Circuit and method for implementing hash algorithm

Abstract

The present disclosure relates to a circuit and method for implementing a hash algorithm. A circuit for executing a hash algorithm is provided, comprising: an input module for receiving data; and an operation module for calculating a hash value based on the received data, wherein the operation module comprises: a plurality of registers for storing data of the operation module; a plurality of combinational logic operation units, each of the plurality of combinational logic operation units for performing combinational logic operations on data from one or more registers of the plurality of registers, wherein the plurality of registers comprises a first group of registers for receiving combinational logic operation data output from one or more combinational logic operation units of the plurality of combinational logic operation units and a second group of registers for receiving shift data output from one or more registers of the plurality of registers, wherein the first group of registers is composed of latches, and the second group of registers is composed of flip-flops.

Description

Technical Field

[0001] The present disclosure generally relates to circuits and methods for implementing a hash algorithm (also referred to as a hash algorithm), and more particularly, to circuits and methods for hybrid latch optimization of computing device chips. Background Art

[0002] From a cryptographic perspective, many cryptographic algorithms are based on proof of work (POW) based on the SHA-256 hash algorithm, and their transaction integrity depends on the collision and pre-image resistance of SHA-256. A hash algorithm is an algorithm that takes variable-length data as input and produces a fixed-length hash value as output. Its essence is the refinement of information. Since 1993, the U.S. National Institute of Standards and Technology has designed and released multiple versions of the secure hash algorithm SHA (Secure Hash Algorithm), and SHA-256 is one of the secure hash algorithms with a hash length of 256 bits.

[0003] The core of using computing devices for encryption is to get rewards based on the computing power of the computing device to calculate SHA-256. For computing devices, chip size, chip running speed and chip power consumption are three crucial factors that determine the performance of computing devices. Among them, chip size determines chip cost, chip running speed determines computing device running speed, that is, computing power, and chip power consumption determines power consumption. Computing devices are particularly sensitive to and value chip cost (such as area) and power consumption ratio (power per T computing power). The technical strength of computing equipment manufacturers is reflected in the parameter of power consumption ratio. In practical applications, the most important performance indicator for measuring computing equipment is the power consumed per unit computing power, that is, the power consumption to computing power ratio.

[0004] Therefore, there is a need for circuits and methods for implementing hash algorithms with a lower power consumption and computing power ratio. More specifically, there is a need for circuits and methods for implementing computing device chips with a lower power consumption and computing power ratio. Summary of the invention

[0005] According to a first aspect of the present disclosure, a circuit for executing a hash algorithm is provided, comprising: an input module for receiving data; and an operation module for calculating a hash value based on the received data, the operation module comprising: a plurality of registers for storing data of the operation module, a plurality of combinational logic operation units, each of the plurality of combinational logic operation units for performing a combinational logic operation on data from one or more registers of the plurality of registers, wherein the plurality of registers comprises a first group of registers for receiving combinational logic operation data output from one or more combinational logic operation units of the plurality of combinational logic operation units and a second group of registers for receiving shift data output from one or more registers of the plurality of registers, wherein the first group of registers comprises latches, and the second group of registers comprises flip-flops.

[0006] According to a second aspect of the present disclosure, a circuit for executing a hash algorithm is provided, comprising: an input module for receiving data; and an operation module for calculating a hash value based on the received data, the operation module comprising a plurality of operation stages arranged in a pipeline structure, the plurality of operation stages comprising a 0th operation stage, a 1st operation stage, and up to a Pth operation stage, P being a fixed positive integer greater than 1 and less than the number of operation stages in the pipeline structure, wherein each operation stage from the 1st operation stage to the Pth operation stage comprises: a plurality of registers for storing data of a current operation stage, a plurality of combinational logic operation units, each combinational logic operation unit of the plurality of combinational logic operation units being used to perform combinational logic operations on data from one or more registers of a plurality of registers in the current operation stage, wherein the plurality of registers comprises a first group of registers for receiving combinational logic operation data output from one or more combinational logic operation units of a plurality of combinational logic operation units in a previous operation stage, and a second group of registers for receiving shift data output from one or more registers of a plurality of registers in a previous operation stage, wherein the first group of registers is composed of latches, and the second group of registers is composed of flip-flops.

[0007] According to a third aspect of the present disclosure, there is provided an apparatus for executing an encryption algorithm of a computing device, comprising the circuit for executing a hash algorithm as described above.

[0008] According to a fourth aspect of the present disclosure, a method for executing a hash algorithm using the circuit described above is provided.

[0009] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0011] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0012] Figure 1 The operation process of the hash algorithm is schematically shown;

[0013] Figure 2 The overall process of SHA-256 processing data and outputting a data summary is schematically shown;

[0014] Figure 3 The message compression function and message expansion function of SHA-256 are schematically shown;

[0015] Figure 4 A schematic diagram schematically shows a specific example of performing round operations in a circuit for implementing SHA-256;

[0016] Figure 5 A schematic diagram schematically shows a pipeline structure for performing round operations in a circuit for implementing SHA-256; and

[0017] Figure 6 A circuit for executing a hash algorithm according to an embodiment of the present disclosure is schematically shown.

[0018] Note that in the embodiments described below, the same reference numerals are sometimes used in common between different drawings to represent the same parts or parts with the same functions, and their repeated descriptions are omitted. In this specification, similar reference numerals and letters are used to represent similar items, so once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0019] For ease of understanding, the positions, sizes, and ranges of various structures shown in the drawings and the like sometimes do not represent actual positions, sizes, and ranges, etc. Therefore, the disclosed invention is not limited to the positions, sizes, and ranges, etc. disclosed in the drawings and the like. In addition, the drawings are not necessarily drawn to scale, and some features may be exaggerated to show details of specific components. DETAILED DESCRIPTION

[0020] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless otherwise specifically stated.

[0021] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure and its application or use. That is, the circuits and methods for implementing the hash algorithm herein are shown in an exemplary manner to illustrate different embodiments of the circuits or methods in the present disclosure, and are not intended to be limiting. Those skilled in the art will appreciate that they merely illustrate exemplary ways that can be used to implement the present invention, rather than an exhaustive way.

[0022] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.

[0023] As mentioned above, hashing is actually the distillation of information, and its reversibility will vary depending on the strength of its encryption. The stronger the encryption, the stronger the irreversibility. In other words, any change in the input information will lead to a huge change in the hash result, making it impossible to obtain information through the reverse mechanism. This is the avalanche effect. Not only that, it is also impossible for us to find two pieces of information with the same hash result.

[0024] The hash algorithm takes variable-length data as input and generates a fixed-length hash value as output. The hash algorithm has the following characteristics: the hash algorithm is used for each data in a large input set including multiple data, and the corresponding multiple hash values ​​generated are evenly distributed and look random. In general, the primary goal of the hash algorithm is to ensure data integrity, so that any change in one or more bits of the input data will most likely change the resulting hash value.

[0025] Figure 1 The operation process of the hash algorithm is schematically shown. First, input data of any length is padded so that the length of the padded data is an integer multiple of a fixed length (e.g., 512 bits), that is, the padded data can be divided into multiple data blocks with the above fixed length. The content of the padding bits includes the bit length information of the original data. Then the hash algorithm will perform operations on each fixed-length data block separately, such as multiple rounds of operations including data expansion and / or compression. When all data blocks are used, the final fixed-length hash value is obtained.

[0026] For hash algorithms that include multiple rounds of operations (such as SHA-256), multiple rounds of operations can be performed using a single operation stage, or a circuit with a pipeline structure having multiple operation stages can be used to achieve high-speed operations, where each operation stage can use registers to store large amounts of data that change in real time during the operation.

[0027] The inventor of the present application realizes that the structure and operation mode of the existing circuit for implementing the hash algorithm still need to be optimized. Specifically, in the existing structure, for example, in the pipeline structure, the register in each operation level is generally a D flip-flop to ensure that the updated data can be stored in the register. Among these data updates, data shifting between registers of adjacent operation levels is included, but the paths for data transmission from adjacent operation levels are not the same. For example, data D stored in some registers of the first operation level can be directly shifted to the register of the second operation level, and data D stored in some registers of the first operation level can also be input into the register of the second operation level after sequential logic and combinational logic operations. The inventor of the present application thinks that, compared with the case where data D does not participate in any operation in the first operation level but is not input into the second operation level until it is shifted to the second operation level, in the case where data D participates in logic operation in the first operation level and is not input into the second operation level, the critical path and propagation delay experienced by data D from the first operation level to the second operation level are different.

[0028] Therefore, assuming that such characteristics of the structure of a circuit for implementing a hash algorithm can be utilized, the inventors of the present application propose an improved circuit and method for implementing a hash algorithm.

[0029] In order to present the inventive concept of the present disclosure more clearly and intuitively, SHA-256 will be briefly introduced below and used as a representative example of a hash algorithm to describe a circuit and method for implementing a hash algorithm according to an embodiment of the present disclosure. Those skilled in the art will understand that the circuit and method for implementing a hash algorithm according to an embodiment of the present disclosure are applicable to any hash algorithm, and are not limited to implementing SHA-256.

[0030] The maximum length of SHA-256 input is less than 2 64 The output is a 256-bit data summary, i.e., a hash value. The input data is processed in 512-bit blocks. Figure 2 The overall process of SHA-256 processing data and outputting a data summary is schematically shown. This process includes the following detailed description.

[0031] The SHA-256 hashing algorithm operation can be conveniently divided into three distinct steps:

[0032] 1. Preprocessing: Perform operations to populate and parse the input message.

[0033] 2. Message extension function: This function can generate 64 32-bit words from 16 32-bit word input message blocks.

[0034] 3. Message compression function: A function that performs the actual hashing operation of the message dependency words from the message expansion function in each round.

[0035] 1. SHA-256 preprocessing

[0036] SHA-256 preprocessing is an initial step that needs to be performed before message expansion and compression functions can be applied. The preprocessing phase performs the following three tasks in sequence:

[0037] 1.1 Pad the message to make it a multiple of 512 bits,

[0038] 1.2 parse this message into 512-bit blocks, and

[0039] 1.3 Set the initial hash value.

[0040] 1.1: Padding the message. To pad the message being hashed, you must first ensure that the message being hashed is a multiple of the SHA-256 block size, which is a multiple of 512 bits. Figure 2 As shown in , now, if we consider that the length of the message is L bits, we need to append a "1" to it, followed by k 0 bits. Here, k is the minimum value of the non-negative solution that satisfies the following equation:

[0041] 1+L+k=448mod 512

[0042] Even if the original data already meets the above length requirements, padding is still required, so the number of padding bits is between 1 and 512. The padding consists of a 1 followed by a 0.

[0043] A 64-bit unsigned integer is appended to the padded data, and the 64-bit unsigned integer is equal to the binary length L of the data before the padded data.

[0044] For example, an example of a (8-bit "ASCII") message "abc" is shown in Table 1 below.

[0045] Length L = 8 * 3 = 24

[0046] 1+L+k=1+24+k=448

[0047] k = 448 - 1 - 24 = 423 (zero bits)

[0048] Table 1

[0049] 01100001 01100010 01100011 1 00…0 00…011000 a, 8 bits b, 8 bits c, 8 bits "1" bit padding Fill with 423 "0" L, 64-bit

[0050] 1.2: Parse the padded message. By padding the message, an extended data with a length that is an integer multiple of 512 bits is generated. The length of the extended data can be expressed as Q*512 bits, where Q is a positive integer greater than 1. Figure 2 As shown, the extended data is divided into Q data blocks M with a length of 512 bits. 1、M 2 Until M Q .

[0051] 1.3: Set the initial hash value. The initial value H of the hash algorithm 0 , intermediate value H 1 , H 2 Until H Q-1 And the final result H Q The hash buffer is stored in a 256-bit hash buffer. The hash buffer can include eight 32-bit registers A, B, C, D, E, F, G, and H. At the beginning of the operation, the hash buffer is first initialized to the initial value H. 0 , that is, initialize registers A, B, C, D, E, F, G and H to the integers (hexadecimal) shown in the following table respectively.

[0052] Table 2

[0053] A=0X6A09E667 E=0X510E527F B = 0XBB67AE85 D=0X9B05688C C=0X3C6EF372 F=0X1F83D9AB D = 0XA54FF53A H = 0X5BE0CD19

[0054] Next, the data is processed in 512-bit blocks. The core of SHA-256 is to process the data in 512-bit blocks M in turn. 1 、M 2 Until M Q Each data block in the process is subjected to 64 rounds of operations. Figure 2 It is marked as f. Among them:

[0055] H i =H (i-1) +f Mi (H (i-1) ) where i = 1, 2, ..., Q

[0056] f is the round function of SHA-256

[0057] + is verbatim modulo 2 32 add

[0058] H i It is a block M i The hash value of

[0059] In one embodiment, the round operation mainly includes a SHA-256 message extension function and a SHA-256 message compression function. Figure 3 The message compression function and message expansion function of SHA-256 are schematically shown, where Figure 3 The upper part in is the SHA-256 message compression function and the lower part is the SHA-256 message expansion function.

[0060] 2. SHA-256 message extension function

[0061] After the above preprocessing stage is completed, the message expansion block takes the first 512-bit message block and outputs the message dependency word W t For block M i The 32-bit message dependency word output by the message expansion function in each round is marked as W 0 , W 1 , …, W 63 And calculate them as follows:

[0062] For 0 ≤ t ≤ 15: W t Directly taken from data block M i ;

[0063] For 16 ≤ t ≤ 63:

[0064] W t =σ 1 (W t-2 )+W t-7 +σ 0 (W t-15 )+W t-16

[0065] in:

[0066] σ 0 (x) = ROTR 7 (x)⊕ROTR 18 (x)⊕SHR 3 (x)

[0067] σ 1 (x) = ROTR 17 (x)⊕ROTR 19 (x)⊕SHR 10 (x)

[0068] Among them, ROTR n (x) means circularly shifting the 32-bit variable x right by n bits; SHR n (x) means shifting the 32-bit variable x to the left by n bits and filling the right side with 0; ⊕ is the XOR operation; + is modulo 2 32 add.

[0069] from Figure 3 It can be clearly seen that in each round, 15 of the 16 values, namely R15, R14, R13, R12, R11, R10, R9, R8, R7, R6, R5, R4, R3, R2 and R1, are shifted by 1 position to R14, R13, R12, R11, R10, R9, R8, R7, R6, R5, R4, R3, R2, R1 and R0 respectively. R15 depends on R0, R1, R9 and R14, and these values ​​are input to register R15 after the combinational logic operation of adders 30, 37 and 38. Specifically, as Figure 4 As shown in FIG, the values ​​from registers R0, R1, R9 and R14 are input into register R15 after being added by full adders (faa) 7, 8 and half adder cla3. Figure 3 and Figure 4 It can be seen that register R15 receives the combinatorial logic operation data output from the combinatorial logic operation unit (such as full adders (FAA) 7, 8 and half adder CLA3), and registers R14 to R0 receive the shift data output from the previous registers R15 to R1 respectively. It can be seen that the time required for the critical path of the data received by register R15 is different from the time required for the critical path of the data received by register R14 to R0.

[0070] 3. SHA-256 message compression function

[0071] The message compression function performs the actual hashing operation and is the main operation that enforces the one-way nature of SHA-256. In addition to the 32-bit words in the eight registers A, B, C, D, E, F, G, and H mentioned above being used and updated in each round, each round also uses two temporary words T1 and T2 for calculating the variables stored in registers A and E. The first step performed by the message compression function is to initialize the variables in these eight registers.

[0072] from Figure 3 It can be clearly seen that in each round, 6 out of 8 values, namely A, B, C, E, F, G are shifted by 1 position to B, C, D, F, G and H respectively. The variables A and E depend on all the input values ​​and are calculated in each round using the equations explained next. t is the 32-bit data calculated by the message expansion function and fed to the compression function, and K t is a specific 32-bit constant. SHA-256 uses 64 constants (per round), which are usually 32-bit words, obtained by taking the first 32 bits of the fractional part of the cube root of the first 64 prime numbers. After the initialization of the 8 variables, 64 rounds of compression functions will be applied to them, and the intermediate round values ​​of the variables are calculated as follows:

[0073] T 1 =H+Σ 1 (E)+Ch(E,F,G)+K t +W t

[0074] T 2 =Σ 0 (A)+Maj(A,B,C)

[0075] A=T 1 +T 2＝ H+Σ1 (E)+Ch(E,F,G)+K t +W t +Σ 0 (A)+Maj(A,B,C)

[0076] B=A

[0077] C=B

[0078] D=C

[0079] E=D+T 1 =D+H+Σ 1 (E)+Ch(E,F,G)+K t +W t

[0080] F=E

[0081] G=F

[0082] H=G

[0083] in:

[0084] Ch(x,y,z)=(x AND y)⊕((NOT x)AND z)

[0085] Maj(x,y,z)=(x AND y)⊕(x AND z)⊕(y AND z)

[0086] Σ 0 (x) = ROTR 2 (x)⊕ROTR 13 (x)⊕ROTR 22 (x)

[0087] Σ 1 (x) = ROTR 6 (x)⊕ROTR 11 (x)⊕ROTR 25 (x)

[0088] Among them, ROTR n (x) means cyclically shifting the 32-bit variable x right by n bits; W t is a 32-bit word derived from the current 256-bit input data block; K t A 32-bit additional constant; + is modulo 2 32 Addition; AND is a 32-bit bitwise AND operation; NOT is a negation operation; ⊕ is an exclusive OR operation.

[0089] like Figure 3 As shown in FIG. , the values ​​from registers A, B, C, E, F, G, and H are shifted and combined with logical operations (e.g., Σ 1(E), Σ 0 (A), etc.), and are input to register A through the combinatorial logic operation of the combinatorial logic operation unit (for example, adders 31, 39, 32, 33, 34, and 35), and the values ​​from registers D, E, F, G, and H are input to register E through the shift operation and combinatorial logic operation through the combinatorial logic operation unit (for example, adders 31, 39, 32, 33, and 36). Specifically, Figure 4 As shown in FIG. 1 , the values ​​from registers A, B, C, E, F, G, and H are input to register A after shift operations and combinational logic operations, and after addition operations of full adders (faa) 1, 2, 3, 4, 5, and half adder cla1, and the values ​​from registers D, E, F, G, and H are input to register E after shift operations and combinational logic operations, and after addition operations of full adders (faa) 1, 2, 3, and 6, and half adder cla2. It can be seen that the time required for the critical path through which the data received by registers A and E passes is different from the time required for the critical path through which the data received by registers B, C, D, F, G, and H passes.

[0090] The SHA-256 algorithm has the following characteristics: Each bit of the generated hash code is a function of all the input bits. The round operation f multiple complex repetitions make the results sufficiently obfuscated, so that it is unlikely to generate duplicate hash codes when two randomly selected data, even if the two data have similar characteristics.

[0091] Those skilled in the art will appreciate that the above detailed description of SHA-256 is intended to more clearly present the inventive concept of the present application and is not intended to constitute any limitation. SHA-256 mentioned herein includes any known version of SHA-256 and its variants and modifications.

[0092] Figure 3 and Figure 4 It is shown that multiple rounds of repeated operations are performed for the hash algorithm in a single operation stage. In addition, for multiple rounds of repeated operations in the hash algorithm, a pipeline structure can be used to parallelly operate multiple groups of different data to improve the operation efficiency. Taking the implementation of the SHA-256 algorithm as an example, since 64 rounds of repeated operations are performed for each 512-bit data block, a 64-stage pipeline structure can be used to parallelly operate 64 groups of data.

[0093] Figure 5 The schematic diagram of the pipeline structure for performing round operations in the circuit for implementing SHA-256 is shown schematically. Figure 5As shown in FIG. 1 , the 0th operation stage, the 1st operation stage and the 63rd operation stage in the pipeline structure are divided by dotted lines. Each operation stage includes 8 32-bit cache registers A to H for storing intermediate values ​​and 124 bits for storing extended data W. t To W t+15 The 16 32-bit extended registers are R0 to R15.

[0094] from Figure 5 It can be seen that in the round operation of the hash algorithm, there are a large number of data shift operations and logical operations. Taking SHA-256 as an example, in each operation level, it is necessary to use the data from registers A, B, C, D, E, F, G and H and R0 to calculate the data to be stored in the cache register A in the next operation level through logical operations, and it is necessary to use the data from registers D, E, F, G, H and R0 to calculate the data to be stored in the cache register E in the next operation level through logical operations. In addition, it is necessary to use the data from registers R0, R1, R9 and R14 to calculate the data to be stored in the extended register R15 in the next operation level through logical operations. The remaining registers BD, FH and R0 to R14 in the next operation level directly receive data from the corresponding registers of the previous operation level through hard wiring. Therefore, in the round operation, this makes the pipeline structure have a data shift path that only participates in data shifting and a logical operation path that participates in various logical operations.

[0095] The inventor of the present application believes that there is room for further optimization for the registers that receive data output from the logic operation unit, especially the registers that receive the logic operation data output from the adder, namely registers A, E and R15. In each operation level of the existing hash operation, all 24 registers (i.e., cache registers A to H and extended registers R0 to R15) are constructed using triggers, such as D flip-flops (DFF). However, for registers A, E and R15 that receive data with long delays, the applicant believes that latches can be used to construct them. It is generally believed that DFF can be composed of two latches, so the area and power consumption of the latch are smaller than those of DFF, which is a natural advantage.

[0096] A trigger can be composed of a latch, but the difference between a latch and a trigger is that when the input data changes, the output of the latch changes synchronously during its enable period; while the output of the trigger only changes at the moment determined by the latch command, and it is prepared to memorize the data before the memory command is issued. That is to say, in a latch, during the enable period of the clock, the input of the latch is transparent, while in a trigger, at the edge of the clock flip, the input of the trigger is transparent. The disadvantage of the latch is that the hold time requirement is relatively high, which is difficult to meet in the pipeline. However, the applicant believes that the hold time requirement for the latch can be met in registers A, E and R15 that receive the combinational logic operation data from the combinational logic operation unit.

[0097] Generally speaking, latches may include level-type latches and pulse-type latches. The level-type latches may include, for example, SR latches, and the pulse-type latches may include, for example, D latches, wherein the function of the pulse-type D latch is the same as that of the DFF and may be used to replace the DFF.

[0098] In sequential circuits, setup and hold time checks are the most common types of timing checks used in timing verification. The synchronous input (e.g., D) has setup and hold time provisions relative to the clock input. These checks specify that the data input must be stable for a specified time before and after the clock input changes. Specifically, the setup time is the amount of time the synchronous input (D) must be stable before the effective edge of the clock, and the hold time is the amount of time the synchronous input (D) must be stable after the effective edge of the clock. If such provisions as setup and hold time are violated, the correct operation of the register cannot be ensured. Specifically, in latches, both setup and hold times are defined relative to the falling clock, where the setup time represents the amount of time the data must be stable before the clock falls, and the hold time represents the amount of time the data must be stable after the clock falls; in flip-flops, both setup and hold times are defined relative to the rising clock, where the setup time represents the amount of time the data must be stable before the clock rises, and the hold time represents the amount of time the data must be stable after the clock rises.

[0099] In a sequential circuit, the time T taken for a signal to be transmitted from one register to the next is an important indicator of system speed. Specifically, as shown in the following equation

[0100] T=T Clk-Q +T 逻辑 +T 建立 +T 偏斜

[0101] Where T Clk-Q is the amount of time you need to wait after clock Clk before the output (Q) is valid; T逻辑 It is the time required to pass the combinational logic between registers. The more combinational logic gates are passed, that is, the more complex the combinational logic is, the longer the time is. 建立 is the register setup time, and T 偏斜 Represents the static variation of the arrival times of the clocks at different registers.

[0102] In sequential circuits, there is a maximum path time constraint that ensures the slowest path to a register is as fast as possible based on the clock.

[0103] T Clk-Q +T cl_pdmax +T 建立 +T 偏斜 ≤T 时钟周期

[0104] Among them, T cl_pdmax represents the maximum time for a signal to pass through the combinational logic, and T 时钟周期 It limits the minimum clock period, which in turn limits the maximum clock frequency. Clk-Q and T 偏斜 It is determined by the characteristics of the register or the process. Therefore, from the above equation, it can be seen that the constraint on the setup time can be relaxed by slowing down the clock (increasing the cycle) or reducing the delay of the logic circuit. Generally speaking, the greater the delay of the combinational logic, the smaller the setup time margin, the slower the chip runs, and the worse the performance. Figures 3 to 5 In the circuit for implementing the hash algorithm shown in , since the delay of the combinational logic in the path from the previous register to registers A, E and R15 is long, the clock cycle is mainly determined by the delay of the combinational logic. Therefore, in such a path, the influence of the setup time is small, so the clock structure matched with DFF can be used, running at the operating frequency of DFF, and the setup efficiency benefit can be obtained.

[0105] In sequential circuits, there is a minimum path time constraint that ensures the fastest path based on the clock is not too fast for the flip-flops.

[0106] T Clk-Q +T cl_pdmin ≥T 偏斜 +T 保持时间

[0107] Among them, T cl_pdmin Represents the minimum time of combinational logic between registers.

[0108] like Figures 3 to 5 As shown in FIG. 1 , for example, when the data in register A is directly shifted to register B, due to T cl_pdmin Basically 0, then T is required 保持时间≤T Clk-Q -T 偏斜 At this time, the hold time of register B is required to be very small. Therefore, if register B is a latch, it may not meet the hold time requirement of the latch. Therefore, register B can be constructed using a D flip-flop. However, if Figure 4 As shown in FIG. 1 , when the data in register D is input to register E through full adder (faa) 6 and half adder cla2, due to T cl_pdmin Larger, requires T 保持时间 ≤T Clk-Q +T cl_pdmin -T 偏斜 At this time, the constraint on the hold time is weaker and the hold time margin is larger, so register E can be constructed using latches. Similarly, registers A and R15 can also be constructed using latches. Using latches to construct these registers can avoid the hold time problem caused by latches.

[0109] From the above analysis, it can be known that latches can save area and power consumption, but the disadvantage is that the hold time requirement is high. However, in the critical path of combinational logic including adders, due to the large delay of the combinational logic, the requirement for setup time is small; therefore, in the circuit for implementing the hash algorithm of the present application, a clock structure matching DFF can be used, running at the operating frequency of DFF, and the benefit of setup efficiency can be obtained; at the same time, in the path where the delay of the combinational logic is large and the hold time margin is large, that is, for registers whose input is an adder or other combinational logic (for example, registers A, E and R15), latches can be used to construct. By locally using latches to replace flip-flops, latches and flip-flops can be mixed, thereby maintaining the operating frequency of the DFF clock and reducing the area and power consumption of the circuit, while avoiding the hold time problem of latches.

[0110] For the hash core, the combinational logic and sequential logic usually take up half the area and half the power consumption respectively. If the 3 registers A, E and R15 among the 24 registers A~H and R0~R15 in each operation level are replaced by latches, that is, 3 / 24=12.5% ​​of the flip-flops can be replaced by latches, then based on a rough calculation that the D flip-flops take up half the area, the chip area can be saved by 3%, and the power consumption can also be saved by about 3%.

[0111] Although replacing all DFFs with latches can save more area and power consumption, it will sacrifice performance, slow down the speed, make the working conditions harsh, reduce stability, and reduce the wafer yield. Therefore, in the present invention, registers A, E and R15 are usually replaced by latches instead of flip-flops.

[0112] In the present invention, when the main clock structure is designed according to the DFF clock structure, some registers with large retention time margin are replaced by latches. By mixing DFF and latches in this way, the advantages of small latch area and power consumption are obtained, and the excessively high / complex requirements of latches on retention time are avoided.

[0113] Figure 6 A circuit 100 for executing a hash algorithm according to an embodiment of the present disclosure is schematically shown, and the circuit 100 includes: an input module 110 for receiving data; and an operation module 120 for calculating a hash value based on the received data. The operation module 120 includes a plurality of operation stages arranged in a pipeline structure, and the plurality of operation stages include the 0th operation stage, the 1st operation stage, and up to the Pth operation stage, where P is a fixed positive integer greater than 1 and less than the number of operation stages in the pipeline structure. For the sake of clarity of the drawings, Figure 6 Only two operation stages are schematically shown.

[0114] Each operation stage from the 1st operation stage to the Pth operation stage may include: a plurality of cache registers for storing intermediate values ​​of the current operation stage, the plurality of cache registers may include a first group of cache registers and a second group of cache registers, wherein the first group of cache registers may be registers receiving operation data output from the combinational logic operation unit of the previous operation stage, and the second group of cache registers may be registers receiving shift data directly from the registers of the previous operation stage; and a plurality of extension registers for storing extended data of the current operation stage, the plurality of extension registers may include a first group of extension registers and a second group of extension registers, and the first group of extension registers may be registers receiving operation data output from the combinational logic operation unit of the previous operation stage, and the second group of extension registers may be registers receiving shift data directly from the registers of the previous operation stage. In some embodiments according to the present disclosure, SHA-256 is implemented using circuit 100, multiple cache registers may include registers A to H for storing intermediate values, and multiple extension registers may include registers R0 to R15 for storing extended data, wherein the first group of cache registers may be registers A and E, and the second group of cache registers may be registers B, C, D, F, G and H, and wherein the first group of extension registers may include register R15, and the second group of extension registers may include registers R0 to R14.

[0115] In an embodiment according to the present disclosure, the 0th to Pth operation stages are consecutive (P+1) operation stages in the pipeline structure, and the pipeline structure may further include other operation stages in addition to the 0th to Pth operation stages, for example, may include one or more operation stages connected before the 0th operation stage, and / or may include one or more operation stages connected after the Pth operation stage. In some embodiments according to the present disclosure, other operation stages in addition to the 0th to Pth operation stages in the pipeline structure may include structures similar to the 0th to Pth operation stages.

[0116] In an embodiment according to the present disclosure, the first group of cache registers and the first group of extended registers may include latches, and the latches may be, for example, latches that adopt a pulse-type clock signal; and the second group of cache registers and the second group of extended registers may include edge-triggered registers, such as rising edge-triggered registers and / or falling edge-triggered registers, which may be, for example, D flip-flops (DFFs).

[0117] Continue to refer Figure 6 The circuit 100 for executing the hash algorithm further includes a clock module 130, which can be used to provide a reference clock signal CLK. The reference clock signal CLK has a reference clock period, and the multiple cache registers and the multiple extension registers of each operation stage from the 0th operation stage to the Pth operation stage can operate based on the reference clock signal.

[0118] In some embodiments according to the present disclosure, the 0th operation stage may be configured to determine extended data in a plurality of extended registers in the 0th operation stage based on data received by the input module 110 .

[0119] Note that in this article, when a clock signal is mentioned, it is not intended to refer to a pulse signal that actually exists in the circuit, but rather to one or more pulse signals that actually exist in the circuit and have a specific frequency and phase. Figure 6 For example, although it is described in the text that the multiple cache registers of each operation level are operated based on the reference clock signal CLK, the reference clock signal CLK used by the 0th operation level and the Pth operation level can be independent pulse signals generated by the clock tree in the clock module 130 but with the frequency and phase required by the reference clock signal CLK.

[0120] The circuit 100 for executing a hash algorithm according to an embodiment of the present disclosure can be used to implement the SHA-256 algorithm, and can implement the SHA-256 algorithm in a variety of different configurations. It will be understood by those skilled in the art that the circuit and method for implementing a hash algorithm according to an embodiment of the present disclosure are applicable to any hash algorithm, and can even be further applied to any circuit and method that can adopt a pipeline structure and has data shifting and logic operations, and is not limited to implementing SHA-256.

[0121] According to an embodiment of the present disclosure, there is also provided an apparatus for executing a computing device encryption algorithm, which includes a circuit for executing a hash algorithm as described above, such as circuit 100. The circuit for executing a hash algorithm proposed in the present disclosure is very suitable for implementing the SHA-256 algorithm with a reduced power consumption and computing power ratio, and thus is very suitable for implementing a computing device with a reduced power consumption and computing power ratio. Advantageously, the power consumption and computing power of the apparatus for executing a computing device encryption algorithm according to an embodiment of the present disclosure has a significant advantage.

[0122] According to an embodiment of the present disclosure, there is also provided a method for executing a hash algorithm, which uses the circuit according to the present disclosure to execute the hash algorithm. Specifically, the method may include: using an input module to receive data; and using an operation module to calculate a hash value based on the received data. The operation module may include: a plurality of registers for storing data of the operation module, a plurality of combinational logic operation units, each combinational logic operation unit in the plurality of combinational logic operation units is used to perform a combinational logic operation on data from one or more registers of the plurality of registers, wherein the plurality of registers include a first group of registers for receiving combinational logic operation data output from one or more combinational logic operation units in the plurality of combinational logic operation units and a second group of registers for receiving shift data output from one or more registers of the plurality of registers, wherein the first group of registers may be composed of latches, and the second group of registers may be composed of triggers.

[0123] In some embodiments according to the present disclosure, the trigger may be an edge-triggered register, such as a rising edge-triggered register and / or a falling edge-triggered register, and may be composed of a D flip-flop. The latch may be, for example, a latch using a pulse-type clock signal.

[0124] In some embodiments according to the present disclosure, the method for executing the hash algorithm may further include using a clock module to provide a reference clock signal. The reference clock signal has a reference clock period, and multiple cache registers and multiple extension registers of each operation stage from the 1st operation stage to the Pth operation stage may operate based on the reference clock signal.

[0125] In some embodiments of the method for executing a hash algorithm according to the present disclosure, the plurality of registers include: 8 32-bit cache registers A to H, for storing intermediate values ​​of an operation module, 16 32-bit extension registers R0 to R15, for storing extended data of the operation module, wherein the first group of registers includes cache registers A and E and extension register R15, and the second group of registers includes cache registers B, C, D, F, G and H and extension registers R0 to R14.

[0126] In some embodiments of the method for executing a hash algorithm according to the present disclosure, one or more combinatorial logic operation sections of the plurality of combinatorial logic operation sections include an adder, and the first group of registers receives operation data output from the adder.

[0127] In some embodiments of the method for executing a hash algorithm according to the present disclosure, the holding time of the latch satisfies the following formula: T 保持时间 ≤T Clk-Q +T cl_pdmin -T 偏斜 , where T 保持时间 is the latch hold time, T Clk-Q is the amount of time the previous register before the latch needs to wait after the clock signal is valid before the output is valid, T cl_pdmin is the delay time of the combinational logic between the previous register and the latch before the latch, and T 偏斜 Represents the static variation of the arrival time of the clock at different latches.

[0128] According to an embodiment of the present disclosure, a method for executing a hash algorithm is also provided, which uses the circuit described in the present disclosure to execute the hash algorithm. Specifically, the method may include: using an input module to receive data; and using a calculation module to calculate a hash value based on the received data. The operation module may include multiple operation stages arranged in a pipeline structure, and the multiple operation stages may include the 0th operation stage, the 1st operation stage, and up to the Pth operation stage, where P is a fixed positive integer greater than 1 and less than the number of operation stages in the pipeline structure, wherein each operation stage from the 1st operation stage to the Pth operation stage may include: multiple registers for storing data of the current operation stage, multiple combinational logic operation units, each combinational logic operation unit of the multiple combinational logic operation units is used to perform combinational logic operations on data from one or more registers of the multiple registers in the current operation stage, wherein the multiple registers include a first group of registers receiving combinational logic operation data output from one or more combinational logic operation units of the multiple combinational logic operation units in the previous operation stage and a second group of registers receiving shift data output from one or more registers of the multiple registers of the previous operation stage, wherein the first group of registers may be composed of latches, and the second group of registers may be composed of flip-flops.

[0129] According to an embodiment of the present disclosure, there is also provided a method for executing an encryption algorithm of a computing device, which includes the steps of the method for executing a hash algorithm as described above.

[0130] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0131] The words "front", "rear", "top", "bottom", "above", "below", etc., if present, in the specification and claims are used for descriptive purposes and are not necessarily used to describe invariant relative positions. It should be understood that the words so used are interchangeable under appropriate circumstances, such that the embodiments of the disclosure described herein, for example, are capable of operation in other orientations than those illustrated or otherwise described herein.

[0132] As used herein, the word "exemplary" means "serving as an example, instance, or illustration," rather than as a "model" to be exactly copied. Any implementation described as an example herein is not necessarily to be construed as preferred or advantageous over other implementations. Furthermore, the present disclosure is not limited by any expressed or implied theory given in the above technical field, background technology, summary of the invention, or detailed description.

[0133] As used herein, the term "substantially" is intended to include any minor variations due to design or manufacturing imperfections, device or component tolerances, environmental influences, and / or other factors. The term "substantially" also allows for deviations from a perfect or ideal condition due to parasitic effects, noise, and other practical considerations that may exist in actual implementations.

[0134] The above description may indicate an element or node or feature that is "connected" or "coupled" together. As used herein, unless otherwise expressly stated, "connection" means that one element / node / feature is directly connected (or directly communicates) to another element / node / feature electrically, mechanically, logically or otherwise. Similarly, unless otherwise expressly stated, "coupling" means that one element / node / feature can be mechanically, electrically, logically or otherwise connected to another element / node / feature in a direct or indirect manner to allow interaction, even if the two features may not be directly connected. In other words, "coupling" is intended to include direct and indirect connections of elements or other features, including connections using one or more intermediate elements.

[0135] It should also be understood that when the term “include / comprises” is used in this document, it indicates the presence of the specified features, integers, steps, operations, units and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, units and / or components and / or their combinations.

[0136] Those skilled in the art will appreciate that the boundaries between the above operations are merely illustrative. Multiple operations can be combined into a single operation, a single operation can be distributed in additional operations, and operations can be performed at least partially overlapping in time. Moreover, alternative embodiments may include multiple instances of specific operations, and the order of operations may be changed in other various embodiments. However, other modifications, variations, and replacements are equally possible. Therefore, this specification and accompanying drawings should be considered illustrative, not restrictive.

[0137] Although some specific embodiments of the present disclosure have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present disclosure. It should also be understood by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A circuit for executing a hash algorithm, characterized in that The circuit comprises: An input module for receiving data; and A calculation module, used to calculate a hash value based on the received data, the calculation module comprising: Multiple registers for storing data from the computing module. a plurality of combinatorial logic operation units, each of the plurality of combinatorial logic operation units being configured to perform a combinatorial logic operation on data from one or more registers of the plurality of registers, The plurality of registers include a first group of registers receiving combinatorial logic operation data output from one or more combinatorial logic operation units among the plurality of combinatorial logic operation units and a second group of registers receiving shift data output from one or more registers among the plurality of registers. The first group of registers is composed of latches, and the second group of registers is composed of flip-flops.

2. The circuit according to claim 1, characterized in that The circuit is used to perform SHA-256, Wherein, the multiple registers include: The first to eighth buffer registers (A to H) are used to store the intermediate values ​​of the operation module, The first to sixteenth extended registers (R0 to R15) are used to store extended data of the operation module. Among them, the first group of registers includes the first cache register (A) and the fifth cache register (E) and the sixteenth extension register (R15), and the second group of registers includes the second to fourth cache registers (B to D) and the sixth to eighth cache registers (F to H) and the first to fifteenth extension registers (R0 to R14).

3. The circuit according to claim 1, characterized in that The flip-flop is a D flip-flop DFF.

4. The circuit according to claim 1, characterized in that One or more of the plurality of combinatorial logic operation sections include an adder, and the first group of registers receives operation data output from the adder.

5. The circuit according to claim 1, characterized in that The latch is a latch using a pulse type clock signal.

6. The circuit according to claim 1, characterized in that The latch hold time satisfies the following formula: T 保持时间 ≤T Clk-Q +T cl_pdmin -T 偏斜 , Where T 保持时间 is the latch hold time, T Clk-Q is the amount of time the previous register before the latch needs to wait after the clock signal is valid before the output is valid, T cl_pdmin is the delay time of the combinational logic between the previous register and the latch before the latch, and T 偏斜 Represents the static variation of the arrival time of the clock at different latches.

7. A circuit for executing a hash algorithm, characterized in that The circuit comprises: An input module for receiving data; and an operation module, for calculating a hash value based on the received data, the operation module comprising a plurality of operation stages arranged in a pipeline structure, the plurality of operation stages comprising a 0th operation stage, a 1st operation stage, and up to a Pth operation stage, where P is a fixed positive integer greater than 1 and less than the number of operation stages in the pipeline structure, Wherein, each operation stage from the 1st operation stage to the Pth operation stage includes: Multiple registers for storing data at the current operation level. a plurality of combinatorial logic operation sections, each of the plurality of combinatorial logic operation sections being used to perform a combinatorial logic operation on data from one or more of the plurality of registers in the current operation stage, The plurality of registers include a first group of registers receiving combinatorial logic operation data output from one or more combinatorial logic operation units in a plurality of combinatorial logic operation units in a previous operation stage and a second group of registers receiving shift data output from one or more registers in a plurality of registers in a previous operation stage. The first group of registers is composed of latches, and the second group of registers is composed of flip-flops.

8. The circuit according to claim 7, characterized in that The circuit is used to perform SHA-256, The plurality of registers in each operation stage from the 1st operation stage to the Pth operation stage include: The first to eighth buffer registers (A to H) are used to store the intermediate values ​​of the operation module, The first to sixteenth extended registers (R0 to R15) are used to store extended data of the operation module. Among them, the first group of registers includes the first cache register (A) and the fifth cache register (E) and the sixteenth extension register (R15), and the second group of registers includes the second to fourth cache registers (B to D) and the sixth to eighth cache registers (F to H) and the first to fifteenth extension registers (R0 to R14).

9. The circuit according to claim 7, characterized in that The flip-flop is a D flip-flop DFF.

10. The circuit according to claim 7, characterized in that One or more of the combinatorial logic operation sections include an adder, and the first group of registers receives operation data output from the adder.

11. The circuit according to claim 7, characterized in that The latch is a latch using a pulse type clock signal.

12. The circuit according to claim 7, characterized in that The latch hold time satisfies the following formula: T 保持时间 ≤T Clk-Q +T cl_pdmin -T 偏斜 , Where T 保持时间 is the latch hold time, T Clk-Q is the amount of time the previous register before the latch needs to wait after the clock signal is valid before the output is valid, T cl_pdmin is the delay time of the combinational logic between the previous register and the latch before the latch, and T 偏斜 Represents the static variation of the arrival time of the clock at different latches.

13. An apparatus for executing an encryption algorithm of a computing device, comprising a circuit according to any one of claims 1 to 12.

14. A method of performing a hash algorithm using a circuit according to any one of claims 1-12.

Images