A configurable hmac message authentication code circuit and method

Abstract

The application discloses a configurable HMAC message authentication code circuit and method, and specific steps thereof include: resource reuse is adopted in padding, message expansion and iteration compression modules, and a plurality of operation number addition parts are optimized, so that one block can realize two kinds of hash functions of SM3 and SHA-256, resource occupation is saved, meanwhile, the addition circuit is optimized in the message expansion module and the iteration compression module, and the calculation complexity is reduced; the round processing function module of the SHA3-512 hash function is designed in a way of unfolding and pipeline cutting, and the storage of the round constant is optimized, so that the key path is shortened and the efficiency is improved; the HMAC function module is designed by using a state machine, and each part module is designed in a hierarchical manner and is relatively independent from each other. On the implementation function, certain flexibility is achieved, and the operation of the hash functions of SM3, SHA-256 and SHA3-51 can be realized, and the operation of the message authentication codes of HMAC-SM3, HMAC-SHA256 and HMAC-SHA3-512 can also be realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of encryption chip, and particularly relates to a configurable HMAC message authentication code circuit and method. BACKGROUND

[0002] In order to protect network security, cryptography is widely used and becomes an important support and tool for building a secure and reliable network environment. Cryptography is a discipline that studies encryption and decryption algorithms, involving encryption technology, identity authentication, digital signature, message authentication and other technologies. It is committed to protecting information security in the communication process, preventing unauthorized individuals or entities from accessing, tampering or stealing information. In the digital information era, the influence of cryptography cannot be ignored, and it provides key protection for the security of emerging technologies such as the Internet of Things and big data.

[0003] The threats that messages may encounter in the information transmission process can be divided into active attacks and passive attacks. Active attacks include tampering, replay, forgery and other methods, while passive attacks are eavesdropping and monitoring. In order to effectively deal with these attacks and ensure the security and integrity of communication, encryption and authentication technologies can be used. Encryption technology can convert sensitive information into unreadable ciphertext, and only authorized recipients can decrypt and obtain the original information. Authentication technology mainly includes digital signature, identity authentication and message authentication. Among them, message authentication ensures the integrity and authenticity of messages by attaching authentication markers (such as message authentication codes MAC) to messages. Message authentication technology can confirm whether the received message is the intention of the sender, which helps to prevent unauthorized modification and forgery, and ensures the privacy and integrity of the message. Message authentication code is a technology that confirms integrity and performs authentication, and is a specific implementation of message authentication, widely used in communication protocols such as IPsec and SSL / TLS. In the field of information technology, message authentication code can further improve the security and reliability of network communication. Message authentication code is mainly implemented using one-way hash functions (also known as hash functions, hash functions, hash functions), block ciphers, stream ciphers, public key cryptography and other methods. In order to adapt to the high-speed transmission of network information, message authentication codes that are fast to calculate and can resist common attacks are needed. Message authentication algorithms using hash functions can meet the above requirements.

[0004] HMAC is a shared key encryption algorithm that uses a bottom layer hash function to verify data integrity and authenticity, which has been widely used in network security. HMAC uses a hash function to generate a message authentication code through multiple rounds of iteration of the key and plaintext. The hash function used by HMAC is not limited to a specific one, and any high-strength hash function can be used, and its strength is based on the strength of the underlying hash function. The commonly used hash functions of HMAC are MD5, SHA-1, SHA-2, SHA-3, etc. In order to meet the growing demand for hash functions, China has independently developed the SM3 algorithm, which can be used in the construction of HMAC, random sequence, etc.

[0005] In practical applications, multiple different HMACs may be used in combination, for example, in the SSL / TLS communication protocol, the client and the server will use different HMACs, and other hash functions may also be used to implement pseudo-random numbers. Although various HMACs can be used flexibly, if a separate module is provided for each algorithm on the same core, the complexity and cost of the system will increase. A feasible solution is to use a reconfigurable unit with multiple functions. The reconfigurable unit allows different hash functions and HMAC algorithms to be selected according to specific security requirements, thereby achieving flexible customization and configuration. By integrating multiple security functions into a single unit, system resources are saved, and the cost of hardware implementation is reduced. The flexibility and customization of the reconfigurable unit can also help the system to select appropriate security strategies and algorithms for different security threats and attack scenarios, thereby improving the security of the system. In previous research on HMAC hardware design, most of them only implement an HMAC algorithm corresponding to one hash function. In this paper, based on the SM3, SHA-256, SHA3-512 and HAMC algorithms, a reconfigurable unit is studied. SUMMARY

[0006] The configurable HMAC message authentication code circuit and method proposed by the application can at least solve one of the technical problems in the background art.

[0007] To achieve the above-mentioned purpose, the application adopts the following technical solutions:

[0008] A configurable HMAC message authentication code circuit includes a data flow control unit, an SM3-SHA256 hash function unit, and a SHA3-512 hash function unit.

[0009] The internal modules of the HMAC message authentication code circuit are controlled by a clock signal output input terminal clk and a reset signal input terminal rst_n.

[0010] The mode signal selection circuit of the HMAC message authentication code circuit controls the enable signals of the SHA3-512 hash function unit and the SM3-SHA256 hash function unit through an exclusive OR gate and an AND gate; the enable signal of the SM3-SHA256 hash function unit and mode[0] are connected through an AND gate as the selection signal of the SM3-SHA256 module;

[0011] The data stream control unit includes five input ends, namely, an HMAC enable signal end hmac_en, an input valid signal end date_en, a plaintext or key end data_in, a last byte input signal end msg_is_last_word and a last byte byte number end byte_num, wherein the enable signal end hmac_en controls whether the remaining four ports are direct data input ends of the SM3-SHA256 hash function unit and the SHA3-512 hash function unit;

[0012] The data stream control unit includes seven output ends, wherein an output valid signal end hmac_vld and a data output signal end msg_hmac are connected with the output ends of the SHA3-512 hash function unit and the SM3-SHA256 hash function unit, and an output end need_data is used for outputting a data request signal;

[0013] The other four output ends of the data stream control unit are respectively connected with the corresponding input ends of the data stream control unit through selectors, and the control end of the selector is connected with the HMAC enable signal input end;

[0014] The data output end out and the out_ready signal output end of the SM3-SHA256 hash function unit and the SHA3-512 hash function unit are connected in a selector at the same time, and the output is controlled through an input mode signal end, the output end of the selector is connected with the corresponding output end of the data stream control unit through a selector, and the final data of the HMAC circuit is output through the selector.

[0015] Further, the SHA3-512 hash function unit in the HMAC message authentication code circuit of the present application includes a padding module and a permutation module;

[0016] The filling module comprises three output ends, which are a data output end, a last block signal output end last_block and an output valid signal output end pout_r, wherein the last block signal output end and the output valid signal output end are connected with the input ends of the permutation module, and the data output end is connected with the little-end conversion module recode1.

[0017] The permutation module comprises six input ends, wherein three input ends are a data input end in, a last block signal input end last_block and an input valid signal input end in_ready, the data input end is connected with the output end of the little-end conversion module recode1, and the last block signal input end and the input valid signal input end are connected with the corresponding output ends of the filling module.

[0018] The permutation module comprises three output ends, which are a data output end out, an output valid signal output end out_ready and an ack signal output end, wherein the data output end is connected with the input end of the little-end conversion module recode2, and the ack signal output end is connected with the input end of the filling module.

[0019] Further, the permutation module in the SHA3-512 hash function unit in the HMAC message authentication code circuit of the present application comprises a round function module, the round function module selects an internal pipeline structure, performs a two-stage expansion processing round operation, a first-stage round function processes even-numbered rounds, and a second-stage round function processes odd-numbered rounds.

[0020] Further, the pipeline structure of the even-numbered rounds in the SHA3-512 hash function unit in the HMAC message authentication code circuit of the present application is inserted with a pipeline register between the θ2 logic circuit and the θ3 logic circuit, and the pipeline structure of the odd-numbered rounds is inserted with a pipeline register between the θ logic circuit and the ρ logic circuit.

[0021] In the round function module, the even-numbered rounds use initial data or feedback of a previous round as input, the former passes through a selector, and the latter passes through two selectors before starting replacement, and the odd-numbered rounds only need to receive data processed by a previous stage without passing through a selector.

[0022] Further, the SHA3-512 hash function unit in the HMAC message authentication code circuit of the present application comprises a message filling module, a message expansion module and an iteration compression module.

[0023] The message filling module comprises two output ends, which are a data output end P_out and an output valid signal end Pout_ready, and are connected with the input ends of the message expansion module.

[0024] The message expansion module comprises four output ends, which are a wj0 data output end, a wj1 data output end, an out_vld signal output end and a ready signal output end, wherein the wj0 data output end, the wj1 data output end and the out_vld signal output end are connected with the input end of the iterative compression module, and the ready signal output end is connected with the output end of the message padding module.

[0025] The iterative compression module comprises two output ends, which are a data output end out and an output valid signal end out_ready, and the two output ends are output ends of the SM3-SHA256 hash function unit.

[0026] Further, the HMAC message authentication code circuit of the present application is characterized in that the A register and the E register update circuit of the compression function in the SM3 algorithm and the SHA-256 algorithm in the iterative compression module of the SM3-SHA256 hash function unit is implemented by using a multiplexing structure, and the 8*32-bit registers A-H required by the SM3 algorithm and the SHA-256 algorithm are further multiplexed.

[0027] In another aspect, a configurable HMAC message authentication method comprises the following steps:

[0028] S1. In the whole HMAC process, the key is padded to meet the length requirement before participating in encryption, and there are two padding methods according to the different lengths of the initial key.

[0029] S2. The padded key is first XORed with the equal-length ipad sequence to obtain a key-related bit sequence ipadkey, and the length of the bit sequence ipadkey is the same as the message block length of the used hash function.

[0030] S3. After obtaining the bit sequence ipadkey, the bit sequence ipadkey is combined with the message, i.e., the message is spliced after the bit sequence ipadkey to obtain the bit sequence ipadkey||m.

[0031] S4. The spliced data is sent into the SM3-SHA256 hash function unit or the SHA3-512 hash function unit for processing.

[0032] S5. The padded key is first XORed with the equal-length opad sequence to obtain a bit sequence opadkey.

[0033] S6. After obtaining the bit sequence opadkey, the hash value obtained in the S4 process is spliced after the bit sequence opadkey.

[0034] S7, finally, the data obtained in S6 is sent into the SM3-SHA256 hash function unit or SHA3-512 hash function unit again for processing, and the hash value obtained is the final message authentication code value.

[0035] Further, the HMAC message authentication method of the application, the filling mode specifically comprises the following two kinds:

[0036] One is when the length of the key is greater than the length of the hash function message block, the data_en signal output is "2", the key is processed once through the hash function, so that the need_data signal frequency point is delayed, and the length of the processed key is less than the length of the message block, then "0" is filled at the end to make the length the same as the length of the hash function message block.

[0037] The second is when the length of the key is less than the length of the hash function message block, the data_en signal output is "1", then "0" is directly filled at the end to make the length the same as the length of the hash function message block.

[0038] In summary, in the filling, message expansion and iteration compression module, resource reuse is adopted, and the multiple operand addition part is optimized, so that one block can realize the SM3 and SHA-256 hash functions; the round processing function module of the SHA3-512 hash function is designed in a way of expansion and pipeline cutting, and the storage of the round constant is optimized; the HMAC function module is designed using a state machine, and each part of the module is designed in a hierarchical manner and is relatively independent of each other. In terms of function implementation, it has certain flexibility, and can realize the operation of SM3, SHA-256 and SHA3-512 hash functions, and can also realize the operation of HMAC-SM3, HMAC-SHA256 and HMAC-SHA3-512 message authentication codes.

[0039] The application makes full use of the data path of the hardware implementation of the HMAC encryption algorithm, adopts a state machine control part to control the SHA3-512 hash function unit and the SM3-SHA256 hash function unit, controls the input and output of the hash function at each state, encrypts the external input plaintext information at the rising edge of the clock signal, and then outputs the ciphertext, the encryption mode of the plaintext is generated according to the control logic of the enable signal and the mode signal, and the round operation in the corresponding configuration mode is performed, which greatly simplifies the design of the control and operation unit, and the structure is simple, and meanwhile, the characteristics of supporting multiple hash functions are supported, the encryption configuration parameters defined by the hash encryption algorithm are realized in a single circuit, the flexibility of the hash encryption algorithm in the information security application of the Internet of Things is improved, different encryption performances required in different encryption demand scenarios are realized, the configuration modes are multiple, and this is conducive to the wide use of the application in the Internet of Things scene.

[0040] Advantages:

[0041] 1. The structures of SM3 and SHA-256 hash functions are analyzed. Resource reuse is adopted in the padding, message expansion and iteration compression modules, so that one module can realize the SM3 and SHA-256 hash functions, and the resource occupation is saved. Meanwhile, the addition circuit is optimized in the message expansion module and the iteration compression module, and the calculation complexity is reduced.

[0042] 2. The round processing function module of the SHA3-512 hash function is adopted in the form of expansion and pipeline cutting to reduce the round cycle count, shorten the critical path, improve the frequency and throughput, optimize the storage of the round constant, and reduce the resource usage.

[0043] 3. The state machine design is used for the HMAC module, and the calling of three hash functions is completed. The designed modules are designed in a hierarchical manner and are relatively independent of each other. In terms of function implementation, it has certain flexibility, that is, it can realize the operation of the SM3, SHA-256 and SHA3-512 hash functions, and can also realize the operation of the HMAC-SM3, HMAC-SHA256 and HMAC-SHA3-512 message authentication codes. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 It is the overall structure block diagram of the HMAC message authentication circuit of the application;

[0045] Figure 2 It is the overall structure schematic diagram of the SM3-SHA256 module of the application;

[0046] Figure 3 It is the padding module in the SM3-SHA256 module of the application;

[0047] Figure 4 It is the padding rule of the prior art SM3;

[0048] Figure 5 It is the message expansion module in the SM3-SHA256 module of the application;

[0049] Figure 6 It is the schematic diagram of the CSHA tree structure of the prior art;

[0050] Figure 7 It is the schematic diagram of the message word shift register of the application;

[0051] Figure 8 It is the iteration compression module in the SM3-SHA256 module of the application;

[0052] Figure 9Update logic circuit for A and E registers of the present invention;

[0053] Figure 10 Overall structure of the SHA3-512 module of the present invention;

[0054] Figure 11 Prior art SHA-3 padding rule;

[0055] Figure 12 Prior art SHA-3 standard padding rule;

[0056] Figure 13 Padding module in the SHA3-512 module of the present invention;

[0057] Figure 14 Internal state of the permutation function Keccak-f;

[0058] Figure 15 Step θ of the permutation function Keccak-f;

[0059] Figure 16 Step ρ of the permutation function Keccak-f;

[0060] Figure 17 Step π of the permutation function Keccak-f;

[0061] Figure 18 Step χ of the permutation function Keccak-f;

[0062] Figure 19 Permutation module in the SHA3-512 module of the present invention;

[0063] Figure 20 Round function structure in the permutation module in the SHA3-512 module of the present invention;

[0064] Figure 21 Four preselected internal pipeline schemes of the present invention;

[0065] Figure 22 HMAC message authentication flowchart;

[0066] Figure 23 Hash function function simulation results;

[0067] Figure 24 Simulation results for key length less than message block length;

[0068] Figure 25 Simulation results for key length greater than message block length. DETAILED DESCRIPTION

[0069] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application.

[0070] The configurable HMAC message authentication code circuit of the embodiment comprises a data flow control unit, an SM3-SHA256 hash function unit and an SHA3-512 hash function unit. The data flow control unit is a state machine FSM, which comprises three output ends. Two output ends output valid signals msg_hmac_vld and data output signals msg_hmac respectively, and are connected to the output ends of the SHA3-512 part and the SM3-SHA256 part through selectors. Another output end of the data flow control unit outputs a data request signal need_data. Four input ends are respectively a data state input end, an input data input end, a byte number input end and a last byte input end, which are connected to in_vld, data, byte_numb and last_word of the state machine part through selectors. The control end of the selector is connected to an HMAC enable signal input end.

[0071] The output end of the selector is connected to four input ends of the SHA3-512 hash function unit and the SM3-SHA256 hash function unit.

[0072] The data output end out and the valid signal output end out_ready of the SHA3-512 hash function unit and the SM3-SHA256 part are connected to the same selector at the same time, and the output is controlled through an input signal mode. The output end of the selector is connected to the corresponding output end of the data flow control unit through a selector, and the final data of the HMAC circuit is output through the selector.

[0073] The mode signal selection circuit controls the enable signals of the SHA3-512 and the SM3-SHA256 through an XOR gate and an AND gate. The enable signal of the SM3-SHA256 and mode[0] are connected to an AND gate as the selection signal of the SM3-SHA256 module.

[0074] The SM3-SHA256 hash function unit comprises a message padding module, a message expansion module and an iteration compression module.

[0075] The message padding module comprises two output ends, a data output end P_out and an output valid signal end Pout_ready, which are connected to the input ends of the message expansion module.

[0076] The message expansion module includes four output ends, which are wj0 data output end, wj1 data output end, out_vld signal output end and ready signal output end, wherein the wj0 data output end, the wj1 data output end and the out_vld signal output end are connected with the input end of the iterative compression module, and the ready signal output end is connected with the output end of the message padding module.

[0077] The iterative compression module includes two output ends, which are data output end out and output valid signal end out_ready, as the output end of the SM3-SHA256 hash function unit. The SHA3-512 hash function unit includes a padding module, a permutation module and a round function module.

[0078] The padding module includes three output ends, which are data output end, last message block signal output end last_block and output valid signal output end pout_r, wherein the last message block signal output end and the output valid signal output end are connected with the input end of the permutation module, and the data output end is connected with the little-end conversion module recode1.

[0079] The permutation module includes six input ends, wherein three input ends are data input end in, last message block signal input end last_block and input valid signal input end in_ready, the data input end is connected with the output end of the little-end conversion module recode1, and the last message block signal input end and the input valid signal input end are connected with the corresponding output end of the padding module.

[0080] The permutation module includes three output ends, which are data output end out, output valid signal output end out_ready and ack signal output end, wherein the data output end is connected with the input end of the little-end conversion module recode2, and the ack signal output end is connected with the input end of the padding module.

[0081] The following is a specific description:

[0082] In this embodiment, three hash functions SM3, SHA-256 and SHA3-512 circuit implementation methods and three HMAC message authentication codes HMAC-SM3, HMAC-SHA256 and HMAC-SHA3-512 circuit implementation methods are taken as examples, and six functional parameter configuration modes are shown in Table 1.

[0083] Table 1 shows six functional parameter configuration modes

[0084]

[0085] Figure 1It is a configurable HMAC message authentication code circuit structure diagram of the embodiment of the application, the configurable HMAC message authentication code circuit described in the embodiment of the application, including state machine control part (FSM), SHA3-512 hash function unit and SM3-SHA256 hash function unit.The embodiment takes three kinds of hash functions SM3, SHA-256, SHA3-512 circuit implementation method and three kinds of HMAC message authentication code HMAC-SM3, HMAC-SHA256, HMAC-SHA3-512 circuit implementation method as an example.

[0086] Continuing to refer to Figure 1 The external port of the configurable HMAC message authentication code circuit is shown in Table 2, specifically, the clock signal clk, the reset signal rst_n, the HMAC enable signal hmac_en, the input valid signal date_en[1:0], the plaintext or key data_in[31:0], the last byte input signal msg_is_last_word, the last byte byte_num[1:0], the mode selection signal mode[1:0], the data request signal need_data, the output valid signal msg_hmac_vld, and the output hash value or message authentication code msg_hmac[511:0] received from the outside.

[0087] Table 2 HMAC input and output interface description

[0088]

[0089] Specifically, continuing to refer to Figure 1The hamc_en signal input under the driving of the clock signal clk controls the enable of the data flow control unit state machine. When the hamc_en signal is pulled high, the two data bits of the input mode signal mode[1:0] are controlled by an exclusive OR gate and an AND gate to control the enable signals of SHA3-512 and SM3-SHA256. The enable signal of SM3-SHA256 and mode[0] pass through an AND gate as the selection signal of the SM3-SHA256 module, which functions to select the hash function currently required to be used. When the HMAC message authentication code function with a key less than 256 bits is performed, the data_en[1:0] input is 2'b01, the data_in[31:0] input is the key, and the key is stored in the key register. After the key transmission is completed, 32-bit data in the key register is taken out every cycle and is XOR assigned to data[31:0] with 32'h36363636, and the in_vld signal is pulled high. The key processing process is counted by the counter, the request data signal need_data is pulled high when the last 32-bit data in the key register is processed, the in_vld is pulled high when the data_en[1:0] input is 2'b11, the input plaintext data_in[31:0] is assigned to data[31:0], the input msg_is_last_word is assigned to last_word, and the input byte_num[1:0] is assigned to byte_numb[1:0]. The hash value output after the hash function processing is stored in the hash value register hash_value[511:0]. The 32-bit data in the key register is taken out again in sequence and is XOR assigned to data[31:0] with 32'h5c5c5c5c, and the in_vld signal is pulled high. The key processing process is counted by the counter, and the data in the hash value register is shifted into data[31:0] and the in_vld is pulled high after the processing is completed. The counter counts the data transmission process again, the last_word is pulled high when the last 32-bit data is input, and byte_num[1:0] is assigned 2'b11. The obtained hash value after the processing is stored in the hash value register hash_value[511:0], and the hmac_vld is pulled high. The output is selected by the selector.

[0090] Specifically, the HMAC function module receives external input clock signal clk, reset signal rst_n, HMAC enable signal hmac_en, data state signal data_en, input data data_in, byte number btye_num, last byte msg_is_last_word, and mode selection signal mode, and controls the hash algorithm part by using the internal state machine control part FSM and the selection signal mode. Under the triggering of the HMAC enable signal hmac_en, the high level enables the control state machine, which represents that the HMAC function is executed at this time, and the mode signal is used to select whether to execute HMAC-SM3, HMAC-SHA256 or HMAC-SHA3-512. When hmac_en is low, it represents that the hash function is executed by default at this time, and the mode signal is used to select whether to execute SM3, SHA-256 or SHA3-512.

[0091] In the SM3_SHA256 module design, a mode selection signal mode is also needed, and the bit width of the mode selection signal is 1. When the mode signal of the HMAC is used for selection and enable, the two bits of the mode signal are XORed and ANDed to obtain the SM3_SHA256 and SHA3-512 module enable signals, respectively, and then ANDed with the low bit of mode to obtain the mode selection signal of the SM3_SHA256 module.

[0092] In the selection of the data input to the hash algorithm module, four selectors are used to select by using the hmac_en signal. When the HMAC function is executed, the hash algorithm module inputs the output from the state machine control module, and when the hash function is executed, the input comes from the external port. The data input valid signal in the HMAC module has a bit width of 2, but the hash module data input valid signal has a bit width of 1, and only two states are involved without other cases. When the date_en signal is 2’b11, the data input is valid, so the two bits of the date_en signal are ANDed to obtain the hash module data input valid signal. When data is output, the hmac_en signal is used to select whether to output the value in the hash value register from the FSM module or the value in the hash algorithm module. The sm3_en signal of the SM3-SHA256 module is used to select which hash function to output. Since the output bit widths of SM3, SHA256 and SHA3-512 are different, 256-bit “0” is additionally spliced to the 256-bit data output by SM3 and SHA-256 when selecting. The output valid signal also uses the hmac_en signal and the sm3_en signal, and the above method is used for selection.

[0093] As Figure 2The SM3-SHA256 hash function unit includes a message padding module, a message expansion module, and an iteration compression module.

[0094] The external ports of the SM3-SHA256 hash function unit include a clock signal clk, a reset signal rst_n, an enable signal sm3_en, a data input signal in, a data input state cycle signal in_ready, a last byte number byte_num[1:0], a last byte input signal is_last, a mode selection signal mode, a data output signal out, and a data output state signal out_ready.

[0095] The message padding module is as shown in Figure 3 The message padding steps are as follows: first, a bit "1" is filled at the end of the input data, then a number of bits "0" are filled, and finally, a 64-bit message length is added. The number of filled zeros should satisfy the condition that the sum of the bit lengths of the message length (M L ), "1", "0", and the message length is the smallest integer multiple of 512. Specifically, two cases may occur. The first case is as shown in Figure 4 (a). If the value of M L mod 512 is less than 448, the message is normally filled according to the above operation. The second case is as shown in Figure 4 (b). If the value of M L mod 512 is greater than or equal to 448, the message block cannot continue to fill the 64-bit message length, and therefore, another message block is needed to fill the message length.

[0096] Specifically, the message padding module is enabled when pad_en is pulled high. The in_ready is pulled high to indicate that the data starts to be input from the in port. Then, pad_oready is pulled high, and the data is input to the data buffer through p_data. The r_ready signal indicates the state of the message expansion module. A high level represents that the message expansion module is in an idle state. At this time, the data can be output through the r_data port by pulling r_vld high. When the input is_last signal is high, it represents that the current input is the last data. At this time, the byte_num input is the number of valid data bytes of the current input, and the last group of data is padded according to the padding rule shown in Table 3 according to the value of byte_num. In addition, if the byte_num input is 2' b11, 32 'h800000000000 is padded in the next cycle. Two counters are defined in the module to calculate the length of the data and the progress of the padding. The data length counter is input to the maximum of 2 64The bit width is defined as 64. A counter is added each time data is input. When the last group of data is input, byte_num is converted into a corresponding length value, and the final data length is obtained by adding the previous counter value. Since the message block is 512 bits, 32-bit data input requires 16 iterations. The progress counter is filled during data input, and after the last group of data is input, the corresponding number of 32-bit "0"s is filled according to the counter. Finally, the data length in the data length counter is filled in two cycles to obtain the filled data.

[0097] Table 3 SM3-SHA256 module filling rule

[0098]

[0099] As Figure 5 shown is a message expansion module in an SM3-SHA256 hash function unit. The message expansion part expands the message block after grouping. The expansion stage confuses and rearranges the message, and generates a more complex message sequence using the information of the original message. In the SM3 algorithm, 132 message words are generated, including 68 W message words and 64 W' message words.

[0100] (1) The 512-bit message block is divided into 16 words W0, W1, … W15 according to 32 bits.

[0101] (2) The 16 words are further expanded to W16 to W67 using the following formula, and finally 68 W message words are obtained. In the formula, the symbol << indicates a circular left shift, and the symbol ⊕ indicates a 32-bit XOR.

[0102]

[0103] (3) Then, the obtained W message words are used to further generate 64 W' message words through the following formula.

[0104]

[0105] The SHA-256 algorithm is different from the SM3 algorithm, and its message expansion module only expands the 512-bit message block into 64 32-bit message words in the message expansion stage. First, the message block is divided into 16 32-bit words W0, W1, …, W16. Then, the remaining 48 message words are obtained according to the following formula. In the formula, POTR represents a circular right shift, SHR represents a right shift, the superscript n represents the number of bits to be moved, and the symbol ⊕ represents a 32-bit XOR.

[0106]

[0107] Specifically, as Figure 6The carry-save adder (CSA) used by the hash algorithm SM3_SHA256 is shown to optimize the addition operation used, the basic idea of which is to separately calculate and save the carry c and the sum bit s, reducing the addition of three operands to the addition of two operands. For example, Result = x1+x2+x3, where the carry c = ((x1&x2) | (x2&x3) | (x1&x3)) << 1, and the sum bit S = x1 ^ x2 ^ x3. When multiple operands perform addition, the CSA tree structure addition method is used, which passes the operands through multiple CSAs and then sums the last two output operands.

[0108] Specifically, as shown in Figure 7 The data received and updated by the message word bit shift register used by the hash algorithm SM3_SHA256 is shifted from the Wt+15 register, and the green line part in the figure represents the generation process of the SM3 message word, and the red line part represents the generation process of the SHA-256 message word. The mode selection signal mode is used to select whether to expand the SM3 or the SHA-256 message word. In the output stage of the message word, SHA-256 only needs to expand W j The message word, so it can be directly output from the Wt+15 register, and W’j only needs to output the calculated data when SM3 is executed, and outputs “0” when SHA-256 is executed. Since W’ j is generated by XORing W j and W j+4 , if the Wt+15 register is still used as the output of W j , W’ j will not be output until four cycles later, which will cause the output of the two groups of message words to be out of sync. To solve the above problem, the Wt+11 register is used as the output of the W j message word in SM3, so the output is four cycles later than that of SHA-256 when the SM3 message expansion is executed.

[0109] Specifically, the exp_en signal of the message expansion module in the SM3-SHA256 hash function unit is the enable signal of the message expansion module, the mode signal is the mode selection signal used to select which hash algorithm to execute. The msg_vld pull-up indicates that the input data is valid, and the 32-bit data is transmitted from msg_in to the module. The ready is connected to the padding module of the previous stage, and the pull-up represents that no message expansion task is being executed at this time, and the data can be received, and the pull-down represents that the message expansion task is being executed at this time. When the out_vld is pulled up, the data is output, wj0 corresponds to W j , and wj1 corresponds to W’ j .

[0110] As shown in Figure 8The iteration compression module in the SM3-SHA256 hash function unit is shown in the schematic diagram. The com_en pull-up indicates that the iteration compression module is enabled. The initial values of A-H of SM3 or SHA-256 are selected by the mode signal and sent to the A-H register and the state register. The data valid signal msg_vld is pulled up, and the extended message word is started to be accepted. With the update of wj0 and wj1, the A-H register is updated accordingly, and the message block compression is performed. A counter is defined inside the iteration compression module to count 64 rounds of compression. When the compression of a message block is completed, the data of this iteration is sent to the state register for saving, and used as the initial value for the next iteration calculation, by selecting the exclusive or iteration of SM3 or the addition iteration of SHA-256 through the mode signal. The last_block pull-up indicates that this is the last message block input. After the compression and iteration are completed, the out_ready is pulled up, and the 256-bit hash value out is output.

[0111] The iteration compression is a key link of the SM3 and SHA-256 algorithms. The iteration of the two algorithms is mainly through the update of eight words A, B, C, D, E, F, G, and H. The specific formulas of the SM3 and SHA-256 compression functions are as follows.

[0112]

[0113]

[0114] From the formulas of the SM3 and SHA-256 compression functions, it can be seen that the main difference between the two algorithms in B, D, F, and H is in the update of A and E. The A and E update circuits of the two algorithms are implemented by using a multiplexing structure, and the 8x32-bit A-H registers required by the two algorithms can be further multiplexed, as shown in the following table. Figure 9 As shown in the table, in SM3, whether A is calculated or E is calculated, SS1 is first calculated, and then SS2 is calculated from SS1, and then TT1 and TT2 are calculated, respectively. In the SS1 calculation process, the three operands need to be shifted after addition to participate in subsequent calculation, so a CSA tree structure is not used in combination with the subsequent addition operation, but a CSA and an adder are used to realize the addition of the three operands in SS1. The number of logic gates passed through by FF j , GG j , Ch, and Maj in the calculation of SM3 and SHA-256 is similar. When calculating these functions, a CSA is used to synchronously calculate the carry and sum of H, W j , and K j . Since K jWhen the SM3 hash algorithm is executed, "0" is input through the selector. The rest of the addition circuit continues to be optimized using the C SA tree structure, and the selector is used to select the operands used by the SM3 and SHA-256 hash calculations. The critical path of the E register update circuit passes through three CSAs, two adders, a P0 permutation function, and two selectors, which is significantly shorter than the addition path passing through five operands. The critical path of the A register update circuit passes through four CSAs, two adders, and two selectors, which is significantly shorter than the addition path passing through six operands in SHA-256.

[0115] SHA-3 adopts a sponge structure. As can be seen from Table 4, SHA3-512 in the SHA-3 series algorithm has higher security.

[0116] Table 4 Size specifications of SHA-3 hash functions

[0117]

[0118] As Figure 10 shown is a SHA3-512 hash function unit including a padding module and a permutation module;

[0119] The external ports thereof are specifically a clock signal clk, a reset signal rst_n, an enable signal en, a data input signal in, a data input state cycle signal in_ready, a last byte number byte_num[1:0], a last byte input signal is_last, a data output signal out, and a data output state signal out_ready.

[0120] The SHA-3 algorithm pads and blocks the message to be processed before algorithm operation. SHA-3 adopts a different padding rule than SM3 and SHA-2. The padding method of the sponge structure is divided into two types, simple padding and multiple bit rate padding. Simple padding only needs to fill a bit "1" and several bits "0" at the end of the message, so that the length of the filled data is a minimum integer multiple of the packet length. The multiple bit rate padding method first adds a bit "1" at the end of the message, then adds a sufficient number of bits "0", and finally adds a bit "1" at the end. After padding, the length of the data still needs to meet the requirement of being a minimum integer multiple of the packet length. In the face of different input message lengths, the following common padding situations may occur. As Figure 11 (a) shown, when the length of the input message is not equal to an integer multiple of the packet length, the bit sequence "10…01" needs to be padded at the end, until the length after padding meets the requirement of an integer multiple of the packet length. As Figure 11(b) shows that when the length of the input message is equal to an integer multiple of the block length, a new message block needs to be added and then filled with a sequence of "10…01" bits of the block length at the end. Figure 11 (c) shows that when the length of the input message is equal to an integer multiple of the block length minus one, a bit "1" needs to be filled at the end first, and then a sequence of "0…01" is added until the length meets the requirement.

[0121] The SHA-3 standard FIPS202 published by NIST in 2015 is slightly different from the above padding rules. In order to distinguish different variants of Keccak, a domain separator "01" is added before padding, as shown in Figure 12 .

[0122] Among them, the padding module is a key step before the data enters the permutation, and in the implementation of the padding step, a multi-bit rate padding method is selected to pad the 32-bit input data.

[0123] Specifically, the port of the padding module is as shown in Figure 13 In a padding process, first, pad_en is pulled high to enable the padding module. When in_ready signal is pulled high, it indicates that 32-bit input data is ready, and the padding module starts to receive data and sends the received data into the shift register. The counter is defined to count the input data, and since the message block length is 576, 32-bit data is input each time, so the maximum count is 18. When is_last signal is pulled high, it indicates that the data transmission is completed. For each variable length input, according to the given byte_num, different number of padding bits are added according to the padding rule shown in Table 5. In addition, if byte_num is 2’b11, 32’h06000000 is filled in the next cycle. Then, a number of 32-bit 0s are filled, and 1 is filled at the end of the last 32-bit data to complete the padding, and last_block is pulled high to indicate that this is the last block of data. When the count is 18, pout_r is pulled high to indicate that the data is ready to be output through the p_data port. The permutation function module takes away the padding data by pulling c_ack high. After the data is taken away, pout_r is pulled low again, and the counter and shift register are cleared.

[0124] Table 5 SHA3-512 module padding rule

[0125]

[0126] The permutation function is a key part of the hash function. The permutation function used in SHA-3 algorithm can be denoted as Keccak-f or f, which maps the 1600-bit state into a 5x5x64 three-dimensional matrix according to the correspondence S[64(5y+x)+z] = A[x][y][z] and performs 24 rounds of operation. The Keccak internal state is shown in Figure 14

[0127] Each block in the figure represents a bit. When the dimension is 1, the column in the x-axis direction is called a row, the column in the y-axis direction is called a column, and the column in the z-axis direction is called a lane. When the dimension is 2, the plane parallel to xz is called a plane, the plane parallel to xy is called a slice, and the plane parallel to yz is called a sheet. The round function of 24 rounds of operation in Keccak-f includes five steps, namely θ, ρ, π, χ and ι, wherein θ can be divided into θ1, θ2 and θ3. Next, the operation of each step is explained, and the mathematical formula of the five-step calculation is shown as follows:

[0128]

[0129] Step θ: As shown in Figure 15 , in the θ step, a linear transformation is performed on each column in the state cube. θ1 is the exclusive OR operation of all data on each column. θ2 is the exclusive OR operation of each column after θ1 operation and its adjacent two columns after θ1 operation. θ3 is the exclusive OR operation of the result obtained by θ2 with itself, and is overwritten. The θ step increases the diffusion of the state, thereby enhancing the security of the algorithm.

[0130] Step ρ: As shown in Figure 16 , when the lane length is 8, the schematic diagram of step ρ is shown. ρ is an operation on the lane, which uses different offsets r(x, y) to shift according to the different x and y, and increases the randomness of the state. The offset corresponds to x and y as shown in Table 6.

[0131] Table 6: Circular shift offset

[0132]

[0133] Step π: As shown in Figure 17 , π is a reordering operation on the lane according to a fixed order, which eliminates horizontal or vertical alignment and increases the randomness of the state.

[0134] Step χ: As shown in Figure 18 ​The shown χ is a processing of data in row, and is the only nonlinear transformation in 5 steps of round function. The final result is obtained by calculating every two adjacent data in row, and then XORing with itself, which increases the nonlinearity of the algorithm.

[0135] Step i: i is XORing with lane x = 0, y = 0 using a set of fixed round constants (RC), which increases the non-symmetry of the algorithm. The round constants used in step i are a set of constants related to the round number ir, and the values of the round constants can be calculated by the following formula, where Trunc represents the specified number of bits, and the calculation results are shown in Table 7.

[0136]

[0137] Table 7: Round constant values

[0138]

[0139]

[0140] As Figure 19 shown in the schematic diagram of the permutation module in the SHA3-512 hash function unit, when the enable signal en is pulled high, it indicates that the permutation module starts working, and the in_valid is pulled high to receive the 576-bit input signal in. When the permutation module has received the data, the ack signal is pulled high to feed back to the padding module, and the ack is pulled low when the next cycle starts to process the round. The permutation module selects the input data in or the output data of the previous round as the input through the control module controlling the round function module. The counter in the control module provides the value of the round constant for the round function module. The round counter is also defined in the control module, and the counter executes two rounds for each count, and the permutation of the message block is completed when the counter counts to 12. When last_block is high, it indicates that the current is the last message block, and when the message block processing is completed, the permutation module outputs the signal out, and the signal out_ready is pulled high to indicate that the permutation is completed.

[0141] Specifically, the round function part is as shown in Figure 20 The round function is the core part of SHA3-512, which is responsible for data replacement and undertakes the main operation of the algorithm. Therefore, optimization of this part can improve the overall performance. Pipeline and unrolling techniques, etc., aim to improve the frequency and throughput in different directions.

[0142] Specifically, in the implementation of the round function, the pipeline can be divided into a round operation pipeline and an internal pipeline. The round operation pipeline inserts registers after each round operation, and the internal pipeline inserts intermediate registers during the round operation. The number of stages of the pipeline is the number of inserted registers in the design, i.e., the sum of the number of registers of the two pipelines.

[0143] The use of the internal pipeline in the round operation module can shorten the critical path to improve the frequency. The round function of SHA-3 includes five steps of operations. The θ1 operation in the θ operation uses 4 XOR gates, the θ2 operation uses 1 XOR gate, and the θ3 operation uses 1 XOR gate. The ρ and π operations do not consume logic gates because they are only data rearrangements, and therefore the two steps are combined for processing. The χ operation uses 1 XOR gate, 1 NOT gate, and 1 AND gate. The ι operation uses 1 XOR gate. The placement of registers at different positions has different effects on the frequency, and therefore four different positions for placing registers are tried, as shown in Table 6. Since the ρ and π operations do not consume logic gates, they are not considered in this paper. More sub-pipeline stages can bring higher frequency, but also consume more resources to reduce the overall efficiency. Therefore, only the case of using one-level internal pipeline is discussed. Figure 21

[0144] In the implementation of the round function, the storage of RC values is also included. The RC value is composed of 24 groups of 64-bit data. By observing Table 7, it can be found that among the 24 RC values, only the 0th, 1st, 3rd, 7th, 15th, 31st, and 63rd bits can be "1", and the remaining bits are zero. In order to reduce resource consumption and the calculation amount required by the "ι" operation in the round function, the RC value is compressed to 7 bits for storage, as shown in Table 8.

[0145] Table 8 Simplified round constant values

[0146]

[0147] In this paper, four internal pipeline schemes mentioned in Figure 21 are implemented using Verilog language, and Modelsim is used for simulation. The ISE tool is used for synthesis on the Xlinx Virtex5 (xc5vlx110-3ff1760) chip. Table 9 shows the comparison of the four schemes in terms of frequency, throughput, resource occupation, and efficiency. The formulas for throughput and efficiency are as follows: and where r is the size of the message block, in SM3 and SHA-256, r is 512, f is the maximum frequency (Frequency), N is the number of message blocks processed simultaneously, and cycles is the number of cycles. In SHA3-512, the size of the message block r is 576.

[0148] Table 9 Experimental results of four internal pipelines​

[0149]

[0150] In the four internal pipeline schemes, pipeline registers are inserted between θ2 and θ3, and the number of logic gates passed by the combinational circuit on both sides of the register in the round function is relatively balanced. According to the experimental results, the frequency effect obtained is the best among the four schemes. According to the formula of the round function, θ3 operation needs to use the variable A again. When inserting the register, not only the variable B needs to be registered, but also the register needs to be used to temporarily store the variable A. Therefore, this structure needs to consume more resources, but the overall performance is good. The frequency between θ and ρ is better than that between θ1 and θ2, although the number of logic gates passed by the combinational circuit on both sides of the register in the round function is comparable, but the former frequency, throughput and other effects are better than the latter. The critical path is relatively long when inserting pipeline registers between χ and ι, which passes through 9 logic gates and a selector. According to the experimental results, whether in frequency, throughput, or efficiency, it is lower than the other three schemes.

[0151] Choosing the right internal pipeline structure can achieve higher frequency, but it increases the number of delay clocks, which is not conducive to the improvement of throughput. Unfolding is an effective method to improve throughput. Unfolding is to instantiate the round function module multiple times before the state register, and to implement multiple rounds of operations in one cycle. Although unfolding can reduce the number of clock cycles, it will bring a long critical path. Excessive unfolding of the round function module will also increase the resources. With the continuous increase of the unfolding factor, although the throughput increases rapidly, the maximum frequency decreases exponentially. There are two main ways to unfold: the first is to process consecutive rounds at each level, for example, in two-level unfolding, 0-11 rounds are processed at the first level, and 12-23 rounds are processed at the second level. The second is to process non-consecutive rounds at each level, for example, in two-level unfolding, the first level processes even rounds (i.e. 0, 2, 4…), and the second level processes odd rounds (i.e. 1, 3, 5…). The second structure is better than the first structure in terms of area and efficiency. In order to improve the design performance more effectively, the design in this paper uses the second way of two-level expansion. The first level of the round function processes even rounds, and the second level of the round function processes odd rounds. At the same time, the design in this paper uses the round operation pipeline structure in each level of expansion to alleviate the problem of long critical path caused by expansion. Combined with the analysis of pipeline and unfolding, the structure proposed is shown in Figure 20 .

[0152] In the designed round function module, even rounds use initial data or feedback of the previous round as input, the former through a selector, the latter through two selectors before starting to replace. Odd rounds only need to receive the data processed by the previous stage, without going through the selector. Therefore, a new two-stage expansion structure is proposed, which inserts registers earlier in even rounds than in odd rounds, so different internal pipeline structures are used in odd and even rounds. According to the experiment of four internal pipelines, the structure of inserting pipeline registers between θ2 and θ3 in even rounds and between θ and ρ in odd rounds is designed. According to the above RC analysis, 24 groups of RC values are further divided into 12 groups of 7-bit even round constants and 12 groups of 7-bit odd round constants, which not only improves performance and efficiency, but also realizes a more compact design. The round function of the structure reduces the round processing period count by half, and the pipeline stage reaches four levels.

[0153] The input of HMAC is the shared key (k) of the communication parties and the message (m) to be transmitted. The structure of HMAC can be represented by the formula HMACk(m) = H((k ⊕ opad) || H((k ⊕ ipad) || m)). Where H represents the hash function, ipad is a bit sequence of 0x36 which is continuously cycled to make its length the same as the message block length of the hash function. Opad is a bit sequence of 0x5c which is continuously cycled to make its length the same as the message block length of the hash function.

[0154] The specific steps of the HMAC algorithm are described below, and the specific process of the HMAC algorithm is shown in Figure 22

[0155] S1. In the entire HMAC process, the key is padded to meet the length requirement before participating in encryption. According to the different lengths of the initial key, there are two padding methods. One is that if the length of the key is greater than the length of the message block of the hash function, the key needs to be processed by the hash function first. The length of the processed key will be less than the length of the message block, and then "0" is filled at the end to make the length the same as the length of the message block of the hash function. The second is that if the length of the key is less than the length of the message block of the hash function, "0" is directly filled at the end to make the length the same as the length of the message block of the hash function.

[0156] S2. The padded key is first XORed with the equal-length ipad sequence to obtain a key-related bit sequence ipadkey; the length of the bit sequence ipadkey is the same as the message block length of the hash function used;

[0157] ​S3, after obtaining the bit sequence ipadkey, the bit sequence ipadkey is combined with the message, that is, the message is spliced behind the bit sequence ipadkey to obtain the bit sequence ipadkey||m;

[0158] S4, the spliced data is sent into an SM3-SHA256 hash function unit or an SHA3-512 hash function unit for processing;

[0159] S5, the filled key is first subjected to XOR operation with the equal-length opad sequence to obtain the bit sequence opadkey;

[0160] S6, after obtaining the bit sequence opadkey, the hash value obtained in the S4 process is spliced behind the bit sequence opadkey;

[0161] S7, finally, the data obtained in S6 is sent into the SM3-SHA256 hash function unit or the SHA3-512 hash function unit again for processing, and the obtained hash value is the final message authentication code value.

[0162] As described above, when hmac_en is "0", data_en is "3" to indicate input data, mode is "1" to indicate that the SM3 hash algorithm is executed, then mode is changed to "2" to indicate that the SHA-256 hash algorithm is executed, and finally mode is changed to "3" to indicate that the SHA3-512 algorithm is executed. When the same message is input, the result is as shown in Figure 23 , the hardware simulation output result of the algorithm is consistent with the software result, which shows that the HMAC module can normally execute the three hash functions alone.

[0163] When hmac_en is "1", data_en is "1" to indicate that the current key is less than the message block length, mode signal is "3" to indicate that the HMAC-SHA3-512 function is executed, then mode signal is changed to "2" to indicate that the HMAC-SHA256 function is executed, and finally mode signal is changed to "1" to start executing the HMAC-SM3 function. When the same message is input, the result is as shown in Figure 24 , the hardware simulation output result of the algorithm is consistent with the software result, which shows that the HMAC module can normally execute the case that the key is less than the message block length.

[0164] When hmac_en is high and data_en is "2", it indicates that the current key is greater than the message block length, and the key needs to be processed by a hash function first, so Figure 25 the need_data signal in Figure 24The mode signal is "3" when the HMAC-SHA3-512 function is executed, then the mode signal is converted to "2" when the HMAC-SHA256 function is executed, and finally the mode signal is converted to "1" to start the HMAC-SM3 function. When the same message is input, the hardware simulation output result of the algorithm is consistent with the software result, indicating that the HMAC module can normally execute the case that the key is greater than the message block length.

[0165] The simulation verifies that the HMAC module can normally execute the six functions of SM3, SHA-256, SHA3-512, HMAC-SM3, HMAC-SHA256 and HMAC-SHA3-512. The frequency resource occupation is obtained by using the Xilinx ISE14.7 tool to synthesize the Virtex-5 (XC5VLX110-3fft1760) device, and the result shows that the maximum frequency of the HMAC module is 164.47M, and the resource occupation is 4158 slices.

[0166] The above examples are only used to illustrate the technical solutions of the present application, but not to limit it; although the present application has been described in detail with reference to the foregoing examples, those skilled in the art should understand that the technical solutions recorded in the foregoing examples can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A configurable HMAC message authentication code circuit, characterized by, The data flow control unit, the SM3-SHA256 hash function unit and the SHA3-512 hash function unit are connected to each other. The internal modules of the HMAC message authentication code circuit are controlled by a clock signal input terminal clk and a reset signal input terminal rst_n. The mode signal selection circuit of the HMAC message authentication code circuit controls the enable signals of the SHA3-512 hash function unit and the SM3-SHA256 hash function unit through an exclusive OR gate and an AND gate; the enable signal of the SM3-SHA256 hash function unit and mode[0] are connected to an AND gate as the selection signal of the SM3-SHA256 module. The data flow control unit comprises five input terminals, namely an HMAC enable signal terminal hmac_en, an input valid signal terminal date_en, a plaintext or key terminal data_in, a last byte input signal terminal msg_is_last_word and a last byte number terminal byte_num, wherein the enable signal terminal hmac_en controls whether the other four terminals are used as the direct data input terminals of the SM3-SHA256 hash function unit and the SHA3-512 hash function unit. The data flow control unit comprises seven output terminals, wherein an output valid signal terminal hmac_vld and a data output signal terminal msg_hmac are connected to the output terminals of the SHA3-512 hash function unit and the SM3-SHA256 hash function unit, and an output terminal need_data is used for outputting a data request signal. The other four output terminals of the data flow control unit are a data state input terminal in_vld, an input data terminal data, a byte number input terminal byte_numb and a last byte input terminal last_word, which are connected to the corresponding input terminals of the data flow control unit through selectors, and the control terminals of the selectors are connected to the HMAC enable signal input terminal. The data output terminals out and the out_ready signal output terminals of the SM3-SHA256 hash function unit and the SHA3-512 hash function unit are connected to a selector at the same time, and the output is controlled through the input mode signal terminal, the output terminals of the selector are connected to the corresponding output terminals of the data flow control unit through selectors, and the final data of the HMAC circuit is output through the selectors.

2. A configurable HMAC message authentication code circuit as claimed in claim 1, characterized in that: The SHA3-512 hash function unit comprises a padding module and a permutation module. The padding module comprises three output terminals, namely a data output terminal, a last block signal output terminal last_block and an output valid signal output terminal pout_r, wherein the last block signal output terminal and the output valid signal output terminal are connected to the input terminals of the permutation module, and the data output terminal is connected to a little-endian conversion module recode1. The permutation module includes six input ends, three of which are a data input end in, a last block signal input end last_block and an input valid signal input end in_ready, the data input end is connected with the output end of the little-end conversion module recode1, the last block signal input end and the input valid signal input end are connected with the corresponding output end of the padding module; The permutation module also includes three output ends, a data output end out, an output valid signal output end out_ready and an ack signal output end, wherein the data output end is connected with the input end of the little-end conversion module recode2, and the ack signal output end is connected with the input end of the padding module.

3. A configurable HMAC message authentication code circuit as claimed in claim 2, characterized in that: The permutation module in the SHA3-512 hash function unit includes a round function module, the round function module selects an internal pipeline structure, performs a two-stage expansion processing round operation, a first-stage round function processes even-numbered rounds, and a second-stage round function processes odd-numbered rounds.

4. A configurable HMAC message authentication code circuit as claimed in claim 3, characterized in that: The pipeline structure of the even-numbered rounds inserts a pipeline register between the theta2 logic circuit and the theta3 logic circuit, and the pipeline structure of the odd-numbered rounds inserts a pipeline register between the theta logic circuit and the rho logic circuit; In the round function module, the even-numbered rounds use initial data or feedback of a previous round as input, the former passes through a selector, and the latter passes through two selectors before starting replacement, and the odd-numbered rounds only need to receive data processed by a previous stage without passing through a selector.

5. The configurable HMAC message authentication code circuit of claim 1, wherein: The SM3-SHA256 hash function unit includes a message padding module, a message expansion module and an iteration compression module; The message padding module includes two output ends, a data output end P_out and an output valid signal end Pout_ready, and is connected with the input end of the message expansion module; The message expansion module includes four output ends, a wj0 data output end, a wj1 data output end, an out_vld signal output end and a ready signal output end, wherein the wj0 data output end, the wj1 data output end and the out_vld signal output end are connected with the input end of the iteration compression module, and the ready signal output end is connected with the output end of the message padding module; The iteration compression module includes two output ends, a data output end out and an output valid signal end out_ready, as the output end of the SM3-SHA256 hash function unit.

6. A configurable HMAC message authentication code circuit as claimed in claim 5, wherein, The iteration compression module of the SM3-SHA256 hash function unit uses a multiplexing structure to realize the A register and the E register update circuit of the compression function in the SM3 algorithm and the SHA-256 algorithm, and further multiplexes the 8*32-bit registers of A~H required by the SM3 algorithm and the SHA-256 algorithm.

7. A configurable HMAC message authentication method for use with the configurable HMAC message authentication code circuit of claim 1, wherein, The method comprises the following steps: S1, in the whole HMAC process, the key is padded to meet the length requirement before participating in encryption, and there are two padding methods according to different initial key lengths; S2, the key is padded to meet the length requirement before participating in encryption, and there are two padding methods according to different initial key lengths; S2, the filled key is first XORed with the equal-length ipad sequence to obtain a key-related bit sequence ipadkey; the length of the bit sequence ipadkey is the same as the message block length of the used hash function; S3, after obtaining the bit sequence ipadkey, the bit sequence ipadkey is combined with the message, that is, the message is spliced to the back of the bit sequence ipadkey to obtain the bit sequence ipadkey||m; S4, the spliced data is sent to the SM3-SHA256 hash function unit or the SHA3-512 hash function unit for processing; S5, the filled key is first XORed with the equal-length opad sequence to obtain a bit sequence opadkey; S6, after obtaining the bit sequence opadkey, the hash value obtained in the S4 process is spliced to the back of the bit sequence opadkey; S7, finally, the data obtained in S6 is sent to the SM3-SHA256 hash function unit or the SHA3-512 hash function unit again for processing, and the obtained hash value is the final message authentication code value.

8. The configurable HMAC message authentication method of claim 7, wherein, The filling mode specifically includes the following two modes: First, when the length of the key is greater than the length of the hash function message block, the data_en signal is output as "2", the key is processed once through the hash function, so that the need_data signal frequency is delayed, and the length of the processed key is less than the length of the message block, then "0" is filled at the end to make the length the same as the length of the hash function message block; Second, when the length of the key is less than the length of the hash function message block, the data_en signal is output as "1", then "0" is directly filled at the end to make the length the same as the length of the hash function message block.

Images