SHA-3 Hardware Project
The SHA-3 hardware page (work in progress) is a collection of our designs of the cryptographic hash functions submitted to the SHA-3 contest. It aims to provide an overview of FPGA and ASIC designs to aid in testing and analysis of all submissions. Source code is freely given for a wrapper interface to allow testing of designs and the source code for the hash functions themselves are to be added at a later stage.
Current hardware results can be found at the SHA-3 Zoo, and an alternate interface and design results may be found at RCIS and Athena.
SHA-3 Second Round Conference
We presented our implementation results at the NIST Second SHA-3 Candidate Conference at Santa Barbara, California, USA. August 17th - August 20th, 2010.
Updated versions of the paper and presentation can be found here.
The results were also presented at the 20th International Conference on Field Programmable Logic and Applications, Milano, Politecnico di Milano, Italy. August 31 - September 2, 2010
Hardware Wrapper
We present a hardware wrapper interface which attempts to encompass all the competition entries (and indeed, hash algorithms in general) across any number of both FPGA and ASIC hardware platforms. This interface comprises communications and padding, and attempts to standardise the hashing algorithms to allow accurate and fair area, timing and power measurement between the different designs.
Our wrapper design is currently on version 2.
DIG = Digest length
CTW = Counter width
MBL = Maximum block length
SR = Shift register
Counter Unit
- Needed for all except: Keccak, Luffa, Cubehash, Shabal
- Groestl counts blocks, not message length
Padder
- Slight variations between each hash function
Core Components
- Multiplexer to select the type of padding (100....., 000...., CTR, etc) for the current 32-bit block
- 32, 32-bit shift registers (1 for each shift value)
- A multiplexer with the outputs of the 32 SRs as input. Choice is made based on the message lenth "mod 32"
Controller
Varies significantly based on the hash function
Typical FSM:
- Read data in
- Padding state
- Load to HF
- Read next block
- Wait for message digest
Padding Unit
Cubehash, Luffa, Shabal and Skein use this padder almost exactly
Keccak requires a more specialized design (not shown here)
Fugue uses this padder but also uses the "optional" mux input for a counter and there is no shift registers required.
All the others use this padder BUT also use the "optional" mux input for the counter value.
A paper presenting the details and communications for our first wrapper can be found here.
Source Code
The Wrapper is made up of four individual subsections:
- The Hash function Top level.
- The padding scheme required.
- The controller.
- The output.
The wrapper also includes a package file (Sub-Wrapper) which holds the bus width size, currently set to 32-bits.
We further subdivided the wrapper into individual files for each hash design (and digest size where necessary), as opposed to originally using an all encompassing wrapper and using generics to select the files required. We do this for a number of reasons.
- To alleviate the requirement for a user to have all designs completed in VHDL/Verilog prior to synthesis.
- To reduce long synthesis time.
HASH VHDL Table
| Hash Design | Digest Size & Wrapper v.2 | Wrapper v.1 |
|---|---|---|
| SHA-2** | 224 256 |
Wrapper v.1 |
| SHA-2** | 384 512 | Wrapper v.1 |
| Blake**^ | 224 256 |
Wrapper v.1 |
| Blake**^ | 384 512 | Wrapper v.1 |
| BMW** | 224 256 |
Wrapper v.1 |
| BMW** | 384 512 | Wrapper v.1 |
| Cubehash* | 224 256 384 512 | Wrapper v.1 |
| Echo**^ | 224 256 |
Wrapper v.1 |
| Echo**^ | 384 512 | Wrapper v.1 |
| Fugue**** | 224 256 | Wrapper v.1 |
| Fugue**** | 384 | Wrapper v.1 |
| Fugue**** | 512 | Wrapper v.1 |
| Groestl** | 224 256 | Wrapper v.1 |
| Groestl** | 384 512 | Wrapper v.1 |
| Hamsi** | 224 256 | Wrapper v.1 |
| Hamsi** | 384 512 | Wrapper v.1 |
| JH* | 224 256 384 512 | Wrapper v.1 |
| Keccak*** | 224 256 384 512 | Wrapper v.1 |
| Luffa** | 224 256 | Wrapper v.1 |
| Luffa** | 384 | Wrapper v.1 |
| Luffa** | 512 | Wrapper v.1 |
| Shabal* | 224 256 384 512 | Wrapper v.1 |
| SHAvite-3**^ | 224 256 | Wrapper v.1 |
| SHAvite-3**^ | 384 512 | Wrapper v.1 |
| SIMD**^^^ | 224 256 | Wrapper v.1 |
| SIMD**^^^ | 384 512 | Wrapper v.1 |
| Skein 512*^^ | 224 256 384 512 | Wrapper v.1 |
Table Descripter
- * area/throughput equal for all message digests, different IV & truncation
- ** area/throughput equal for 224/256 and 384/512, different IV & truncation
- *** throughput varies for each message digest, area & critical path the same
- **** area/throughput equal for 224/256, different IV & truncation, different for 384 & 512
- ^ HAIFA construction so MES = (block size + CTW)
- ^^ also requires MES = (block size + CTW)
- ^^^ 64-bit counter implemented, but it can be any size up to MES
Message Size
The following table presents the different input message and state sizes for the SHA-3 hash functions and their digest variants. It can be used with the example testbench given below to choose the correct values required for hash function testing.
| DIGEST | 224 | 256 | 384 | 512 | ||||||||
| CTW | MES | SAL | CTW | MES | SAL | CTW | MES | SAL | CTW | MES | SAL | |
| SHA-2** | 64 | 512 | 0 | 64 | 512 | 0 | 128 | 1024 | 0 | 128 | 1024 | 0 |
| Blake**^ | 64 | 576 | 128 | 64 | 576 | 128 | 128 | 1152 | 256 | 128 | 1152 | 256 |
| BMW** | 64 | 512 | 0 | 64 | 512 | 0 | 64 | 1024 | 0 | 64 | 1024 | 0 |
| Cubehash* | 5 | 256 | 0 | 5 | 256 | 0 | 5 | 256 | 0 | 5 | 256 | 0 |
| Echo**^ | 64 | 1600 | 128 | 64 | 1600 | 128 | 64 | 1088 | 128 | 64 | 1088 | 128 |
| Fugue**** | 64 | 32 | 0 | 64 | 32 | 0 | 64 | 32 | 0 | 64 | 32 | 0 |
| Groestl** | 64 | 512 | 0 | 64 | 512 | 0 | 64 | 1024 | 0 | 64 | 1024 | 0 |
| Hamsi** | 64 | 32 | 0 | 64 | 32 | 0 | 64 | 64 | 0 | 64 | 64 | 0 |
| JH* | 128 | 512 | 0 | 128 | 512 | 0 | 128 | 512 | 0 | 128 | 512 | 0 |
| Keccak*** | 0 | 1152 | 0 | 0 | 1088 | 0 | 0 | 832 | 0 | 0 | 576 | 0 |
| Luffa** | 5 | 256 | 0 | 5 | 256 | 0 | 5 | 256 | 0 | 5 | 256 | 0 |
| Shabal* | 5 | 512 | 0 | 5 | 512 | 0 | 5 | 512 | 0 | 5 | 512 | 0 |
| SHAvite-3**^ | 64 | 576 | 256 | 64 | 576 | 256 | 128 | 1152 | 512 | 128 | 1152 | 512 |
| SIMD**^^^ | 64 | 512 | 0 | 64 | 512 | 0 | 64 | 1024 | 0 | 64 | 1024 | 0 |
| Skein*^^ | 96 | 608 | 0 | 96 | 608 | 0 | 96 | 608 | 0 | 96 | 608 | 0 |
Padding Schemes
The following table presents the different padding schemes for the SHA-3 hash functions.
Note: All inputs (inclusive of padding) are taken left to right as in the NIST specifications. Any endianess is dealt with internally to the hash function.
All IVs are also stored internally in the hash function.
| Padding | |
| sha224/256 | 1, zeros until congruent (448 mod 512), 64-bit message length |
| sha384/512 | 1, zeros until congruent (896 mod 1024), 128-bit message length |
| blake224 | 1, zeros, until congruent (448 mod 512), 64-bit message length |
| blake256 | 1, zeros, until congruent (447 mod 512), 1, 64-bit message length |
| blake384 | 1, zeros, until congruent (895 mod 1024), 128-bit message length |
| blake512 | 1, zeros, until congruent (894 mod 1024), 1, 128-bit message length |
| bmw224/256 | 1, zeros until congruent (448 mod 512), 64-bit message length |
| bmw384/512 | 1, zeros until congruent (960 mod 1024), 64-bit message length |
| cubehash | 1, zeros until a multiple of 256 (256 = 8 * b, b=32) |
| echo224/256 | 1, zeros until congruent (1392 mod 1536), 16-bit message digest,128-bit message length |
| echo384/512 | 1, zeros until congruent (880 mod 1024), 16-bit message digest, 128-bit message length |
| fugue | zeros until a multiple of 32, 64-bit message length |
| groestl224/256 | 1, zeros until congruent (448 mod 512), 64-bit block counter |
| groestl384/512 | 1, zeros until congruent (960 mod 1024), 64-bit block counter |
| hamsi224/256 | 1, zeros until a multiple of 32, 64-bit message length |
| hamsi384/512 | 1, zeros until a multiple of 64, 64-bit message length |
| jh | 1, zeros until congruent (384 mod 512), 128-bit message length, min 512-bits added |
| keccak224 | 1, zeros until a multiplie of 8, append 8-bit representation of 28, append 8-bit representation of 1152/8, 1, zeros until a multiple of 1152 |
| keccak256 | 1, zeros until a multiplie of 8, append 8-bit representation of 32, append 8-bit representation of 1088/8, 1, zeros until a multiple of 1088 |
| keccak384 | 1, zeros until a multiplie of 8, append 8-bit representation of 48, append 8-bit representation of 832/8, 1, zeros until a multiple of 832 |
| keccak512 | 1, zeros until a multiplie of 8, append 8-bit representation of 64, append 8-bit representation of 576/8, 1, zeros until a multiple of 576 |
| luffa | 1, zeros until a multiple of 256 |
| shabal | 1, zeros until a multiple of 512 |
| shavite3-224/256 | 1, zeros until congruent (432 mod 512), 64-bit message length, 16-bit digest length |
| shavite3-384/512 | 1, zeros until congruent (880 mod 1024), 128-bit message length, 16-bit digest length |
| simd224/256 | zeros until a multiple of 512, extra block with message length |
| simd384/512 | zeros until a multiple of 1024, extra block with message length |
| skein | if a mutliple of 8, zeros until a mutliple of 512, else 1, zeros until a multiple of 512 |
Publications
FPGA Implementations of the Round Two SHA-3 Candidates
Brian Baldwin,Andrew Byrne, Liang Lu, Mark Hamilton, Neil Hanley, Maire O'Neill and William P. Marnane
20th International Conference on Field Programmable Logic and Applications -FPL 2010, August 31 - September 2 2010
FPGA Implementations of the Round Two SHA-3 Candidates
Brian Baldwin,Andrew Byrne, Liang Lu, Mark Hamilton, Neil Hanley, Maire O'Neill and William P. Marnane
The Second SHA-3 Candidate Conference. August 23-24, 2010
http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/Program_SHA3_Aug2010.pdf
A Hardware Wrapper for the SHA-3 Hash Algorithms
Brian Baldwin,Andrew Byrne, Liang Lu, Mark Hamilton, Neil Hanley, Maire O'Neill and William P. Marnane
Cryptology ePrint Archive, Report 2010/124, 2010
http://eprint.iacr.org/2010/124
(To appear at The 21st Irish Signals and Systems Conference, ISSC 2010, 23rd - 24th June 2010)
An FPGA Technologies Area Examination of the SHA-3 Hash Candidate Implementations
Brian Baldwin, William P. Marnane
Cryptology ePrint Archive, Report 2009/603, 2009
http://eprint.iacr.org/2009/603
FPGA Implementations of SHA-3 Candidates:CubeHash, Groestl, Lane, Shabal and Spectral Hash
Brian Baldwin, Andrew Byrne, Mark Hamilton, Neil Hanley,Robert P. McEvoy, Weibo Pan and William P. Marnane
Digital Systems Design, Euromicro Symposium on -DSD 2009, pages 783-790. 2009
http://www.computer.org/portal/web/csdl/doi/10.1109/DSD.2009.162
Alternate (longer) version:
http://eprint.iacr.org/2009/342
Acknowledgements
This material is based upon works supported by the Science Foundation Ireland under Grant No. 06/MI/006.
The support of the Informatics Commercialisation initiative of Enterprise Ireland is gratefully acknowledged.



