Sha3 algorithm implementation method and device based on risc-v architecture

Abstract

The application discloses a kind of based on RISC-V architecture SHA3 algorithm implementation method, device and system, applied to computer technology field, comprising: according to target function, determine effective length and output data length;According to input information, effective length and output data length, determine the total number of filling process in absorption stage and the total number of compression process in compression stage;In absorption stage, according to the first initial state vector, input information, effective length and filling process total number, each filling process is calculated one by one, to obtain absorption stage output vector;In compression stage, based on absorption stage output vector each compression process is calculated one by one, to obtain compression stage output vector;It can realize the acceleration calculation of SHA3 algorithm based on RISC-V architecture, it is favorable to expand the application range of RISC-V architecture.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a SHA3 algorithm implementation method, device and system based on RISC-V architecture. BACKGROUND

[0002] Since the RISC-V instruction set is released, a plurality of extended instruction sets have been successively announced. At present, in the aspect of the cryptography K instruction set, only the related research of scalar instruction exists, and there is no vector cryptography instruction. In addition, in the cryptography instruction extension, even if the scalar extension exists, there is no extended instruction available for SHA3. That is, at present, the acceleration calculation of the SHA3 algorithm based on the vector instruction on the RISC-V architecture cannot be realized, and the application of the RISC-V architecture is limited.

[0003] In view of this, how to provide a SHA3 algorithm implementation method, device and system based on RISC-V architecture becomes a problem to be solved by the person skilled in the art. SUMMARY

[0004] The purpose of the embodiment of the present application is to provide a SHA3 algorithm implementation method, device and system based on RISC-V architecture, which realizes the acceleration calculation of the SHA3 algorithm based on the RISC-V architecture in the use process, and is beneficial to expand the application range of the RISC-V architecture.

[0005] To solve the above technical problems, the embodiment of the present application provides a SHA3 algorithm implementation method based on RISC-V architecture, which comprises:

[0006] According to the objective function, the effective length and the output data length are determined;

[0007] According to the input information, the effective length and the output data length, the total number of filling processes in the absorption stage and the total number of compression processes in the compression stage are determined;

[0008] In the absorption stage, according to the first initial state vector, the input information, the effective length and the total number of filling processes, each filling process is calculated one by one to obtain an absorption stage output vector;

[0009] In the compression stage, each compression process is calculated one by one based on the absorption stage output vector to obtain a compression stage output vector.

[0010] Optionally, the absorption stage output vector is obtained by calculating each filling process one by one according to the first initial state vector, the input information, the effective length and the total number of filling processes in the absorption stage, which comprises:

[0011] For the i-th padding process, obtaining a first vector with a length of the effective length from the input information;

[0012] XORing the first vector with a current state vector to obtain an XOR result;

[0013] performing f function calculation on the XOR result to obtain a first output vector;

[0014] determining whether the i-th padding process is the last padding process, if yes, taking the first output vector as an absorption stage output vector, and if no, updating the current state vector with the first output vector;

[0015] performing a plus 1 operation on the i, and returning to execute the obtaining of the first vector with a length of the effective length from the input information until an absorption stage output vector is obtained after the last padding process ends; wherein, when the i is 0, the current state vector is the first initial state vector.

[0016] Optionally, the calculating of each compression process based on the absorption stage output vector in the compression stage to obtain a compression stage output vector comprises:

[0017] for a current compression process, performing f function operation on a current state vector to obtain a second output vector;

[0018] determining whether the current compression process is the last compression process, if yes, obtaining a compression stage output vector based on the absorption stage output vector and each second output vector, and if no, updating the current state vector with the second output vector and returning to execute the f function operation on the current state vector until the last compression process ends.

[0019] Optionally, before the calculating of each compression process based on the absorption stage output vector to obtain a compression stage output vector, the method further comprises:

[0020] determining whether the output vector length is greater than the effective length, if yes, executing the calculating of each compression process based on the absorption stage output vector to obtain a compression stage output vector, and if no, directly taking the first output vector length bits of the absorption stage output vector as a compression stage output vector.

[0021] Optionally, the determining of the effective length and the output data length according to the target function comprises:

[0022] The effective length and the output data length corresponding to the target function are matched from a pre-established function parameter configuration table according to the target function.

[0023] The embodiment of the application further provides an SHA3 algorithm implementation device based on a RISC-V architecture, comprising:

[0024] A determination module is configured to determine an effective length and an output data length according to a target function;

[0025] A calculation module is configured to determine a total number of padding processes in an absorption stage and a total number of compression processes in a compression stage according to input information, the effective length and the output data length;

[0026] An absorption processing module is configured to calculate each padding process one by one according to a first initial state vector, the input information, the effective length and the total number of padding processes in the absorption stage, to obtain an absorption stage output vector;

[0027] A compression processing module is configured to calculate each compression process one by one based on the absorption stage output vector in the compression stage, to obtain a compression stage output vector.

[0028] Optionally, the absorption processing module comprises:

[0029] A first acquisition unit is configured to acquire an (i+1)th first vector with a length of the effective length from the input information for the ith padding process;

[0030] An exclusive or unit is configured to perform an exclusive or operation on the first vector and a current state vector to obtain an exclusive or result;

[0031] A calculation unit is configured to perform f function calculation on the exclusive or result to obtain a first output vector;

[0032] A first judgment unit is configured to judge whether the ith padding process is the last padding process, if yes, a first determination unit is triggered, and if not, a first update unit is triggered;

[0033] The first determination unit is configured to take the first output vector as an absorption stage output vector;

[0034] The first update unit is configured to update the current state vector by using the first output vector;

[0035] A second update unit is configured to perform a plus one operation on the i, and trigger the acquisition module until an absorption stage output vector is obtained after the last padding process is finished; wherein, when the i is 0, the current state vector is the first initial state vector.

[0036] Optionally, the compression processing module comprises:

[0037] a f function calculation unit configured to perform f function operation on the current state vector to obtain a second output vector for the current compression process;

[0038] a second determination unit configured to trigger the second determination unit if the current compression process is the last compression process, and trigger the third update unit if the current compression process is not the last compression process;

[0039] the second determination unit is configured to obtain a compression stage output vector based on the absorption stage output vector and the second output vector;

[0040] the third update unit is configured to update the current state vector using the second output vector and trigger the f function calculation unit until the last compression process is executed.

[0041] The embodiment of the present application also provides a SHA3 algorithm implementation system based on a RISC-V architecture, comprising a memory and a processor, wherein:

[0042] the memory is configured to store a computer program;

[0043] the processor is configured to implement the steps of the SHA3 algorithm implementation method based on the RISC-V architecture as claimed in claim 1 when executing the computer program.

[0044] Optionally, the processor comprises a processing module, a register module, a vector shifter, a vector XORer and an f function calculation module, wherein:

[0045] the register module is configured to store input information and a state vector;

[0046] the processing module is configured to determine an effective length and an output data length according to a target function, determine a total number of filling processes in an absorption stage and a total number of compression processes in a compression stage according to the input information, the effective length and the output data length, send a current filling process number i to the vector shifter in the absorption stage, and after receiving a first output vector, determine whether the current filling process is the last filling process, and if so, take the first output vector as an absorption stage output vector, and if not, update a current state vector of the register module using the first output vector, and after performing an increment operation on the i, send a new i to the vector shifter;

[0047] The vector shifter is configured to determine an i+1th first vector with the effective length from the input information according to the i, and send the first vector to the vector Xor.

[0048] The vector Xor is configured to perform Xor operation on the first vector and the current state vector, and send the Xor result to the f function calculation module.

[0049] The f function calculation module is configured to perform f function calculation on the Xor result to obtain a first output vector, and feed back the first output vector to the processing module.

[0050] The processing module is further configured to send a compression instruction to the f function calculation module in the compression stage, and when receiving a second output vector, determine whether the current compression process is the last compression process, obtain a compression stage output vector based on the absorption stage output vector and the second output vector, determine whether the current compression process is not the last compression process, update the current state vector of the register module by using the second output vector, and return to send the compression instruction to the f function calculation module.

[0051] The f function calculation module is configured to perform f function operation on the current state vector according to the compression instruction to obtain a second output vector, and feed back the second output vector to the processing module.

[0052] The embodiment of the present application provides a SHA3 algorithm implementation method, device and system based on RISC-V architecture, the method comprises: determining an effective length and an output data length according to a target function; determining a total number of filling processes in an absorption stage and a total number of compression processes in a compression stage according to input information, the effective length and the output data length; in the absorption stage, calculating each filling process one by one according to a first initial state vector, the input information, the effective length and the total number of filling processes to obtain an absorption stage output vector; in the compression stage, calculating each compression process one by one based on the absorption stage output vector to obtain a compression stage output vector.

[0053] It can be seen that the present application determines the effective length and the output data length in the SHA3 algorithm according to the target function, and further determines the total number of filling processes in the absorption stage and the total number of compression processes in the compression stage according to the input information, the effective length and the output data length, and calculates each filling process one by one in the absorption stage according to the first initial state vector, the input information, the effective length and the total number of filling processes, so as to obtain the output vector of the absorption stage, and then each compression process is calculated one by one in the compression stage based on the output vector of the absorption stage, so as to obtain the output vector of the compression stage, so that the acceleration calculation of the SHA3 algorithm based on the RISC-V architecture is realized, and the application range of the RISC-V architecture is expanded. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the prior art and the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0055] Figure 1 A flowchart of a SHA3 algorithm implementation method based on RISC-V architecture provided by the embodiments of the present application is shown.

[0056] Figure 2 A function parameter configuration table provided by the embodiments of the present application is shown.

[0057] Figure 3 A function structure diagram of a SHA3 algorithm provided by the embodiments of the present application is shown.

[0058] Figure 4 A structure diagram of a SHA3 algorithm implementation device based on RISC-V architecture provided by the embodiments of the present application is shown.

[0059] Figure 5 A structure diagram of a SHA3 algorithm implementation system based on RISC-V architecture provided by the embodiments of the present application is shown.

[0060] Figure 6 Another structure diagram of a SHA3 algorithm implementation system based on RISC-V architecture provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0061] The embodiments of the present application provide a SHA3 algorithm implementation method, device and system based on RISC-V architecture, which realizes acceleration calculation of the SHA3 algorithm based on RISC-V architecture in use, and is beneficial to expand the application range of RISC-V architecture.

[0062] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0063] Please refer to Figure 1 , Figure 1 A flowchart of a method for implementing an SHA3 algorithm based on a RISC-V architecture according to an embodiment of the present application is shown in FIG. 1. The method comprises the following steps.

[0064] S110: determining an effective length and an output data length according to a target function;

[0065] It should be noted that when implementing the SHA3 algorithm based on the RISC-V architecture, the effective length r and the output data length d of the SHA3 algorithm can be determined according to the target function. Different target functions correspond to different effective lengths and output data lengths, and the effective length and the output data length corresponding to the target function can be matched from a pre-established function parameter configuration table according to the type of the target function. The function parameter configuration table is shown in FIG. 2. The SHA3 algorithm can include six function types, namely SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128 and SHAKE256. Among them, SHA3-224, SHA3-256, SHA3-384 and SHA3-512 belong to SHA3 Hash Function (hash function), and the output data length d of this type of function is fixed. SHAKE128 and SHAKE256 belong to SHA3 Extendable-Output Functions (extended output function), and the output data length d is variable. In addition, Figure 2 In the formula, I / O represents the output data, State represents the state vector, the length of the state vector is r+c, r represents the length of the effective data (i.e. the effective length), c represents the security length, d represents the output data length, the unit is bit, Byte is the length converted into Byte, and pad is the character in the padding process. Figure 2

[0066] S120: determining the total number of padding processes in the absorption stage and the total number of compression processes in the compression stage according to the input information, the effective length and the output data length;

[0067] ​Specifically, after determining the effective length r and the output data length d, the input information is obtained, and the total number N of the filling process in the absorption stage is obtained based on the input information and the effective length. The total number M of the compression process in the compression stage is obtained based on the effective length and the output data length.

[0068] It should be noted that, as Figure 3 The SHA3 hash function shown has a core structure resembling a sponge. The left side of the dashed lines represents the absorption phase, and the right side represents the squeezing phase. The rounded rectangles *f* in the absorption and squeezing phases refer to the main processing equations of the hash function, also known as the Keccak-F function or permutation function. The leftmost rectangle is a vector of all zeros, with a length of 1600 bits in SHA3, also called the initial state vector. Throughout the process, each dashed rectangle processes the state and passes it to the next. Each dashed rectangle in the absorption phase represents a filling process (e.g., P0, P1, P2), and each dashed rectangle in the squeezing phase represents a squeezing process (e.g., Z0, Z1, Z2). The total length of the input information is an integer multiple of the effective length *r*, and it can be evenly divided into several vectors of length *r*, which are XORed with the first *r* bits of the state vector in each filling process. Therefore, after obtaining the input information, the total number of filling processes in the absorption phase can be further determined based on the total length of the input information and the effective length r. For example, if the total number of filling processes is N, then each filling process is P0, P1, ..., P(N-1). S130: In the absorption phase, based on the first initial state vector, the input information, the effective length, and the total number of filling processes, each filling process is calculated one by one to obtain the output vector of the absorption phase;

[0069] Specifically, after receiving the absorption instruction, the absorption phase operation can be performed according to the absorption instruction. Specifically, it can start from the first filling process to the last filling process, and calculate each filling process one by one according to the first initial state vector, input information, and effective length, until the calculation of the last filling process is completed and the absorption phase output vector is obtained.

[0070] Specifically, in the absorption phase, the first r bits of the initial state vector 0 of the first filling process P0 are XORed with the corresponding r bits of the input vector and then input to the f function for calculation. The calculation result is then output to the second filling process P1, and so on until the last filling process is completed.

[0071] S140: In the compression phase, each compression process is calculated based on the output vector of the absorption phase to obtain the output vector of the compression phase.

[0072] Specifically, after the absorption stage ends, the compression stage is entered, and specifically, each compression process can be calculated based on the absorption stage output vector after receiving the compression instruction to obtain the compression stage output vector, so as to realize the accelerated calculation of the SHA3 algorithm. Moreover, only two instructions (absorption instruction and compression instruction) are needed in the implementation process, and the operation amount is small and the efficiency is high.

[0073] Further, in the absorption stage, each padding process is calculated based on the first initial state vector, the input information, the effective length and the total number of padding processes to obtain the absorption stage output vector, including:

[0074] For the i-th padding process, the i+1-th first vector with the effective length is obtained from the input information;

[0075] The first vector is XORed with the current state vector to obtain an XOR result;

[0076] The XOR result is calculated by the f function to obtain a first output vector;

[0077] It is judged whether the i-th padding process is the last padding process, if yes, the first output vector is taken as the absorption stage output vector, if not, the first output vector is used to update the current state vector;

[0078] The i is incremented by 1, and the execution of obtaining the i+1-th first vector with the effective length from the input information is returned until the absorption stage output vector is obtained after the last padding process ends; wherein, when i is 0, the current state vector is the first initial state vector.

[0079] It should be noted that in actual application, for the first filling process P0, when i is 0, a first vector of the first length r bits can be determined from the input information according to the effective length r, and the first r bits of the initial state vector are subjected to an exclusive or operation with the first vector to obtain an exclusive or result, the exclusive or result is input to the f function for f function calculation to obtain a first output vector, the first output vector is used to update the current state vector to obtain a new current state vector input to the second filling process P1, and i is updated by 1, that is, i is updated to 1, then a first vector of the second length r bits is determined from the input information according to the effective length r, then the calculation result is output to the second filling process P1, and the first vector is subjected to an exclusive or operation with the first r bits of the menopausal state vector to obtain an exclusive or result, the exclusive or result is subjected to f function calculation to obtain a first output vector corresponding to the second filling process, then the first output vector is taken as the current state vector of the third filling process, and the calculation of the third filling process is entered, and the process is sequentially repeated until the last filling process is executed to obtain the absorption stage output vector.

[0080] Further, in the compression stage, the process of calculating each compression process one by one based on the absorption stage output vector to obtain the compression stage output vector can specifically include:

[0081] For the current compression process, the f function operation is performed on the current state vector to obtain a second output vector.

[0082] It is judged whether the current compression process is the last compression process, if yes, the compression stage output vector is obtained based on the absorption stage output vector and each second output vector, and if not, the second output vector is used to update the current state vector, and the process of performing the f function operation on the current state vector is returned to be executed until the last compression process is executed.

[0083] It should be noted that after the calculation of the absorption stage is completed, the compression stage is entered, and the output result of the absorption stage can be directly used as the initial state vector of the compression stage. In the first compression process, the initial state vector is calculated by the function f to obtain a second output vector. In the compression process that is not the last compression process, the second output vector is taken as a new current state vector, and the current state vector is calculated by the function f to obtain a second output vector of the compression process. Until the last compression process is executed, a corresponding second output vector is obtained. Then, based on the second output vectors of each stage and the output vector of the absorption stage of the last stage, a compression stage output vector is obtained. For example, if the compression process is M, the compression stage output vector is the integration of the first r bits of the absorption receiving output vector, the first r bits of each of the first M-1 second output vectors, and the (d-M*r) bits of the Mth second output vector, and is taken as the final compression stage output vector. For example, the output data length d of the target function SHAKE128 is 2000 bits, and the effective length r corresponding thereto is 1344. Therefore, the corresponding compression process is 1, that is, after the absorption stage is completed, only one Z0 process needs to be executed, and after the second output result corresponding to the Z0 process is obtained, the first 1344 bits of the absorption stage output vector and the first 656 bits of the second output result are integrated to obtain the final compression stage output vector.

[0084] Further, before the above-mentioned calculation of each compression process based on the absorption stage output vector to obtain the compression stage output vector, the method can further include:

[0085] If the output vector length is greater than the effective length, the step of calculating each compression process based on the absorption stage output vector to obtain the compression stage output vector is executed; otherwise, the output vector length bits of the absorption stage output vector are directly taken as the compression stage output vector.

[0086] It can be understood that when the target function is SHA3-224, SHA3-256, SHA3-384, or SHA3-512, the effective length r is 224, 256, 384, or 512, respectively. Figure 2As can be seen from the table in the table, the output data length corresponding to the functions is less than the corresponding effective length r, and therefore, for the functions, the number of compression processes corresponding to the output vector obtained after the end of the absorption stage can be 0, that is, no compression process is performed, and only the first output vector length bits of the output vector of the absorption stage are directly taken as the output vector of the compression stage. Of course, for the two types of functions SHAKE128 and SHAKE256, it can be judged whether the output vector length d corresponding to the target function is greater than the effective length r, when it is not greater than, the first output vector length bits of the output vector of the absorption stage can also be directly taken as the output vector of the compression stage, when it is greater than, each compression process can be calculated according to the number of compression processes, and finally the output vector of the compression stage with the final length of the output vector length d is obtained according to the output vector of the absorption stage and the second output vector of each compression process. For example, for SHAKE128, when d is less than or equal to 1344, the calculation of the compression process is not needed, and when d is greater than 1344, the calculation of the compression process is needed.

[0087] It can be seen that, by determining the effective length and the output data length in the SHA3 algorithm according to the target function, further determining the total number of padding processes in the absorption stage and the total number of compression processes in the compression stage according to the input information, the effective length and the output data length, and calculating each padding process one by one according to the first initial state vector, the input information, the effective length and the total number of padding processes in the absorption stage to obtain the output vector of the absorption stage, and then calculating each compression process one by one based on the output vector of the absorption stage in the compression stage to obtain the output vector of the compression stage, the acceleration calculation of the SHA3 algorithm based on the RISC-V architecture is realized by the method, which is beneficial to expand the application range of the RISC-V architecture.

[0088] On the basis of the above-mentioned embodiments, the embodiment of the present application further provides a device for implementing SHA3 algorithm based on RISC-V architecture, which specifically refers to Figure 4 . The device comprises:

[0089] The determination module 11 is configured to determine the effective length and the output data length according to the target function;

[0090] The calculation module 12 is configured to determine the total number of padding processes in the absorption stage and the total number of compression processes in the compression stage according to the input information, the effective length and the output data length;

[0091] The absorption processing module 13 is configured to calculate each padding process one by one according to the first initial state vector, the input information, the effective length and the total number of padding processes in the absorption stage to obtain the output vector of the absorption stage;

[0092] The compression processing module 14 is configured to calculate each compression process based on the absorption stage output vector in the compression stage to obtain a compression stage output vector.

[0093] Optionally, the absorption processing module 13 comprises:

[0094] The first obtaining unit is configured to obtain an i+1th first vector with an effective length from the input information for an i th padding process.

[0095] The exclusive-OR unit is configured to perform an exclusive-OR operation on the first vector and the current state vector to obtain an exclusive-OR result.

[0096] The calculation unit is configured to perform an f function calculation on the exclusive-OR result to obtain a first output vector.

[0097] The first determining unit is configured to determine whether the i th padding process is the last padding process, and if yes, trigger the first determining unit, and if no, trigger the first updating unit.

[0098] The first determining unit is configured to determine whether the i th padding process is the last padding process, and if yes, trigger the first determining unit, and if no, trigger the first updating unit.

[0099] The first updating unit is configured to update the current state vector by using the first output vector.

[0100] The second updating unit is configured to perform an i+1 operation on i, and trigger the obtaining module until the absorption stage output vector is obtained after the last padding process is completed, wherein i is 0, and the current state vector is the first initial state vector.

[0101] Optionally, the compression processing module 14 comprises:

[0102] The f function calculation unit is configured to perform an f function operation on the current state vector to obtain a second output vector for the current compression process.

[0103] The second determining unit is configured to determine whether the current compression process is the last compression process, and if yes, trigger the second determining unit, and if no, trigger the third updating unit.

[0104] The second determining unit is configured to determine whether the current compression process is the last compression process, and if yes, trigger the second determining unit, and if no, trigger the third updating unit.

[0105] The third updating unit is configured to update the current state vector by using the second output vector, and trigger the f function calculation unit until the last compression process is executed.

[0106] It should be noted that the RISC-V architecture-based SHA3 algorithm implementation device in the embodiment of the present application has the same beneficial effects as the RISC-V architecture-based SHA3 algorithm implementation method provided in the above-mentioned embodiment, and for the specific introduction of the RISC-V architecture-based SHA3 algorithm implementation method involved in the embodiment of the present application, please refer to the above-mentioned embodiment, which will not be repeated here.

[0107] On the basis of the above-mentioned embodiment, the embodiment of the present application further provides a RISC-V architecture-based SHA3 algorithm implementation system, as shown in Figure 4 The system comprises a memory 2 and a processor 3, wherein:

[0108] The memory 2 is used for storing a computer program;

[0109] The processor 3 is used for implementing the steps of the RISC-V architecture-based SHA3 algorithm implementation method of claim 1 when executing the computer program.

[0110] For example, the processor in the embodiment of the present application is used to determine the effective length and the output data length according to the target function; determine the total number of padding processes in the absorption stage and the total number of compression processes in the compression stage according to the input information, the effective length and the output data length; in the absorption stage, calculate each padding process one by one according to the first initial state vector, the input information, the effective length and the total number of padding processes, to obtain the absorption stage output vector; in the compression stage, calculate each compression process one by one based on the absorption stage output vector, to obtain the compression stage output vector.

[0111] Further, the processor 3 comprises a processing module 31, a register module 32, a vector shifter 33, a vector XOR operator 34 and an f function calculation module 35, wherein:

[0112] The register module 32 is used for storing input information and state vectors;

[0113] The processing module 31 is used for determining the effective length and the output data length according to the target function, and determining the total number of padding processes in the absorption stage and the total number of compression processes in the compression stage according to the input information, the effective length and the output data length; in the absorption stage, the processing module 31 sends the current padding process number i to the vector shifter 33, and after receiving the first output vector, if it is determined that the current padding process is the last padding process, the first output vector is taken as the absorption stage output vector, and if it is determined that the current padding process is not the last padding process, the first output vector is used to update the current state vector of the register module 32, and then the new i is sent to the vector shifter 33 after the i is incremented by 1;

[0114] a vector shifter 33 configured to determine an (i+1)th first vector with an effective length from the input information according to i, and send the first vector to a vector XOR operator 34;

[0115] the vector XOR operator 34 configured to perform XOR operation on the first vector and the current state vector, and send the XOR result to an f function calculation module 35;

[0116] the f function calculation module 35 configured to perform f function calculation on the XOR result to obtain a first output vector, and feed back the first output vector to the processing module 31;

[0117] the processing module 31 further configured to send a compression instruction to the f function calculation module 35 in the compression stage; and configured to, after receiving the second output vector, determine whether the current compression process is the last compression process, obtain a compression stage output vector based on the absorption stage output vector and the second output vector when the current compression process is the last compression process, update the current state vector of the register module 32 using the second output vector when the current compression process is not the last compression process, and return to send the compression instruction to the f function calculation module 35;

[0118] the f function calculation module 35 configured to perform f function operation on the current state vector according to the compression instruction to obtain a second output vector, and feed back the second output vector to the processing module 31.

[0119] It should be noted that, as Figure 6As shown, the register module 32 can specifically include a first vector register and a second vector register, wherein the first vector register is used to store the input information, and the second vector register is used to store the state vector. After the processing module 1 determines the effective length r and the output data length d according to the objective function, the processing module 1 determines the total number of filling processes in the absorption stage according to the input information and the effective length, determines the total number of compression processes in the compression stage according to the effective length and the output data length, and sends the current filling process number i to the vector shifter 33 according to the absorption instruction in the absorption stage, wherein i starts from 0. The vector shifter 33 obtains the i+1th first vector with a length of r from the input information according to the i value, and then sends the first vector to the vector XOR operator 34. For example, for the first absorption process, i = 0, the first vector with a length of r is obtained from the input information and sent to the vector XOR operator 34, and the processing module 31 also sends the effective length r to the vector XOR operator 34. The vector XOR operator 34 obtains the current state vector from the second vector register, then performs XOR operation on the first r bits of the current state vector and the first vector to obtain an XOR result, and sends the XOR result to the f function calculation module 35. The f function calculation module 35 performs f function calculation on the XOR result to obtain a first output vector, and then feeds back the first output vector to the processing module 31. The processing module 31 further determines whether the current filling process is the last filling process. If yes, the first output vector is taken as the absorption stage output vector. If no, the first output vector is sent to the second vector register to update the current state vector in the second vector register, and then the next filling process number i+1 is sent to the vector shifter 33, so that the vector shifter 33 obtains the i+2th first vector with a length of r from the input information and sends the first vector to the vector XOR operator 34. The vector XOR operator 34 performs XOR operation on the first r bits of the current state vector and the new first vector received to obtain an XOR result, and sends the XOR result to the f function calculation module 35. The f function calculation module 35 performs f function calculation on the XOR result to obtain a first output vector corresponding to the i+1th filling process, and feeds back to the processing module 31. This process is repeated until the first output vector is taken as the absorption stage output vector when it is determined that the current filling process is the last filling process, thereby completing the calculation of the absorption stage.

[0120] In the compression phase, the processing module 31 sends a compression instruction to the f function calculation module 35, the f function calculation module 35 obtains the current state vector from the second vector register according to the compression instruction (for the first compression process, the current state vector corresponding thereto is the output vector of the absorption phase), performs f function operation on the current state vector to obtain a second output vector, and feeds back the second output vector to the processing module 31. After receiving the second output vector, when the processing module 31 determines that the current compression process is the last compression process, the output vector of the compression phase is obtained based on the output vector of the absorption phase and the obtained second output vectors; when the processing module 31 determines that the current compression process is not the last compression process, the processing module 31 sends the second output vector to the second vector register, updates the current state vector in the second vector register, and returns to send a compression instruction to the f function calculation module 35 until the last compression process is completed, and the final output vector of the compression phase is obtained.

[0121] In addition, for specific introduction of the absorption phase and the compression phase, please refer to the above method embodiment, and the present application will not be described here.

[0122] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the related parts can be referred to the method part.

[0123] It should be further noted that the relative terms, such as first and second, in the specification are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitation, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0124] Those skilled in the art will further appreciate that the units and algorithms described in connection with the examples disclosed herein can be embodied directly in hardware, in software, or in a combination of the two. For the sake of brevity, descriptions of a method or an algorithm described in the preceding description will not be repeated in the following description of the examples. For the sake of brevity, descriptions of a method or an algorithm described in the preceding description will not be repeated in the following description of the examples. Those skilled in the art will appreciate that the functions described in the examples can be implemented in software in which the steps are performed by application specific, hardware / software modules or circuits or general purpose hardware or a combination thereof. For example, some of the examples can be implemented in software that is stored in memory and executed by a processor of the machine. As another example, some of the examples can be implemented by hardware, for example, as an integrated circuit such as an application specific integrated circuit, a field programmable gate array or a hardware implementation of a software module.

[0125] The steps of a method or algorithm described in connection with the examples disclosed herein can be embodied directly in hardware, in software, or in a combination of the two. Software modules can be stored in Random Access Memory (RAM), memory, or in another type of storage medium such as a disk drive, CD-ROM, or hard drive. The examples described herein are not limited to any particular software configuration.

[0126] The above description of disclosed examples is intended to be illustrative and not restrictive. Many embodiments of the present application will be apparent to those of skill in the art upon reviewing the above description. The scope of the application should, therefore, be determined not with reference to the above description, but instead with reference to the appended claims, along with their full scope of equivalents.

Claims

1. A method for implementing an SHA3 algorithm based on a RISC-V architecture, characterized in that, The method comprises the following steps: determining an effective length and an output data length according to a target function; determining a total number of filling processes in an absorption stage and a total number of compression processes in a compression stage according to input information, the effective length and the output data length, wherein the total number of filling processes is determined based on the input information and the effective length, and the total number of compression processes is determined based on the effective length and the output data length; in the absorption stage, calculating each filling process according to a first initial state vector, the input information, the effective length and the total number of filling processes to obtain an absorption stage output vector; in the compression stage, calculating each compression process based on the absorption stage output vector to obtain a compression stage output vector; the step of determining the effective length and the output data length according to the target function comprises the following steps: determining the effective length and the output data length corresponding to the target function from a pre-established function parameter configuration table according to the target function; before the step of calculating each compression process based on the absorption stage output vector to obtain a compression stage output vector, the method further comprises the following steps: determining whether the length of the output vector is greater than the effective length and whether the output data length is greater than the effective length, if yes, performing the step of calculating each compression process based on the absorption stage output vector to obtain a compression stage output vector, and if no, directly taking the first output vector length bits of the absorption stage output vector as the compression stage output vector; the step of calculating each filling process according to the first initial state vector, the input information, the effective length and the total number of filling processes to obtain an absorption stage output vector in the absorption stage comprises the following steps: for the i-th filling process, obtaining a first vector with an i+1-th length equal to the effective length from the input information; performing an exclusive or operation on the first vector and a current state vector to obtain an exclusive or result; performing an f function calculation on the exclusive or result to obtain a first output vector; determining whether the i-th filling process is the last filling process, if yes, taking the first output vector as the absorption stage output vector, and if no, updating the current state vector by using the first output vector; performing a plus 1 operation on the i, and returning to perform the step of obtaining a first vector with an i+1-th length equal to the effective length from the input information until the absorption stage output vector is obtained after the last filling process is completed; wherein, when the i is 0, the current state vector is the first initial state vector; the step of calculating each compression process based on the absorption stage output vector to obtain a compression stage output vector in the compression stage comprises the following steps: for the current compression process, performing an f function operation on the current state vector to obtain a second output vector; determining whether the current compression process is the last compression process, and if so, obtaining a compression stage output vector based on the absorption stage output vector and each second output vector; and if not, updating the current state vector using the second output vector, and returning to perform the process of performing the f function operation on the current state vector until the last compression process is performed; wherein the compression process is M, and the compression stage output vector is data integrated from the first r bits of the absorption stage output vector, the first r bits of each of the first M-1 second output vectors, and the (d-M*r) bits of the Mth second output vector.

2. An apparatus for implementing SHA3 algorithm based on RISC-V architecture, characterized in that, comprising: a determination module configured to determine an effective length and an output data length according to a target function; a calculation module configured to determine a total number of padding processes in an absorption stage and a total number of compression processes in a compression stage according to input information, the effective length, and the output data length, wherein the total number of padding processes is determined based on the input information and the effective length, and the total number of compression processes is determined based on the effective length and the output data length; an absorption processing module configured to calculate each of the padding processes in the absorption stage according to a first initial state vector, the input information, the effective length, and the total number of padding processes, to obtain an absorption stage output vector; a compression processing module configured to calculate each of the compression processes in the compression stage based on the absorption stage output vector, to obtain a compression stage output vector; and determining the effective length and the output data length according to the target function includes: matching the effective length and the output data length corresponding to the target function from a pre-established function parameter configuration table according to the target function; before calculating each of the compression processes based on the absorption stage output vector to obtain a compression stage output vector, further comprising: determining whether an output vector length is greater than the effective length and whether an output data length is greater than the effective length, and if so, performing the step of calculating each of the compression processes based on the absorption stage output vector to obtain a compression stage output vector; and if not, directly taking the first r bits of the absorption stage output vector as a compression stage output vector; and the absorption processing module includes: a first acquisition unit configured to acquire, for an i-th padding process, an i+1-th first vector with a length of the effective length from the input information; an exclusive OR unit configured to perform an exclusive OR operation on the first vector and a current state vector to obtain an exclusive OR result; a calculation unit configured to perform an f function calculation on the exclusive OR result to obtain a first output vector; a first determination unit configured to determine whether the i-th padding process is the last padding process, and if so, trigger a first determination unit, and if not, trigger a first update unit; the first determination unit configured to take the first output vector as an absorption stage output vector. The first updating unit is configured to update the current state vector by using the first output vector; The second updating unit is configured to increase the i by 1 and trigger the acquisition module until an absorption stage output vector is obtained after the last padding process; when the i is 0, the current state vector is the first initial state vector; the compression processing module comprises: The f function calculation unit is configured to perform f function operation on the current state vector to obtain a second output vector for a current compression process; The second determining unit is configured to obtain a compression stage output vector based on the absorption stage output vector and the second output vector; The third updating unit is configured to update the current state vector by using the second output vector and trigger the f function calculation unit until the last compression process is executed; when the compression process is M, the compression stage output vector is obtained by integrating the first r bits of the absorption receiving output vector, the first r bits of each of the first M-1 second output vectors and the (d-M*r) bits of the Mth second output vector, and the data is integrated as the final compression stage output vector. Comprise:

3. A RISC-V architecture based SHA3 algorithm implementation system, characterized in that, Memory and processor, wherein: The memory is configured to store a computer program; The processor is configured to execute the computer program to implement the steps of the SHA3 algorithm implementation method based on the RISC-V architecture according to claim 1. The processor comprises a processing module, a register module, a vector shifter, a vector XOR and an f function calculation module, wherein:

4. The RISC-V architecture based SHA3 algorithm implementation system according to claim 3, characterized in that, The register module is configured to store input information and state vectors; The processing module is configured to determine the total number of padding processes in the absorption stage and the total number of compression processes in the compression stage according to the input information, the effective length and the output data length; configured to send the current padding process number i to the vector shifter in the absorption stage, and after receiving the first output vector, if it is determined that the current padding process is the last padding process, the first output vector is taken as the absorption stage output vector, if it is determined that the current padding process is not the last padding process, the current state vector of the register module is updated by using the first output vector, and the new i is sent to the vector shifter after the i is increased by 1; The vector shifter is configured to determine the first vector with the effective length from the acquired input information according to the i, and send the first vector to the vector XOR; The vector XOR is configured to perform XOR operation on the first vector and the current state vector, and send the obtained XOR result to the f function calculation module; ​ The f function calculation module is configured to perform f function calculation on the XOR result to obtain a first output vector, and feed back the first output vector to the processing module; The processing module is further configured to send a compression instruction to the f function calculation module in the compression stage; when it is determined that the current compression process is the last compression process after receiving a second output vector, obtain a compression stage output vector based on the absorption stage output vector and the second output vector; when it is determined that the current compression process is not the last compression process, update the current state vector of the register module by using the second output vector, and return to send the compression instruction to the f function calculation module; The f function calculation module is configured to perform f function operation on the current state vector according to the compression instruction to obtain a second output vector, and feed back the second output vector to the processing module.

Images