SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> E. ARCHITECTURES WITH QUASI-PIPELINING <s> An implementation of the hash functions SHA-256, 384 and 512 is presented, obtaining a high clock rate through a reduction of the critical path length, both in the Expander and in the Compressor of the hash scheme. The critical path is shown to be the smallest achievable. Synthesis results show that the new scheme can reach a clock rate well exceeding 1 GHz using a 0.13um technology. <s> BIB001 </s> SHA-2 Acceleration Meeting the Needs of Emerging Applications: A Comparative Survey <s> E. ARCHITECTURES WITH QUASI-PIPELINING <s> The hash algorithm forms the basis of many popular cryptographic protocols and it is therefore important to find throughput optimal implementations. Though there have been numerous published papers proposing high throughput architectures, none of them have claimed to be optimal. In this paper, we perform iteration bound analysis on the SHA2 family of hash algorithms. Using this technique, we are able to both calculate the theoretical maximum throughput and determine the architecture that achieves this throughput. In addition to providing the throughput optimal architecture for SHA2, the techniques presented can also be used to analyze and design optimal architectures for some other iterative hash algorithms. <s> BIB002
The first quasi-pipelined architecture for SHA-2 is introduced in  , together with an improved variant employing delaybalancing. A slightly different version is presented in BIB001 , where the Expander is also optimised with the delay balancing technique. An independent theoretical analysis carried out in BIB002 confirms that this design is optimal, at the architectural level, with respect to throughput. Unrolling by factors 2 and 4 of the quasi-pipelining architecture is presented in  , obtaining an improvement in throughput only for SHA-512 with unrolling factor 2. Although it does not apply explicitly the quasi-pipelined formulation described in Section IV-C6, the work in  exploits the same basic idea of splitting the adder chain with registers and exploiting Equation (II.12) for data forwarding, here for the E t accumulator. This work also employs a form of precomputation by summing the value K t with the word W t directly in the Expander, so as to remove this sum from the critical path. Table 3 compares the various techniques described in Section IV in terms of their effects on performance, area occupation and energy efficiency, and the implementation complexity of each of them. The table also lists the most representative works employing each technique. As described in Section V, each design usually exploits more than one technique in order to meet the stated objectives.