage scaling strategy, which uses parallelism and pipelining, to tradeoff silicon area and power reduction. Since energy is only consumed when capacitance is being switched power can be reduced by minimizing this capacitance through operation reduction choice of number representation, exploitation of signal correlations, resynchronization to minimize glitching, logic design, circuit design, and physical design. The low-power techniques that are presented have been applied to the design of a chipset for a portable multimedia terminal that supports pen input, speech I/O and full-motion video. The entire chipset that performs protocol conversion, synchronization, error correction, packetization, buffering, video decompression and D/A conversion operates from a 1.1 V supply and consumes less than 5 mW. > <s> BIB001 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. POWER AND ENERGY CONSUMPTION <s> Power consumption has become one of the biggest challenges in high-performance microprocessor design. The rapid increase in the complexity and speed of each new CPU generation is outstripping the benefits of voltage reduction and feature size scaling. Designers are thus continuously challenged to come up with innovative ways to reduce power, while trying to meet all the other constraints imposed on the design. This paper presents an overview of the issues related to power consumption in the context of Intel CPUs. The main trends that are driving the increased focus on design for low power are described. System and benchmarking issues, and sources of power consumption in a high-performance CPU are briefly described. Techniques that have been tried on real designs in the past are described. The role of CAD tools and their limitations in this domain are also discussed. In addition, areas that need increased research focus in the future are also pointed out. <s> BIB002 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. POWER AND ENERGY CONSUMPTION <s> This paper analyzes the dynamic power consumption in the fabric of Field Programmable Gate Arrays (FPGAs) by taking advantage of both simulation and measurement. Our target device is Xilinx Virtex™-II family, which contains the most recent and largest programmable fabric. We identify important resources in the FPGA architecture and obtain their utilization, using a large set of real designs. Then, using a number of representative case studies we calculate the switching activity corresponding to each resource. Finally, we combine effective capacitance of each resource with its utilization and switching activity to estimate its share of power consumption. According to our results, the power dissipation share of routing, logic and clocking resources are 60%, 16%, and 14%, respectively. Also, we concluded that dynamic power dissipation of a Virtex-II CLB is 5.9μW per MHz for typical designs, but it may vary significantly depending on the switching activity. <s> BIB003 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. POWER AND ENERGY CONSUMPTION <s> A design approach to create small-sized high-speed implementation of the new version of secure hash algorithm is proposed. The resulted design can be easily embedded to operate in HMAC IP cores, providing a high degree of security. The proposed implementation does not introduce significant area penalty, compared to other competitive designs. However the achieved throughput presents an increase compared to commercially available IP cores that range from 43%-1830%. <s> BIB004 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. POWER AND ENERGY CONSUMPTION <s> This paper presents accurate area and power estimation models for implementations using FPGAs from the Xilinx Virtex-2Pro family. These models are designed to facilitate efficient design space exploration in an automated algorithm-architecture codesign framework. Detailed models for accurately estimating the number of slices, block RAMs and 18times18-bit multipliers for fixed point and floating-point IP cores have been developed. These models are also utilized to develop accurate power models that consider the effect of logic power, signal power, clock power and I/O power. In all cases, the model coefficients have been derived by using curve fitting or regression analysis. The modeling error for the IP cores is very small (average 0.95%). The error for fairly large examples such as floating point implementation of 8-point FFTs is also quite small; it is 1.87% for estimation of number of slices and 3.48% for estimation of power consumption. <s> BIB005 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. POWER AND ENERGY CONSUMPTION <s> This paper describes a design and implementation of low-power and high-speed security hardware cores for the Advanced Encryption Standard (AES) and the Secure Hash Algorithm (SHA1). We propose three Register Transfer Level (RTL) circuit techniques, namely, Application Specific Register Reduction (ASRR), Locally Explicit Clock Enabling (LECE), and Bus Specific Clock (BSC). LECE and BSC can be used directly to any ASIC design flow and can be applied for any technology nodes. With 65 nanometer industry technology, our proposed schemes demonstrated at RTL and gate level that for AES, 44.57% total power reduction (dynamic and cell leakage power), 10.43% area reduction, and 5.78 Gbps throughput with 452 MHz circuit speed are achieved and for SHA1, 63.26% total power reduction, 12.72% area reduction with 1.28 GHz circuit speed are achieved. <s> BIB006 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> C. POWER AND ENERGY CONSUMPTION <s> Hash functions are a crucial tool in a large variety of applications, ranging from security protocols to cryptocurrencies down to the Internet-of-Things devices used, for example, as biomedical appliances. In particular, SHA-2 is today a ubiquitous hashing primitive. Its acceleration has driven a wealth of contributions in the technical literature and even a whole industry segment involving dedicated hash processing accelerators. Because of the variety of requirements in terms of performance, resources, and energy consumption as well as the impact of the particular hardware technology of choice, evaluating and comparing different architectural schemes is a nontrivial task, along with the exploration of new solutions matching given user requirements. Based on a careful review of the state of the art, this paper introduces an SHA-2 workbench to be used as a framework for evaluating different implementation styles and architectural choices. The workbench comes in the form of a generic HDL description, where the various implementation options are exposed in the form of user-configurable parameters and can be variously combined obtaining either known solutions or possibly new configurations to be explored. We systematically use the workbench to analyze the available SHA-2 architectural techniques. This extensive evaluation provides a deep understanding of the performance and energy implications of each implementation style and even allows the identification of nonobvious matches between architectural choices and target technologies in order to optimize hash rate and area efficiency figures. <s> BIB007
As with any digital system, energy consumption represents the main operational cost for SHA-2 hardware accelerators. However, interestingly, operational costs might not be the only factor of interest, as instantaneous power consumption may sometimes have strong implications on the physical design of the accelerator. In fact, the energy absorbed per unit of time by a circuit is dissipated as heat, which must be driven away from the hardware to avoid damaging the circuit by overheating BIB002 . The cost of cooling clearly increases with the amount of power to be driven away BIB001 , while thermal requirements can even place an upper bound on the amount of functionality that can be integrated in a chip  , no matter what the cost constraints are, leading to the so called power cap issues. Other applications, including passively-powered circuits, are limited in the amount of power they can draw. The constraint on the SHA-2 functionality placed by power supplying limitations is even tougher than the one posed by power dissipation, since there are no measures that can be used to mitigate the problem, unlike the case of cooling. In such occurrences, the input power constraint can only be met by means of architectural optimisations  . If N M is the number of clock cycles required to hash a single message M by a hardware component consuming power P, the energy consumption of hashing a message can be written as since τ clk ·N M is the time required to hash the message M . For architectures processing one message at a time, N M = N clk , while for architectures processing more than one message simultaneously, the identity N M = N clk holds on average over multiple messages. Therefore, the average energy consumption per message hash can be written as with F being the hash rate, defined by Equation (VI.2). The equation above suggests that the energy consumption can be reduced by either increasing the hash rate, or decreasing the power consumption. The hash rate has been analyzed in Section VI-A, so the remainder of this section will focus on power consumption. The power consumption of a circuit is usually divided into a static and dynamic component. The static component depends mainly on technological aspects, such as the power supply V , or the threshold voltage of the transistors, amongst others  . On the other hand, the dynamic component can be influenced by architectural decisions BIB006 and therefore by the particular techniques employed in designing the SHA-2 circuit. Energy is absorbed from the supply by a CMOS gate during a transition from 0 to V , and is dissipated as heat during the subsequent transition from V to 0. Therefore, only the former transition leads to energy consumption BIB001 . For this reason, the switching activity α is often defined as the probability of a transition from 0 to V within a clock cycle, avoiding a 1/2 factor throughout the power consumption formulae. At the gate level, the dynamic power consumption can be written as BIB001 : where C is the capacitive load of the gate. For FPGAs, the power consumption can be rewritten to take into account the utilisation U of each resource in the whole device after programming BIB003 : These formulae show the impact of the clock frequency on power consumption. Techniques that optimise throughput of the SHA-2 accelerator through decreasing the critical path end up increasing the power consumption, due to the corresponding increase of f clk . This is the case of variable precomputation, spatial reordering, and quasi-pipelining. As mentioned above, in massively parallel systems, increasing f clk puts more pressure on the cooling system, whose dissipation capabilities may limit the maximum clock frequency, or poses an inherent limitation for passively-powered devices. On the other hand, this power increase does not lead to an energy-per-hash consumption increase, since f clk also appears on the denominator of Equations (VI.3) and (VI.4). It is worth noting that if the optimisation of throughput is not due to a decrease in τ clk but to a decrease in N clk , this argument does not apply. In such cases, there is no power consumption penalty, and there is an energy-per-message reduction due to the throughput increase, as shown by Equation (VI.4). Techniques that increase throughput by decreasing N clk include pipelining and loop unrolling. Another factor impacting power consumption is area occupation  , since more low-level resources need to be powered, and physical data and clock nets are longer BIB005 . This is shown also by Equation (VI.6). Therefore, designs which optimise resource utilisation, such as loop folding, also improve power efficiency. On the other hand, techniques leading to increased area occupation, such as pipelining and loop unrolling, also face increased power consumption. A more direct effect of architectural choices on power consumption is linked with the number of register operations BIB004 ,  . Since each register is read and written once per clock cycle, reducing the number of clock cycles needed to compute a hash also reduces the number of operations performed by registers, hence the dynamic power dissipation due to register operations. From this point of view, loop unrolling turns out to be beneficial in terms of power savings. The overall effect to be expected on power consumption due to each design technique is summarized in Table 3 . Pipelining has an adverse effect on power consumption, due to its increase in area and register operations. On the other hand, loop unrolling can be expected to be beneficial, despite the area increase, due to its frequency and register operation reduction. The experimental evaluation of BIB007 confirms the impact of loop unrolling, while other techniques appear not to have significant effects on power consumption. Loop folding has in fact twofold implications on power consumption. It leads to power savings due to the area reduction, but this also comes at the cost of increased register operations. The predominant effect ultimately depends on the underlying technology employed for the SHA-2 accelerator.