Coprocessor and computer device

Abstract

The embodiment of the present application provides a coprocessor and a computer device. In the coprocessor, an instruction decoding unit, a message cache unit, and an iterative transformation unit perform the following operations in the form of a three-stage pipeline: the instruction decoding unit decodes the received user-defined instruction to obtain a first data address and an operation command, and transmits the first data address and the operation command to the message cache unit. The user-defined instruction is an instruction in a special instruction set, which supports multiple KECCAK algorithms and multiple KMAC algorithms. The message cache unit reads the first processing message according to the first data address and the operation command, and transmits the first processing message to the iterative transformation unit for iterative calculation to obtain a corresponding message digest, and saves the message digest in a status register. By customizing the special instruction set, the coprocessor can support multiple KECCAK algorithms and multiple KMAC algorithms, thereby improving the flexibility and diversity of the algorithms supported by the coprocessor.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of integrated technology, and in particular, to a coprocessor and a computer device. Background Art

[0002] Keccak is a one-way hash function algorithm selected as the third-generation Secure Hash Algorithm 3 (SHA-3) standard.

[0003] Currently, there are two main types of KECCAK coprocessors that customize special instructions: one is that special instructions perform basic operator calculations on vector data of limited length; the other is that special instructions perform hash calculations of specified patterns on the entire message block. Although the first type is highly flexible, its computing performance is limited by limited computing bandwidth and overly fine operator division. The disadvantage of the second type is that it is not very flexible and cannot support more KECCAK-related algorithms. Summary of the invention

[0004] The embodiments of the present application provide a coprocessor and a computer device, which have the flexibility to support various KECCAK algorithms and various KMAC algorithms, while increasing the speed of inputting message data, thereby increasing the throughput of the coprocessor.

[0005] On the one hand, an embodiment of the present application provides a coprocessor, including:

[0006] The instruction decoding unit, the message buffer unit, and the iterative transformation unit perform the following operations in the form of a three-stage pipeline:

[0007] The instruction decoding unit decodes the received user-defined instruction to obtain a first data address and an operation command, and transmits the first data address and the operation command to the message buffer unit; the user-defined instruction is an instruction in a dedicated instruction set, and the dedicated instruction set supports multiple KECCAK algorithms (including SHA3 algorithm) and multiple KMAC algorithms;

[0008] The message buffer unit reads a first processing message according to the first data address and the operation command, and transmits the first processing message to the iterative transformation unit;

[0009] The iterative transformation unit performs iterative calculation on the first processed message to obtain a corresponding message digest, and stores the message digest in a status register.

[0010] Optionally, the instruction types in the dedicated instruction set include: microinstructions and macroinstructions;

[0011] Optionally, the microinstructions include:

[0012] MTUDI rd, rs, is used to save the value of the general register specified by rd in the coprocessor register specified by rs;

[0013] MFUDI rd, rs, is used to read the value of the coprocessor register specified by rs into the general register specified by rd;

[0014] SHA3M224 rd, rs, is used to perform SHA3_224 calculation on the message specified by rs, and the calculation result is saved in the storage space specified by rd;

[0015] SHA3M256 rd, rs, is used to perform SHA3_256 calculation on the message specified by rs, and the calculation result is saved in the storage space specified by rd;

[0016] SHA3M384 rd, rs, is used to perform SHA3_384 calculation on the message specified by rs, and the calculation result is saved in the storage space specified by rd;

[0017] SHA3M512 rd, rs, is used to perform SHA3_512 calculation on the message specified by rs, and the calculation result is saved in the storage space specified by rd;

[0018] SHAKE128 rd, rs, rt, used to perform SHAKE128 calculation on the message specified by rs, according to the length specified by rt, and the calculation result is saved in the storage space specified by rd;

[0019] SHAKE256 rd, rs, rt, used to perform SHAKE256 calculation on the message specified by rs, according to the length specified by rt, and the calculation result is saved in the storage space specified by rd;

[0020] KMAC128ABS0 rd, rs, is used to perform KECCAK128 calculation on the string str1 specified by rs, and the calculation result is saved in the status register;

[0021] KMAC256ABS0 rd, rs, is used to perform KECCAK256 calculation on the string str2 specified by rs, and the calculation result is saved in the status register;

[0022] KMAC128ABS1 rd, rs, is used to perform KECCAK128 calculation on the string str3 specified by rs, and the calculation result is saved in the status register;

[0023] KMAC256ABS1 rd, rs, is used to perform KECCAK256 calculation on the string str4 specified by rs, and the calculation result is saved in the status register;

[0024] KMAC128ABS2 rd, rs, rt, used to perform KECCAK128 calculation on the string str5 specified by rs, and the calculation result is saved in the status register;

[0025] KMAC256ABS2 rd, rs, rt, is used to perform KECCAK256 calculation on the string str6 specified by rs, and the calculation result is saved in the status register;

[0026] KCCKRET is used to return to the main program after the execution of the macro instruction is completed so that the main program can continue to execute.

[0027] Optionally, the macro instruction includes:

[0028] KMAC128 rd, rs, rt, used to perform KMAC128 authentication on the message specified by rs with the key specified by rt, and the authentication result is stored in the register specified by rd;

[0029] KMAC256 rd, rs, rt, used to perform KMAC256 authentication on the message specified by rs with the key specified by rt, and the authentication result is saved in the register specified by rd;

[0030] KMACXOF128 rd, rs, rt, used to perform KMACXOF128 authentication on the message specified by rs with the key specified by rt, and the authentication result is saved in the register specified by rd;

[0031] KMACXOF256 rd, rs, rt, is used to perform KMACXOF256 authentication on the message specified by rs with the key specified by rt, and the authentication result is saved in the register specified by rd.

[0032] Optionally, when the macroinstruction is KMAC128 rd, rs, rt, go to the instruction memory pointing to the subordinate instruction to read the corresponding microinstruction, wherein the microinstruction includes: KMAC128ABS1 state, custptr; KMAC128ABS0state, keyptr; KMAC128ABS2 rd, rs, rt; KCCKRET;

[0033] When the macroinstruction is KMAC256 rd, rs, rt, go to the instruction memory pointing to the subordinate instruction to read the corresponding microinstruction, wherein the microinstruction includes: KMAC256ABS1 state, custptr; KMAC256ABS0 state, keyptr; KMAC256ABS2 rd, rs, rt; KCCKRET;

[0034] When the macroinstruction is KMACXOF128 rd, rs, rt, go to the instruction memory pointing to the subordinate instruction to read the corresponding microinstruction, wherein the microinstruction includes: KMAC128ABS1 state, custptr; KMAC128ABS0state, keyptr; KMAC128ABS2 rd, rs, 0; KCCKRET;

[0035] When the macroinstruction is KMACXOF256 rd, rs, rt, go to the instruction memory pointing to the subordinate instruction to read the corresponding microinstruction, wherein the microinstruction includes: KMAC256ABS1 state, custptr; KMAC256ABS0state, keyptr; KMAC256ABS2 rd, rs, 0; KCCKRET.

[0036] Optionally, it also includes multiple special function registers; the multiple special function registers include: MSGPTR, used to save the message pointer; MSGLEN, used to save the message length; KEYPTR, used to save the key pointer; KEYLEN, used to save the key length; CUSTPTR, used to save the user customized string; CUSTLEN, used to save the user customized string length; DSTPTR, used to save the calculation result pointer.

[0037] When the instruction decoding unit performs the step of decoding the received user-defined instruction to obtain the first data address and the operation command, it is specifically used to:

[0038] When the user-defined instruction is a macro instruction, a corresponding micro instruction program is obtained according to the position indicated by the macro instruction; multiple micro instructions in the micro instruction program are decoded in sequence, and a corresponding first data address and an operation command are obtained from the decoding result of each micro instruction;

[0039] When the user-defined instruction is a microinstruction, the microinstruction is decoded to obtain the first data address and the operation command.

[0040] Optionally, the message cache unit includes: a barrel storage unit and a filling controller, and the first processed message includes: a plurality of first message blocks;

[0041] The filling controller sequentially reads the plurality of first message blocks according to the first data address and the operation command, and sequentially writes the plurality of first message blocks into the barrel storage unit;

[0042] The filling controller reads the multiple first message blocks from the barrel storage unit in sequence according to the order of writing into the barrel storage unit and transmits them to the iterative transformation unit.

[0043] Optionally, the filling controller is further used to: after writing each first message block into the barrel-shaped storage unit, push the message block attributes of each first message block into the message queue, the message block attributes including: the message length of the first message block and the position information of the first message block in the barrel-shaped storage unit;

[0044] When the filling controller executes the step of sequentially reading the plurality of first message blocks from the barrel storage unit in the order of writing into the barrel storage unit and transmitting the first message blocks to the iterative transformation unit, it is specifically used to:

[0045] Reading message block attributes of the plurality of first message blocks in sequence from the message queue;

[0046] According to the attributes of the read message block, the corresponding first message block is read from the barrel storage unit, and the read first message block is transmitted to the iterative transformation unit.

[0047] Optionally, before the filling controller transmits the read first message block to the iterative transformation unit, it is further configured to:

[0048] It is determined that the iterative transformation unit has completed iterative calculation of a message block previous to the first message block.

[0049] Optionally, when the filling controller executes the steps of sequentially reading the plurality of first message blocks according to the first data address and the operation command, and sequentially writing the plurality of first message blocks into the barrel storage unit, it is specifically configured to:

[0050] For the multiple first message blocks, perform the following operations respectively:

[0051] When the free space of the barrel storage unit can accommodate at least one message block, a first message block is read according to the first data address and the operation command, and the first message block is written into the barrel storage unit.

[0052] Optionally, it also includes:

[0053] When the first processed message has been written into the barrel storage unit and the free space of the barrel storage unit can accommodate at least one message block, the instruction decoding unit is also used to: decode the next received user-defined instruction, obtain the corresponding second data address, and transmit the second data address to the fill controller.

[0054] The filling controller is further used for reading a second message block of the second processing message according to the second data address, and writing the second message block into the barrel storage unit.

[0055] Optionally, it also includes:

[0056] When the iterative transformation unit completes the iterative calculation of the first processed message, the filling controller is further used to read the one second message block from the barrel storage unit and transmit it to the iterative transformation unit.

[0057] Optionally, when the iterative transformation unit executes the step of iteratively calculating the first processed message to obtain a corresponding message digest and saving the message digest in a status register, it is specifically used to:

[0058] For the multiple first message blocks, the following operations are performed in sequence: filling one first message block into a target data block; performing an XOR operation on the target data block and the data in the state register, and storing the obtained XOR operation result in the state register; using a round function to perform an iterative round permutation operation of multiple clock cycles on the XOR operation result to obtain a calculation result of the one first message block, and storing the calculation result in the state register;

[0059] The calculation result of the last first message block among the multiple first message blocks is the message digest.

[0060] Optionally, the round function includes: a first permutation function, a second permutation function and a first mapping function, the first permutation function is a θ function, the second permutation function is obtained by compressing a χ function and an ι function, the first mapping function is obtained by compressing a ρ function and a π function calculated continuously, the χ function and the ι function are permutation functions, and the ρ function and the π function are mapping functions.

[0061] Optionally, the coprocessor further comprises: a direct memory access controller;

[0062] After the iterative transformation unit completes the iterative calculation of the first processing message, the direct memory access controller saves the message digest to the special function register according to the output length specified by the special function register.

[0063] In one aspect, an embodiment of the present application provides a computer device, including:

[0064] Any of the above coprocessors.

[0065] In the embodiment of the present application, the instruction decoding unit, the message cache unit, and the iterative transformation unit in the coprocessor read the message data and iteratively calculate in the form of a three-stage pipeline, which realizes the pre-fetching of the message data, improves the speed of inputting the message data, thereby improving the processing speed of the hardware circuit, and at the same time improving the throughput of the coprocessor. By customizing the dedicated instruction set, the coprocessor can support a variety of KECCAK algorithms (including the SHA3 algorithm) and a variety of KMAC algorithms, thereby improving the flexibility and diversity of the algorithms supported by the KECCAK coprocessor. In addition, as long as the free space of the barrel storage unit is sufficient to accommodate at least one message block, the filling controller can read the next message block to fill it into the barrel storage unit, without waiting for the iterative transformation unit to complete the iterative calculation of the previous message block before reading the next message block to fill it into the barrel storage unit, thereby improving the utilization rate of the storage space of the barrel storage unit. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0067] Figure 1 A schematic diagram of the structure of a coprocessor provided in an embodiment of the present application Figure 1 ;

[0068] Figure 2 A schematic diagram of the structure of a coprocessor provided in an embodiment of the present application Figure 2 ;

[0069] Figure 3 A schematic diagram of the structure of a coprocessor provided in an embodiment of the present application Figure 3 ;

[0070] Figure 4 A schematic diagram of the structure of a coprocessor provided in an embodiment of the present application Figure 4 ;

[0071] Figure 5 A schematic diagram of the structure of a coprocessor provided in an embodiment of the present application Figure 5 ;

[0072] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and beneficial effects of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0074] In order to meet the requirements of special application scenarios for KECCAK computing performance and multi-mode KECCAK algorithms, according to the characteristics that the KECCAK algorithm mode depends on the filling mode, the embodiment of the present application proposes a KECCAK coprocessor, which not only has the flexibility to support various KECCAK algorithms and various KMAC algorithms, but also avoids performance degradation caused by frequent access to the bus through a series of optimizations in the overall structure and computing units. The following is a detailed description:

[0075] refer to Figure 1 , is a schematic diagram of the structure of a coprocessor provided by an embodiment of the present application, comprising: an instruction decoding unit 101, a message cache unit 102, and an iterative transformation unit 103, wherein the iterative transformation unit 103 comprises: a state register 104. The instruction decoding unit 101, the message cache unit 102, and the iterative transformation unit 103 perform the following operations in the form of a three-stage pipeline:

[0076] The instruction decoding unit 101 decodes the received user-defined instruction, obtains the first data address and the operation command, and transmits the first data address and the operation command to the message buffer unit 102. The user-defined instruction is an instruction in a dedicated instruction set, and the dedicated instruction set supports multiple KECCAK algorithms and multiple KMAC algorithms. The instruction types in the dedicated instruction set include: microinstructions and macroinstructions.

[0077] The message buffer unit 102 reads the first processing message according to the first data address and the operation command, and transmits the first processing message to the iterative transformation unit 103 in sequence.

[0078] The iterative transformation unit 103 performs iterative calculation on the first processed message to obtain a corresponding message digest, and stores the message digest in the state register 104 .

[0079] In the embodiment of the present application, the instruction decoding unit, message cache unit, and iterative transformation unit in the coprocessor read the message data and iterative calculation in the form of a three-stage pipeline, which realizes the pre-fetching of the message data, improves the speed of inputting the message data, thereby improving the processing speed of the hardware circuit, and at the same time improves the throughput of the coprocessor. By customizing the dedicated instruction set, the coprocessor can support multiple KECCAK algorithms and multiple KMAC algorithms, which improves the flexibility and diversity of the algorithms supported by the KECCAK coprocessor.

[0080] In some embodiments, see Figure 2 The instruction decoding unit 101 includes: a decoding controller 201 and a program memory 202.

[0081] When the user-defined instruction is a macroinstruction, the decoding controller 201 determines the corresponding decoding logic based on the macroinstruction and executes the following decoding logic: obtain the corresponding microinstruction program according to the position indicated by the macroinstruction; decode multiple microinstructions in the microinstruction program in turn, and obtain the corresponding first data address and operation command from the decoding result of each microinstruction.

[0082] In a specific implementation, the corresponding microinstruction program is obtained from the program memory 202 according to the location indicated by the macroinstruction.

[0083] When the user-defined instruction is a microinstruction, the decoding controller 201 determines the corresponding decoding logic according to the microinstruction, and executes the following decoding logic: decodes the microinstruction to obtain the first data address and the operation command.

[0084] In some embodiments, in order to meet the requirements of special application scenarios for KECCAK computing performance and multi-mode KECCAK algorithms, and to support various KECCAK algorithms and various KMAC algorithms, this application customizes a series of special instructions (special instruction sets) based on the spec2 instruction format of MIPS ISA, specifically including two types of microinstructions and macroinstructions, as shown in Table 1 and Table 2:

[0085] ;

[0086]

[0087] In order to meet the calculation of various algorithms, the coprocessor in this application also sets 7 special function registers, as shown in Table 3:

[0088]

[0089] In the embodiment of the present application, by customizing a series of related dedicated instructions, the coprocessor has the flexibility to support various KECCAK algorithms and various KMAC algorithms.

[0090] In some embodiments, see Figure 3 , the message cache unit 102 includes: a barrel storage unit 301, a filling controller 302 and a message queue 303. The first processed message includes: a plurality of first message blocks.

[0091] The filling controller 302 reads the plurality of first message blocks in sequence according to the first data address and the operation command, and writes the plurality of first message blocks into the barrel storage unit 301 in sequence.

[0092] Specifically, the filling controller 302 reads multiple first message blocks to the barrel storage unit 301 in sequence according to the first data address and the operation command from the external memory. The size of the barrel storage unit 301 can be set according to actual conditions, for example, the storage width of the barrel storage unit 301 is 64 bits and the depth is 21.

[0093] Each barrel storage unit 301 of the message buffer unit 102 has a valid flag, indicating that the data in the barrel storage unit 301 is valid. When the barrel storage unit 301 is filled, the corresponding valid flag is set to 1; when the barrel storage unit 301 is read, the corresponding valid flag is cleared.

[0094] The filling controller 302 reads a plurality of first message blocks from the bucket storage unit 301 in sequence according to the order in which the first message blocks are written into the bucket storage unit 301 and transmits the first message blocks to the iterative transformation unit 103 .

[0095] In a specific implementation, in order to realize the above-mentioned reading logic for multiple first message blocks, after the filling controller 302 writes each first message block into the barrel storage unit 301, the message block attributes of each first message block are pushed into the message queue 303. The message block attributes include: the message length of the first message block and the position information of the first message block in the barrel storage unit 301.

[0096] Thus, when the iterative transformation unit 103 needs a message block, the filling controller 302 sequentially reads the message block attributes of the plurality of first message blocks from the message queue 303 according to the read-write logic (i.e., first-in first-out). According to the read message block attributes, the corresponding first message block is read from the barrel storage unit 301, and the read first message block is transmitted to the iterative transformation unit 103.

[0097] In some embodiments, when the instruction decoding unit 101, the message buffer unit 102, and the iterative transformation unit 103 execute the algorithm in the form of a three-stage pipeline, the filling controller 302 performs the following operations for multiple first message blocks:

[0098] When the free space of the barrel storage unit 301 can accommodate at least one message block, a first message block is read according to the first data address and the operation command, and the first message block is written into the barrel storage unit 301 .

[0099] When the free space of the bucket storage unit 301 cannot accommodate a message block, the first message block is tentatively read.

[0100] In some embodiments, when the iterative transformation unit 103 has completed iterative calculation of a previous message block of a first message block, the filling controller 302 reads the first message block from the barrel storage unit 301 and transmits the first message block to the iterative transformation unit 103 .

[0101] Specifically, the iterative transformation unit 103 performs 24 rounds of iterative calculations on the input message block, and a new message block can only be received after the 24 rounds of iterative calculations are completed.

[0102] That is to say, when the first processing message includes multiple first message blocks, after executing a user-defined instruction decoding operation, as long as the free space of the barrel storage unit 301 is sufficient to accommodate at least one message block, the filling controller 302 can read the next first message block and fill it into the barrel storage unit 301, without having to wait for the iterative transformation unit 103 to complete the iterative calculation of the previous first message block before reading the next first message block and filling it into the barrel storage unit 301, thereby improving the utilization rate of the storage space of the barrel storage unit.

[0103] In some embodiments, when the first processed message has been written into the barrel storage unit 301 and the free space of the barrel storage unit 301 can accommodate at least one message block, the instruction decoding unit 101 is also used to: decode the next received user-defined instruction, obtain the corresponding second data address, and transmit the second data address to the fill controller 302.

[0104] The filling controller 302 is further configured to read a second message block of the second processed message according to the second data address, and write the second message block into the barrel storage unit 301 .

[0105] Specifically, when multiple first message blocks in the first processing message are filled into the barrel storage unit 301, and the free space of the barrel storage unit 301 can still accommodate at least one message block, the instruction decoding unit 101 decodes the next received user-defined instruction, obtains the corresponding second data address, and transmits the second data address to the filling controller 302.

[0106] When the multiple first message blocks in the first processing message are filled into the barrel storage unit 301 and the free space of the barrel storage unit 301 cannot accommodate a message block, the instruction decoding unit 101 temporarily stops decoding of the next user-defined instruction.

[0107] That is to say, in the present application, the next user-defined instruction does not need to wait for the current user instruction processing to be completely completed before decoding, and fill the relevant message block into the barrel storage unit 301. As long as the free space of the barrel storage unit 301 is sufficient to accommodate at least one message block, the next user-defined instruction can be decoded, and data is requested from the external memory to fill the free space of the barrel storage unit 301 according to the second data address obtained by decoding, thereby improving the utilization rate of the storage space of the barrel storage unit.

[0108] When the iterative transformation unit 103 completes the iterative calculation of the multiple first message blocks in the first processing message, the filling controller 302 reads a second message block from the barrel storage unit 301 and transmits it to the iterative transformation unit 103 .

[0109] For the iterative transformation unit 103, the iterative transformation unit 103 needs to complete iterative calculations on all first message blocks in the first processing message before receiving the second message blocks in the second processing message for new iterative calculations.

[0110] In some embodiments, when the first processing message includes only one message block, when the first processing message has been written into the barrel storage unit 301, and the free space of the barrel storage unit 301 can accommodate at least one message block, the instruction decoding unit 101 decodes the next received user-defined instruction, obtains the corresponding second data address, and transmits the second data address to the filling controller 302. The filling controller 302 reads the second processing message according to the second data address, and writes the second processing message into the barrel storage unit 301. When the iterative transformation unit 103 completes the iterative calculation of the first processing message, the filling controller 302 reads the second processing message from the barrel storage unit 301 and transmits it to the iterative transformation unit 103.

[0111] In some embodiments, see Figure 4 The iterative transformation unit 103 also includes: an iterative controller 401, an RC calculation unit 402, a round function 403, and an XOR operation unit 404.

[0112] For multiple first message blocks, the iterative controller 401 performs the following operations in sequence: fills a first message block into a target data block; inputs the target data block and the data in the status register 104 into the XOR operation unit 404 for XOR operation, and saves the XOR operation result in the status register 104; uses the round function 403 to perform an iterative round permutation operation for multiple clock cycles on the XOR operation result to obtain the calculation result of the first message block, and saves the calculation result in the status register 104.

[0113] Specifically, when the first message block is received, the iterative transformation unit 103 enters the ITER_XOR state, and then fills the first message block with a 1600-bit target data block. The data of the target data block in the state register 104 is subjected to an XOR operation, and the obtained XOR operation result is saved in the state register 104. After one clock cycle of the ITER_XOR state, the iterative transformation unit 103 enters the sponge absorption stage ITER_ABSB, that is, the iterative round permutation operation of the XOR operation result for 12 clock cycles is started, and the result obtained in each clock cycle is updated to the state register 104 to obtain the calculation result of the first message block.

[0114] When all first message blocks are received and the SHA3 mode is not the output extension mode, a message digest is directly generated, wherein the calculation result of the last first message block among the multiple first message blocks is the message digest. The iterative transformation unit 103 returns to the idle mode.

[0115] When all first message blocks are received and the SHA3 mode is the output extension mode, the iterative transformation unit 103 enters the squeeze state, and continues to perform the iterative round permutation operation until a message digest is generated. The iterative transformation unit 103 returns to the idle mode.

[0116] When performing the round permutation operation, a 2-round expansion technique is required, that is, 2 rounds of round function calculations are completed in each clock cycle, and the RC calculation unit 402 provides an RC value for the expanded 2-round round function 403. The iterative calculation of each message block requires 13 clock cycles.

[0117] There are five sub-functions in the round function 403, among which the θ function, the χ function and the ι function are permutation functions, and the ρ function and the π function are mapping functions. The present application performs the following two optimizations within the round function 403:

[0118] First, the continuously calculated ρ function and π function are compressed to obtain a first mapping function, which is used to reduce the path delay of the mapping calculation so that the iterative permutation module can work at a higher clock frequency.

[0119] Second, since the RC value in the ι function calculation is generated using the relay calculation-relay storage method, the ι function and the previous permutation function (χ function) can be compressed to obtain the second permutation function, which can shorten the path delay of the 64-bit lookup table with an access depth of 24 and save hardware resource overhead.

[0120] Without doing any other processing on the θ function, the θ function is directly used as the first permutation function. It can be seen that the present application optimizes the original five sub-functions in the round function into three sub-functions: the first permutation function, the second permutation function and the first mapping function, which effectively reduces the path delay in the calculation process and saves the overhead of hardware resources.

[0121] In some embodiments, see Figure 5 , the coprocessor further includes: a direct memory access controller 501;

[0122] After the iterative transformation unit 103 completes the iterative calculation of the first processing message, the direct memory access controller 501 saves the message digest to the special function register according to the output length specified by the special function register. In addition, the message cache unit 102 can also read the first processing message from the external memory through the direct memory access controller 501 according to the first data address and the operation command.

[0123] During the coprocessor's working cycle (from the start of decoding by the coprocessor to the direct memory access controller storing the calculation result in the specified address), the coprocessor's status signal is always in the busy state.

[0124] Based on the same technical concept, an embodiment of the present application provides a computer device, which can be any of the aforementioned coprocessors, such as Figure 6 As shown, it includes a coprocessor 601, a processor 602, and a memory 603 connected to the coprocessor 601 and the processor 602. The specific connection medium between the coprocessor 601, the processor 602 and the memory 603 is not limited in the embodiment of the present application. Figure 6 For example, the coprocessor 601, the processor 602 and the memory 603 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus and the like.

[0125] In the embodiment of the present application, the memory 603 stores instructions that can be executed by at least one processor 602, and the at least one processor 602 executes the instructions stored in the memory 603.

[0126] The processor 602 is the control center of the computer device, and can use various interfaces and lines to connect various parts of the computer device, and realize virtual production by running or executing instructions stored in the memory 603 and calling data stored in the memory 603. Optionally, the processor 602 may include one or more processing units, and the processor 602 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 602. In some embodiments, the processor 602 and the memory 603 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0127] The processor 602 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0128] The memory 603 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 603 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, and the like. The memory 603 is any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer device, but is not limited thereto. The memory 603 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0129] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer device or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0131] These computer program instructions may also be stored in a computer readable memory capable of directing a computer device or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0132] These computer program instructions can also be loaded onto a computer device or other programmable data processing device so that a series of operation steps are executed on the computer device or other programmable device to produce a process implemented by the computer device, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0133] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0134] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A coprocessor, characterized in that: include: An instruction decoding unit, a message cache unit, and an iterative transformation unit, wherein the message cache unit includes a barrel storage unit and a filling controller; the instruction decoding unit, the message cache unit, and the iterative transformation unit perform the following operations in the form of a three-stage pipeline: The instruction decoding unit decodes the received user-defined instruction to obtain a first data address and an operation command, and transmits the first data address and the operation command to the message buffer unit; the user-defined instruction is an instruction in a dedicated instruction set, and the dedicated instruction set supports multiple KECCAK algorithms and multiple KMAC algorithms; The filling controller reads a plurality of first message blocks included in the first processing message according to the first data address and the operation command, and writes the plurality of first message blocks into the barrel storage unit in sequence; The filling controller sequentially reads the plurality of first message blocks from the barrel storage unit in the order in which they are written into the barrel storage unit and transmits the first message blocks to the iterative transformation unit; The iterative transformation unit performs the following operations in sequence for the multiple first message blocks: fills a first message block into a target data block; performs an XOR operation on the target data block and the data in the status register, and stores the XOR operation result in the status register; uses a round function to perform an iterative round permutation operation for multiple clock cycles on the XOR operation result to obtain a calculation result of the one first message block, and stores the calculation result in the status register; wherein the calculation result of the last first message block among the multiple first message blocks is a message summary.

2. The coprocessor according to claim 1, wherein: The instruction types in the dedicated instruction set include: microinstructions and macroinstructions.

3. The coprocessor according to claim 2, wherein: The microinstructions include: MTUDI rd, rs, is used to save the value of the general register specified by rd in the coprocessor register specified by rs; MFUDI rd, rs, is used to read the value of the coprocessor register specified by rs into the general register specified by rd; SHA3M224 rd, rs, is used to perform SHA3_224 calculation on the message specified by rs, and the calculation result is saved in the storage space specified by rd; SHA3M256 rd, rs, is used to perform SHA3_256 calculation on the message specified by rs, and the calculation result is saved in the storage space specified by rd; SHA3M384 rd, rs, is used to perform SHA3_384 calculation on the message specified by rs, and the calculation result is saved in the storage space specified by rd; SHA3M512 rd, rs, is used to perform SHA3_512 calculation on the message specified by rs, and the calculation result is saved in the storage space specified by rd; SHAKE128 rd, rs, rt, used to perform SHAKE128 calculation on the message specified by rs, according to the length specified by rt, and the calculation result is saved in the storage space specified by rd; SHAKE256 rd, rs, rt, used to perform SHAKE256 calculation on the message specified by rs, according to the length specified by rt, and the calculation result is saved in the storage space specified by rd; KMAC128ABS0 rd, rs, is used to perform KECCAK128 calculation on the string str1 specified by rs, and the calculation result is saved in the status register rd; KMAC256ABS0 rd, rs, is used to perform KECCAK256 calculation on the string str2 specified by rs, and the calculation result is saved in the status register rd; KMAC128ABS1 rd, rs, is used to perform KECCAK128 calculation on the string str3 specified by rs, and the calculation result is saved in the status register rd; KMAC256ABS1 rd, rs, is used to perform KECCAK256 calculation on the string str4 specified by rs, and the calculation result is saved in the status register rd; KMAC128ABS2 rd, rs, rt, used to perform KECCAK128 calculation on the string str5 specified by rs, and the calculation result is saved in the status register rd, rt is an immediate value; KMAC256ABS2 rd, rs, rt, used to perform KECCAK256 calculation on the string str6 specified by rs, and the calculation result is saved in the status register rd, rt is an immediate value; KCCKRET is used to return to the main program after the execution of the macro instruction is completed so that the main program can continue to execute.

4. The coprocessor according to claim 2, wherein: The macro instructions include: KMAC128 rd, rs, rt, used to perform KMAC128 authentication on the message specified by rs with the key specified by rt, and the authentication result is stored in the register specified by rd; KMAC256 rd, rs, rt, used to perform KMAC256 authentication on the message specified by rs with the key specified by rt, and the authentication result is saved in the register specified by rd; KMACXOF128 rd, rs, rt, used to perform KMACXOF128 authentication on the message specified by rs with the key specified by rt, and the authentication result is saved in the register specified by rd; KMACXOF256 rd, rs, rt, is used to perform KMACXOF256 authentication on the message specified by rs with the key specified by rt, and the authentication result is saved in the register specified by rd.

5. The coprocessor according to claim 4, wherein: Also includes: When the macroinstruction is KMAC128 rd, rs, rt, go to the instruction memory pointing to the subordinate instruction to read the corresponding microinstruction, wherein the microinstruction includes: KMAC128ABS1 state, custptr; KMAC128ABS0 state, keyptr; KMAC128ABS2 rd, rs, rt; KCCKRET; When the macroinstruction is KMAC256 rd, rs, rt, go to the instruction memory pointing to the subordinate instruction to read the corresponding microinstruction, wherein the microinstruction includes: KMAC256ABS1 state, custptr; KMAC256ABS0 state, keyptr; KMAC256ABS2 rd, rs, rt; KCCKRET; When the macroinstruction is KMACXOF128 rd, rs, rt, go to the instruction memory pointing to the subordinate instruction to read the corresponding microinstruction, wherein the microinstruction includes: KMAC128ABS1 state, custptr; KMAC128ABS0 state, keyptr; KMAC128ABS2 rd, rs, 0; KCCKRET; When the macroinstruction is KMACXOF256 rd, rs, rt, go to the instruction memory pointing to the subordinate instruction to read the corresponding microinstruction, wherein the microinstruction includes: KMAC256ABS1 state, custptr; KMAC256ABS0 state, keyptr; KMAC256ABS2 rd, rs, 0; KCCKRET.

6. The coprocessor according to claim 1, wherein: It also includes multiple special function registers; the multiple special function registers include: MSGPTR, used to save the message pointer; MSGLEN, used to save the message length; KEYPTR, used to save the key pointer; KEYLEN, used to save the key length; CUSTPTR, used to save the user customized string; CUSTLEN, used to save the user customized string length; DSTPTR, used to save the calculation result pointer.

7. The coprocessor according to claim 2, wherein: When the instruction decoding unit performs the step of decoding the received user-defined instruction to obtain the first data address and the operation command, it is specifically used to: When the user-defined instruction is a macro instruction, a corresponding micro instruction program is obtained according to the position indicated by the macro instruction; multiple micro instructions in the micro instruction program are decoded in sequence, and a corresponding first data address and an operation command are obtained from the decoding result of each micro instruction; When the user-defined instruction is a microinstruction, the microinstruction is decoded to obtain the first data address and the operation command.

8. The coprocessor according to claim 1, wherein: The filling controller is further used to: after writing each first message block into the barrel-shaped storage unit, push the message block attribute of each first message block into the message queue, wherein the message block attribute includes: the message length of the first message block and the position information of the first message block in the barrel-shaped storage unit; When the filling controller executes the step of sequentially reading the plurality of first message blocks from the barrel storage unit in the order of writing into the barrel storage unit and transmitting the first message blocks to the iterative transformation unit, it is specifically used to: Reading message block attributes of the plurality of first message blocks in sequence from the message queue; According to the attributes of the read message block, the corresponding first message block is read from the barrel storage unit, and the read first message block is transmitted to the iterative transformation unit.

9. The coprocessor according to claim 8, wherein: Before the filling controller transmits the read first message block to the iterative transformation unit, the filling controller is further used to: It is determined that the iterative transformation unit has completed iterative calculation of a message block previous to the first message block.

10. The coprocessor according to claim 1, wherein: When the filling controller executes the steps of sequentially reading a plurality of first message blocks included in the first processing message according to the first data address and the operation command, and sequentially writing the plurality of first message blocks into the barrel storage unit, it is specifically used to: For the multiple first message blocks, perform the following operations respectively: When the free space of the barrel storage unit can accommodate at least one message block, a first message block is read according to the first data address and the operation command, and the first message block is written into the barrel storage unit.

11. The coprocessor according to claim 1, wherein: Also includes: When the first processed message has been written into the barrel storage unit and the free space of the barrel storage unit can accommodate at least one message block, the instruction decoding unit is further used to: decode the next received user-defined instruction, obtain the corresponding second data address, and transmit the second data address to the fill controller; The filling controller is further used for reading a second message block of the second processing message according to the second data address, and writing the second message block into the barrel storage unit.

12. The coprocessor according to claim 11, wherein: Also includes: When the iterative transformation unit completes the iterative calculation of the first processed message, the filling controller is further used to read the one second message block from the barrel storage unit and transmit it to the iterative transformation unit.

13. The coprocessor according to claim 1, wherein: The round function includes: a first permutation function, a second permutation function and a first mapping function, the first permutation function is a θ function, the second permutation function is obtained by compressing a χ function and an ι function, the first mapping function is obtained by compressing a continuously calculated ρ function and a π function, the χ function and the ι function are permutation functions, and the ρ function and the π function are mapping functions.

14. The coprocessor according to claim 1, wherein: The coprocessor also includes: a direct memory access controller; After the iterative transformation unit completes the iterative calculation of the first processing message, the direct memory access controller saves the message digest to the special function register according to the output length specified by the special function register.

15. A computer device, characterized in that: include: A coprocessor as claimed in any one of claims 1 to 14.

Images