Circuit based on Galois Hash verification

Abstract

The invention provides a circuit for Galois Hash-based verification, which is used for carrying out calculation processing on a data sequence comprising a first data block, a second data block and a third data block, and comprises an additional verification data calculation circuit for receiving the first data block in a data stream and carrying out calculation according to the first data block, and left-shifting the calculation result according to the total length of the second data block and the third data block to generate a first output; the ciphertext calculation circuit comprises k first calculation units and is used for receiving second data blocks in the data stream in parallel in each round of calculation of the ciphertext calculation circuit and performing parallel calculation on the received data blocks to generate second output; the bubble processing circuit receives the first number of third data blocks after the last round of calculation of the ciphertext calculation circuit and performs calculation to generate a third output; and the first adder is used for performing calculation according to the first output, the second output and the third output to generate a message verification code.

Description

Technical Field

[0001] The invention relates to a circuit based on Galois hash verification. Background Art

[0002] The current GHASH (Galois HASH) is mainly used to verify Ethernet applications (such as routers, switches or bridges). Figure 1A A schematic diagram showing the data flow based on the Ethernet protocol is shown. Figure 1A There are intervals between adjacent data packets of the Ethernet data stream. Therefore, the communication device can use the intervals between adjacent data packets to complete the GHASH operation on the bubble, where the bubble can be length data, or cyclic redundancy check (CRC) data and length data. However, some communication interconnection protocols, such as PCIe-Gen6 (peripheral component interconnect express-generation 6, the sixth generation of high-speed serial computer expansion bus standard) and CXL (Compute Express Link), use flow control unit (flit) as the basic unit of transmission. Taking the CXL protocol as an example, Figure 1B A schematic diagram of the data flow of the CXL protocol is shown. A CXL data flow may contain multiple consecutive flits, such as F1, F2, and F3. There is no gap between adjacent flits, so how to process bubble data without blocking the CXL data flow is a problem.

[0003] In addition, compared to Ethernet, CXL has a higher throughput (128Gbps, 256Gbps or higher), and the data width is also above 512bit, so when the length of the GHASH data block is 128bit, it must process four 128bit data blocks in a single clock cycle. This requires a higher parallel computing architecture.

[0004] Furthermore, in Ethernet, GHASH operations can be performed on data packets as units, and additional authentication data (AAD), ciphertext or plaintext (Cipher / Plaintext) can be processed in sequence according to the input order, where AAD comes from the header of the Ethernet data packet, and the ciphertext or plaintext comes from the packet payload of the data packet. In the CXL protocol, AAD is input in parallel with the ciphertext or plaintext, so it cannot be processed in sequence.

[0005] Therefore, proposing a method for performing GHASH verification on a data stream that is continuously transmitted without intervals (for example, a data stream that uses a flit as a basic transmission unit) is one of the important topics in this field. Summary of the invention

[0006] The present invention is directed to a circuit for verification based on Galois HASH (GHASH), which can perform GHASH operation on a data stream (such as CXL data stream) that is continuously transmitted without intervals.

[0007] A circuit based on Galois hash verification of the present invention is used to calculate and process a data sequence including a first data block, a second data block and a third data block, and the circuit includes an additional verification data calculation circuit, a ciphertext calculation circuit, a bubble processing circuit, a controller and a first adder. The additional verification data calculation circuit receives the first data block in the data stream and performs calculation according to the first data block, and shifts the calculation result to the left according to the total length of the second data block and the third data block to generate a first output. The ciphertext calculation circuit includes k first calculation units, which are used to receive the second data block in the data stream in parallel in each round of calculation of the ciphertext calculation circuit, and perform parallel calculation on each received data block to generate a second output, wherein k is a positive integer greater than 1. The bubble processing circuit receives a first number of third data blocks after the last round of calculation of the ciphertext calculation circuit and performs calculation to generate a third output. The controller couples the additional verification data calculation circuit, the ciphertext calculation circuit and the bubble processing circuit. The first adder is used to calculate according to the first output, the second output and the third output to generate a message verification code.

[0008] In one embodiment of the present invention, the first computing unit also receives a second number of third data blocks in parallel in the last round of calculation, and the values ​​of the first number and the second number are determined by the controller based on the value of k, the number of third data blocks and the number of second data blocks received in the last round of calculation.

[0009] In one embodiment of the present invention, the above-mentioned first calculation unit performs calculation based on the received second data block or third data block and the first power function of the hash subkey; wherein the power of the first power function of the hash subkey is determined by the controller according to the order of the second data block or the third data block in the data sequence using the value of k.

[0010] In one embodiment of the present invention, when the received second data block or the third data block is the last (k-1) data block in the data sequence, the controller determines the power of the first power function of the hash subkey according to the order of the second data block or the third data block in the last (k-1) data blocks; and when the received second data block or the third data block is not the last (k-1) data block in the data stream, the controller determines the power of the first power function of the hash subkey according to the value of k.

[0011] In one embodiment of the present invention, the first calculation unit includes a third adder, a third multiplier, a third register, a fourth register and three multiplexers. The third multiplier is coupled to the third adder. The third register is coupled to the third adder and the third multiplier. The fourth register is coupled to the third register. The third multiplexer is coupled to the third multiplier and the controller. The third adder calculates the received second data block or the third data block with the value of the third register and outputs the calculation result to the third multiplier; the third multiplexer outputs the first power function of the hash subkey to the third multiplier under the control of the controller; the third multiplier calculates according to the calculation result of the third adder and the first power function of the hash subkey, and stores the calculation result to the third register to update the value of the third register; and when the ciphertext calculation circuit receives and calculates all the second data blocks and the second number of third data blocks, the controller controls the output of the value of the third register as the second output.

[0012] In one embodiment of the present invention, when the bubble processing circuit receives a first number of third data blocks, the controller outputs the values ​​in the third registers of the corresponding first number of first calculation units among the k first calculation units to the bubble processing circuit, and at the same time controls the remaining first calculation units to output the values ​​in the third registers to the fourth registers for storage, and when the bubble processing circuit generates a third output, uses the value of the fourth register as the second output, and outputs the second output and the third output synchronously.

[0013] In one embodiment of the present invention, the above-mentioned bubble processing circuit generates a third output based on the received first number of third data blocks, the output of the first number of first computing units and at least the second power function of the hash sub-key; wherein the power of the second power function of the hash sub-key is determined by the controller according to the order of the third data blocks in the data sequence.

[0014] In one embodiment of the present invention, the bubble processing circuit includes a third calculation unit and a fourth calculation unit; the controller selectively enables the third calculation unit, or starts the third calculation unit and the fourth calculation unit according to the value of the first quantity.

[0015] In one embodiment of the present invention, the third calculation unit includes a fourth adder, a fourth multiplier, a fifth register, a fourth multiplexer and a fifth multiplexer. The fourth adder is coupled to the ciphertext calculation circuit. The fourth multiplier is coupled to the fourth adder. The fifth register is coupled to the fourth multiplier. The fourth multiplexer is coupled to the fourth adder. The fifth multiplexer is coupled to the fourth multiplier. The fifth multiplexer outputs the second power function of the hash subkey to the fourth multiplier under the control of the controller. The fourth multiplier calculates the calculation result of the fourth adder and the second power function of the hash subkey, and stores the calculation result in the fifth register.

[0016] In one embodiment of the present invention, the fourth calculation unit includes a fifth adder, a fifth multiplier and a sixth register. The fifth multiplier is coupled to the fifth adder. The sixth register is coupled to the fifth multiplier. The fifth multiplier receives the calculation result of the fifth adder and the second power function of the hash subkey for calculation and stores the calculation result in the sixth register.

[0017] In one embodiment of the present invention, the additional verification data calculation circuit includes a second calculation unit and a shift unit. The second calculation unit is used to receive the first data block, and calculate according to the first data block and the hash subkey to generate a first result. The shift unit is used to determine the shift amount, and transmit the shift amount to the second calculation unit, so that the second calculation unit shifts the first result to the left according to the shift amount to generate a first output; when the circuit based on Galois hash verification receives all the second data blocks and the third data blocks, the controller controls the first multiplexer of the second calculation unit to output the shift amount to the first multiplier of the second calculation unit.

[0018] In one embodiment of the present invention, the second computing unit includes a second adder, a first multiplier, a first register and a first multiplexer. The first multiplier is coupled to the second adder. The first register is coupled to the second adder, the first multiplier and the first adder. The first multiplexer is coupled to the first multiplier, the shift unit and the controller.

[0019] In one embodiment of the present invention, the above-mentioned shift unit includes a second multiplier, a second register and a second multiplexer. The second register is coupled to the second multiplier and the first multiplexer. The second multiplexer is coupled to the second multiplier and the controller. The controller controls the power of the third power function of the hash subkey output by the second multiplexer according to the total length of the second data block and the third data block, and the second multiplier performs calculations according to the third power function of the hash subkey and the value of the second register, and stores the calculation result in the second register to update the value of the second register. When the circuit based on Galois hash verification receives all the second data blocks and the third data blocks, the controller controls the first multiplexer to output the value of the second register as the shift amount to the second calculation unit.

[0020] In one embodiment of the present invention, the above-mentioned circuit based on Galois hash verification further includes a sixth multiplexer, the input end of the sixth multiplexer is coupled to the ciphertext calculation circuit, the output end of the sixth multiplexer is coupled to the bubble processing circuit, and the sixth multiplexer is used to transmit the output of the first number of first calculation units to the bubble processing circuit under the control of the controller. .

[0021] In one embodiment of the present invention, the above-mentioned circuit based on Galois hash verification also includes a seventh multiplexer, the input end of the seventh multiplexer is coupled to the ciphertext calculation circuit and the bubble processing circuit, and the output end of the seventh multiplexer is coupled to the first adder; the seventh multiplexer is used to transmit the second output and the third output to the first adder under the control of the controller.

[0022] The circuit provided by the present application is provided with a bubble processing circuit that can process the third data block (the third data block is, for example, a data block corresponding to the bubble data), so that the ciphertext calculation circuit can continuously receive and process the subsequent data stream, avoiding the problem of affecting the reception of the subsequent data stream due to the processing of the third data block. In addition, the present application uses an additional verification data calculation circuit and a ciphertext calculation circuit to respectively receive and process the first data block and the second data block in the data stream. On the one hand, this parallel computing architecture improves data throughput and reduces latency. On the other hand, this computing architecture has no requirements for the input order of the first data block and the second data block. The first data block and the second data block can be input in sequence or in parallel, which enables the present application to simultaneously support different requirements for data order of different GHASH standards. In addition, the number of the first computing units in the ciphertext calculation circuit can be flexibly configured, which also enables the solution of the present application to meet the requirements of data streams with different bit widths. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1A A schematic diagram showing the data flow of the Ethernet protocol.

[0024] Figure 1B An exemplary flit format for an interconnect protocol is shown.

[0025] Figure 2 A schematic diagram of a circuit for GHASH-based authentication is shown according to an embodiment of the present invention.

[0026] Figure 3A A circuit diagram of an additional verification data calculation circuit is shown according to an embodiment of the present invention.

[0027] Figure 3B A flowchart of generating output by an additional verification data calculation circuit is shown according to an embodiment of the present invention.

[0028] Figure 4AA circuit diagram of a unit of a ciphertext calculation circuit is shown according to an embodiment of the present invention.

[0029] Figure 4B A flowchart of generating output by a ciphertext calculation circuit is shown according to an embodiment of the present invention.

[0030] Figure 5 A circuit diagram of a bubble processing circuit is shown according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] Reference will now be made in detail to exemplary embodiments of the present invention, examples of which are illustrated in the accompanying drawings. Whenever possible, the same reference numerals are used in the drawings and the description to refer to the same or like parts.

[0032] In communication protocols such as PCIe-Gen6 and CXL that use flit as the basic unit of transmission, a data stream usually includes multiple flits that are transmitted continuously, with no interval between two adjacent flits. Each flit may include a header (flitheader) and ciphertext or plain text (Cipher / Plain text). Figure 1B An exemplary flit format is shown, where F1 includes a header a1 and plaintext d1, F2 may include a header a2 and plaintext d2, and F3 may include a header a3 and plaintext d3.

[0033] The data sequence that needs to be GHASH operated includes three parts, namely AAD, ciphertext or plaintext (for the convenience of explanation, "ciphertext or plaintext" will be collectively referred to as data load below) and bubble data. Taking the transmission protocol of CXL IDE as an example, its AAD is composed of the headers in each flit, and the data load part includes the data load in each flit. It can be seen that the AAD and data load in the transmission protocol of CXL IDE are not input in sequence, but in parallel. Bubble data is data inserted after AAD and data load, which can only include length data. The length data is used to indicate the length of AAD and the length of data load. It can be understood that the length data can only be calculated after the GHASH operation circuit receives multiple flits included in the data stream. When CRC data is enabled, bubble data includes CRC data and length data.

[0034] For example, if the data stream includes flit1 and flit2, where flit1 includes header A1 and data blocks X1 and X2 representing plain text or cipher text, and flit2 includes header A2 and data blocks X3 and X4 representing plain text or cipher text, then the GHASH operation sequence can be expressed as:

[0035] X=A1||A2||X1||X2||X3||X4||X(L), where “||” is a concatenation symbol, X(L) is a data block formed by concatenating len(A) and len(C), i.e., len(A)||len(C), where len(A) indicates the length of the AAD data block, i.e., the total length of data blocks A1 and A2, and len(C) is the length of the data payload, i.e., the total length of data blocks X1, X2, X3, and X4; when CRC data is enabled, the data sequence for GHASH operation can be expressed as:

[0036] X=A1||A2||X1||X2||X3||X4||X(CRC)||X(L), where X(CRC) indicates CRC data.

[0037] The GHASH operation circuit and the GHASH operation process of the present application will be described in detail below with reference to the accompanying drawings.

[0038] Figure 2 is a schematic diagram of a GHASH-based verification circuit 10 according to an embodiment of the present invention.

[0039] The circuit 10 may include a controller 20, an additional verification data calculation circuit 100, a ciphertext calculation circuit 200, a bubble processing circuit 300, a multiplexer 220, a multiplexer 400, and an adder 500. It should be noted that the adder and the multiplier mentioned in the embodiments of the present invention may be a Galois adder and a Galois multiplier, respectively.

[0040] The controller 20 may be coupled to the additional verification data calculation circuit 100, the ciphertext calculation circuit 200, the bubble processing circuit 300, the multiplexer 220, and the multiplexer 400. The additional verification data calculation circuit 100, the ciphertext calculation circuit 200, the bubble processing circuit 300, the multiplexer 220, or the multiplexer 400 may receive corresponding data and perform calculations under the control of the controller 20. The controller 20 is, for example, a central processing unit (CPU), or other programmable general-purpose or special-purpose micro control unit (MCU), microprocessor, digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processing unit (GPU), image signal processor (ISP), image processing unit (IPU), arithmetic logic unit (ALU), complex programmable logic device (CPLD), field programmable gate array (FPGA) or other similar components or combinations of the above components.

[0041] The output end of the additional verification data calculation circuit 100 can be coupled to the adder 500. The additional verification data calculation circuit 100 can be used to receive one or more data blocks I1 corresponding to AAD (header in flit) in the data stream under the control of the controller 20, and perform calculations based on the data blocks I1, and then shift the calculation results based on the data load and the total length of the bubble data to generate an output O1. Specifically, the additional verification data calculation circuit 100 may include a shift unit 110 and a calculation unit 120. The calculation unit 120 is used to perform a GHASH operation on the data block I1. The shift unit 110 is connected to the calculation unit 120 to shift the calculation result of the calculation unit 120 to the left under the control of the controller 20. The number of bits shifted to the left (i.e., the shift amount) depends on the total bit width of the data load and the bubble data (i.e., the total data length).

[0042] The output end of the ciphertext calculation circuit 200 can be coupled to the input end of the multiplexer 220 and the input end of the multiplexer 400. The ciphertext calculation circuit 200 can be used to receive (for example: receive under the control of the controller 20) multiple data blocks I2, and the multiple data blocks I2 may include data blocks corresponding to data loads (ciphertext or plaintext in flit) and / or bubble data. The ciphertext calculation circuit 200 generates an output O2 based on the multiple data blocks I2. Specifically, the ciphertext calculation circuit 200 may include multiple calculation units 210 for receiving data blocks I2 and performing GHASH operations on the data blocks I2. The output end of each calculation unit 210 can be coupled to the input end of the multiplexer 220 and the input end of the multiplexer 400, respectively, and the output end of the multiplexer 220 can be coupled to the bubble processing circuit 300.

[0043] The output end of the bubble processing circuit 300 can be coupled to the input end of the multiplexer 400. The bubble processing circuit 300 can be used to receive the calculation result of the ciphertext calculation circuit 200 outputted by the multiplexer 220 as the data block I3, and generate the output O3 according to the data block I3 and the bubble data. Specifically, the bubble processing circuit 300 may include a calculation unit 310 and a calculation unit 320 for receiving the bubble data and the data block I3 from the ciphertext calculation circuit 200 and generating the output O3 according to the data block I3 and the bubble data.

[0044] The input end of the multiplexer 400 can be coupled to the output end of the ciphertext calculation circuit 200 and the output end of the bubble processing circuit 300, respectively, and the output end of the multiplexer 400 is coupled to the adder 500. The multiplexer 400 can be coupled to the controller 20, and under the control of the controller 20, select the corresponding output from the output end of the ciphertext calculation circuit 200 and the output end of the bubble processing circuit 300 to transmit to the adder 500. The adder 500 performs a Galois addition operation according to the output of the additional verification data calculation circuit 100, the output of the multiplexer 400, and the 0th block sequence of the AES-GCM (i.e., ciph-j0-value, also referred to as J0) to generate and output a message authentication code (MAC) MAC.

[0045] Reference Figure 3A and 3B , Figure 3A is a circuit diagram of an additional verification data calculation circuit 100 according to an embodiment of the present invention, and Figure 3B is a flow chart of the additional verification data calculation circuit 100 generating the output O1 according to an embodiment of the present invention.

[0046] The calculation unit 120 of the additional verification data calculation circuit 100 includes an adder 21, a multiplier 22, a register 23 and a multiplexer 24. Figure 3AAs shown, one input end of the adder 21 can be used to receive (for example, received under the control of the controller 20) the data block I1, and the other input end can be coupled to the output end of the register 23. The input end of the multiplier 22 can be coupled to the output end of the adder 21 and the output end of the multiplexer 24. The output end of the multiplier 22 can be coupled to the input end of the register 23. The output end of the register 23 can be coupled to the adder 500 to transmit the output O1 to the adder 500. The initial value stored in the register 23 can be 0. One input end of the multiplexer 24 can be coupled to the output end of the shift unit 110, and the other input end receives the hash subkey H for GHASH operation. The multiplexer 24 can be coupled to the controller 20, and is controlled by the controller 20 to output the hash subkey H or the output of the shift unit 110 to the multiplier 22.

[0047] The shift unit 110 of the additional verification data calculation circuit 100 includes a multiplier 25, a register 26, and a multiplexer 27. The input end of the multiplier 25 can be coupled to the output end of the multiplexer 27 and the output end of the register 26. The output end of the multiplier 25 can be coupled to the input end of the register 26. The initial value stored in the register 26 can be 1. The multiplexer 27 can be coupled to the controller 20, and the multiple input ends of the multiplexer 27 are respectively used to receive power functions of H of different powers, which are H, H to the power of 2, H to the power of 3, ..., H to the power of (k+2), where k is the number of calculation units 210 in the ciphertext calculation circuit 200. Under the control of the controller 20, the multiplexer 27 selects the corresponding power function of H and outputs it to the multiplier 25.

[0048] Combine the following Figure 3A and 3B The process of the additional verification data calculation circuit 100 performing GHASH operation on AAD is described.

[0049] In step S201 , the adder 21 may receive a data block I1 in a data stream and a value in a register 23 for calculation, wherein the data block I1 may be a data block corresponding to AAD.

[0050] In step S202, the multiplier 22 may receive the output value of the adder 21 from the adder 21, and the multiplexer 24 may transmit the hash subkey H to the multiplier 22 under the control of the controller 20. The multiplier 22 may calculate the product of the output value of the adder 21 and H to update the value in the register 23.

[0051] It should be noted that each flit includes at most one data block corresponding to AAD, so the additional verification data calculation circuit 100 receives and calculates at most one data block corresponding to AAD in each round.

[0052] For example, if the data block corresponding to AAD in the currently received flit is A1, the calculation process of data block A1 is as follows:

[0053] The adder 21 receives the data block A1 and obtains the value of the register 23, the initial value of which is 0. The adder 21 adds the data block A1 and the initial value 0 of the register 23 to obtain A1. The multiplier 22 multiplies the calculation result A1 of the adder 21 by H to obtain A1·H. At this time, the value of the register 23 is updated to A1·H.

[0054] If there are multiple data blocks corresponding to AAD in the current data stream, the above steps S201-S202 can be repeated to receive and calculate each data block corresponding to AAD. Assuming that the currently received CXL data stream includes 3 data blocks corresponding to AAD, in the order of receiving, these 3 data blocks are A1, A2, and A3, then the calculation unit 120 needs to perform 3 rounds of calculation.

[0055] The first round of calculation of data block A1, as can be seen from the above, after the calculation of data block A1 is completed, the value of register 23 is updated to A1·H.

[0056] In the second round, adder 21 receives data block A2 and obtains value A1·H of register 23. Adder 21 adds data block A2 and value A1·H of register 23 to obtain A1·H+A2. Multiplier 22 multiplies the calculation result of adder 21 by H to obtain (A1·H+A2)·H. At this time, the value of register 23 is updated to (A1·H+A2)·H.

[0057] In the third round, adder 21 receives data block A3 and obtains the value (A1·H+A2)·H of register 23. Adder 21 adds data block A3 and the value (A1·H+A2)·H of register 23 to obtain (A1·H+A2)·H+A3. Multiplier 22 multiplies the calculation result of adder 21 by H to obtain ((A1·H+A2)·H+A3)·H. At this time, the value of register 23 is updated to ((A1·H+A2)·H+A3)·H.

[0058] In step S203, the controller 20 may control the multiplexer 27 to transmit H Li To the multiplier 25, the multiplier 25 converts H Li Multiply it by the value of register 26 to update the value of register 26, where i is the calculation round, Li is the data load and the number of data blocks of bubble data received by the ciphertext calculation circuit 200 and the bubble processing circuit 300 in the i-th round of calculation, and i is an integer greater than or equal to 1.

[0059] Specifically, the GHASH algorithm requires that the calculation be performed in the order of the operation sequence (for example, X=A1||A2||X1||X2||X3||X4||X(L)), that is, AAD is calculated first, then the data load is calculated, and finally the bubble data is calculated. However, in the transmission protocol of CXL IDE, there is no temporal sequence between AAD and the data load when they are input. In the embodiment of the present application, the additional verification data calculation circuit 100 is used to calculate AAD separately, and then the calculation result of AAD is shifted to the left as a whole, and the shift amount is the total length value of the data load and the bubble data, thereby meeting the requirements of the GHASH algorithm.

[0060] The data blocks corresponding to the data load are received and processed by the ciphertext calculation circuit 200, and the number of data blocks that the ciphertext calculation circuit 200 can receive in each round does not exceed the number k of the calculation units 210 in the ciphertext calculation circuit 200. When the number of data blocks corresponding to the data load of the data stream exceeds k, the ciphertext calculation circuit 200 needs to receive and process the data in multiple rounds. Whether the bubble data is processed by the ciphertext calculation circuit 200 or the bubble processing circuit 300 or both depends on the relationship between the number of data blocks of the data load received by the ciphertext calculation circuit 200 in the last round, the number of data blocks of the bubble data, and the number k of the calculation units 210. For example, if the number of data blocks of the data load received by the ciphertext calculation circuit 200 in the last round is r (r is less than or equal to k), and the number of data blocks included in the bubble data is t (t is 1 or 2), when (r+t) is less than or equal to the number k of the calculation units 210, the ciphertext calculation circuit 200 can calculate the data load and the bubble data together in the last round without enabling the bubble processing circuit 300; when (r+t) is greater than the number k of the calculation units 210, the ciphertext calculation circuit 200 cannot calculate all the bubble data in the last round, and a new calculation round needs to be added to calculate the remaining bubble data. In this case, the remaining bubble data can be transmitted to the bubble processing circuit 300 for processing, so that the ciphertext calculation circuit 200 does not need to add a new calculation round and can directly process the next operation sequence. In other words, if the sum of the number of data blocks of the data load received by the circuit 10 in the last round and the number of data blocks included in the bubble data (for example, m, m=r+t) is greater than the number k of the computing units 210, the controller 20 can input the last (mk) data blocks in the bubble data into the bubble processing circuit 300 for processing, where the (mk) data blocks may include all or part of the bubble data.

[0061] For example, if the data block sequence of the data load and the bubble data is: X1||X2||X3||X4||X5||X6||X7||X(L)], and the number k of the calculation units 210 in the ciphertext calculation circuit 200 is 4. In the first round, the ciphertext calculation circuit 200 can receive four data blocks, namely X1, X2, X3, and X4. At this time, no data block is transmitted to the bubble processing circuit 300, so the number of data blocks L1=4, and the controller 20 can control the multiplexer 27 to transmit H 4 To the multiplier 25, the multiplier 25 converts H 4 Multiply the initial value 1 of register 26 to update the value in register 26 to H 4 Then, in the second round, the ciphertext calculation circuit 200 may receive data blocks X5, X6, and X7. Since the sum of the number of data blocks X5, X6, X7, and X(L) is equal to the number k of the calculation units 210, the ciphertext calculation circuit 200 may calculate the data blocks X5, X6, X7, and X(L) together in the second round. At this time, the bubble processing circuit 300 has not received any data. Therefore, in the second round, the number of data blocks L2=4, and the controller 20 may control the multiplexer 27 to transmit H 4 To multiplier 25. Multiplier 25 can convert H 4 With the value H in register 26 4 Multiply to update the value in register 26 to H 8 , where H 8 The number 8 in is the sum of the number of data blocks included in the data payload and the bubble data.

[0062] In another example, if the sequence of the data payload and the bubble data is: X1||X2||X3||X4||X5X6||X7||X(CRC)||X(L), and the number of the calculation units 210 in the ciphertext calculation circuit 200 is 4. In the first round, the ciphertext calculation circuit 200 can receive four data blocks, namely X1, X2, X3, and X4, and there is no data input in the bubble processing circuit 300. The number of data blocks L1=4, the controller 20 can control the multiplexer 27 to transmit H 4 To the multiplier 25, the multiplier 25 converts H 4 Multiply the initial value 1 of register 26 to update the value in register 26 to H 4 In the second round, the sum of the data blocks X5, X6, X7 of the data load and the data blocks X(CRC) and the length data blocks X(L) is greater than the number of the calculation units 210, so the controller 20 can control the ciphertext calculation circuit 200 to calculate four data blocks (data blocks X5, X6, X7 and X(CRC)), and the remaining X(L) can be calculated by the bubble processing circuit 300. At this time, the number of data blocks L2=5, and the controller 20 can control the multiplexer 27 to transmit H5 To multiplier 25. Multiplier 25 can convert H 5 With the value H in register 26 4 Multiply to update the value in register 26 to H 9 , where H 9 The number 9 in is the sum of the total number of data blocks included in the data payload and the bubble data.

[0063] After the circuit 10 receives all the data payloads and bubble data, the process proceeds to step S204 .

[0064] In step S204, the controller 20 may control the multiplexer 24 to transmit the value in the register 26 to the multiplier 22. The multiplier 22 may multiply the output of the adder 21 by the value in the register 26 to update the value in the register 23.

[0065] For example, if the GHASH operation sequence X=A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(L)], it can be seen from the above steps S201 and S202 that after receiving and calculating the data blocks A1, A2, and A3, the value of register 23 is ((A1·H+A2)·H+A3)·H. It can be seen from step S203 that after receiving the data load and bubble data, the value of register 26 is H 8 , multiply the value of register 23 by the value of register 26 to obtain ((A1·H+A2)·H+A3)·H 9 , and update the value of register 23 to ((A1·H+A2)·H+A3)·H 9 It can be understood that multiplying the value of register 23 by the value of register 26 is equivalent to shifting the calculation result of AAD (the value of register 23) to the left, and the shift length is the total length value of the data payload and the bubble data.

[0066] In step S205 , the controller 20 may use the value of the register 23 as the output O1 , and transmit the output O1 to the adder 500 .

[0067] Continuing with the above example, the output O1 is ((A1·H+A2)·H+A3)·H 9 .

[0068] Reference Figure 2 , 4A and 4B, Figure 4A is a circuit diagram of a computing unit 210 of a ciphertext computing circuit 200 according to an embodiment of the present invention, and Figure 4B1 is a flow chart of the ciphertext calculation circuit 200 generating the output O2 according to an embodiment of the present invention. The ciphertext calculation circuit 200 may include k calculation units 210, where k is a positive integer greater than 1. In some embodiments, k may preferably be 2, 4, 8, 16, ... The output end of each calculation unit 210 may be coupled to the input end of the multiplexer 220, 400. The calculation unit 210 may include an adder 31, a multiplier 32, a register 33, a register 34, and a multiplexer 35. One input end of the adder 31 may receive the data block I21 under the control of the controller 20, and the other input end may be coupled to the output end of the register 33. The input end of the multiplier 32 may be coupled to the output end of the adder 31 and the output end of the multiplexer 35. The output end of the multiplier 32 may be coupled to the input end of the register 33. The output terminal of the register 33 as the first output terminal of the calculation unit 210 can be coupled to the input terminal of the adder 31, the input terminal of the register 34, and the input terminals of the multiplexers 220 and 400. The output terminal of the register 34 as the second output terminal of the calculation unit 210 can be coupled to the input terminal of the multiplexer 400. The initial values ​​of the registers 33 and 34 can be 0. The multiplexer 35 can be coupled to the controller 20 and controlled by the controller 20 to output power functions of H of different powers (i.e., H, H 2 , ..., H k , k is the number of computing units 210 in the ciphertext computing circuit 200) to the multiplier 32.

[0069] Specifically, in step S301, the ciphertext calculation circuit 200 may receive a parallel data block I2, wherein the parallel data block I2 may include one or more data blocks corresponding to the data payload, and may also include all or part of the data blocks corresponding to the bubble data, and the number of data blocks included in the parallel data block I2 is less than or equal to the number k of the plurality of calculation units 210. Each data block in the parallel data block I2 (e.g. Figure 4A The data block I21) in can be received by each computing unit 210 respectively.

[0070] For example, if the sequence of data payload and bubble data is: X1||X2||X3||X4||X5||X6||X7||X(L), and the number of computing units 210 k=4, then each computing unit 210 in the ciphertext computing circuit 200 can receive data blocks X1, X2, X3, and X4 respectively in the first round. Each computing unit 210 in the ciphertext computing circuit 200 can receive data blocks X5, X6, X7, and X(L) respectively in the second round.

[0071] In step S302 , the adder 31 in the calculation unit 210 adds the received data block to the value in the register 33 , and outputs the calculation result to the multiplier 32 .

[0072] Taking one of the calculation units 210 as an example, if in the first round, the data block received by the adder 31 is the data block X1, and the initial value of the register 33 is 0, the calculation result of the adder 31 is X1. The calculation process of other calculation units is similar to this, and will not be repeated here.

[0073] In step S303, under the control of the controller 20, the multiplexer 35 transmits the corresponding power function of the hash subkey H to the multiplier 32, wherein the gating of the multiplexer 35 (i.e., the selection of the power function of the hash subkey H) is determined according to the position of the data block received by the computing unit 210 in the entire sequence (or the order in which the circuit 10 receives the data block) and the number k of the computing units 210. The multiplier 32 can multiply the output of the adder 31 by the power function of H output by the multiplexer 35 to update the value in the register 33.

[0074] Specifically, if the controller 20 determines that the data block received by the adder 31 is one of the last (k-1) data blocks in the operation sequence, that is, the data block is one of the last (k-1) data blocks received by the circuit 10, the controller 20 determines the power function of the output H of the multiplexer 35 according to the order of the data block in the last (k-1) data blocks. Let ki represent the order of the data block in the last (k-1) data block, and the power function of the output H of the multiplexer 35 is H k-ki , where ki = 1, 2, ..., (k-1). That is, if the data block is ranked first in the last (k-1) data blocks, that is, ki = 1, then the power function of the output H of the multiplexer 35 is H k-1 If the data block ranks second in the last (k-1) data blocks, i.e., ki=2, then the power function of H output by multiplexer 35 is H k-2 , and so on. If the data block is ranked last in the last (k-1) data blocks, that is, ki=(k-1), then the power function of H output by the multiplexer 35 is H.

[0075] If the controller 20 determines that the data block received by the adder 31 is not one of the last (k-1) data blocks in the operation sequence, it determines that the power function of the output H of the multiplexer 35 is H k .

[0076] For example, if the GHASH operation sequence X=A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(L), and the number k of the computing units 210 is 4, it can be seen that the last (k-1) data blocks are X6, X7, and X(L). For these three data blocks, the power functions of H output by the multiplexer 35 are H 3 , H 2, H, and for data blocks X1, X2, X3, X4, X5, the power function of H output by multiplexer 35 is unified as H 4 .

[0077] It can be understood that the circuit 10 first receives the data blocks in the data stream (such as the data blocks of AAD and the data blocks in the data payload), and then receives the data block X(L) of the bubble data, that is, the data block X(L) is the last data block received by the circuit 10, so the power function of H corresponding to the data block X(L) is H. When the CRC data is enabled, the data block X(CRC) is the second to last data block received by the circuit 10, so the power function of H corresponding to the data block X(L) is H. 2 That is to say, for the data block of the bubble data, it is only necessary to determine the position of the data block in the entire sequence (or the order in which the circuit 10 receives the data block).

[0078] In step S304 , after receiving all the data payloads, the controller 20 may determine whether the bubble processing circuit 300 calculates at least a portion of the bubble data.

[0079] As described above, the controller 20 can make a judgment based on the relationship between the number of data blocks of the data payload and the number of data blocks of the bubble data received by the ciphertext calculation circuit 200 in the last round and the number k of the calculation units 210. If the judgment result of the controller 20 is that the bubble processing circuit 300 is needed to calculate at least a part of the bubble data (for example: the sum of the number of data blocks of the data payload and the number of data blocks of the bubble data received in the last round is greater than k), the process can proceed to step S305. If the judgment result of the controller 20 is that the bubble processing circuit 300 is not needed to calculate the bubble data (for example: the number of data blocks of the data payload and the number of data blocks of the bubble data received in the last round is less than or equal to k), the process can proceed to step S307.

[0080] In step S305, the controller 20 controls the multiplexer 220 to output the values ​​(e.g., data block I3) in the registers 33 of the corresponding s calculation units 210 among the k calculation units of the ciphertext calculation unit 200 to the bubble processing circuit 300, and the controller 20 controls the remaining (ks) calculation units 210 to output the values ​​in the registers 33 to the registers 34 to wait for the calculation result of the bubble processing circuit 300. After the bubble processing circuit 300 generates the calculation result, the value of the register 34 can be transmitted to the multiplexer 400 together with the calculation result of the bubble processing circuit 300 as the output O21, and transmitted to the adder 500 by the multiplexer 400. The value of s is equal to the number of data blocks of the bubble data transmitted to the bubble processing circuit 300. Since the bubble data may include the length data, or may include the length data and the CRC check data, the number of data blocks of the bubble data transmitted to the bubble processing circuit 300 is at most 2, that is, s can be equal to 1 or 2.

[0081] In step S306, after the bubble processing circuit 300 completes the calculation, under the control of the controller 20, the multiplexer 400 outputs the value in the register 34 of the (ks) calculation units 210 (i.e., the output O2 of the ciphertext calculation circuit 200, where the output O2 includes the output O21 of the register 33 or the register 34) and the calculation result of the bubble processing circuit 300 (i.e., the output O3 of the bubble processing circuit 300) to the adder 500.

[0082] In step S307 , the controller 20 controls the multiplexer 400 to output the values ​​in the registers 33 of the k computing units 210 to the adder 500 .

[0083] For example, if the GHASH operation sequence X=A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(L), the number k of computing units 210 in the ciphertext computing circuit 200 is 4, and the 4 computing units are 210-1, 210-2, 210-3, and 210-4 respectively, then the calculation of the ciphertext computing circuit 200 is as follows.

[0084] In the first round of calculation, the calculation units 210-1, 210-2, 210-3, and 210-4 receive data blocks X1, X2, X3, and X4 respectively and perform parallel calculations. Taking the calculation unit 210-1 receiving the data block X1 as an example, the adder 31 adds X1 to the initial value 0 of the register 33 to obtain X1; the multiplier 32 adds the calculation result of the adder 31 to H 4 Multiply them and we get X1·H 4 At this time, the value in register 33 is updated to X1·H 4Similarly, the values ​​in registers 33 in the other three computing units 210-2, 210-3, and 210-4 are updated to X2·H respectively. 4 、X3·H 4 、X4·H 4 .

[0085] In the second round of calculation, the calculation units 210-1, 210-2, 210-3, and 210-4 receive data blocks X5, X6, X7, and X(L) respectively and perform parallel calculations. Taking the calculation unit 210-1 receiving the data block X1 as an example, the adder 31 in the calculation unit 210-1 adds X5 to the value X1·H in the register 33. 4 Add them together and we get X5+X1·H 4 The multiplier 32 adds the result of the adder 31 to H 4 Multiply them and we get (X1·H 4 +X5)·H 4 At this time, the value in register 33 is updated to (X1·H 4 +X5)·H 4 The values ​​in the registers 33 in the other three computing units 210-2, 210-3, and 210-4 are updated to (X2·H 4 +X6)·H 3 、(X3·H 4 +X7)·H 2 、(X4·H 4 +X(L))·H.

[0086] At this time, the controller 20 can control the multiplexer 400 to output the values ​​in the registers 33 of the four computing units to the adder 500 .

[0087] For example, if the input sequence X=A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(CRC)||X(L), in the first round, the computing units 210-1, 210-2, 210-3, and 210-4 receive data blocks X1, X2, X3, and X4, respectively. At the end of the first round, the values ​​in the registers 33 in the computing units 210-1, 210-2, 210-3, and 210-4 are updated to X1·H, respectively. 4 、X2·H 4 、X3·H 4 、X4·H 4 .

[0088] In the second round of calculation, the calculation units 210-1, 210-2, 210-3, and 210-4 receive data blocks X5, X6, X7, and X(CRC) respectively. At the end of the second round, the values ​​in the registers 33 in the calculation units 210-1, 210-2, 210-3, and 210-4 are updated to (X1·H 4 +X5)·H 4 、(X2·H 4 +X6)·H 4 、(X3·H 4 +X7)·H 3 、(X4·H 4 +X(CRC))·H 2 .

[0089] After the second round, there is one last bubble data, namely, data block X(L). At this time, in order to free up the ciphertext calculation circuit 200 to receive the next input sequence, the controller 20 can control the bubble processing circuit 300 to receive the data block X(L), and at the same time control the multiplexer 220 to transfer the value in the register 33 of the calculation unit 210-1 (namely (X1·H 4 +X5)·H 4 ) is output to the bubble processing circuit 300. In addition, in order to synchronize the output of the ciphertext calculation circuit 200 with that of the bubble processing circuit 300, the controller 20 may control other calculation units (calculation units 210-2, 210-3, 210-4) to output the values ​​in their registers 33 to the corresponding registers 34, respectively, to wait for the output of the bubble processing circuit 300.

[0090] Figure 5 According to an embodiment of the present invention, a circuit diagram of a bubble processing circuit 300 is shown. The bubble processing circuit 300 may include two calculation units 310 and 320, wherein in the calculation unit 310, an input end of an adder 41 is used to receive a data block I31 (e.g., an output value of a calculation unit 210) from the ciphertext calculation circuit 200, and another input end is coupled to a multiplexer 44, and the multiplexer 44 may output a data block X(CRC) or X(L) to the adder 41 under the control of the controller 20; an input end of a multiplier 42 is coupled to the output end of the adder 41, and another input end is coupled to a multiplexer 45, and the multiplexer 45 may output H or H under the control of the controller 20. 2to the multiplier 42; the input end of the register 43 is coupled to the output end of the multiplier 42, and the output end is coupled to the multiplexer 400. In the calculation unit 320, an input end of the adder 46 is used to receive the data block I31 (for example, the output value of another calculation unit 210) from the ciphertext calculation circuit 200. If the multiplexer 44 outputs the data block X (CRC) to the adder 41, the other input end of the adder 46 is used to receive the data block X (L); one input end of the multiplier 47 is coupled to the output end of the adder 46, and the other input end is used to receive H; the input end of the register 48 is coupled to the output end of the multiplier 47, and the output end is coupled to the multiplexer 400.

[0091] The controller 20 may determine whether to enable the calculation unit 310, or the calculation units 310 and 320, according to the number of data blocks of the bubble data to be processed by the bubble processing circuit 300. In addition, the controller 20 may determine the data block (X(CRC) or X(L)) output by the multiplexer 44 and the data (H or the power function H of H) output by the multiplexer 45 according to the number of data blocks of the bubble data to be processed by the bubble processing circuit 300. 2 ).

[0092] If the controller 20 determines that only one data block of bubble data (i.e., data block X(L)) is processed by the bubble processing circuit 300, the calculation unit 310 may be selected to be enabled. Specifically, the controller 20 may control the multiplexer 44 to input the data block X(L) into the adder 41. The adder 41 may calculate the sum of the data block I31 and the data block X(L), and output the calculation result to the multiplier 42. The controller 20 may control the multiplexer 45 to transmit H (X(L) is the last data block in the input sequence) to the multiplier 42. The multiplier 42 may calculate the product of the output of the adder 41 (i.e., the sum of the data block I31 and the data block X(L)) and H, and store the product in the register 43, where the data block I31 is the value in the register 33 in the calculation unit 210-1 transmitted by the multiplexer 220. The controller 20 may use the output O31 of the register 43 as the output O3 of the bubble processing circuit 300 to transmit the output O3 to the multiplexer 400 .

[0093] If the controller 20 determines that two data blocks of bubble data (i.e., X(CRC) and X(L)) are input to the bubble processing circuit 300, the calculation units 310 and 320 may be enabled at the same time, wherein the calculation unit 310 is used to calculate X(CRC) and the calculation unit 320 is used to calculate X(L). Specifically, the controller 20 may control the multiplexer 44 to input the data block X(CRC) to the adder 41. The adder 41 may calculate the sum of the data block I31 and the data block X(CRC). The controller 20 may control the multiplexer 45 to transmit H 2(X(CRC) is the second to last data block in the input sequence) to the multiplier 42. The multiplier 42 can calculate the output of the adder 41 (ie: the sum of the data block I31 and the data block X(CRC)) and H 2 , and stores the product in register 43, wherein data block I31 is the value in register 33 in calculation unit 210-1 transmitted by multiplexer 220. At the same time, controller 20 may control data block X(L) to be input into adder 46. Adder 46 may calculate the sum of data block I32 and data block X(L), wherein data block I32 is the value in register 33 in calculation unit 210-2 transmitted by multiplexer 220. Controller 20 may transmit H to multiplier 47. Multiplier 47 may calculate the product of the output of adder 46 (i.e., the sum of data block I32 and data block X(L)) and H, and store the product in register 48. Controller 20 may use output O31 of register 43 and output O32 of register 48 as output O3 of bubble processing circuit 300, so as to transmit output O3 to multiplexer 400, wherein output O3=O31+O32.

[0094] The adder 500 performs Galois addition operation according to the output O1 of the additional verification data calculation circuit 100, the output O2 of the ciphertext calculation circuit, the output O3 of the bubble processing circuit 300 and the 0th block sequence (J0) of AES-GCM to generate and output a message authentication code MAC.

[0095] For example, if the input sequence X=A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(CRC)||X(L), the number k of the calculation units 210 in the ciphertext calculation circuit 200 is 4, and the 4 calculation units are 210-1, 210-2, 210-3, and 210-4. As mentioned above, after the ciphertext calculation circuit 200 completes the second round of calculation, the values ​​in the registers 33 of the calculation units 210-1, 210-2, 210-3, and 210-4 are respectively (X1·H 4 +X5)·H 4 、(X2·H 4 +X6)·H 4 、(X3·H 4 +X7)·H 3 、(X4·H 4 +X(CRC))·H 2 The value in register 33 of calculation unit 210-1 (ie, (X1·H 4 +X5)·H 4 ) is output to the calculation unit 310 in the bubble processing circuit 300, and the values ​​in the registers 33 of other calculation units are output to the corresponding registers 34 respectively.

[0096] The adder 41 in the calculation unit 310 converts (X1·H 4 +X5)·H 4 Added to the output X(L) of multiplexer 44, we get (X1·H 4 +X5)·H 4 +X(L), the multiplier 42 multiplies the calculation result of the adder 41 by H output by the multiplexer 45 to obtain ((X1·H 4 +X5)·H 4 +X(L))·H, and stores it in register 43.

[0097] The controller 20 may control the multiplexer 400 to output the value of the register 34 and the value in the register 43 to the adder 500 .

[0098] In summary, a bubble processing circuit specifically used for processing bubble data is provided in the circuit of the present application, which enables the circuit of the present application to process continuously input data streams without intervals. In addition, the present application processes AAD and data payload separately, uses an additional verification data calculation circuit to receive and process AAD, and uses a ciphertext calculation circuit to receive and process data payload. This means that the present application has no requirements for the input order of AAD and data payload. AAD and data payload can be input in sequence or in parallel. In other words, the present application can simultaneously support different requirements for data order of different GHASH standards. Therefore, the present application can be applied not only to the CXL protocol format, but also to other data formats, such as Figure 1A Schematic diagram of Ethernet.

[0099] For Ethernet protocol data streams, since the additional verification data comes from the packet header and the data load comes from the packet payload, the additional verification data and the data load are input in chronological order. Figure 2 When the circuit in the figure performs GHASH operation on the data stream of Ethernet protocol, it only needs to use Figure 2 The ciphertext calculation circuit of the middle circuit can calculate the additional verification data and the data load in sequence according to the data input data, and there is no need to enable the additional verification data calculation circuit.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A circuit based on Galois hash verification, characterized in that: The circuit is used to perform calculation processing on a data sequence including a first data block, a second data block and a third data block, and the circuit includes: an additional verification data calculation circuit, receiving a first data block in the data stream and performing calculation according to the first data block, and shifting the calculation result left according to the total length of the second data block and the third data block to generate a first output; A ciphertext calculation circuit, the ciphertext calculation circuit comprising k first calculation units, configured to receive second data blocks in the data stream in parallel in each round of calculation of the ciphertext calculation circuit, and perform parallel calculation on each received data block to generate a second output, wherein k is a positive integer greater than 1; a bubble processing circuit that receives a first number of third data blocks after a last round of calculation by the ciphertext calculation circuit and performs calculations to generate a third output; a controller coupled to the additional verification data calculation circuit, the ciphertext calculation circuit and the bubble processing circuit; and The first adder is used to perform calculation according to the first output, the second output and the third output to generate a message authentication code.

2. The circuit according to claim 1, characterized in that The first computing unit also receives a second number of third data blocks in parallel in the last round of calculation, and the values ​​of the first number and the second number are determined by the controller based on the value of k, the number of the third data blocks and the number of second data blocks received in the last round of calculation.

3. The circuit according to claim 2, characterized in that The first calculation unit performs calculation according to the received second data block or the third data block and a first power function of a hash subkey; The power of the first power function of the hash subkey is determined by the controller according to the order of the received second data block or the third data block in the data sequence and the value of k.

4. The circuit according to claim 3, characterized in that When the received second data block or the received third data block is the last (k-1) data block in the data sequence, the controller determines the power of the first power function of the hash subkey according to the order of the second data block or the third data block in the last (k-1) number blocks; When the received second data block or the third data block is not the last (k-1) data block in the data sequence, the controller determines the power of the first power function of the hash subkey according to the value of k.

5. The circuit according to claim 3, characterized in that: The first computing unit comprises: The third adder; a third multiplier, coupled to the third adder; a third register, coupled to the third adder and the third multiplier; a fourth register, coupled to the third register; and a third multiplexer coupled to the third multiplier and the controller; The third adder calculates the received second data block or the third data block and the value of the third register and outputs the calculation result to the third multiplier; The third multiplexer outputs the first power function of the hash subkey to the third multiplier under the control of the controller; The third multiplier performs calculation according to the calculation result of the third adder and the first power function of the hash subkey, and stores the calculation result to the third register to update the value of the third register; when the ciphertext calculation circuit receives and calculates all the second data blocks and the second number of third data blocks, the controller controls the output of the value of the third register as the second output.

6. The circuit according to claim 5, characterized in that When the bubble processing circuit receives the first number of third data blocks, the controller outputs the values ​​in the third registers of the corresponding first number of first calculation units among the k first calculation units to the bubble processing circuit, and at the same time controls the remaining first calculation units to output the values ​​in the third registers to the fourth registers for storage, and when the bubble processing circuit generates the third output, uses the value of the fourth register as the second output, and synchronously outputs the second output and the third output.

7. The circuit according to claim 1, characterized in that The bubble processing circuit generates the third output based on the received first number of third data blocks, the output of the first number of first computing units, and at least a second power function of the hash subkey; The power of the second power function of the hash subkey is determined by the controller according to the order of the third data block in the data sequence.

8. The circuit according to claim 7, characterized in that The bubble processing circuit includes a third calculation unit and a fourth calculation unit; The controller selectively enables the third computing unit, or starts the third computing unit and the fourth computing unit according to a value of the first number.

9. The circuit according to claim 8, characterized in that The third computing unit comprises: a fourth adder, coupled to the ciphertext calculation circuit; a fourth multiplier, coupled to the fourth adder; a fifth register, coupled to the fourth multiplier; a fourth multiplexer, coupled to the fourth adder; and a fifth multiplexer, coupled to the fourth multiplier; The fifth multiplexer outputs the second power function of the hash subkey to the fourth multiplier under the control of the controller; and The fourth multiplier calculates the calculation result of the fourth adder and the second power function of the hash subkey, and stores the calculation result in the fifth register.

10. The circuit according to claim 9, characterized in that The fourth calculation unit comprises: a fifth adder, coupled to the ciphertext calculation circuit; a fifth multiplier, coupled to the fifth adder; and a sixth register, coupled to the fifth multiplier; The fifth multiplier receives the calculation result of the fifth adder and the second power function of the hash subkey to perform calculation and stores the calculation result in the sixth register.

11. The circuit according to claim 1, characterized in that The additional verification data calculation circuit comprises: a second calculation unit, configured to receive the first data block, and perform calculation according to the first data block and a hash subkey to generate a first result; a shift unit, configured to determine a shift amount, and transmit the shift amount to the second calculation unit, so that the second calculation unit shifts the first result left according to the shift amount to generate the first output; When the circuit based on Galois hash verification receives all the second data blocks and the third data blocks, the controller controls the shift unit to output the shift amount to the second calculation unit.

12. The circuit according to claim 11, characterized in that The second computing unit comprises: A second adder; a first multiplier, coupled to the second adder; a first register coupled to the second adder, the first multiplier, and the first adder; and The first multiplexer is coupled to the first multiplier, the shift unit and the controller.

13. The circuit according to claim 12, characterized in that The shift unit comprises: a second multiplier; a second register coupled to the second multiplier and the first multiplexer; and a second multiplexer coupled to the second multiplier and the controller; The controller determines the power of the third power function of the hash subkey output by the second multiplexer according to the total length of the second data block and the third data block, the second multiplier performs calculation according to the third power function of the hash subkey and the value of the second register, and stores the calculation result in the second register to update the value of the second register; and When the circuit based on Galois hash verification receives all the second data blocks and the third data blocks, the controller controls the first multiplexer to output the value of the second register as the shift amount to the second calculation unit.

14. The circuit according to claim 7, characterized in that The circuit based on Galois hash verification also includes a sixth multiplexer, an input end of the sixth multiplexer is coupled to the ciphertext calculation circuit, an output end of the sixth multiplexer is coupled to the bubble processing circuit, and the sixth multiplexer is used to transmit the output of the first number of first calculation units to the bubble processing circuit under the control of the controller.

15. The circuit according to claim 1, characterized in that The circuit based on Galois hash verification further includes a seventh multiplexer, an input end of the seventh multiplexer is coupled to the ciphertext calculation circuit and the bubble processing circuit, and an output end of the seventh multiplexer is coupled to the first adder; The seventh multiplexer is used for transmitting the second output and the third output to the first adder under the control of the controller.

Images