FPGA Implementation of CubeHash, Grøstel, JH, and SHAvite-3 Hash Functions

Transcription

1 FPGA Implmnttion o CuHs, Grøstl, JH, n SHAvit-3 Hs Funtions A. H. Nmin, G. Li, J. Wu, J. Xu, Y. Hun, O. Nm, R. Elz n M. A. Hsn Dprtmnt o Eltril n Computr Eninrin, Univrsity o Wtrloo Wtrloo, Ontrio N2L 3G Cn Emil: {nmin,27li,xwu,j27xu,y43un,onm,rouvn}@nmil.uwtrloo., sn@uwtrloo. Astrt In tis work, FPGA implmnttion o t omprssion untion or our o t son roun nits o t SHA-3 omptition r prsnt. All implmnttions wr prorm usin t sm tnoloy n optimiztion tniqus to prsnt ir omprison twn t nits. For our implmnttions w v us t Strtix III FPGA mily rom Altr. Aiv rsults r ompr wit similr implmnttions to provi ir omprison o nits prormn in rwr. Inx trms : Hs untions, SHA-3, CuHs, Grøstl, JH, SHAvit-3, rwr implmnttion, omprssion untion, FPGA. I. INTRODUCTION A ryptorpi s untion (or loritm) is untion tt tks vril-siz mss n rturns ixsiz output, wi is ll t mss-ist []. Hs untions r us in vrity o pplitions inluin, mss utntition, iitl sintur, inrprintin, n t inxin []. Sur Hs Aloritm- (SHA-) is s untion sin y t Ntionl Surity Any (NSA) n pulis s U.S. Frl Inormtion Prossin Stnr [2]. It is y r t most wily us s loritm or surity pplitions n protools. Rntly mtmtil wknss s n oun in t rittur o SHA- sustin mor sur s untion woul sirl or utur us [3]. Ntionl Institut o Stnrs n Tnoloy (NIST) is urrntly onutin n opn, puli omptition to intiy suitl nits or t nw s loritm (SHA-3) [4]. NIT s lso rommn rpi trnsition rom SHA- to SHA-2 ( stronr vrsion o SHA-) till omplt vlopmnt o SHA-3. At prsnt, ourtn nits xist in t son roun o t SHA-3 omptition. T sotwr sour o o ll t nits is vill onlin wi n sily ompil or irnt pltorms. A omprnsiv omprison o sotwr implmnttion n prormn o t nits n oun in [6]. Rrttly, only w o t nits ontin rwr implmnttion rsults o tir proposl. Also, ir omprison o t implmnttion rsults oul not on sily sin irnt pltorm n tnolois v n us or t implmnttions. T min ol o tis work is to implmnt numr o SHA-3 nits in rwr usin t sm tnoloy n sin tniqus n rt ir omprison o tir rwr prormn. An rlir vrsion o tis work rsult in rwr implmnttion o iv o t nits nmly, Blu Minit Wis, Lu, Skin, Sl, n Blk [3]. In tis work w prsnt rwr implmnttion rsults o our otr nits nmly, Cus, Grøstl, JH, n SHAvit-3 lon wit tt o SHA-2. For our rwr implmnttions w v us t Sttix III FPGA mily rom Altr. A omplt omprison o rwr prormn o ll nin nits is prsnt in t omprison stion. T rst o tis work is strutur s ollows. In Stion II, nrl isussion out s untions n our sin ppro is prsnt. A summry o CuHs, Gostl, JH, SHAvit-3 n SHA-2 s loritms n tir rwr implmnttion is ivn in Stion III-VII. Stion VIII isusss summry o rwr implmnttion rsults n omprison to otr nits rwr implmnttions. Som onluin rmrks r prsnt in Stion IX.

2 II. A BRIEF REVIEW OF HASH ALGORITHMS AND GENERAL DESIGN APPROACH To pross vril-siz input mss, most s untions r s on two st pross. T irst st ll t Prprossin st rivs t vril-siz input, ps it to t propr siz n tn rks it own into ix-siz mss loks. Pin t mss to t propr siz vris twn irnt loritms n mit inlu in t mss lnt, ountr vlu, or vn onstnt vlu to t input. T mss loks tn rriv onsutivly t t son st rrr to s t Hs omputtion st. Hr, t mss loks r pross itrtivly y untion ll t omprssion untion trou numr o rouns. T inputs o t omprssion untion r t mss lok n t output o t omprssion untion rom t prvious roun. Usin tis -k strutur, t inl ix-siz output woul ist s wi is untion o ll prvious inputs. NIST s mn tt ll nits to provi irnt mss ists o 224,, 384 n its sizs. Howvr, in tis work w just ous on t -it vrsions o t loritms. Our implmnttions v n rri out usin t VHDL to sri t loritms in rwr. T VHDL ils wr tn ompil wit t Qurtus II sotwr pk rom ALtr unr UNIX nvironmnt. For our implmnttions w trt t Strtix III FPGA mily. All sins ontin sril-in prlll-out (SIPO) n prlll-in sril-out (PISO) mouls to trnsr t t in/out o t FPGA. Usin ts mouls, w woul tk into ount t limit numr o I/O pins n t I/O pins sp limits o t FPGA. Mor tils o ts mouls r ivn in t omprison stion. III. CUBEHASH HASH FUNCTION CuHs s n propos y Dn Brnstin in [8]. It mks us o our irnt oprtions in its omprssion untion; 32-it ition, rott, swp n XOR oprtions. Two tunl prmtrs (r, ) r us to st t surity/prormn tr-os o t systm. For CuHs-, r n r qul to n 32, rsptivly. T omprssion untion strts y initilizin 24 it intrnl stt rom t input mss n t prvious s vlu. Tn tr xists on roun o trnsormtion to t stt. T roun is ompos o two ition, two rott, our swp, n two XOR oprtions. Dtils out ts oprtions n tir orr o pplitions n oun in [8]. Atr t roun oprtion, intr is XOR into t lst stt wor n t inliztion st ins wi is m o tn intil roun oprtions similr to t initil roun. T rsult is 24 it stt, o wi t lst siniint -its rt t output s. T nrl lok irm us or t rwr implmnttion o CuHs- is sown in Fi.. M i Comprssion On XOR '' Finliztion Tn 24 Trunt... Fi.. Hrwr ritturs us or t omprssion untion o CuHs- FPGA implmnttion rsult o Cus- is summriz in t irst row o Tl I. In tis tl, C.F. Clk Frquny rprsnts t mximum rquny tt t omprssion untion oul lok t. C.F. Clk Cyls rprsnts t rquir numr o lok yls or t omprssion untion to rt it mss ist. Comintionl ALUTs rprsnts t numr o LUTs rquir or implmnttion o t omintionl iruits. Dit loi Ristrs sows t numr o ALUTs us s ristrs y In r n Out r ristrs. Also in t tl, I/O Clk yls n rquny r t rsult o usin PISO n SIPO mouls wi r xplin in t omprison stion.

3 IV. GRØSTEL HASH FUNCTION T Grøstl loritm is u to L. R. Knusn t l. [9]. T omprssion untion is s on two unrlyin prmuttion mouls P n Q runnin in prlll. Dsin o t prmuttion mouls ws inspir y t Rijnl lok ipr, onsistin o numr o rouns (tn rouns or t -it vrsion). E roun ontins our sprt trnsormtions: Aonstnt, SuByt, SitByt, n MixByt. T AConstnt s roun-pnnt onstnt to t stt vril. T SuByts sustituts yt in t stt y notr yt usin S-ox. T SitByt ylilly sits t yts insi t stt vril. In MixBy yt o t stt is sn s n lmnt in GF(2 8 ) n is in multipli y notr onstnt lmnt insi t il. SuByt n MixByt trnsormtion r in t sm wy s in Rijnl loritm. T inl s is rt y xlusiv-orin o t prvious s wit t outputs o t P n Q mouls. T nrl lok irm us or t rwr implmnttion o Grøstl- is sown in Fi. 2. FPGA implmnttion rsults o Grøstl- r summriz in t son row o Tl I. M i -.. AConstnt_Q SuByt SitByt MixByt AConstnt_P SuByt SitByt MixByt Q P AConstnt_Q SuByt SitByt MixByt AConstnt_P SuByt SitByt MixByt Fi. 2. Hrwr ritturs us or t omprssion untion o Grøstl- V. JH HASH FUNCTION Honjun Wu s propos t JH loritm []. T omprssion pross strts y xlusiv-orin t input mss to t irst prt o t prvious s. Atr rroupin t its, tr xist 35 rouns o t roun untion. T roun untion uss t nrliz sin mtooloy n is m o tr sprt lyrs: S-Box, Linr trnsormtion (L), n Prmuttion (P). Tr xist two irnt S-oxs insi t S-ox lyr. T prmtr roun onstnt trmins wi o t S-oxs is us or roun. T linr trnsormtion lyr uss multiplition ovr t init il GF(2 4 ) usin t irruil polynomil x 4 x. T prmuttion lyr is similr to t row rottion in t. T nxt stps in omprssion r on lyr o S-Box n -roupin moul. At t n, t ms prt o t stt vril is xlusiv-or wit t input to rt t output s. T nrl lok irm us or t rwr implmnttion o JH- is sown in Fi. 3. FPGA implmnttion rsults o JH- r summriz in t tir row o Tl I. VI. SHAVITE-3 HASH FUNCTION T SHAvit-3 loritm s n propos y Eli Bim n Orr Dunklmn []. It is s on t Hs Itrtiv Frm Work (HAIFA) onstrution n it uss uilin loks wit lok siz o 28 its [],[2]. E roun uss our oprtions: 8-it S-ox, yli sit, multiplition ovr init il GF(2 8 ), n XOR. T omprssion untion is m o lok ipr (E) in t Dvis-Myr mo. E is twlv roun Fistl lok ipr wr roun is ompos o tr ull rouns o. E roun rquirs ky wi is otin rom mss xpnsion o t mss loks y t ky nrtor moul. T ky nrtor moul uss 6 rouns o n 28 XOR ts to rt 36 ky o siz 28-its (, usin t mss lok, n t ountr s t inputs. T nrl lok irm us or t rwr implmnttion o SHAvit-3- is sown in Fi. 4. FPGA implmnttion rsult o t JH- is summriz in t ourt row o Tl I.

4 M i i- H ls i- H ms. S-Box S S S S Groupin Trnsormtion L Prmution P Trnsormtion L E 8 S-Box Prmution P S-Box S S D-roupin i H ms i H ls Fi. 3. Hrwr ritturs us or t omprssion untion o JH- - M i- C i- 64 Ky Gnrtor k Fi. 4. Hrwr ritturs us or t omprssion untion o SHAvit-3- VII. SHA-2 HASH FUNCTION Consirin t isovry o t wknss in SHA-, NIST s rqust t rpi trnsition to t stronr SHA-2 mily o s untions. T SHA-2 s untions r struturlly similr to SHA- n potntilly rry t sm wknss ut sin ty r mu stronr, prtil ttks r unlikly in nr utur. T si t lok us in SHA-2 (SHA-) is wor wi is 32 its lon. SHA- mks us o itwis loil wor XOR n AND oprtions lon wit wor ition (moulo 232), rott rit n sit rit oprtions. T omprssion untion is m o 64 onsutiv roun untions. E roun untion riv tr inputs: 28-it stt vril (in 32-it roups s input wors -), K t wi is 32-it onstnts n w t wi is vril rt trou t mss sul pross rom input mss loks. t output o t roun untion is t nxt stt vlu (output wors -). T rwr rittur us or implmnttion o SHA- is sown in Fi. 5. In tis iur loks,, C, n Mj r loil untions m o rott, sit n loil oprtions [5]. FPGA implmnttion rsult o t SHA- is summriz in t lst row o Tl I. - K t W t C Mj 64 K t W t C Mj { Fi. 5. Hrwr ritturs us or t omprssion untion o SHA-

5 Hs C.F. Clk C.F. Clk I/O Clk I/O Clk Totl Comintionl Dit Loi Ar Dly I/O Frquny Cyls Frquny Cyls Dly ALUTs Ristrs Cost Funtion Pins CuHs 2.88 MHz 4 MHz 4 47 ns Grøstl 9.59 MHz 4 MHz 32 3 ns JH 5.79 MHz 4 MHz ns SHAvit MHz 4 MHz ns BMW[3] 9.55 MHz 4 MHz ns Lu[3] 47.4 MHz 4 MHz 6 6 ns Skin-[3] 6.42 MHz 72 4 MHz 8 49 ns Sl[3] MHz 48 4 MHz ns Blk[3] MHz 4 MHz ns SHA MHz 4 MHz ns TABLE I FPGA IMPLEMENTATION SUMMARY OF THE DIFFERENT COMPRESSION FUNCTIONS VIII. FPGA IMPLEMENTATION COMPARISON W v us Strtix III FPGA mily rom Altr or our Implmnttions. Qurtus II sotwr pk rom Altr unr UNIX nvironmnt ws us to implmnt t sins. All implmnttions ontin SIPO n PISO mouls to trnsr t t into or out o t FPGA. Usin ts mouls, t limit numr o I/O pins n t I/O sp limits o t FPGA r tkn into ount. T SIPO moul rivs t input t s 32-it wors n tn stors tm or t propr output slt y t input slt lins. Usin tis mto input its n lo into t SIPO moul 32-its t tim. Tn t t n trnsr to t omprssion untion in prlll. T PISO moul uss similr i; it los t t rom t omprssion untion in prlll n tn trnsrs tm to t output 32-its t tim. FPGA implmnttion rsults o t our nits nmly CuHs, Grøstl, JH, n SHAvit-3 r list in t irst our rows o t Tl I. For t purpos o omprison, implmnttion rsults or our prvious work [3] on iv otr nits nmly Blu Minit Wis, Lu, Skin, Sl, n Blk usin t sm FPGA tnoloy r list in t nxt iv rows o t tl [3]. T lst row o t tl, rprsnts t implmnttion rsults o SHA-2 rom Stion VII. In Tl I, t I/O Clk Frquny rprsnts t mximum sp t wi t SIPO n PISO mouls oul lok t. T I/O sp is limit y t FPGA itsl wi in our s is 2.5ns [4]. Also in t sm tl I/O Clk yls, rprsnts t rquir numr o lok yls y SIPO n PISO mouls to lo t t into/out o t FPGA. T tils o SIPO n PISO mouls r sown in Fi. 6. Fi. 6. SIPO n PISO mouls us in FPGA implmnttions Rrin t omprssion untion sp, s n sn rom t tl, Lu prsnts t stst rittur ollow y CuHs, Grøstl n JH. Tkin into ount t I/O ly, t stst nit is still Lu ollow y Grøstl, CuHs, n Blu Minit Wis. Rrin r us, Skin, Sl, n Blk prsnt t smllst r utiliztion. Comprin t nits to SHA-, ll onsir nits prorm str tn SHA- (wit or witout tkin into ount t I/O ly) xpt Skin wi is lmost prsntin t sm prormn. Rrin t r us Grøstl, JH, n SHAvit-3 rquir mor r ompr to SHA-. Not tt usully minimizin r n ly r ot importnt ols in ny rwr implmnttion. To tis n, w v in r tims ly s msur o prormn in our omprison tl. W n s tt Lu outprorms ll otr sins ollowin y Skin, CuHs, n Sl s it is sown in t Ar Dly Cost Funtion olumn in Tl I.

6 IX. CONCLUSIONS W v prsnt FPGA implmnttion o t omprssion untion or our nits o t SHA-3 omptition. Implmnttions v n rri out usin t Strtix III FPGA mily rom Altr. Rsults v lso n ompr wit t implmnttion rsults o som otr nits usin t sm pltorm. X. ACKNOWLEDGMENTS T utors woul lik to tnk CMC or proviin t CAD tools n support. Tis work ws support in prt y NSERC strti projt rnt wr to Dr. Hsn. REFERENCES [] Mnzs, A. J., Vn Oorsot, P. C., Vnston, S. A.: Hnook o Appli Cryptorpy. T CRC Prss sris on isrt mtmtis n its pplitions, pp , 997. [2] Ntionl Institut o Stnrs n Tnoloy: Sur Hs Stnr, Frl Inormtion Prossin Stnrs (FIPS) Pulition 8-3, Otor, 28. [3] Wn, X., Yo, A., Yo, F.: Nw Collision sr or SHA-. Crypto 25 rump ssson. [4] Ntionl Institut o Stnr n Tnoloy (NIST): Cryptorpi Hs Aloritm Comptition Wsit: ttp://sr.nist.ov/roups/st/s/s-3/. [5] T SHA-3 Zoo - T ECRYPT s untion wsit. Wsit: ttp://s.iik.turz.t/wiki/t SHA-3 Zoo. [6] Europn Ntwork o Exlln or Cryptoloy II (ECRYPT II): ECRYPT Bnmrkin o All Sumitt Hss (EBASH): ttp://n.r.yp.to/s.tml. [7] Flismnn, E., Forlr, C., Gorski, M.: Clssiition o t SHA-3 Cnits. Intrntionl Assoition or Cryptoloi Rsr (IACR) Print riv [8] Brnstin, D. J., CuHs spiition, Wsit: ttp://us.r.yp.to/ [9] Gurvrm, p.,knusn, L. R., Mtusiwiz, K., Mnl, F., Rrr, C., Slr, M., Tomsn, S. S., Grøstl - SHA-3 nit, Wsit: ttp:// [] Wu, H., SHA-3 proposl JH, Wsit: ttp://is.i2r.-str.u.s/st/onjun/j/. [] Bim, E., Dunklmn, O., T SHAvit-3 Hs Funtion, Wsit: ttp:// orr/shavit-3/. [2] Bim, E., n Dunklmn, O.: A Frmwork or Itrtiv Hs Funtions HAIFA, NIST 2n s untion worksop, Snt Brr, Auust 26. [3] Nmin, A. H., Hsn, M. A.: Implmnttion o t Comprssion Funtion or Slt SHA-3 Cnits on FPGA, 7t Roniurl Aritturs Worksop, pt. [4] ALTERA: Strtix III Dvi Hnook, Volum, My 29. [5] Frl Inormtion Prossin Stnrs Pulition (FIPS PUB) 8-2: Sur Hs Sintur Stnr (SHS), pp. -79, Au. 22.