Data compression circuit and chip for a secure hash algorithm

Abstract

A data compression circuit and chip of SHA-256, wherein the nth stage single-stage compression circuit is an iteration circuit with intermediate variables, comprising: eight input side registers A, B, C, J, E, F, G, I; eight output side registers A', B', C', J', E', F', G', I'; a first preprocessing circuit configured to perform one iteration operation of variable i based on the input message word and the outputs of A and G; an operation circuit of variable e configured to perform one iteration operation of variable e based on the outputs of I, E, F and G; a second preprocessing circuit configured to perform one iteration operation of variable j based on the outputs of E and C; an operation circuit of variable a configured to perform one iteration operation of variable a based on the outputs of A, B, C and J; A and B', B and C', E and F', and F and G' are directly connected; the iteration operation of variables a and e is balanced to the iteration operation of four variables in the embodiment of the disclosure, and the critical path is shortened.

Description

Technical Field

[0001] This disclosure relates to, but is not limited to, the implementation of a secure hash algorithm, and more specifically, to a data compression circuit and chip for a secure hash algorithm. Background Technology

[0002] SHA-2 (Security Hash Algorithm-2) is a cryptographic hash algorithm used to implement one-way mappings between data. It can map messages of arbitrary length to fixed-length message digests, and the mapping process is irreversible. Depending on the length of the output message digest, SHA-2 is divided into algorithms such as SHA-224, SHA-256, SHA-384, and SHA-512, primarily used in digital signatures, fingerprint verification, and network security protocols. SHA-256 is a one-way hash algorithm capable of mapping messages of any length less than 2 bytes to a fixed-length message digest. 64 The SHA-256 algorithm converts a 256-bit input message into a message digest, which offers high security. However, its performance still needs improvement when applied to chips. Summary of the Invention

[0003] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0004] This disclosure provides a data compression circuit for the secure hash algorithm SHA-256. The nth stage compression circuit in this data compression circuit is an iterative circuit with intermediate variables, where n = n1, n1+1, n1+2, ..., n2, n2 > n1 ≥ 3. The iterative circuit includes:

[0005] There are 8 input registers A, B, C, J, E, F, G, I. Among them, A, B, C, D output the data of variables a, b, c, j after n-2 iterations, respectively, and E, F, G, I output the data of variables e, f, g, i after n iterations, respectively.

[0006] There are 8 output registers A', B', C', J', E', F', G', I', where A', B', C', J' store the data of variables a, b, c, j after n-1 iterations, respectively, and E', F', G', I' store the data of variables e, f, g, i after n+1 iterations, respectively.

[0007] The first preprocessing circuit is configured to perform one iterative operation on variable i based on the input message word and the outputs of A and G, to obtain i. n+1 or And satisfy i n+1 =a n-2 +g n +Kn+1 +W n+1 ;

[0008] The circuit for calculating variable e is configured to perform one iterative operation on variable e based on the outputs of I, E, F, and G, to obtain e. n+1 or And satisfy e n+1 =i n +∑1e n +Ch(e n ,f n ,g n );

[0009] The second preprocessing circuit is configured to perform one iterative operation on variable j based on the outputs of E and C, to obtain j. n-1 or And satisfy j n-1 =e n -c n-2 ;

[0010] The circuit for calculating variable 'a' is configured to perform one iterative operation on variable 'a' based on the outputs of A, B, C, and J, to obtain 'a'. n-1 or And satisfy a n-1 =∑0a n-2 +Maj(a n-2 ,b n-2 ,c n-2 )+j n-2 ;

[0011] Among them, A and B', B and C', E and F', and F and G' are directly connected;

[0012] Where, x m K represents the value of variable x after m iterations, where x is a, b, c, j, e, f, g, i; n+1 It is the (n+1)th fixed message word, W n+1 It is the (n+1)th message word obtained by grouping or expanding the input message block.

[0013] This disclosure also provides a chip including a message expansion circuit and a data compression circuit, wherein the data compression circuit employs the secure hash algorithm SHA-256 described in any embodiment of this disclosure.

[0014] The data compression circuit and chip of the SHA-256 algorithm described in the above embodiments of this disclosure can shorten the critical path of SHA-256 operation, without the need to add registers, providing higher performance, lower power consumption, and smaller chip area.

[0015] After reading and understanding the accompanying diagrams and detailed descriptions, the other aspects can be understood. Attached Figure Description

[0016] The accompanying drawings are provided to illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the technical solutions of this disclosure and do not constitute a limitation on the technical solutions of this disclosure.

[0017] Figure 1A This is a diagram illustrating message padding in SHA-256;

[0018] Figure 1B This is a structural block diagram of a chip that can implement SHA-256 according to an embodiment of this disclosure;

[0019] Figure 2 This is a circuit diagram of the data compression section and the data expansion section according to an embodiment of the present disclosure;

[0020] Figure 3 It is a logic block diagram of the compressed structure used to implement the original single-round iterative function;

[0021] Figure 4 This is a schematic diagram of the compressed structure used to implement the single-round iterative function of the embodiments of this disclosure;

[0022] Figure 5 This is a schematic diagram of another compressed structure for implementing the single-round iterative function of the embodiments of this disclosure;

[0023] Figure 6 This is a schematic diagram of another compressed structure for implementing the single-round iterative function of the embodiments of this disclosure;

[0024] Figure 7 This is a logic block diagram of a single-stage compression circuit for implementing a single-round iterative function according to an embodiment of the present disclosure;

[0025] Figure 8 This is a logic block diagram of another single-stage compression circuit for implementing a single-round iterative function according to an embodiment of the present disclosure;

[0026] Figure 9A This is a logic block diagram of a single-stage compression circuit when the bitwise inversion of the output variable is performed according to an embodiment of this disclosure;

[0027] Figure 9B This is a logic block diagram of a two-stage compression circuit for bitwise inversion of the output variable according to an embodiment of this disclosure;

[0028] Figure 10 This is a schematic diagram of CSA;

[0029] Figure 11 This is a schematic diagram of the FAIN module in the CSN of this disclosure embodiment;

[0030] Figure 12 This is a logic block diagram of a two-level compression structure based on CSN according to an embodiment of this disclosure;

[0031] Figure 13 yes Figure 12 A logic block diagram of another structure of the first-level compression structure;

[0032] Figure 14 This is a logic block diagram of the compression circuit of level 0 and level 1 according to an embodiment of this disclosure;

[0033] Figure 15 This is a logic block diagram of the second and third stages of the compression circuit according to an embodiment of this disclosure;

[0034] Figure 16 This is a logic block diagram of the compression circuit for levels 63 to 64 of an embodiment of this disclosure;

[0035] Figure 17 This is a logic block diagram of the compression circuit at level 65 of an embodiment of this disclosure. Detailed Implementation

[0036] This disclosure describes several embodiments, but these descriptions are exemplary and not restrictive, and it will be apparent to those skilled in the art that more embodiments and implementations are possible within the scope of the embodiments described herein.

[0037] In the description of this disclosure, words such as "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment described as "exemplary" or "for example" in this disclosure should not be construed as being more preferred or advantageous than other embodiments. The word "and / or" in this document describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. "Multiple" refers to two or more. Furthermore, to facilitate a clear description of the technical solutions of the embodiments of this disclosure, the terms "first" and "second" are used to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply differences.

[0038] In the description of this application, phrases such as "including any one or more of the following: Option 1, Option 2, ..." or "including any one or more of Option 1, Option 2, ..." mean including any one of the listed options, or any combination of multiple listed options. For example, "including any one or more of the following: A, B" or "including any one or more of A, B" means including only A, only B, or both A and B; similarly, "including any one or more of the following: A, B, C" or "including any one or more of A, B, C" means including only A, only B, only C, both A and B, both A and C, both B and C, or both A, B, and C. The same principle applies to applications with more options.

[0039] In describing representative exemplary embodiments, the specification may have presented methods and / or processes as a specific sequence of steps. However, the method or process should not be limited to the specific order of steps described herein, to the extent that it does not depend on such a specific order. As will be understood by those skilled in the art, other sequences of steps are also possible. Therefore, the specific order of steps set forth in the specification should not be construed as a limitation of the claims. Furthermore, the claims relating to the method and / or process should not be limited to the steps performed in the order written, and those skilled in the art will readily understand that these orders may be varied and still remain within the spirit and scope of the embodiments disclosed herein.

[0040] The SHA-256 algorithm can handle lengths less than 2 bytes. 64 The input message (also known as input data) is converted into a 256-bit message digest, the message block length is 512 bits, and the message word length in the iterative compression process is 32 bits. SHA-384 and SHA-512 support a maximum length of 2... 128 The message word is 64 bits long. The basic operations during iterative compression are the same, only the initial values ​​used are different.

[0041] The following description uses the SHA-256 algorithm as an example, but the methods and apparatus of this disclosure can also be used to implement other SHA-2 algorithms.

[0042] The SHA-256 algorithm uses functions Ch, Maj, ∑0, and ∑1 for data compression and functions σ0 and σ1 for data expansion. These functions are defined as follows:

[0043]

[0044]

[0045]

[0046]

[0047]

[0048]

[0049] The symbols in the above functions have the following meanings:

[0050] ∧ Bitwise AND operation

[0051] ∨ Bitwise OR operation

[0052] Bitwise XOR operation

[0053] Bitwise NOT operation

[0054] ROTR n (x) Circular right shift operation: Circularly shift x to the right by n bits.

[0055] SHR n (x) Right shift operation \, shifts x to the right by n bits, padding the left with 0s.

[0056] The SHA-256 algorithm mainly consists of three parts: message padding, data expansion, and data compression.

[0057] Message Population

[0058] First, add a 1 bit to the end of the message of length L, then add K 0 bits, and finally append 64 bits of length information. For example... Figure 1A As shown in the diagram. For example, when padding the input hexadecimal plaintext message "616263", according to the padding rules, the first step is to add a bit 1 to the end of the message, the second step is to add bits 0, the total number of bits being: 512 - 24 - 1 - 64 = 423 bits. The third step is to add 64 bits of length information. The length of the input message is 6 x 4 = 24 bits, and 24 in decimal is 18 in hexadecimal. Therefore, the 64-bit length information is "0000 0000 0000 0018".

[0059] Data expansion

[0060] The padded message can be divided into multiple 512-bit message blocks. The SHA-256 algorithm uses two types of message words during iterative compression: one is a fixed 32-bit constant, also called a fixed message word, of which there are 64, denoted as K0, K1…, K… 63 Another method is message word generation through message block expansion. Each expanded message block generates 64 32-bit message words. The rules for message block expansion are as follows:

[0061] The message block is divided into 16 message words W0, W1, ..., W 15 ;and

[0062] The remaining 48 message words W are obtained using the following formula. 16 W 17 …,W 63 :

[0063] W j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 j = 16, 17, ..., 63

[0064] The functions σ0 and σ1 used are as described above and will not be repeated here.

[0065] Data compression

[0066] The SHA-256 algorithm is an iterative compression process. A message block is compressed at 64 levels to output a 256-bit hash value.

[0067] The iterative compression process uses 8 variables a, b, c, d, e, f, g, h and 64 fixed constant message words K. n and the 64 message words W generated by extension n n = 0, 1, ..., 63, and both variables and message words are 32 bits.

[0068] In the SHA-256 algorithm, the compression operation performed in each iteration is the same. The single-level iteration function is represented as follows:

[0069] h n+1 =g n

[0070] g n+1 =f n

[0071] f n+1 =e n

[0072] e n+1 =d n +h n +∑1e n +Ch(e n ,f n ,g n )+K n +W n

[0073] d n+1 =c n

[0074] c n+1 =b n

[0075] b n+1 =a n

[0076] a n+1 =∑0a n +Maj(a n ,b n ,c n )+h n +∑1e n +Ch(e n ,f n ,g n )+K n +W n

[0077] In this paper, the aforementioned single-level iterative function is referred to as the original single-level iterative function. In this paper, a and a, b and b, c and c, d and d, e and e, f and f, g and g, h and h, i and i, j and j, n and n, etc., represent the same variable.

[0078] After dividing the input message into multiple message blocks, when compressing the first message block, the initial values ​​of the eight variables a0, b0, c0, d0, e0, f0, g0, h0 are fixed. After 64 levels of iterative compression, the output value a of the eight variables is... 63 ,b 63 ,c 63 ,d 63 ,e 63 ,f 63 ,g 63 ,h 63 Modulo 2 with their respective initial values 32 After addition and concatenation, the compressed output of the first message block is obtained, which is a 256-bit hash value. Starting from the second message block, each message block is compressed in the same way, using the output of the previous message block as the initial values ​​of 8 variables, until all message blocks are compressed, and the 256-bit message digest of the input message is output.

[0079] Figure 1B A chip capable of implementing the aforementioned SHA-256 algorithm is shown. The chip includes:

[0080] The message filling circuit is configured to fill in the input message;

[0081] The message expansion circuit is configured to group the padded message block into 16 message words; and to expand the 16 message words obtained by grouping into 48 message words.

[0082] The data compression circuit is configured to perform 64-level iterative compression based on the 64 message words output by the message grouping module and the message word generation module to generate a message digest converted from the input message;

[0083] Control circuit. It is configured to work in concert with the control message filling circuit, message expansion circuit, and data compression circuit to convert the input message according to the SHA-256 algorithm.

[0084] In the chip's input signals shown in the diagram, Rst is the reset signal, Clk is the clock signal, Last_byte is the end signal, data_in is the input message data, data_en = 1 indicates valid input data, and Vbit is the input signal. Last_byte indicates the last valid input data. In the output signals, digest is the message digest converted from the input message, bingo_buf is the valid message digest flag, and fifo_read is the external FIFO data read control bit. The above signals are merely illustrative; other signals can be added or removed.

[0085] The aforementioned chips can be application-specific integrated circuit (ASIC) chips, but are not limited to them.

[0086] High-throughput SHA-256 is typically implemented using a pipelined hardware architecture. An exemplary SHA-256 fully pipelined circuit architecture is shown below. Figure 2As shown, the system includes a pipelined data compression circuit and a message expansion circuit. Taking the processing of a single message block as an example, with each clock trigger edge, the message expansion circuit enters a new message block M, divides M into message words W0 to W15, and stores them in the first-stage register group Wt Reg of the data expansion circuit. W0 is then input to the 0th-stage compressor for compression. Then, as the clock trigger edges continue to arrive, the message block is continuously pipelined forward and expanded stage by stage through the expander circuit to generate message words W16 to W63. Simultaneously, message words W1 to W63 are progressively input to the corresponding compressor circuits for compression, until 64 stages of compression are completed, yielding the compressed output data of the message block. After processing the message block, all information related to that message block is removed from the pipelined structure. The data compression circuit uses a 64-stage variable register AH Reg to temporarily store variable values. The data expansion circuit uses a 64-stage message word register Wt Reg to temporarily store the expanded message words.

[0087] In the above pipeline structure, the single-stage compression circuit corresponds to the single-stage iterative function of the SHA256 algorithm. An exemplary single-stage compression circuit is as follows: Figure 3 As shown in the diagram. The rectangles in the diagram represent variable registers. The eight variable registers on the left are called input registers, which are used to store the values ​​of variables a, b, c, d, e, f, g, and h after n iterations. n ,b n ,c n ,d n ,e n ,f n ,g n ,h n The eight variable registers on the right are called output registers, and are used to store the values ​​of variables a, b, c, d, e, f, g, and h after n+1 iterations, respectively. n+1 ,b n+1 ,c n+1 ,d n+1 ,e n+1 ,f n+1 ,g n+1 ,h n+1 The data. The output register of the nth stage compression circuit is the input register of the (n+1)th stage compression circuit, where n = 0, 1, 2, ..., 63. a0, b0, c0, d0, e0, f0, g0, h0 represent the values ​​of variables a, b, c, d, e, f, g, h before iteration, i.e., the initial values ​​of variables a, b, c, d, e, f, g, h.

[0088] For ease of expression, x mThis represents the value of variable x after m iterations. x can be any variable, including a, b, c, j, e, f, g, i, and intermediate variables, such as i and j in the examples below.

[0089] For ease of explanation, the input and output registers are represented by the corresponding symbols of the variables they store. For example, in the input registers, the register used to store the data of variable 'a' is called register A, abbreviated as A; the register used to store the data of variable 'b' is called register B, abbreviated as B; the register used to store the data of variable 'c' is called register C, abbreviated as C; and so on. Similarly, in the output registers, the register used to store the data of variable 'a' is called register A', abbreviated as A'; the register used to store the data of variable 'b' is called register B', abbreviated as B'; the register used to store the data of variable 'c' is called register C', abbreviated as C'; and so on.

[0090] In some embodiments, the variables stored in the input-side registers and output-side registers may differ at different stages. For example, the compression circuits at stages 0 to 2 have registers to store the data of variables d and h, referred to as registers D and H. The compression circuits at stages 3 to 62 do not have registers to store the data of variables d and h, but instead have registers to store the data of variables i and j, referred to as registers I and J. However, registers I and J and registers D and H can be identical in hardware.

[0091] Figure 3 The boxes in the diagram represent various operators, and the arrows indicate the data flow direction. Boxes marked with a "+" indicate modulo 2. 32 The adder; the box marked "Ch" represents the circuit used to implement the function Ch operation, called the Ch operator; the box marked "Maj" represents the circuit used to implement the function Maj operation, called the Maj operator; the box marked "∑0" represents the circuit used to implement the function ∑0 operation, called the ∑0 operator; the box marked "∑1" represents the circuit used to implement the function ∑1 operation, called the ∑1 operator.

[0092] The expressions for functions Ch, Maj, ∑0, and ∑1 have been given above:

[0093]

[0094]

[0095]

[0096]

[0097] Based on the above expressions, the Ch operator, Maj operator, ∑0 operator, and ∑1 operator can be implemented using various gate-level circuits. The embodiments disclosed herein are not limited to a specific implementation method.

[0098] The critical path of a single-stage compression circuit is a n+1 and e n+1 The calculation path. Figure 3 In the single-stage compression circuit shown, in order to obtain a n+1 and e n+1 Each operation requires six addition operations, resulting in a long path that can affect the chip's operating frequency, performance, and power consumption.

[0099] This disclosure optimizes the compression structure of the SHA256 algorithm. Addition operations are distributed as evenly as possible across iterative operations on multiple variables to shorten the critical path.

[0100] Therefore, the embodiments disclosed herein will use W n ,K n ,d n ,h n To add them beforehand, introduce a variable i, let:

[0101] i n =d n +h n +K n +W n =c n-1 +g n-1 +K n +W n

[0102] Yes: i n+1 =c n +g n +K n+1 +W n+1

[0103] Because: e n+1 =d n +h n +∑1e n +Ch(e n ,f n ,g n )+K n +W n

[0104] There is: e n+1 =i n +∑1e n +Ch(e n ,f n ,g n )

[0105] Because: an+1 =∑0a n +Maj(a n ,b n ,c n )+h n +∑1e n +Ch(e n ,f n ,g n )+K n +W n

[0106] There is: a n+1 =∑0a n +Maj(a n ,b n ,c n )+i n +∑1e n +Ch(e n ,f n ,g n )-d n

[0107] There is: a n+1 =∑0a n +Maj(a n ,b n ,c n )+e n+1 -d n

[0108] Calculate e in advance n+1 -d n Introduce variable j, let:

[0109] j n =e n+1 -d n =e n+1 -c n-1

[0110] There is: j n+1 =e n+2 -c n

[0111] Because: a n+1 =∑0a n +Maj(a n ,b n ,c n )+e n+1 -d n

[0112] There is: a n+1 =∑0a n +Maj(a n ,bn ,c n )+j n

[0113] The improved single-level iterative function of this embodiment is obtained as follows:

[0114] j n+1 =e n+2 -c n

[0115] i n+1 =c n +g n +K n+1 +W n+1

[0116] h n+1 =g n

[0117] g n+1 =f n

[0118] f n+1 =e n

[0119] e n+1 =i n +∑1e n +Ch(e n ,f n ,g n )

[0120] d n+1 =c n

[0121] c n+1 =b n

[0122] b n+1 =a n

[0123] a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0124] In the improved formula above, variables h and d do not participate in the calculations of other variables as intermediate variables; they are simply obtained by calculating g and c. Therefore, the intermediate calculation process can be temporarily eliminated. During the final compression stage, based on g... 62 Get h 63 According to c 62 Get d 63 That's all.

[0125] Based on the improved single-stage iterative function described above, the optimized compression circuit is obtained as follows: Figure 4 As shown. Calculate a. n+1 and e n+1 The critical path now only requires two addition operations, a significant reduction from the previous six.

[0126] Figure 4 The compression structure requires the use of e n+2 Generate j n+1 To make the data flow more reasonable, variable e can be iterated twice relative to variable j in advance, so that e n+2 You can be in j n+1 Previously obtained, but the variables e, f, g, i are strongly correlated. In this embodiment, the iterative calculations of e, f, g, i are performed together in advance. The modified compressed structure is as follows: Figure 5 As shown.

[0127] However, i is generated after the movement. n+1 C is required. n And c n Than i n+1 Later, it was found that, in order to make the data flow more reasonable, by:

[0128] c n+1 =b n

[0129] b n+1 =a n

[0130] We can get c n =a n-2 ,so:

[0131] i n+1 =a n-2 +g n +K n+1 +W n+1

[0132] The corresponding compression structure is as follows Figure 6 As shown.

[0133] Will Figure 6 The compression structure shown corresponds to a single stage, which can be obtained as follows: Figure 7 The single-stage compression circuit is shown below. The corresponding single-stage iterative function for this single-stage compression circuit is as follows:

[0134] j n+1 =e n+2 -c n

[0135] i n+1 =a n-2+g n +K n+1 +W n+1

[0136] g n+1 =f n

[0137] f n+1 =e n

[0138] e n+1 =i n +∑1e n +Ch(e n ,f n ,g n )

[0139] c n+1 =b n

[0140] b n+1 =a n

[0141] a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0142] The above single-level iterative function can also include expressions for variables h and d: h n+1 =g n d n+1 =c n However, as mentioned earlier, in some single-stage compression circuits, iterative calculations of variables d and f may not be necessary.

[0143] The single-level iterative function described above relies on the values ​​of the variables. If the data of the variables were the bitwise negations of the variables, the expression of the single-level iterative function would need to be adaptively changed. However... Figure 7 Based on the compression circuit shown, the hardware structure can also be modified to implement the above single-level iterative function using various hardware structures.

[0144] In the text, bitwise NOT of a variable is used to invert the value of the variable, such as a. n ,b n ,c n The value obtained by bitwise inversion is denoted as

[0145] Based on the above-mentioned single-level iterative function, one embodiment of this disclosure provides a data compression circuit for the secure hash algorithm SHA-256, wherein the nth-level single-level compression circuit is an iterative circuit with intermediate variables (referring to variables i, j), n = n1, n1+1, n1+2, ..., n2, n2>n1≥3, and the iterative circuit includes:

[0146] There are 8 input registers A, B, C, J, E, F, G, I. Among them, A, B, C, D output the data of variables a, b, c, j after n-2 iterations, respectively, and E, F, G, I output the data of variables e, f, g, i after n iterations, respectively.

[0147] There are 8 output registers A', B', C', J', E', F', G', I', where A', B', C', J' store the data of variables a, b, c, j after n-1 iterations, respectively, and E', F', G', I' store the data of variables e, f, g, i after n+1 iterations, respectively.

[0148] The first preprocessing circuit is configured to perform one iterative operation on variable i based on the input message word and the outputs of A and G, to obtain i. n+1 or And satisfy i n+1 =a n-2 +g n +K n+1 +W n+1 ;

[0149] The circuit for calculating variable e is configured to perform one iterative operation on variable e based on the outputs of I, E, F, and G, to obtain e. n+1 or And satisfy e n+1 =i n +∑1e n +Ch(e n ,f n ,g n );

[0150] The second preprocessing circuit is configured to perform one iterative operation on variable j based on the outputs of E and C, to obtain j. n-1 or And satisfy j n-1 =e n -c n-2 ;

[0151] The circuit for calculating variable 'a' is configured to perform one iterative operation on variable 'a' based on the outputs of A, B, C, and J, to obtain 'a'. n-1 or And satisfy a n-1 =∑0a n-2 +Maj(an-2 ,b n-2 ,c n-2 )+j n-2 ;

[0152] Among them, A and B', B and C', E and F', and F and G' are directly connected;

[0153] Where, x m K represents the value of variable x after m iterations, where x is a, b, c, j, e, f, g, i; n+1 It is the (n+1)th fixed message word, W n+1 It is the (n+1)th message word obtained by grouping or expanding the input message block.

[0154] In the text, the data for variables can be the values ​​of the variables, such as a. n-2 ,b n-2 ,c n-2 It can also be the bitwise negation of a variable, such as... And so on. "Bitwise inversion" is simply called "invert".

[0155] In this embodiment, when the data of the variable obtained by the iterative operation is the bitwise inverse of the variable, such as... Requires satisfying e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ), refers to The result of bitwise inversion is e n+1 The expression is satisfied. This embodiment optimizes the compression circuit, but the value of any variable after m iterations is still the value of that variable after m iterations of the SHA-256 algorithm, and will not change, where m = 0, 1, 2, ..., 63.

[0156] In this embodiment, the calculation paths of variables a and e are simplified to two addition operations. Among the two added intermediate variables, the calculation path of i has three additions, but it does not have the relatively complex operators Maj, Ch, ∑0, ∑1 on the calculation paths of a and e. The calculation path of j has one subtraction operation. Therefore, by iteratively calculating variables i and j, the calculation of variables a and e is preprocessed, and the iterative calculation of two variables is balanced as much as possible to achieve the iterative calculation of four variables. Compared with the iterative calculation of six additions of a and e in the original single-level iterative function, the critical path is significantly shortened.

[0157] Furthermore, since the compression circuit can change the register used to store the data of variables h and d to store the data of variables I and j in the intermediate nth compression circuit, the number of registers is not increased. Therefore, when implementing this improved compression circuit on a chip, higher performance, lower power consumption, and a smaller chip area can be provided.

[0158] In an exemplary embodiment of this disclosure, the data compression circuit includes 66 compression circuits from level 0 to level 65, wherein the 66 compression circuits are in a pipeline structure, n1 is greater than or equal to 3, and n2 is less than or equal to 62.

[0159] Each stage of the 66-stage compression circuit includes 8 input-side registers and 8 output-side registers. The output-side register group of each stage of the compression circuit is the input-side register group of the next stage of the compression circuit.

[0160] In one example of this embodiment, n1 = 3 and n2 = 62, meaning that the compression circuits from level 3 to level 62 are all iterative circuits of this embodiment (with intermediate variables), but this disclosure is not limited to this. It is also possible to use the iterative circuits of this embodiment starting from level 4, level 5, or even later levels or more. In this case, the multiple single-stage compression circuits preceding the iterative circuits of this embodiment can be based on... Figure 3 The compression circuit shown requires that variables a, b, c, d be delayed by two iterations relative to variables e, f, g, h (i.e., two fewer iterations). The data for variables i and j can be obtained in the stage preceding the iterative circuit of this embodiment using the iterative formula for variables i and j in the single-stage iterative function of this embodiment. Similarly, the iterative circuit of this embodiment can also end at stage 61, stage 60, or one or more stages earlier. After completion, variables a, b, c, d, e, f, g, h can be used to complete subsequent iterative calculations. This disclosure does not limit the specific compression circuit.

[0161] In an exemplary embodiment of this disclosure, the iterative circuit includes a first iterative circuit; the A, B, C, J, E, F, G, I of the first iterative circuit respectively output a n-2 ,b n-2 ,c n-2 ,j n-2 ,e n ,f n ,g n i n The first iterative circuit's A', B', C', J', E', F', G', I' respectively store a n-1 ,b n-1 ,c n-1 ,j n-1 ,e n+1 ,f n+1 ,gn+1 i n+1 .

[0162] An example of this embodiment is as follows: Figure 7 As shown, in this first iterative circuit:

[0163] The first preprocessing circuit includes an input terminal connected to the output terminals of A and G and receiving W. n+1 The output terminal is connected to the first addition circuit of I'; the first preprocessing circuit is configured to perform one iterative operation i on variable i. n+1 =a n-2 +g n +K n+1 +W n+1 Get i n+1 ;K n+1 K is a constant and can be used as an input, or it can be implemented through the internal logic of the circuit, like CSK. n+1 The same calculation result is used as input.

[0164] The second preprocessing circuit includes an input terminal connected to the output terminals of C and E, and an output terminal connected to the first subtraction circuit of J'; the second preprocessing circuit is configured to perform one iterative operation j on variable j. n-1 =e n -c n-2 Get j n-1 ;

[0165] The operational circuit for variable e includes a ∑1 operator whose input is connected to the output of E, a Ch operator whose input is connected to the outputs of E, F, and G, and a second adder circuit whose input is connected to the outputs of the ∑1 operator, the Ch operator, and I. The output of the second adder circuit is connected to the input of E'. The operational circuit for variable e is configured to perform one iterative operation on variable e. n+1 =i n +∑1e n +Ch(e n ,f n ,g n ) to get e n+1 ;

[0166] The operational circuit for variable a includes a Maj operator whose input is connected to the outputs of A, B, and C; a ∑0 operator whose input is connected to the output of A; and a third adder circuit whose input is connected to the outputs of the Maj operator, the ∑0 operator, and J. The output of the third adder circuit is connected to the input of A'. The operational circuit for variable a is configured to perform one iterative operation a on variable a. n-1 =∑0a n-2 +Maj(a n-2 ,b n-2 ,cn-2 )+j n-2 Get a n-1 .

[0167] The direct connections between A and B', B and C', E and F', and F and G' are used to respectively connect a n-2 ,b n-2 ,e n ,f n Get b by hitting one shot n-1 ,c n-1 ,f n+1 ,g n+1 .

[0168] exist Figure 7 Based on the nth-stage compression circuit shown, for additions with more than two inputs, a carry-save adder (CSA) can be used to perform 3-2 simplification, converting the addition of three numbers into the addition of two numbers. For additions with only two inputs, a carry-propagate adder (CPA) can be used. CPA accepts two inputs, a1 and a2, and produces output b. The two outputs of the CSA (carry-save adder) are the carry (cout) and the sum (sum). CSA can retain the carry when adding multiple data, performing only one carry transfer, which can effectively reduce computational latency.

[0169] In one example of this embodiment, after using CSA, the corresponding nth-stage compression circuit is as follows: Figure 8 As shown in the figure. The boxes marked "CSA" represent CSA. The first adder circuit includes a first CSA, a second CSA, and an adder for adding two numbers, which is represented by a box with a "+" sign in the figure, taking CPA as an example; the second and third adder circuits both include CSA and CPA connected in series.

[0170] In this embodiment, the input-side register and output-side register in the nth-stage compression circuit are registers whose output is the same as its input. The iterative circuit in the nth-stage compression circuit adopts the following... Figure 7 or Figure 8 The first iterative circuit shown.

[0171] Figure 7 or Figure 8In the single-stage compression circuit used in the illustrated embodiment, the input-side register and output-side register can be the same register for both input and output, i.e., a Q-output register. However, in another embodiment of this disclosure, a register whose output is the inverted input, i.e., a QN-output register, can also be used. Compared to a Q-output register, the QN-output register has one less NOT gate (inv) in its structure, resulting in a smaller area and lower latency.

[0172] When a register with QN output is used as both an input and output register in a data compression circuit, if the data of the variable stored in the input register is the value of the variable, such as a0, b0, c0, d0, e0, f0, g0, h0, a2, b2, c2, d2, e2, f2, g2, h2, etc., then the output from the input register will be the bitwise inverted value of the variable.

[0173] After bitwise inversion, the individual function changes as follows:

[0174]

[0175]

[0176]

[0177]

[0178] Adding multiple variables and then inverting each bit, we have:

[0179]

[0180] Based on the single-level iterative function when the data of the variable is the value of the variable, the single-level iterative function when the data of the variable is the bitwise negation of the variable can be derived. The two are compared below:

[0181] Based on the value of the variable: j n+1 =e n+2 -c n

[0182] Bitwise NOT of variables:

[0183] Based on the value of the variable: i n+1 =a n-2 +g n +K n+1 +W n+1

[0184] Bitwise NOT of variables:

[0185] Based on the value of the variable: e n+1 =in +∑1e n +Ch(e n ,f n ,g n )

[0186] Bitwise NOT of variables:

[0187] Based on the value of the variable: a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0188] Bitwise NOT of variables:

[0189] In the above expression, It can also be represented as K n+1 , It can also be represented as W n+1 .

[0190] Considering that in the nth level of the compression structure, variables e, f, g, i undergo two more iterations than a, b, c, j, the single-level iterative function based on the bitwise negation of the variables can be expressed as follows:

[0191]

[0192]

[0193]

[0194]

[0195]

[0196]

[0197]

[0198]

[0199] This single-level iterative function based on the bitwise negation of a variable is a variation of the single-level iterative function based on the variable's value, and both satisfy the SHA-256 algorithm. The resulting bitwise negation value of the variable is stored in a register with a QN output; its output can then be converted back to the variable's value, or it can be converted back to the variable's value through a NOT gate.

[0200] In an exemplary embodiment of this disclosure, when the input-side register and output-side register in the nth-stage compression circuit are registers whose output is the inverted value of the input, using the iterative circuit of this embodiment, in two adjacent iterative circuits, if the input-side register of the first iterative circuit outputs the bit-inverted value of the variable, then the input-side register of the second iterative circuit outputs the value of the variable. This is because after the iterative operation of the first iterative circuit, the bit-inverted value of the variable is stored in the input-side register of the second iterative circuit, and the input-side register is the QN output register; therefore, the input-side register of the second iterative circuit outputs the value of the variable. See also... Figure 9B .

[0201] Therefore, in this embodiment of the present disclosure, the iterative circuit serving as the nth stage compression circuit includes a first iterative circuit and a second iterative circuit, where n = n1, n1+1, n1+2, ..., n2, n2 > n1 ≥ 3, and the second iterative circuit outputs A, B, C, J, E, F, G, I respectively. The A', B', C', J', E', F', G', I' of the second iterative circuit are stored as follows:

[0202] In one example of this embodiment, see [example to be inserted]. Figure 9A and Figure 9B In the left-hand circuit, in the second iterative circuit:

[0203] The first preprocessing circuit includes a first NOT gate whose input is connected to the output of A, and an input connected to G and the output of the first NOT gate, and receives W. n+1 The first subtraction circuit, the output of which is connected to the input of I'; the first preprocessing circuit is configured to perform one iterative operation on variable i. get K n+1 It can be a constant, used as input, or the corresponding logical operation can be implemented using the internal logic of the circuit.

[0204] The second preprocessing circuit includes a second NOT gate whose input is connected to the output of C, and an adder circuit whose input is connected to the output of the second NOT gate and E. The output of the adder circuit is connected to the input of J'. The second preprocessing circuit is configured to perform one iterative operation on variable j. get

[0205] The operational circuit for variable e includes a third NOT gate connected to the I output, a ∑1 operator connected to the E output, a Ch operator connected to the outputs of E, F, and G, a fourth NOT gate connected to the ∑1 operator output, and a second subtraction circuit connected to the Ch operator, the third NOT gate, and the fourth NOT gate output. The output of the second subtraction circuit is connected to the E' input. The operational circuit for variable e is configured to perform one iterative operation on variable e. get

[0206] The operational circuit for variable a includes a first NOT gate, a fifth NOT gate whose input is connected to the output of J, a Maj operator whose input is connected to the outputs of A, B, and C, a ∑0 operator whose input is connected to the output of the first NOT gate, and a third subtraction circuit whose input is connected to the outputs of the Maj operator, the ∑0 operator, and the fifth NOT gate. The output of the third subtraction circuit is connected to the input of A'. The operational circuit for variable a is configured to perform one iterative operation on variable a. get

[0207] The direct connections between A and B', B and C', E and F', and F and G' are used to respectively... Get after hitting a beat

[0208] Both the first preprocessing circuit and the operation circuit for variable a include a first NOT gate, meaning that the first NOT gate is shared by both circuits.

[0209] Corresponding to the CSA (Carry-Save Subtractor) which combines the addition of three numbers into the addition of two numbers, a new device can be designed: the Carry-Save Subtractor (CSS). The expression structure of CSS is as follows: xyz = CSS(x, y, z) = Sc. That is, CSS simplifies the subtraction operation xyz with three input operands x, y, and z into a subtraction operation Sc with two output operands, where...

[0210] like Figure 9A As shown, some or all of the first, second, and third subtraction circuits in the second iterative circuit use carry-holding subtractors (CSS) to simplify the subtraction of three operands to two operands. Because the first preprocessing circuit has four operands, two CSSs are first used to perform two 3-2 simplifications to obtain two operands, and then a regular subtractor is used to perform the subtraction operation on these two operands.

[0211] In one example of this embodiment, the input-side register and output-side register in the nth-stage compression circuit are registers whose output is the inverted version of the input; in two adjacent iterative circuits, one is the first iterative circuit and the other is the second iterative circuit. For example... Figure 9B As shown, Figure 9B The compression circuit on the left is the second iteration circuit, and the compression circuit on the right is the first iteration circuit.

[0212] In one exemplary embodiment of this disclosure, the CSA is improved by designing a new device, referred to herein as a carry-hold adder inverting circuit, or simply CSN circuit or CSN.

[0213] The FA1 module is a 1-bit full adder, the basic unit of CSA (Computer-Assisted Adder). A full adder is a binary addition circuit capable of calculating carry-in from the least significant bit. Compared to a half adder, a full adder considers not only whether there is a carry-in from the current bit's result, but also the carry-in from the previous bit. Its inputs and outputs are as follows: Figure 10 As shown, its inputs include A, B, and CI, where A and B are the numbers to be added, and CI is the carry input; the outputs include S and CO, where S is the sum, and CO is the carry output, referred to as carry in this paper. The truth table of the FA1 module is as follows:

[0214] 0 0 O 0 0 0 1 0 1 0 1 0 0 1 0 1 1 0 0 1 0 0 1 1 0 0 1 1 0 1 1 0 1 0 1 1 1 1 1 1

[0215] In the FA1 module, the outputs of S and CO actually contain an internal inverter. Removing this inverter reduces area, power consumption, and delay. The modified device is named the full adder inverting circuit, abbreviated as FA1N. Figure 11 As shown, the truth table is the opposite of FA1, as follows:

[0216]

[0217] The expression structure of FAIN is: FA1N(COn,Sn)=A+B+CI

[0218] Easy to launch:

[0219]

[0220]

[0221] This disclosure describes operations on 32-bit data, using 32 FAINs to form a CSN. It's easy to understand that a FAIN-based CSN performs logical operations on three input operands, outputting COn and Sn. Sn is the bitwise inverse of the sum of the three operands, and COn is the bitwise inverse of the carry-in of the sum of the three operands. In this text, the sum of the three operands refers to the output S obtained by inputting the three numbers into the CSA, and the carry-in refers to the carry CO obtained by inputting the three numbers into the CSA. Sn is also denoted as... COn is also denoted as If you invert the bits of numbers A, B, and C and input them into CSN, the two output numbers will be the same as the two output numbers of CSA when A, B, and C are input into CSA.

[0222] Therefore, one embodiment of this disclosure provides a logic operation circuit, namely a CSN, which performs logical operations on three input operands and outputs two operands. One of these two operands is the bitwise inverted value of the sum of the three operands, and the other is the bitwise inverted value of the carry from the sum of the three operands. The CSN includes one or more 1-bit full adder inversion circuits, which are obtained by canceling one inverter in a 1-bit full adder.

[0223] Based on the register using the QN output, and combined with the CSN of this embodiment, the data compression circuit of SHA-256 is re-derived as follows:

[0224] First, we define several variations of the function expressions in SHA256, as follows:

[0225]

[0226]

[0227]

[0228]

[0229] That is, given the same input, the Chn operator, the Majn operator, and the ∑ operator... n0 Operators and ∑ n1 The outputs of the operators are the bitwise inverses of the outputs of the Ch operator, the Maj operator, the ∑0 operator, and the ∑1 operator, respectively. Taking the Chn operator as an example, with inputs x, y, z, the output is... And if the input is The output of the Chn operator is the same as the output of the Ch operator when x, y, z are input. The Majorn operator, ∑ n0 Operators and ∑ n1The operators are similar and will not be elaborated further. In actual physical implementations, the above-mentioned Chn operator, Majn operator, and ∑... n0 Operators and ∑ n1 The operators Ch, Maj, ∑0, and ∑1 are of similar size.

[0230] Using the above Chn operator, Majn operator, and ∑ n0 Operators and ∑ n1 The operator, and the register with QN output, is selected. In the embodiments of this disclosure, the compression circuits of adjacent two stages are as follows: Figure 12 As shown.

[0231] Figure 12 Of the eight input registers in the first-stage circuit, the four registers A, B, C, and I used to store variables a, b, c, and i output the values ​​of a, b, c, and i. n-2 ,b n-2 ,c n-2 i n The four registers J, E, F, and G used to store variables j, e, f, and g output the bitwise inverted values ​​of j, e, f, and g. Correspondingly, the eight output-side registers A', B', C', J', E', F', G', I' respectively store the iterated a n-1 ,b n-1 ,c n-1 , i n+1 In the second-stage circuit, since registers with outputs that are the inverted inputs are used, the four registers A, B, C, and I used to store variables a, b, c, and i output the bitwise inverted values ​​of a, b, c, and i. The four registers J, E, F, and G used to store variables j, e, f, and g output the values ​​of j, e, f, and g. n-1 ,e n+1 ,f n+1 ,g n+1 Correspondingly, in the eight output registers, A', B', C', J', E', F', G', and I' respectively store the results of the iteration. j n-1 ,e n+1 ,f n+1 ,g n+1 ,

[0232] Formulas related to bitwise NOT include:

[0233]

[0234]

[0235]

[0236] by Figure 12 Taking the iterative operation of variable 'a' in the first-stage compression circuit as an example, the iterative operation of variable 'a' here uses the Majn operator and ∑ n0 The Majn operator consists of an operator, a CSN, and an adder. The input to the Majn operator is a. n-2 ,b n-2 ,c n-2 The output is ∑ n0 The input to the operator is a n-2 The output is Therefore, the inputs to CSN are respectively and Then the output of CSN and Maj(a) n-2 ,b n-2 ,c n-2 ),Σ0(a n-2 ) and j n-2 When CSA is input, its output is the same, denoted as S and CO. Then, an adder is used to add S and CO together to obtain a. n-1 Therefore, a n-1 =∑0a n-2 +Maj(a n-2 ,b n-2 ,c n-2 )+j n-2 .

[0237] Again Figure 12 Taking the iterative operation of variable e in the first-stage compression circuit as an example, the iterative operation of variable e here uses the Chn operator and ∑ n1 The input consists of an operator, a CSN, and an adder that adds two input numbers to one. The input to the Chn operator is... The output can be denoted as Ch(e) n ,f n ,g n );∑ n1 The input of the operator is The output can be denoted as ∑1e n Then the input to CSN is Ch(e n ,f n ,g n ),∑1e n and i n The output can be denoted as and In the adder Adding it to 1, the output is Right now equal According to the formula It can be known According to the formula It can be known therefore Therefore e n+1 =S+CO; Here, S and CO are the values ​​of Ch(e) n ,f n ,g n ),∑1 e n and i n The sum and carry obtained from inputting CSA indicate the variable e. n+1 The value of e satisfies: n+1 =i n +∑1 e n +Ch(e n ,f n ,g n ).

[0238] Again Figure 12 Taking the iterative operation of variable j in the first-stage compression circuit as an example, the iterative operation of variable j here uses an adder, the input of which is... and c n-2 The output is Right now According to the formula It can be known It can be seen that j satisfies n-1 =e n -c n-2 .

[0239] Figure 12 In the first-stage compression circuit, a new device is used for the iterative operation of variable i. This new device is based on CSN and is designed for the case where one input is a constant K and the other input needs to be inverted. The corresponding logic circuit is designed based on the truth table between the two inputs and two outputs. It is referred to as CSK in this paper.

[0240] See Figure 13 The original structure of this CSK is as follows: Figure 13 The bottom row shows a NOT gate and the first CSN, which uses the output g of the NOT gate. n and a n-2 There are two inputs, the other of which is a fixed message word K. n+1 Because of K n+1 Since the variables are constants, this structure has only two inputs: the values ​​of variables a and g. Therefore, this CSN has two outputs. and middle, equal to g n ,a n-2 and K n+1 The carry-over in the addition is inverted bitwise. equal to g n,a n-2 and K n+1 The bitwise NOT of the sum.

[0241] CSK has two inputs and two outputs, each consisting of 32-bit data. For each bit of this 32-bit data, the truth table between the two inputs and outputs can be derived according to the above requirements:

[0242] When K=0, the truth table between the input and output is as follows:

[0243]

[0244] Right now:

[0245] When K=1, the truth table between the input and output is as follows:

[0246]

[0247] Right now:

[0248] For each of the 32 bits, construct the corresponding logic circuit based on the truth table to obtain CSK.

[0249] Therefore, one embodiment of this disclosure also provides a logic operation circuit, namely CSK, which is configured to perform logical operations based on two input operands g, a and a constant K, and output two operands s, c, where s equals The sum of K and C is inverted bitwise, and c equals The carry-in of adding to K is inverted bitwise. CSK may include one or more 1-bit arithmetic circuits, wherein the 1-bit arithmetic circuit satisfies that, when K = 0, the two outputs s and c satisfy: When K=1, the two outputs s and c satisfy:

[0250] In data compression circuits, CSK uses constants that are different fixed message words K. n+1 Therefore, each CSK will be due to K n+1 The specific implementation may vary, but using CSK can reduce module area, power consumption, and improve performance.

[0251] Again Figure 12 Taking the iterative operation of variable i in the first-stage compression circuit as an example, combined with Figure 13 Let's verify whether the iterative operation on variable i satisfies: i n+1 =a n-2 +g n +K n+1 +W n+1The iterative operation on variable i here uses CSK, CSN, and an adder (unless otherwise specified, the adder in this article is an adder that takes two operands as input and outputs a sum). As mentioned earlier, CSK is equivalent to using a non-gatekeeper. Change to g n Then g n ,a n-2 and K n+1 Given a CSN, the two outputs of the CSK are denoted as follows: and in, It is g n ,a n-2 and K n+1 The sum of the two elements is inverted bitwise. It is g n ,a n-2 and K n+1 The carry-in of the addition is bitwise NOT. The CSN receives the two outputs of the CSK and... right and Perform logical operations to output CO2 and S2, where S2 is... and The sum of two parts is inverted; CO2 is... and The carry-in of the addition is bitwise NOT. Then, CO2 and S2 are added in the adder to obtain i. n+1 According to the formula above, i n+1 It equals CO1, S1 and W n+1 They are added together, and the sum of CO1 and S1 equals a. n-2 +g n +K n+1 Therefore, it can be known that i n+1 =a n-2 +g n +K n+1 +W n+1 .

[0252] Therefore, Figure 12 The first-stage compression circuit (i.e., the third iteration circuit) in the present disclosure can implement the single-round iteration function of the embodiments of the present disclosure. Figure 12 The second-stage compression circuit (i.e., the fourth iteration circuit) has iteration circuits for each variable similar to those in the third iteration circuit, and will not be described again. CSK is based on g... n+1 , and Perform logical operations to output CO1 and S1, where S1 is... and The sum of the two elements is inverted bitwise; CO1 is... and The carry-in of the addition is inverted bit by bit. The inputs of CSK connected to CSN are the two outputs of CSK and W. n+2 The adder connected to CSN adds the two outputs of CSN to 1 to obtain i. n+2 It can be verified in the same way that the fourth iteration circuit can also implement the single-round iteration function of the embodiments of this disclosure. Furthermore, Figure 13 The two-stage compression circuit shown can also implement the single-round iterative function of the embodiments of this disclosure.

[0253] In this embodiment of the disclosure, the iterative circuit includes a third iterative circuit; the A, B, C, J, E, F, G, I of the third iterative circuit respectively output a n-2 ,b n-2 ,c n-2 , i n The third iterative circuit's A', B', C', J', E', F', G', I' respectively store a n-1 ,b n-1 ,c n-1 , i n+1 .

[0254] In one example of this disclosure, see Figure 12 In the first-stage compression circuit, and in the third-iteration circuit:

[0255] The first preprocessing circuit includes an input terminal connected to and receiving the output terminals of A and G, W. n+1 The first processing circuit for the data, wherein the output of the first processing circuit is connected to the input of I'; the first preprocessing circuit is configured to be based on a n-2 , and K n+1 W n+1 The data is used to perform one iteration operation on variable i to obtain i. n+1 ;K n+1 K is a constant and can be used as an input, or it can be implemented through the internal logic of the circuit, like CSK. n+1 The same calculation result is used as input.

[0256] The input of the second preprocessing circuit is connected to the outputs of C and E, and the output is connected to J'; the second preprocessing circuit is configured to perform one iterative operation on variable j. get

[0257] The operational circuit for variable e includes a ∑ whose input terminal is connected to the output terminal of E. n1 The Chn operator, whose input is connected to the outputs of E, F, and G, and whose input is connected to ∑ n1The second operational circuit is connected to the output terminals of the operator, the Chn operator, and I, and the output terminal of the second operational circuit is connected to the input terminal of E'; the operational circuit for the variable e is configured based on... and i n To perform one iteration of the operation on variable e, we obtain

[0258] The operational circuit for variable a includes a Majn operator whose input is connected to the outputs of A, B, and C, and a ∑ operator whose input is connected to the output of A. n0 Operators, and input terminals and Majn operators, ∑ n0 A third operational circuit is connected to the output of the operator and J, and the output of the third operational circuit is connected to the input of A'; the operational circuit for the variable a is configured based on a. n-2 ,b n-2 ,c n-2 , Performing one iteration of the operation on variable a yields a. n-1 ;

[0259] The direct connections between A and B', B and C', E and F', and F and G' are used to respectively connect a n-2 ,b n-2 , Get b by hitting one shot n-1 ,c n-1 ,

[0260] In this embodiment of the present disclosure, the iterative circuit further includes a fourth iterative circuit; the A, B, C, J, E, F, G, I of the fourth iterative circuit respectively output j n-2 ,e n ,f n ,g n , The A', B', C', J', E', F', G', I' of the fourth iterative circuit are respectively stored j n-1 ,e n+1 ,f n+1 ,g n+1 ,

[0261] In one example of this embodiment, see [example]. Figure 12 The second-stage compression circuit, in the fourth iterative circuit:

[0262] The first preprocessing circuit includes an input terminal connected to the output terminals of A and G and receiving W. n+1 The fourth processing circuit for the data, wherein the output terminal of the fourth processing circuit is connected to the input terminal of I'; the first preprocessing circuit is configured to be based on g n and K n+1 W n+1 The data is obtained by performing one iteration operation on variable i.

[0263] The input of the second preprocessing circuit is connected to the outputs of C and E, and the output is connected to J'; the second preprocessing circuit is configured to perform one iterative operation on variable j. Get j n-1 ;

[0264] The operational circuit for variable e includes a ∑ whose input terminal is connected to the output terminal of E. n1 The Chn operator, whose input is connected to the outputs of E, F, and G, and whose input is connected to ∑ n1 A third operational circuit is connected to the outputs of the operators, Chn operator, and I, and the output of the third operational circuit is connected to the input of E'; the operational circuit for the variable e is configured based on e. n ,f n ,g n and To obtain e by performing one iteration of the variable e. n+1 ;

[0265] The operational circuit for variable a includes a Majn operator whose input is connected to the outputs of A, B, and C, and a ∑ operator whose input is connected to the output of A. n0 Operators, and input terminals and Majn operators, ∑ n0 The second operational circuit is connected to the output of the operator and J, and the output of the second operational circuit is connected to the input of A'; the operational circuit for the variable a is configured based on... j n-2 Performing one iteration of the operation on variable a yields...

[0266] The direct connections between A and B', B and C', E and F', and F and G' are used to respectively... e n ,f n Get it by hitting it f n+1 ,g n+1 .

[0267] It should be noted that the examples of the embodiments disclosed herein still use the nth-level compression circuit as an example to describe the fourth iteration circuit, while Figure 12 The second-stage compression circuit is based on the (n+1)th stage compression circuit, therefore the subscripts of the variables are different.

[0268] In an example of an embodiment of this disclosure, in the above-described third and fourth iterative circuits:

[0269] The second arithmetic circuit includes a CSN circuit and a fourth adder circuit connected to the CSN circuit. The input terminal of the CSN circuit is also the input terminal of the second arithmetic circuit, wherein:

[0270] The CSN circuit is configured to perform logical operations on the three input operands and output... and It is the bitwise inverse of the sum of the three operands. It is the bitwise inverse of the carry-out from the sum of the three operands;

[0271] The fourth adder circuit is configured to... The sum is added to 1, and the result is output from the output terminal of the fourth adder circuit, which is the same as the output terminal of the second arithmetic circuit.

[0272] exist Figure 12 In the circuit, the fourth adder circuit uses an arrow to indicate adding 1, but it does not need to receive input; the logic for adding 1 can be implemented internally within the circuit.

[0273] In an example of an embodiment of this disclosure, in the above-described third and fourth iterative circuits:

[0274] The third operational circuit includes an interconnected CSN circuit and a fifth adder circuit. The input terminal of the CSN circuit is also the input terminal of the third operational circuit, wherein:

[0275] The CSN circuit is configured to perform logical operations on the three input operands and output... and It is the bitwise inverse of the sum of the three operands. It is the bitwise inverse of the carry-out from the sum of the three operands;

[0276] The fifth adder circuit is configured to... and The sum is obtained by adding the two components and outputting it from the output terminal of the fifth adder circuit, which is also the output terminal of the third arithmetic circuit.

[0277] In one example of the embodiments of this disclosure, in the third iterative circuit described above:

[0278] The first arithmetic circuit includes a first circuit, a first CSN circuit, and a sixth adder circuit, wherein:

[0279] The input terminal of the first circuit is connected to the output terminals of A and G, and is configured based on a n-2 and K n+1 Perform logical operations and output. and in, It is g n ,a n-2 and K n+1 The sum of the two elements is inverted bitwise. It is g n ,a n-2 and K n+1 Invert the bits of the carry-over in the addition;

[0280] The input terminal of the first CSN circuit is connected to the output terminal of the first circuit and receives... Set to input and Perform logical operations to output CO2 and S2, where S2 is... and The sum of two parts is inverted; CO2 is... and Invert the bits of the carry-over in the addition;

[0281] The sixth adder circuit is configured to add CO2 and S2 together, and output the sum to the input terminal of I'.

[0282] In this example, see Figure 13 The first circuit includes a sixth NOT gate and a second CSN, wherein: the input terminal of the sixth NOT gate is connected to the output terminal of G, and is configured to... Inverting the bits gives g. n The input terminal of the second CSN circuit is connected to the output terminal of the sixth NOT gate and A, and receives K. n+1 , set to the input g n ,a n-2 and K n+1 Perform logical operations and output. and In another example, the first circuit is implemented using CSK, which is based on the input. a n-2 Fixed message word K n+1 and output and The truth table is constructed between them.

[0283] In one example of the embodiment of this disclosure, in the fourth iterative circuit described above:

[0284] The fourth operational circuit includes a second circuit, a third CSN circuit, and a seventh adder circuit, wherein:

[0285] The input terminal of the second circuit is connected to the output terminals of A and G, and is configured based on g. n , and Perform logical operations to output CO1 and S1, where S1 is... and The sum of the two elements is inverted bitwise; CO1 is... and Invert the bits of the carry-over in the addition;

[0286] The input terminal of the third CSN circuit is connected to the output terminal of the second circuit and receives W. n+1 Set to the inputs CO1, S1 and W n+1 Perform logical operations and output. and in, It is CO1, S1 and W n+1 The sum of the two elements is inverted bitwise. It is CO1, S1 and W n+1 Invert the bits of the carry-over in the addition;

[0287] The seventh adder circuit is configured to... Add 1 to the sum, and output the sum to the input of I'.

[0288] In this example, the second circuit includes a seventh NOT gate and a fourth CSN circuit, wherein: the input terminal of the seventh NOT gate is connected to the output terminal of G, and is configured to control g. n Inverting the bits yields... The input terminal of the fourth CSN circuit is connected to the output terminal of the seventh NOT gate and A and receives data. Set to input and Perform logical operations to output CO1 and S1. Alternatively, in another example, the second circuit is implemented using CSK, which is based on the input g. n , Fixed message word Construct a truth table between the outputs CO1 and S1.

[0289] In one example, it could be used starting from stage 4 of the entire data compression circuit. Figure 12 and Figure 13 The two-stage compression structure shown is useful for applications where performance is prioritized starting from stage 4. Optimization can begin at stage 4 (or stage 5, 6, or later). In this case, from stage 4 to stage 62, even-numbered stages will use the third iteration circuit on the left, and odd-numbered stages will use the fourth iteration circuit on the right. Starting from stage 4, the data of the variable output from the stage 4 input register can be adjusted by selecting the variable register type (QN output or Q output) or using NOT gates. Figure 12The first-stage compression circuit or the second-stage compression circuit is the same.

[0290] Because in the single-stage compression circuit of this embodiment, e, f, g, i are iterated twice ahead of a, b, c, j, the original 64-stage pipeline structure will become 66 stages. Furthermore, the compression circuit structures of at least the first three stages are somewhat different.

[0291] In this embodiment, for level 3 a1, e1, e2, e3, the original SHA256 algorithm is used instead, that is:

[0292] a1=∑0a0+Maj(a0,b0,c0)+h0+∑1e0+Ch(e0,f0,g0)+K0+W0

[0293] e1=d0+h0+∑1e0+Ch(e0,f0,g0)+K0+W0

[0294] e2=d1+h1+∑1e1+Ch(e1,f1,g1)+K1+W1

[0295] e3=d2+h2+∑1e2+Ch(e2,f2,g2)+K2+W2

[0296] In the improved method of this embodiment, the calculation of a, b, c, d is two beats later than that of e, f, g, i. In the first three stages, a, b, c, d need to be delayed by two beats, so only a1, b1, c1, d1 can be obtained. When calculating e3, d2 cannot be used, and since d2 = c1, e3 is obtained by the following formula:

[0297] e3=c1+h2+∑1e2+Ch(e2,f2,g2)+K2+W2

[0298] Similarly, the value of variable j after one iteration can be calculated using j1 = e2 - d1, and the value of variable i after three iterations can be calculated using i3 = b1 + g2 + K3 + W3.

[0299] In the text, the number of iterations a variable undergoes depends on which other variables' values ​​are used to calculate the value of that variable. Taking i3 as an example, when i3 is obtained by iterating based on i3 = b1 + g2 + K3 + W3, then i3 is the value of variable i after 3 iterations.

[0300] In an exemplary embodiment of this disclosure, the compression circuits of levels 0 to 2 are configured to perform iterative operations on variables a, b, c, d, e, f, g, h based on the initial values ​​a0, b0, c0, d0, e0, f0, g0, h0 and K0, K1, K2, K3, W0, W1, W2, W3, to obtain the data of variables a, b, c, j after one iteration and the data of e, f, g, i after three iterations, and then pass them to the compression circuit of level 3. The data of j1 after one iteration satisfies j1 = e2 - d1, and the data of i after three iterations satisfies i3 = b1 + g2 + K3 + W3; where d m h represents the value of variable d after m iterations. m This represents the value of variable h after m iterations, where m is a natural number.

[0301] In this embodiment:

[0302] The 0th-level compression circuit is configured to perform one iterative operation on variables a, b, c, d, e, f, g, h based on the initial values ​​a0, b0, c0, d0, e0, f0, g0, h0 and K0, W0, to obtain the data of variables a, b, c, d, e, f, g, h after one iteration and pass it to the next-level compression circuit.

[0303] The first-stage compression circuit is configured to perform one iteration operation on variables e, f, g, h based on the data of variables d, e, f, g after one iteration and the data of K1, W1. The resulting data of e, f, g, h after two iterations and the data of a, b, c, d after one iteration are then passed to the next-stage compression circuit.

[0304] The second-stage compression circuit is configured to perform an iterative operation on variables e, f, g based on the data of variable c after one iteration, the data of variables e, f, g, h after two iterations, and the data of K2, W2, to obtain the data of variables e, f, g after three iterations; based on the data of variable b after one iteration, the data of variable g after two iterations, and the data of K2, W2, it performs an iterative operation on variable i based on one iteration to obtain the data of variable i after three iterations, satisfying i3=b1+g2+K3+W3; based on the data of variable d after one iteration and the data of variable e after two iterations, it performs an iterative operation on variable j based on one iteration to obtain the data of variable j after one iteration, satisfying j1=e2-d1.

[0305] The aforementioned level 0 compression circuit can be implemented based on a single-level iterative function of SHA-256, which will not be elaborated here.

[0306] In one example of this embodiment, such as Figure 14 As shown, the first-stage compression circuit includes:

[0307] The eight input registers A, B, C, D, E, F, G, HI output a1, b1, c1, d1, e1, f1, g1, h1 respectively.

[0308] Eight output-side registers A', B', C', D', E', F', G', H' store a1, b1, c1, d1, e2, f2, g2, h2 respectively;

[0309] The operation circuit for e2 is obtained by performing one iteration operation on variable e: e2 = d1 + h1 + ∑1 e1 + Ch(e1, f1, g1) + K1 + W1.

[0310] Among them, A and A', B and B', C and C', D and D', E and F', F and G', and G and H' are directly connected, and a1, b1, c1, d1 are directly passed to the output side. e1, f1, g1 are incremented by one step to obtain f2, g2, h2.

[0311] In one example of this embodiment, such as Figure 15 As shown, the second-stage compression circuit includes:

[0312] The eight input registers A, B, C, D, E, F, G, H output a1, b1, c1, d1, e2, f2, g2, h2 respectively.

[0313] The eight output registers A', B', C', J', E', F', G', I' store a1, b1, c1, j1, e3, f3, g3, i3 respectively;

[0314] Perform one iteration operation on variable e: e3 = c1 + h2 + ∑1 e n +Ch(e2,f2,g2)+K2+W2 yields the operational circuit for e3;

[0315] Perform one iterative operation on variable j, j1 = e2 - d1, to obtain the operational circuit of j1;

[0316] The iterative operation i3 = b1 + g2 + K3 + W3 of variable i is performed to obtain the operation circuit of i3;

[0317] Among them, A and A', B and B', C and C', E and F', and F and G' are directly connected, respectively passing a1, b1, c1 directly to the output side, and taking a step on e2 and f2 to get f3 and g3;

[0318] In this example, the input-side registers and output-side registers in the compression circuits of stages 0 to 2 are both registers with the same output as the input, but it is not limited to this.

[0319] In another example of this embodiment, when the input-side register outputs the bitwise inverse value of the variable, the second-stage compression circuit includes:

[0320] The eight input registers A, B, C, D, E, F, G, and H output respectively.

[0321] The eight output registers A', B', C', J', E', F', G', I' respectively store

[0322] Perform one iteration operation on variable e. get Operational circuit;

[0323] Perform one iteration operation on variable j. get Operational circuit;

[0324] Perform one iteration operation on variable i. get Operational circuit;

[0325] Among them, A and A', B and B', C and C', E and F', and F and G' are directly connected, respectively... Directly transmitted to the output side, and thus... Get it by hitting it

[0326] In this example, the input-side registers and output-side registers in the compression circuit from level 0 to level 2 are both registers whose output is the inverted input, but it is not limited to this.

[0327] In some applications, the initial iterations are not the primary focus; therefore, the implementation of these initial stages can be based on various methods, as long as the variable values ​​of the input registers of the nth-stage single-stage compression circuit in this embodiment can be obtained. The nth-stage single-stage compression circuit employs... Figure 12 In the third and fourth iteration circuits shown, the input registers store the values ​​of some variables and their bitwise inverted values. This can also be achieved through methods such as... Figure 14 and Figure 15 The compression circuit shown can be used to implement this, in the last stage by inverting some variables bit by bit through NOT gates, or by using the first stage compression circuit in the nth stage single-stage compression circuit of this embodiment, and making special designs for the input-side registers, using a register with QN output in some parts and a register with Q output in others.

[0328] In this embodiment, the compression circuits at levels 63 to 65 require replacing two intermediate variables with d and h, and some variables have already been iterated. Their structure differs from the aforementioned level n compression structure. However, the computational circuits used for variable iteration calculations can all employ the same variable computational circuits as those in the level n compression structure.

[0329] In an exemplary embodiment of this disclosure, the compression circuits of levels 63 to 65 are configured to perform iterative operations on the variables e, f, g, i after 63 iterations and the variables a, b, c, j after 61 iterations, based on the data output from level 62. This yields the data of variables a, b, c, d after 64 iterations and the data of e, f, g, h after 64 iterations.

[0330] In this embodiment,

[0331] The 63rd stage compression circuit is configured to perform one iterative operation on variables e, f, g, i based on the data of variables e, f, g after 63 iterations to obtain the data of variables e, f, g after 64 iterations; and to perform one iteration on the data of variable g after 63 iterations to obtain the data of variable h after 64 iterations; based on the data of variables a, b, c, j after 61 iterations and the data of variable e after 63 iterations, it performs one iterative operation on variables a, b, c, j to obtain the data of variables a, b, c, j after 62 iterations; and then, transmit the obtained data to the next stage compression circuit.

[0332] The 64th stage compression circuit is configured to perform one iteration operation on variables a, b, c, j based on the data of variables a, b, c, j after 62 iterations and the data of variable e after 64 iterations, to obtain the data of variables a, b, c, j after 63 iterations; and to pass the obtained data and the data of variables e, f, g, h after 64 iterations to the next stage compression circuit.

[0333] The 65th stage compression circuit is configured to perform one iteration operation on variables a, b, c based on the data of variables a, b, c, j after 63 iterations, to obtain the data of variables a, b, c after 64 iterations; then, the data of variable c after 63 iterations is incremented by one step to obtain the data of variable d after 64 iterations; and finally, the variables a, b, c, d, e, f, g, h after 64 iterations are output.

[0334] In one example of this embodiment, please refer to Figure 16 The 63rd level compression circuit includes:

[0335] The eight input registers A, B, C, J, E, F, G, H output the data of variables a, b, c, j after 61 iterations and the data of variables e, f, g, i after 63 iterations, respectively.

[0336] Eight output registers A', B', C', J', E', F', G', H' store the data of variables a, b, c, j after 62 iterations and the data of variables e, f, g, h after 64 iterations, respectively.

[0337] The operation circuit for variable e adopts the operation circuit for variable e in the first iteration circuit, the second iteration circuit, the third iteration circuit, or the fourth iteration circuit, and is set to perform one iteration operation on variable e, f, g based on the data of variable e, f, g, i after 63 iterations to obtain the data of variable e after 64 iterations.

[0338] The operation circuit for variable a is configured to perform one iterative operation on variable a based on the data of variables a, b, c, j after 61 iterations, to obtain the data of variable a after 62 iterations.

[0339] The second preprocessing circuit uses the second preprocessing circuit in the first, second, third, or fourth iteration circuit to perform one iteration operation on variable j based on the data of variable c after 61 iterations and the data of variable e after 63 iterations, to obtain the data of variable j after 62 iterations.

[0340] In this context, A and B', B and C', E and F', F and G', and G and H' are directly connected. The data of variables a and b after 61 iterations and the data of variables e, f, and g after 63 iterations are respectively combined to obtain the data of variables b and c after 62 iterations and the data of variables f, g, and h after 64 iterations.

[0341] Figure 16 The 63rd stage compression circuit in the circuit has input registers A, B, C, J, E, F, G, I that output... j 61 ,e 63 ,f 63 ,g 63 , The output registers A', B', C', J', E', F', G', and H' respectively store... j 62 ,e 64 ,f 64 ,g 64 ,h 64 The operational circuit for the iteration of variables a, e, j uses the same operational circuit for variables a, e, j as in the fourth iteration circuit. However, compared to... Figure 12The fourth iteration circuit (i.e., the second-stage compression circuit on the right side of the figure) and the 63rd-stage compression circuit do not require iterative calculation of variable i and do not have corresponding calculation circuits.

[0342] In one example of this embodiment, please refer to Figure 16 The 64th level compression circuit includes:

[0343] The eight input registers A, B, C, J, E, F, G, H output the data of variables a, b, c, j after 62 iterations and the data of variables e, f, g, h after 64 iterations, respectively.

[0344] Eight output registers A', B', C', J', E', F', G', H' store the data of variables a, b, c, j after 63 iterations and the data of variables e, f, g, h after 64 iterations, respectively.

[0345] The operation circuit for variable a is configured to perform one iterative operation on variable a based on the data of variables a, b, c, j after 62 iterations, to obtain the data of variable a after 63 iterations.

[0346] The second preprocessing circuit uses the second preprocessing circuit in the first, second, third, or fourth iteration circuit to perform one iteration operation on variable j based on the data of variable c after 62 iterations and the data of variable e after 64 iterations, to obtain the data of variable j after 63 iterations.

[0347] Among them, A and B', B and C' are directly connected, and the data of variables a and b after 62 iterations are incremented by one step to obtain the data of variables b and c after 63 iterations; E and E', F and F', G and G', and H and H' are directly connected, and the data of variables e, f, g, and h after 64 iterations are directly passed to the next level.

[0348] Figure 16 The 64th stage compression circuit in the circuit has input registers A, B, C, J, E, F, G, and H that output a respectively. 62 ,b 62 ,c 62 , The output registers A', B', C', J', E', F', G', and H' respectively store a 63 ,b 63 ,c 63 , The operational circuit for iterating variables a and e can be the same as the operational circuit for variable a in the third iteration circuit. Relative to... Figure 12The third iteration circuit (i.e., the first-stage compression circuit on the left side of the figure) and the 64th-stage compression circuit do not require iterative calculations of variables e and i, so there is no corresponding calculation circuit.

[0349] Figure 16 The second preprocessing circuit for variable j and the circuit for pre-adding H0 are integrated together, becoming a CSA and an adder. The input of the CSA is... and c 62 .Will c 62 And the initial value data of variable a, i.e., constants. The addition is simplified using 3-2, and the output sum and carry are then added together using an adder to obtain the data of variable j, which is stored in J'. The data of variable j obtained here is not... Instead The reason for this treatment is to make a 64 Adding H0 beforehand shortens the path of variable a in the 65th stage of the compression circuit. (Constant) It can be integrated into the CSA circuitry, similar to the design of CSK.

[0350] In one example of this embodiment, the 65th level compression circuit includes:

[0351] The eight input registers A, B, C, J, E, F, G, H output the data of variables a, b, c, j after 63 iterations and the data of variables e, f, g, h after 64 iterations, respectively.

[0352] Eight output registers A', B', C', J', E', F', G', H' store the data of variables a, b, c, d, e, f, g, h after 64 iterations, respectively;

[0353] The operation circuit for variable a is configured to perform one iterative operation on variable a based on the data of variables a, b, c, j after 63 iterations, to obtain the data of variable a after 64 iterations.

[0354] Specifically, the data of variables a, b, c output by A, B, and C respectively are added to the initial data of variables b, c, and d respectively, and then stored in B', C', and D'. The data of variables e, f, g, h output by E, F, G, and H respectively are added to the initial data of variables e, f, g, and h respectively, and then stored in E', F', G', and H'. Alternatively, A and B', B and C', and C' and D' are directly connected to obtain the data of variables a, b, c after 63 iterations by adding one more iteration to obtain the data of variables a, b, c after 64 iterations. E and E', F and F', G and G', and H and H' are directly connected to directly transmit the data of variables e, f, g, and h after 64 iterations to the output side.

[0355] Figure 17 The 65th stage compression circuit in the circuit has input registers A, B, C, J, E, F, G, and H that output respectively. j 62 ,e 64 ,f 64 g 64 ,h 64 The operational circuit for the iteration of variable 'a' can adopt the operational circuit for the variable in the fourth iteration circuit, as shown in [reference needed]. Figure 12 The example shown in the diagram increases the iteration values ​​of variables b, c, d, e, f, g, h by adding their respective initial data at level 65. The input registers A, B, and C output the bitwise inverted values ​​of variables a, b, and c. Add constants to the adders respectively. and Data for variables b, c, and d can be obtained. The values ​​are then stored in output registers B, C, and D. For the values ​​of variables e, f, g, and h output by E, F, G, and H, H4, H5, H6, and H7 are added respectively to obtain the values ​​e+H4, f+H5, g+H6, h+H7 for variables e, f, g, and h, which are then stored in output registers E', F', G', and H'. H0 to H7 are the initial values ​​of variables a, b, c, d, e, f, g, and h, respectively.

[0356] Figure 17 The example involves adding the iteration results of the variables to their initial data beforehand. However, in other examples, it's not necessary to add the iteration results to the initial data. In this case, A and B', B and C', and C' and D' can be directly connected to obtain the data of variables a, b, and c after 63 iterations by adding one more iteration to get the data of variables a, b, and c after 64 iterations. Similarly, E and E', F and F', G and G', and H and H' can be directly connected to pass the data of variables e, f, g, and h after 64 iterations directly to the output side.

[0357] Figure 17 The example is obtained after the output register of level 65, which is the hash value after the input message block is compressed. In application, if the bitwise inverse value of the variable is required, it can be achieved by setting the corresponding NOT gate.

[0358] Figure 16 and Figure 17 It shows the basis Figure 12 The third and fourth iteration circuits shown are one implementation method for the last three stages of compression circuit when implementing the nth stage compression circuit (n = n1, n1+1, n1+2, ..., n2, n2 > n1 ≥ 3). Figure 8 The first iterative circuit, or Figure 9B The first and second iteration circuits shown implement the nth-level compression circuit. The operation circuits for variable iteration in the last three compression circuits can adopt the operation circuits for the corresponding variables in the first and / or second iteration circuits. Alternatively, the iteration value of the phase variable can be added to the initial data of the variable in advance, so that the output of the 65th-level compression circuit is the hash value obtained by compressing the message block.

[0359] One embodiment of this disclosure also provides a chip, including a message expansion circuit and a data compression circuit, wherein the data compression circuit employs the secure hash algorithm SHA-256 as described in any embodiment of this disclosure.

[0360] In one or more exemplary embodiments described above, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality may be stored as one or more instructions or code on or transmitted via a computer-readable medium and executed by a hardware-based processing unit. The computer-readable medium may comprise a computer-readable storage medium corresponding to a tangible medium, such as a data storage medium, or a communication medium comprising any medium facilitating the transfer of a computer program from one place to another, such as according to a communication protocol. In this manner, the computer-readable medium may generally correspond to a non-transitory tangible computer-readable storage medium or a communication medium, such as a signal or carrier wave. The data storage medium may be any available medium accessible by one or more computers or one or more processors to retrieve instructions, code, and / or data structures for implementing the techniques described in this disclosure. Computer program products may comprise computer-readable media.

[0361] In some aspects, the functionality described herein can be provided within dedicated hardware and / or software modules configured for encoding and decoding, or incorporated into combined codecs. Furthermore, the technology can be fully implemented within one or more circuit or logic elements.

[0362] The technical solutions of the embodiments of this disclosure can be implemented in a wide variety of devices or equipment, including wireless mobile phones, integrated circuits (ICs), or a set of ICs (e.g., chipsets). Various components, modules, or units are described in the embodiments of this disclosure to emphasize functional aspects of a device configured to perform the described techniques, but they do not necessarily need to be implemented through different hardware units. Rather, as described above, the various units can be combined in codec hardware units or provided by a collection of interoperable hardware units (including one or more processors as described above) combined with suitable software and / or firmware.

Claims

1. A data compression circuit for the secure hash algorithm SHA-256, characterized in that, The first in the data compression circuit n The single-stage compression circuit is an iterative circuit with intermediate variables. n = n 1, n 1+1, n 1+2,…, n 2, n 2> n 1-3, the iterative circuit includes: Eight input registers A, B, C, J, E, F, G, I, where A, B, C, and D output the variables after n-2 iterations. a,b, c,j The data, E, F, G, I, respectively output the variables after n iterations. e,f,g,i Data; Eight output registers A', B', C', J', E', F', G', I', where A', B', C', and J' store the variables after n-1 iterations. a,b,c,j The data, E', F', G', I', respectively store the variables after n+1 iterations. e,f,g,i Data; The first preprocessing circuit is configured to perform one variable operation based on the input message word and the outputs of A and G. i Through iterative operations, we obtain or And satisfy ; variable e The arithmetic circuit is configured to perform one operation on the variable based on the outputs of I, E, F, and G. e Through iterative operations, we obtain or And satisfy ; The second preprocessing circuit is configured to perform one variable operation based on the outputs of E and C. j Through iterative operations, we obtain or And satisfy ; variable a The arithmetic circuit is configured to execute the variable once based on the outputs of A, B, C, and J. a Through iterative operations, we obtain or And satisfy ; Among them, A and B', B and C', E and F', and F and G' are directly connected; in, x m Representing variables x through m The value of the next iteration. x for a,b,c,j,e,f,g,i ; It is the (n+1)th fixed message word. It is the (n+1)th message word obtained by grouping or expanding the input message block.

2. The data compression circuit as described in claim 1, characterized in that: The data compression circuit includes 66 compression stages, from stage 0 to stage 65, and the 66 compression stages are in a pipelined structure. n 1 is greater than or equal to 3, n 2 is less than or equal to 62; Each stage of the 66-stage compression circuit includes 8 input-side registers and 8 output-side registers. The output-side register group of each stage of the compression circuit is the input-side register group of the next stage of the compression circuit.

3. The data compression circuit as described in claim 1, characterized in that: The iterative circuit includes a first iterative circuit; The A, B, C, J, E, F, G, and I of the first iterative circuit output respectively a n-2 ,b n-2 ,c n-2 ,j n-2 , e n ,f n ,g n ,i n The A', B', C', J', E', F', G', I' of the first iterative circuit are stored respectively. a n-1 ,b n-1 ,c n-1 ,j n-1 , e n+1 ,f n+1 ,g n+1 i n+1 .

4. The data compression circuit as described in claim 3, characterized in that: In the first iterative circuit: The first preprocessing circuit includes an input terminal connected to the output terminals of A and G and receiving... The output terminal is connected to the first adder circuit of I'; The first preprocessing circuit is configured to perform the variable once. i Iterative operations get The second preprocessing circuit includes an input terminal connected to the output terminals of C and E, and an output terminal connected to the first subtraction circuit of J'; the second preprocessing circuit is configured to perform one variable... j Iterative operations get ; The variable e The operational circuit includes a ∑1 operator whose input is connected to the output of E, and an input connected to the outputs of E, F, and G. Ch Operators, and input terminals and ∑1 operators, Ch The second adder circuit is connected to the output of the operator and I, and the output of the second adder circuit is connected to the input of E'; the variable e The arithmetic circuit is set to execute the variable once. e Iterative operations get e n+1 ; The variable a The operational circuit includes input terminals connected to the output terminals of A, B, and C. Operators, the ∑0 operator whose input is connected to the output of A, and the operator whose input is connected to... The output of the operator, the ∑0 operator, and J is connected to a third adder circuit, the output of which is connected to the input of A'; the variable a The arithmetic circuit is set to execute the variable once. a Iterative operations get a n-1 ; The direct connections between A and B', B and C', E and F', and F and G' are used to respectively... a n-2 ,b n-2 ,e n ,f n Get it by hitting it b n-1 , c n-1 , f n+1 , g n+1 .

5. The data compression circuit as described in claim 4, characterized in that: The first adder circuit includes a first carry-retaining adder CSA, a second CSA, and a carry-with adder CPA connected in series; the second adder circuit and the third adder circuit both include a CSA and a CPA connected in series.

6. The data compression circuit as described in claim 3, characterized in that: The iterative circuit further includes a second iterative circuit; The second iterative circuit outputs A, B, C, J, E, F, G, I respectively. a n-2 , b n-2 , c n-2 , j n-2 , e n , f n , g n , i n The A', B', C', J', E', F', G', I' of the second iterative circuit are stored as follows: a n-1 , b n-1 , c n-1 , j n-1 , e n+1 , f n+1 , g n+1 , i n+1 .

7. The data compression circuit as described in claim 6, characterized in that: In the second iterative circuit: The first preprocessing circuit includes a first NOT gate whose input is connected to the output of A, and an input connected to G and the output of the first NOT gate to receive... The first subtraction circuit, the output of which is connected to the input of I'; the first preprocessing circuit is configured to perform one variable... i Iterative operations get i n+1 ; The second preprocessing circuit includes a second NOT gate whose input is connected to the output of C, and an adder circuit whose input is connected to the output of the second NOT gate and E. The output of the adder circuit is connected to the input of J'. The second preprocessing circuit is configured to perform one variable... j Iterative operations get j n-1 ; The variable e The operational circuit includes a third NOT gate whose input is connected to the I output, a ∑1 operator whose input is connected to the E output, and an input connected to the outputs of E, F, and G. Ch The operator, the fourth NOT gate whose input is connected to the output of the ∑1 operator, and the input to and Ch The outputs of the operator, the third NOT gate, and the fourth NOT gate are connected to a second subtraction circuit, the output of which is connected to the input of E'; the variable e The arithmetic circuit is set to execute the variable once. e Iterative operations get e n+1 ; The variable a The operational circuit includes a first NOT gate, a fifth NOT gate whose input is connected to the output of J, and inputs connected to the outputs of A, B, and C. The operator, the ∑0 operator whose input is connected to the output of the first NOT gate, and the operator whose input is connected to... Operator, The third subtraction circuit is connected to the output of the operator and the fifth NOT gate, and the output of the third subtraction circuit is connected to the input of A'; the variable a The arithmetic circuit is set to execute the variable once. a Iterative operations get a n-1 ; The direct connections between A and B', B and C', E and F', and F and G' are used to respectively... a n-2 , b n-2 , e n , f n Get after hitting a beat b n-1 , c n-1 , f n+1 , g n+1 .

8. The data compression circuit as described in claim 7, characterized in that: Some or all of the first, second, and third subtraction circuits use carry-holding subtractors (CSS) to simplify the subtraction of three operands to two operands. The CSS is configured to simplify the subtraction operation xyz with three input operands x, y, and z into a subtraction operation sc with two output operands, where s = x y z, c=(x y z) ( x y) ( x z).

9. The data compression circuit as described in claim 3, characterized in that: The input-side register and output-side register in the nth-stage compression circuit are registers whose output is the same as their input, and the iterative circuits are all the first iterative circuits.

10. The data compression circuit as described in claim 6, characterized in that: The input-side register and output-side register in the nth stage compression circuit are registers whose output is the inverted input. Of the two adjacent iterative circuits, one is the first iterative circuit and the other is the second iterative circuit.

11. The data compression circuit as described in claim 3, characterized in that: The iterative circuit includes a third iterative circuit; The third iterative circuit outputs A, B, C, J, E, F, G, and I respectively. a n-2 ,b n-2 ,c n-2 , j n-2 , e n , f n g n ,i n The A', B', C', J', E', F', G', I' of the third iterative circuit are stored respectively. a n-1 ,b n-1 ,c n-1 , j n-1 , e n+1 , f n+1 , g n+1 ,i n+1 .

12. The data compression circuit as described in claim 11, characterized in that: In the third iterative circuit: The first preprocessing circuit includes an input terminal connected to the output terminals of A and G and receiving... The first processing circuit for the data, wherein the output of the first processing circuit is connected to the input of I'; the first preprocessing circuit is configured to be based on a n-2 , g n as well as The data is executed once by the variable. i The iterative operation yields The input of the second preprocessing circuit is connected to the outputs of C and E, and the output is connected to J'; the second preprocessing circuit is configured to perform one variable operation. j Iterative operations get ; The variable e The operational circuit includes a ∑ whose input terminal is connected to the output terminal of E. n1 The operator's input is connected to the outputs of E, F, and G. Chn Operator, and input terminal and ∑ n1 Operator, Chn The second operational circuit is connected to the output of the operator and I, and the output of the second operational circuit is connected to the input of E'. The variable e The operational circuit is set to be based on e n , f n g n and i n To execute the variable once e The iterative operation yields e n+1 ; The variable a The operational circuit includes input terminals connected to the output terminals of A, B, and C. The operator, whose input is connected to the output of A, is ∑ n0 Operators, and input terminals and Operator, ∑ n0 The third operational circuit is connected to the output of the operator and J, and the output of the third operational circuit is connected to the input of A'. The variable a The operational circuit is set to be based on a n-2 , b n-2 ,c n-2 , j n-2 Execute variable once a The iterative operation yields a n-1 ; The direct connections between A and B', B and C', E and F', and F and G' are used to respectively... a n-2 ,b n-2 , e n , f n Get it by hitting it b n-1 , c n-1 , f n+1 , g n+1 .

13. The data compression circuit as described in claim 12, characterized in that: The first operational circuit includes a first circuit, a first CSN circuit, and a sixth adder circuit, wherein: The input terminal of the first circuit is connected to the output terminals of A and G, and is configured based on g n , a n-2 and Perform logical operations and output. CO 1 and S 1, among which, S 1 is g n , a n-2 and The sum of the two elements is inverted bitwise. CO 1 yes g n , a n-2 and Invert the bits of the carry-over in the addition; The input terminal of the first CSN circuit is connected to the output terminal of the first circuit and receives... Set to input CO 1 , S 1 and Perform logical operations and output. CO 2 and S 2, of which, S 2 is CO 1 , S 1 and The sum of the two elements is inverted bitwise. CO 2 yes CO 1 , S 1 and Invert the bits of the carry-over in the addition; The sixth adder circuit is configured to... CO 2 and S The two are added together, and the sum is output to the input of I'.

14. The data compression circuit as described in claim 13, characterized in that: The first circuit includes a sixth NOT gate and a second CSN, wherein: the input terminal of the sixth NOT gate is connected to the output terminal of G, and is configured to... g n Inverting the bits yields... g n The input terminal of the second CSN circuit is connected to the output terminal of the sixth NOT gate and A and receives data. Set to input g n , a n-2 and Perform logical operations and output. CO 1 and S 1; or The first circuit is implemented using CSK, which is based on the input. g n , a n-2 and fixed message words and output CO 1 and S Construct a truth table between 1 and 2.

15. The data compression circuit as described in claim 11, characterized in that: The iterative circuit also includes a fourth iterative circuit; The fourth iterative circuit outputs A, B, C, J, E, F, G, and I respectively. a n-2 , b n-2 , c n-2 , j n-2 , e n ,f n , g n , i n The A', B', C', J', E', F', G', I' of the fourth iterative circuit are stored respectively. a n-1 , b n-1 , c n-1 , j n-1 , e n+1 ,f n+1 , g n+1 , i n+1 .

16. The data compression circuit as described in claim 15, characterized in that: In the fourth iterative circuit: The first preprocessing circuit includes an input terminal connected to the output terminals of A and G and receiving... The fourth processing circuit for the data, wherein the output terminal of the fourth processing circuit is connected to the input terminal of I'; the first preprocessing circuit is configured to be based on a n-2 , g n as well as The data is executed once by the variable. i The iterative operation yields The input of the second preprocessing circuit is connected to the outputs of C and E, and the output is connected to J'; the second preprocessing circuit is configured to perform one variable operation. j Iterative operations get ; The variable e The operational circuit includes a ∑ whose input terminal is connected to the output terminal of E. n1 The operator's input is connected to the outputs of E, F, and G. Chn Operator, and input terminal and ∑ n1 Operator, Chn A third operational circuit is connected to the output of the operator and I, and the output of the third operational circuit is connected to the input of E'. The variable e The operational circuit is set to be based on e n ,f n ,g n and i n To execute the variable once e The iterative operation yields e n+1 ; The variable a The operational circuit includes input terminals connected to the output terminals of A, B, and C. The operator, whose input is connected to the output of A, is ∑ n0 Operators, and input terminals and Operator, ∑ n0 The second operational circuit is connected to the output of the operator and J, and the output of the second operational circuit is connected to the input of A'. The variable a The operational circuit is set to be based on a n-2 , b n-2 , c n-2 , j n-2 Execute variable once a The iterative operation yields a n-1 ; The direct connections between A and B', B and C', E and F', and F and G' are used to respectively... a n-2 , b n-2 , e n , f n Get it by hitting it b n-1 , c n-1 , f n+1 ,g n+1 .

17. The data compression circuit as described in claim 16, characterized in that: The second arithmetic circuit includes a CSN circuit and a fourth adder circuit connected to the CSN circuit. The input terminal of the CSN circuit is also the input terminal of the second arithmetic circuit, wherein: The CSN circuit is configured to perform logical operations on the three input operands and output... CO and S, S is the bitwise inverse of the sum of the three operands. CO is the bitwise inverse of the carry-in from the sum of the three operands; The fourth adder circuit is configured to... CO S and 1 are added together, and the sum is output from the output terminal of the fourth adder circuit, which is the same as the output terminal of the second arithmetic circuit.

18. The data compression circuit as described in claim 16, characterized in that: The third operational circuit includes an interconnected CSN circuit and a fifth adder circuit. The input terminal of the CSN circuit is also the input terminal of the third operational circuit, wherein: The CSN circuit is configured to perform logical operations on the three input operands and output... CO and S, S is the bitwise inverse of the sum of the three operands. CO is the bitwise inverse of the carry-in from the sum of the three operands; The fifth adder circuit is configured to... CO and The sum of S is obtained by adding the two sides and outputting it from the output terminal of the fifth adder circuit, which is the same as the output terminal of the third arithmetic circuit.

19. The data compression circuit as described in claim 16, characterized in that: The fourth operational circuit includes a second circuit, a third CSN circuit, and a seventh adder circuit, wherein: The input terminal of the second circuit is connected to the output terminals of A and G, and is configured based on g n , a n-2 and Perform logical operations and output. CO 1 and S 1, among which, S 1 is g n , a n-2 and The sum of the two elements is inverted bitwise. CO 1 yes g n , a n-2 and Invert the bits of the carry-over in the addition; The input terminal of the third CSN circuit is connected to the output terminal of the second circuit and receives data. Set to input CO 1 , S 1 and Perform logical operations and output. CO 2 and S 2, of which, S 2 is CO 1 , S 1 and The sum of the two elements is inverted bitwise. CO 2 yes CO 1 , S 1 and Invert the bits of the carry-over in the addition; The seventh adder circuit is configured to... CO 2 , S Add 2 and 1 together, and output the sum to the input of I'.

20. The data compression circuit as described in claim 19, characterized in that: The second circuit includes a seventh NOT gate and a fourth CSN circuit, wherein: the input terminal of the seventh NOT gate is connected to the output terminal of G, and is configured to... g n Inverting the bits yields... g n The input terminal of the fourth CSN circuit is connected to the output terminal of the seventh NOT gate and A and receives data. Set to input g n , a n-2 and Perform logical operations and output. CO 1 and S 1; or The second circuit is implemented using CSK, which is based on the input. g n , a n-2 Fixed message word and output CO 1 and S Construct a truth table between 1 and 2.

21. The data compression circuit as described in claim 2, characterized in that: The compression circuits at levels 0 through 2 are configured based on variables. a,b,c,d,e,f,g,h initial value a 0 ,b 0 ,c 0 ,d 0 , e 0 ,f 0 , g 0 ,h 0 and K 0 ,K 1 ,K 2 ,K 3 ,W 0 ,W 1 ,W 2 ,W 3 The data is used to perform iterative operations on the variables, resulting in variables after one iteration. a,b,c,j Data and after 3 iterations e,f,g,i The data is then transmitted to the third-stage compression circuit, where, after one iteration... The data satisfies After 3 iterations i The data satisfies ;in, d m Representing variables d through m The value of the next iteration. h m Representing variables h through m The value of the next iteration. m It is a natural number.

22. The data compression circuit as described in claim 21, characterized in that: The level 0 compression circuit is configured based on variables. a,b,c,d,e,f,g,h initial value a 0 ,b 0 ,c 0 ,d 0 ,e 0 ,f 0 ,g 0 , h 0 and K 0 , W 0 The data is executed once by the variable. a,b,c,d , e,f,g,h The iterative operation yields the variable after one iteration. a,b,c, d , e,f,g,h The data is then transmitted to the next stage of the compression circuit. The first-stage compression circuit is configured based on variables after one iteration. d , e,f,g Data and K 1 ,W 1 The data is executed once by the variable. e,f,g,h The iterative operation yields the result after two iterations. e,f,g,h Data and after one iteration a,b,c,d The data is transmitted together to the next stage of compression circuitry; The second-stage compression circuit is configured based on variables after one iteration. c Data, variables after two iterations e,f,g,h Data and K 2 ,W 2 ， Execute variable once e,f,g The iterative operation yields the variable after 3 iterations. e,f,g ; Based on variables after one iteration b Data, variables after two iterations g Data and K 2 ,W 2 Execute the variable once i The iterative operation yields the variable after 3 iterations. i The data and satisfy Based on variables after one iteration d Data, variables after two iterations e The data is executed once for the variable. j The iterative operation yields the variable after one iteration. j The data and satisfy .

23. The data compression circuit as described in claim 22, characterized in that, The first-stage compression circuit includes: The eight input registers A, B, C, D, E, F, G, and HI output respectively. a 1 ,b 1 ,c 1 ,d 1 ,e 1 ,f 1 ,g 1 ,h 1 ; The eight output registers A', B', C', D', E', F', G', and H' store respectively. a 1 ,b 1 ,c 1 ,d 1 ,e 2 ,f 2 , g 2 ,h 2 ; Execute variable once e Iterative operations get Operational circuit; Among them, A and A', B and B', C and C', D and D', E and F', F and G', and G and H' are directly connected. a 1 ,b 1 ,c 1, d 1 Directly transmitted to the output side, e 1 ,f 1 ,g 1 Get it by hitting it f 2 , g 2 , h 2 .

24. The data compression circuit as described in claim 23, characterized in that, The second-stage compression circuit includes: The eight input registers A, B, C, D, E, F, G, and H output respectively. a 1 ,b 1 ,c 1 ,d 1 , e 2 ,f 2 ,g 2 ,h 2 ; The eight output registers A', B', C', J', E', F', G', I' respectively store a 1 ,b 1 ,c 1 ,j 1 ,e 3 ,f 3 , g 3 ,i 3 ; Execute variable once e Iterative operations get Operational circuit; Execute variable once j Iterative operations get Operational circuit; Execution variables i Iterative operations get Operational circuit; Among them, A and A', B and B', C and C', E and F', and F and G' are directly connected, respectively... a 1 ,b 1 ,c 1 Directly transmitted to the output side, and thus... e 2 ,f 2 Get it by hitting it f 3 , g 3 ; In the compression circuits of stages 0 to 2, both the input-side registers and the output-side registers are the same registers for both output and input.

25. The data compression circuit as described in claim 23, characterized in that, The second-stage compression circuit includes: The eight input registers A, B, C, D, E, F, G, and H output respectively. a 1 , b 1 , c 1 , d 1 , e 2 , f 2 , g 2 , h 2 ; The eight output registers A', B', C', J', E', F', G', I' respectively store a 1 , b 1 , c 1 , j 1 , e 3 , f 3 , g 3 , i 3 ; Execute variable once e Iterative operations get Operational circuit; Execute variable once j Iterative operations get Operational circuit; Execute variable once i Iterative operations get Operational circuit; Among them, A and A', B and B', C and C', E and F', and F and G' are directly connected, respectively... a 1 , b 1 , c 1 Directly transmitted to the output side, and thus... e 2 , f 2 Get it by hitting it f 3 , g 3 ; In the compression circuits of stages 0 to 2, both the input-side registers and the output-side registers are registers whose output is the inverted form of the input.

26. The data compression circuit as described in any one of claims 3 to 25, characterized in that: The compression circuits from levels 63 to 65 are configured based on the variable obtained from the output of level 62 after 63 iterations. e,f,g,i Data and variables after 61 iterations a,b,c,j The data is used to perform iterative operations on the variables, resulting in variables after 64 iterations. a,b, c,d Data and after 64 iterations e,f,g,h The data.

27. The data compression circuit as described in claim 26, characterized in that: The 63rd stage compression circuit is configured based on variables after 63 iterations. e,f,g,i The data is executed once by the variable. e,f,g The iterative operation yielded the variable after 64 iterations. e,f,g The data, for variables after 63 iterations g The data was processed in one iteration to obtain the variables after 64 iterations. h Data; based on variables after 61 iterations. a,b,c,j and variables after 63 iterations e The data is executed once by the variable. a,b,c,j The iterative operation yielded the variable after 62 iterations. a,b,c,j The data; and, the obtained data is transmitted to the next stage compression circuit; The 64th stage compression circuit is configured based on variables after 62 iterations. a,b,c,j Data and variables after 64 iterations e The data is executed once by the variable. a,b,c,j The iterative operation yielded the variable after 63 iterations. a,b,c,j The data; and the obtained data and the variables after 64 iterations. e,f,g,h The data is transmitted to the next stage of the compression circuit; The 65th level compression circuit is configured based on variables after 63 iterations. a,b,c,j The data is executed once by the variable. a,b,c The iterative operation yielded the variable after 64 iterations. a,b,c Data; For the variables after 63 iterations c The data was processed in one iteration to obtain the variables after 64 iterations. d The data; and the variables after 64 iterations. a,b,c,d,e,f,g,h Output.

28. The data compression circuit as described in claim 27, characterized in that, The 63rd level compression circuit includes: The eight input registers A, B, C, J, E, F, G, and H each output the variable after 61 iterations. a,b,c,j Data and variables after 63 iterations e,f,g,i Data; Eight output registers A', B', C', J', E', F', G', and H' store the variables after 62 iterations. a,b,c,j Data and variables after 64 iterations e,f,g,h Data; variable e The operational circuit uses the variables from the first iteration circuit, the second iteration circuit, the third iteration circuit, or the fourth iteration circuit. e The computational circuit is configured to be based on variables that have undergone 63 iterations. e,f,g,i The data is executed once by the variable. e,f,g The iterative operation yielded the variable after 64 iterations. e Data; variable a The operational circuit uses the variables from the first iteration circuit, the second iteration circuit, the third iteration circuit, or the fourth iteration circuit. a The computational circuit is configured to be based on variables that have undergone 61 iterations. a,b,c,j The data is executed once by the variable. a The iterative operation yielded the variable after 62 iterations. a Data; The second preprocessing circuit employs the second preprocessing circuit from the first, second, third, or fourth iterative circuits, based on variables after 61 iterations. c Data and variables after 63 iterations e The data is executed once by the variable. j The iterative operation yielded the variable after 62 iterations. j Data; Among them, A and B', B and C', E and F', F and G', and G and H' are directly connected, respectively connecting the variables after 61 iterations. a, b Data and variables after 63 iterations e,f,g The data is processed in one iteration to obtain the variables after 62 iterations. b,c Data and variables after 64 iterations f,g,h The data.

29. The data compression circuit as described in claim 27, characterized in that, The 64th level compression circuit includes: The eight input registers A, B, C, J, E, F, G, and H each output the variable after 62 iterations. a,b,c,j Data and variables after 64 iterations e,f,g,h Data; Eight output registers A', B', C', J', E', F', G', and H' store the variables after 63 iterations. a,b,c,j Data and variables after 64 iterations e,f,g,h Data; variable a The operational circuit uses the variables from the first iteration circuit, the second iteration circuit, the third iteration circuit, or the fourth iteration circuit. a The computational circuit is configured to be based on variables that have undergone 62 iterations. a,b,c,j The data is executed once by the variable. a The iterative operation yielded the variable after 63 iterations. a Data; The second preprocessing circuit employs the second preprocessing circuit from the first, second, third, or fourth iterative circuits, based on variables after 62 iterations. c Data and variables after 64 iterations e The data is executed once by the variable. j The iterative operation yielded the variable after 63 iterations. j Data; In this context, A and B', and B and C' are directly connected, representing the variables after 62 iterations. a,b The data is processed in one iteration to obtain the variables after 63 iterations. b,c The data; direct connections between E and E', F and F', G and G', and H and H', respectively, will connect the variables after 64 iterations. e,f,g,h The data is directly passed to the next level.

30. The data compression circuit as described in claim 27, characterized in that, The 65th level compression circuit includes: The eight input registers A, B, C, J, E, F, G, and H each output the variable after 63 iterations. a,b,c,j Data and variables after 64 iterations e,f,g,h Data; Eight output registers A', B', C', J', E', F', G', and H' store the variables after 64 iterations. a, b, c, d e,f,g,h Data; variable a The operational circuit uses the variables from the first iteration circuit, the second iteration circuit, the third iteration circuit, or the fourth iteration circuit. a The computational circuit is configured to be based on variables that have undergone 63 iterations. a,b,c,j The data is executed once by the variable. a The iterative operation yielded the variable after 64 iterations. a Data; In this context, A and B', B and C', and C' and D' are directly connected, representing the variables after 63 iterations. a,b,c The data was processed in one iteration to obtain the variables after 64 iterations. a,b,c The data; direct connections between E and E', F and F', G and G', and H and H', respectively, will connect the variables after 64 iterations. e,f,g,h The data is directly transmitted to the output side.

31. A chip comprising a message expansion circuit and a data compression circuit, characterized in that, The data compression circuit employs the SHA-256 secure hash algorithm as described in any one of claims 1 to 30.

Images