SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> A. PERFORMANCE <s> Hash functions are among the most widespread cryptographic primitives, and are currently used in multiple cryptographic schemes and security protocols, such as IPSec and SSL. In this paper, we investigate a new hardware architecture for a family of dedicated hash functions, including American standards SHA-1 and SHA-512. Our architecture is based on unrolling several message digest steps and executing them in one clock cycle. This modification permits implementing majority of dedicated hash functions with the throughput exceeding 1 Gbit/s using medium-size Xilinx Virtex FPGAs. In particular, our new architecture has enabled us to speed up the implementation of SHA-1 compared to the basic iterative architecture from 544 Mbit/s to 1 Gbit/s using Xilinx XCV1000. The implementation of SHA-512 has been sped up from 717 to 929 Mbit/s for Virtex FPGAs, and exceeded 1 Gbit/s for Virtex-E Xilinx FPGAs. <s> BIB001 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> A. PERFORMANCE <s> This paper proposes a set of new techniques to improve the implementation of the SHA-2 hashing algorithm. These techniques consist mostly in operation rescheduling and hardware reutilization, allowing a significant reduction of the critical path while the required area also decreases. Both SHA256 and SHA512 hash functions have been implemented and tested in the VIRTEX II Pro prototyping technology. Experimental results suggest improvements to related SHA256 art above 50% when compared with commercial cores and 100% to academia art, and above 70% for the SHA512 hash function. The resulting cores are capable of achieving the same throughput as the fastest unrolled architectures with 25% less area occupation than the smallest proposed architectures. The proposed cores achieve a throughput of 1.4 Gbit/s and 1.8 Gbit/s with a slice requirement of 755 and 1667 for SHA256 and SHA512 respectively, on a XC2VP30-7 FPGA. <s> BIB002 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> A. PERFORMANCE <s> This paper presents a new set of techniques for hardware implementations of secure hash algorithm (SHA) hash functions. These techniques consist mostly in operation rescheduling and hardware reutilization, therefore, significantly decreasing the critical path and required area. Throughputs from 1.3 Gbit/s to 1.8 Gbit/s were obtained for the SHA implementations on a Xilinx VIRTEX II Pro. Compared to commercial cores and previously published research, these figures correspond to an improvement in throughput/slice in the range of 29% to 59% for SHA-1 and 54% to 100% for SHA-2. Experimental results on hybrid hardware/software implementations of the SHA cores, have shown speedups up to 150 times for the proposed cores, compared to pure software implementations. <s> BIB003 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> A. PERFORMANCE <s> Many cryptographic primitives that are used in cryptographic schemes and security protocols such as SET, PKI, IPSec, and VPNs utilize hash functions, which form a special family of cryptographic algorithms. Applications that use these security schemes are becoming very popular as time goes by and this means that some of these applications call for higher throughput either due to their rapid acceptance by the market or due to their nature. In this work, a new methodology is presented for achieving high operating frequency and throughput for the implementations of all widely used-and those expected to be used in the near future-hash functions such as MD-5, SHA-1, RIPEMD (all versions), SHA-256, SHA-384, SHA-512, and so forth. In the proposed methodology, five different techniques have been developed and combined with the finest way so as to achieve the maximum performance. Compared to conventional pipelined implementations of hash functions (in FPGAs), the proposed methodology can lead even to a 160 percent throughput increase. <s> BIB004 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> A. PERFORMANCE <s> High-throughput and area-efficient designs of hash functions and corresponding mechanisms for Message Authentication Codes (MACs) are in high demand due to new security protocols that have arisen and call for security services in every transmitted data packet. For instance, IPv6 incorporates the IPSec protocol for secure data transmission. However, the IPSec's performance bottleneck is the HMAC mechanism which is responsible for authenticating the transmitted data. HMAC's performance bottleneck in its turn is the underlying hash function. In this article a high-throughput and small-size SHA-256 hash function FPGA design and the corresponding HMAC FPGA design is presented. Advanced optimization techniques have been deployed leading to a SHA-256 hashing core which performs more than 30p better, compared to the next better design. This improvement is achieved both in terms of throughput as well as in terms of throughput/area cost factor. It is the first reported SHA-256 hashing core that exceeds 11Gbps (after place and route in Xilinx Virtex 6 board). <s> BIB005 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> A. PERFORMANCE <s> Hash functions are a crucial tool in a large variety of applications, ranging from security protocols to cryptocurrencies down to the Internet-of-Things devices used, for example, as biomedical appliances. In particular, SHA-2 is today a ubiquitous hashing primitive. Its acceleration has driven a wealth of contributions in the technical literature and even a whole industry segment involving dedicated hash processing accelerators. Because of the variety of requirements in terms of performance, resources, and energy consumption as well as the impact of the particular hardware technology of choice, evaluating and comparing different architectural schemes is a nontrivial task, along with the exploration of new solutions matching given user requirements. Based on a careful review of the state of the art, this paper introduces an SHA-2 workbench to be used as a framework for evaluating different implementation styles and architectural choices. The workbench comes in the form of a generic HDL description, where the various implementation options are exposed in the form of user-configurable parameters and can be variously combined obtaining either known solutions or possibly new configurations to be explored. We systematically use the workbench to analyze the available SHA-2 architectural techniques. This extensive evaluation provides a deep understanding of the performance and energy implications of each implementation style and even allows the identification of nonobvious matches between architectural choices and target technologies in order to optimize hash rate and area efficiency figures. <s> BIB006
The most used metric to assess performance of hash circuits is the throughput, defined as the number of bits delivered per unit of time. If the hash circuit is capable of outputting a new hash value every N clk clock cycles, and the clock period is τ clk , the throughput can be written as The number of bits of the output depends on the selected hash function and does not offer any degree of freedom for improving throughput, unless the designer is in the position of choosing which hash function to employ. For this reason, when comparing designs for the SHA-2 function with different hash sizes, it is preferable to refer to the hash rate, defined as The other two terms of Equation (VI.1) are instead fully dependent on architectural design decisions. The clock period is lower bounded by the critical path delay, hence it is directly influenced by the architectural techniques which impact the critical path. Variable precomputation, spatial reordering and quasi-pipelining all reduce the critical path, therefore they are beneficial for the throughput metric. The number of clock cycles between two consecutive outputs is the latency required to compute the hash of a single PDB. For architectures capable to perform one iteration per clock cycle, N clk is R + 1 unless the architecture can handle concurrently the final sum and the execution of the last iteration, such as BIB002 , BIB003 , or includes the adder in the critical path, such as BIB004 , BIB005 ; in such cases N clk is R. Architectures with loop folding, on the other hand, require multiple clock cycles per iteration, making this technique negative for throughput. Hardware pipelining, relying on S pipelined blocks each handling R/S iterations, does not modify the number of clock cycles required to produce a single hash message. Instead, it reduces N clk by processing more PDBs simultaneously based on the availability of multiple units. The throughput is consequently increased by a factor equal to the number of pipeline stages. Loop unrolling has a twofold effect on performance. On one hand, it directly reduces the number of cycles required to hash a message by computing multiple iterations in a single clock cycle. On the other hand, it substantially increases τ clk due to the increased number of combinatorial levels required to compute the different iterations. The overall effect of loop unrolling hence depends on whether the reduction of the number of clock cycles compensates for the increase in the critical path. This does not happen in BIB001 , while it happens in BIB004 . This discussion does not take into account the fact that loop unrolling can enable further transformations which can reduce the critical path, as mentioned in Section IV-C3. Moreover, while the reduction of N clk is platformindependent, the increase in τ clk does depend on the underlying technology. This implies that the overall effect of loop unrolling on throughput is technology-dependent. In BIB006 loop unrolling turns out to be beneficial for throughput on fairly recent FPGAs.