Circuit based on galois hash verification

Abstract

The application provides a circuit for Galois Hash Verification, which is used for computing and processing a data sequence including a first data block, a second data block and a third data block, and comprises: an additional verification data computing circuit, which receives the first data block in a data stream and computes according to the first data block, and shifts the computing result to the left according to the total length of the second data block and the third data block to generate a first output; a ciphertext computing circuit, which comprises k first computing units, and is used for receiving the second data block in the data stream in parallel in each round of computation of the ciphertext computing circuit, and computing each received data block in parallel to generate a second output; a bubble processing circuit, which receives a first number of third data blocks after the last round of computation of the ciphertext computing circuit and computes to generate a third output; and a first adder, which is used for computing according to the first output, the second output and the third output to generate a message authentication code.

Description

TECHNICAL FIELD

[0001] The present application relates to a circuit based on Galois Hash verification. BACKGROUND

[0002] Current GHASH (Galois HASH) is mainly used for verification of Ethernet applications (e.g. routers, switches or bridges). Figure 1A A schematic diagram of an Ethernet protocol based data stream is shown. Referring to Figure 1A There is a gap between adjacent data packets of an Ethernet data stream, therefore, the communication device can use the gap between adjacent data packets to complete the GHASH operation of a bubble, which can be length data, or cyclic redundancy check (CRC) data and length data. However, some communication interconnection protocols, such as PCIe-Gen6 (peripheral component interconnect express-generation 6), CXL (Compute Express Link) and the like use flits as the basic unit of transmission. Taking the CXL protocol as an example, Figure 1B A schematic diagram of a CXL protocol based data stream is shown. The CXL data stream can contain a plurality of consecutive flits, such as F1, F2 and F3. There is no gap between adjacent flits, therefore, how to process bubble data without blocking the CXL data stream is a problem.

[0003] In addition, compared with Ethernet, CXL has a higher throughput (128Gbps, 256Gbps or higher) and a data width of more than 512 bits, therefore, in the case where the length of the GHASH data block is 128 bits, it must process 4 data blocks of 128 bits in a single clock cycle. This requires a higher parallel computing architecture.

[0004] Furthermore, in Ethernet, GHASH operation can be performed in units of data packets, and additional authentication data (AAD), cipher or plaintext can be processed in sequence according to the input order, where the AAD comes from the packet header of the Ethernet data packet, and the cipher or plaintext comes from the packet payload of the data packet. In the CXL protocol, the AAD and the cipher or plaintext are input in parallel, therefore, they cannot be processed in sequence.

[0005] Therefore, it is an important subject in the field to propose a method for GHASH verification of non-interval continuous transmission data stream (for example, data stream with flit as transmission basic unit). SUMMARY

[0006] The present application is directed to a circuit for Galois HASH (GHASH) based verification, which can perform GHASH operation on non-interval continuous transmission data stream (for example, CXL data stream).

[0007] The circuit for GHASH based verification of the present application is used for computing and processing a data sequence including a first data block, a second data block and a third data block, and includes an additional verification data computing circuit, a ciphertext computing circuit, a bubble processing circuit, a controller and a first adder. The additional verification data computing circuit receives the first data block in the data stream and performs computation according to the first data block, and left shifts the computation result according to the total length of the second data block and the third data block to generate a first output. The ciphertext computing circuit includes k first computing units, which are used for receiving the second data block in the data stream in parallel in each round of computation of the ciphertext computing circuit, and performing parallel computation on each received data block to generate a second output, where k is a positive integer greater than 1. The bubble processing circuit receives a first number of third data blocks after the last round of computation of the ciphertext computing circuit and performs computation to generate a third output. The controller is coupled to the additional verification data computing circuit, the ciphertext computing circuit and the bubble processing circuit. The first adder is used for performing computation according to the first output, the second output and the third output to generate a message authentication code.

[0008] In an embodiment of the present application, the first computing units also receive a second number of third data blocks in parallel in the last round of computation, and the values of the first number and the second number are determined by the controller based on the value of k, the number of third data blocks and the number of second data blocks received in the last round of computation.

[0009] In an embodiment of the present application, the first computing units perform computation according to the received second data block or third data block and the first power function of the hash sub-key; where the power of the first power function of the hash sub-key is determined by the controller according to the order of the second data block or third data block in the data sequence with the value of k.

[0010] In an embodiment of the present application, when the received second data block or the third data block is the last (k-1) data blocks in the data sequence, the controller determines the power of the first power function of the hash sub-key according to the order of the second data block or the third data block in the last (k-1) data blocks; and when the received second data block or the third data block is not the last (k-1) data blocks in the data sequence, the controller determines the power of the first power function of the hash sub-key according to the value of k.

[0011] In an embodiment of the present application, the first calculation unit comprises a third adder, a third multiplier, a third register, a fourth register and a third multiplexer. The third multiplier is coupled to the third adder. The third register is coupled to the third adder and the third multiplier. The fourth register is coupled to the third register. The third multiplexer is coupled to the third multiplier and the controller. The third adder calculates the received second data block or the third data block with the value of the third register and outputs the calculation result to the third multiplier; the third multiplexer outputs the first power function of the hash sub-key to the third multiplier under the control of the controller; the third multiplier calculates according to the calculation result of the third adder and the first power function of the hash sub-key, and stores the calculation result to the third register to update the value of the third register; and when the ciphertext calculation circuit receives and calculates all the second data blocks and the second number of the third data blocks, the controller controls the value of the third register as the second output.

[0012] In an embodiment of the present application, when the bubble processing circuit receives the first number of the third data blocks, the controller outputs the value in the third register of the corresponding first number of the first calculation units in the k first calculation units to the bubble processing circuit, while controlling the remaining first calculation units to output the value in the third register to the fourth register for storage, and when the bubble processing circuit generates the third output, the value of the fourth register is output as the second output, and the second output and the third output are output synchronously.

[0013] In an embodiment of the present application, the bubble processing circuit generates the third output according to the received first number of the third data blocks, the output of the first number of the first calculation units and at least the second power function of the hash sub-key; wherein the power of the second power function of the hash sub-key is determined by the controller according to the order of the third data block in the data sequence.

[0014] In an embodiment of the present application, the bubble processing circuit comprises a third calculation unit and a fourth calculation unit; the controller selectively enables the third calculation unit according to the first number of values, or enables the third calculation unit and the fourth calculation unit.

[0015] In an embodiment of the present application, the third calculation unit comprises a fourth adder, a fourth multiplier, a fifth register, a fourth multiplexer and a fifth multiplexer. The fourth adder is coupled to the ciphertext calculation circuit. The fourth multiplier is coupled to the fourth adder. The fifth register is coupled to the fourth multiplier. The fourth multiplexer is coupled to the fourth adder. The fifth multiplexer is coupled to the fourth multiplier. The fifth multiplexer outputs the second power function of the hash subkey to the fourth multiplier under the control of the controller. The fourth multiplier calculates the calculation result of the fourth adder and the second power function of the hash subkey and stores the calculation result to the fifth register.

[0016] In an embodiment of the present application, the fourth calculation unit comprises a fifth adder, a fifth multiplier and a sixth register. The fifth multiplier is coupled to the fifth adder. The sixth register is coupled to the fifth multiplier. The fifth multiplier receives the calculation result of the fifth adder and the second power function of the hash subkey for calculation and stores the calculation result to the sixth register.

[0017] In an embodiment of the present application, the additional verification data calculation circuit comprises a second calculation unit and a shift unit. The second calculation unit is configured to receive the first data block and calculate according to the first data block and the hash subkey to generate a first result. The shift unit is configured to determine a shift amount and transmit the shift amount to the second calculation unit, so that the second calculation unit shifts the first result to the left according to the shift amount to generate a first output. When all the second data blocks and the third data blocks are received by the circuit based on the Galois Hash verification, the controller controls the first multiplexer of the second calculation unit to output the shift amount to the first multiplier of the second calculation unit.

[0018] In an embodiment of the present application, the second calculation unit comprises a second adder, a first multiplier, a first register and a first multiplexer. The first multiplier is coupled to the second adder. The first register is coupled to the second adder, the first multiplier and the first adder. The first multiplexer is coupled to the first multiplier, the shift unit and the controller.

[0019] In an embodiment of the present application, the shift unit comprises a second multiplier, a second register and a second multiplexer. The second register is coupled to the second multiplier and the first multiplexer. The second multiplexer is coupled to the second multiplier and the controller. The controller controls the power of the third power function of the hash subkey output by the second multiplexer according to the total length of the second data blocks and the third data blocks. The second multiplier calculates according to the third power function of the hash subkey and the value of the second register and stores the calculation result to the second register to update the value of the second register. When all the second data blocks and the third data blocks are received by the circuit based on the Galois Hash verification, the controller controls the first multiplexer to output the value of the second register as the shift amount to the second calculation unit.

[0020] In an embodiment of the present application, the GHASH verification circuit further comprises a sixth multiplexer, an input of the sixth multiplexer is coupled to the ciphertext computation circuit, an output of the sixth multiplexer is coupled to the bubble processing circuit, and the sixth multiplexer is configured to transmit the output of the first number of the first computation units to the bubble processing circuit under the control of the controller.

[0021] In an embodiment of the present application, the GHASH verification circuit further comprises a seventh multiplexer, an input of the seventh multiplexer is coupled to the ciphertext computation circuit and the bubble processing circuit, an output of the seventh multiplexer is coupled to the first adder, and the seventh multiplexer is configured to transmit the second output and the third output to the first adder under the control of the controller.

[0022] The circuit provided by the present application is provided with a bubble processing circuit capable of processing a third data block (for example, a data block corresponding to bubble data), which enables the ciphertext computation circuit to continuously receive and process subsequent data streams, thereby avoiding the problem of affecting the reception of subsequent data streams due to the processing of the third data block. In addition, the first data block and the second data block in the data stream are received and processed by the additional verification data computation circuit and the ciphertext computation circuit, respectively. On the one hand, this parallel computing architecture improves the data throughput and reduces the delay, and on the other hand, this computing architecture does not require the input order of the first data block and the second data block, and the first data block and the second data block can be input in sequence or in parallel, which enables the present application to simultaneously support different requirements of different GHASH standards for data order. In addition, the number of first computation units in the ciphertext computation circuit can be flexibly configured, which also enables the scheme of the present application to meet the requirements of data streams with different bit widths. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1A A schematic diagram of a data stream of an Ethernet protocol is shown.

[0024] Figure 1B An exemplary flit format for an interconnect protocol is shown.

[0025] Figure 2 A schematic diagram of a circuit for GHASH-based verification is shown according to an embodiment of the present application.

[0026] Figure 3A A circuit diagram of an additional verification data computation circuit is shown according to an embodiment of the present application.

[0027] Figure 3B A flowchart of generating an output by an additional verification data computation circuit is shown according to an embodiment of the present application.

[0028] Figure 4AA circuit diagram of a unit of the ciphertext calculation circuit is shown according to an embodiment of the present application.

[0029] Figure 4B A flowchart of generating an output by the ciphertext calculation circuit is shown according to an embodiment of the present application.

[0030] Figure 5 A circuit diagram of the bubble processing circuit is shown according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] Reference will now be made in detail embodiments of the application, examples of which are illustrated in the accompanying drawings. Wherever possible, the same reference numbers are used in the drawings and the description to refer to the same or like parts.

[0032] In a communication protocol using flit as the basic unit of transmission, such as PCIe-Gen6, CXL, etc., a data stream usually includes multiple consecutive flits of transmission, and there is no interval between two adjacent flits, and each flit can include a flit header and ciphertext or plaintext (Cipher / Plain text). Figure 1B An exemplary flit format is shown, F1 includes a header a1 and plaintext d1, F2 can include a header a2 and plaintext d2, and F3 can include a header a3 and plaintext d3.

[0033] The data sequence that needs to be subjected to GHASH operation includes three parts, namely AAD, ciphertext or plaintext (for the convenience of description, "ciphertext or plaintext" will be collectively referred to as data payload hereinafter) and bubble data. Taking the transmission protocol of CXL IDE as an example, the AAD is composed of the headers in each flit, and the data payload part includes the data payload in each flit, so it can be seen that the AAD and the data payload in the transmission protocol of CXL IDE are not input in sequence, but are input in parallel. The bubble data is data inserted after the AAD and the data payload, which can only include length data for indicating the length of the AAD and the length of the data payload, and it can be understood that the length data cannot be calculated until the GHASH operation circuit receives the multiple flits included in the data stream. In the case of enabling CRC data, the bubble data includes CRC data and length data.

[0034] For example, if the data stream includes flit1 and flit2, where flit1 includes header A1 and data blocks X1, X2 representing plaintext or ciphertext, and flit2 includes header A2 and data blocks X3, X4 representing plaintext or ciphertext, the operation sequence of GHASH can be represented as:

[0035] X = A1||A2||X1||X2||X3||X4||X(L), wherein "||" is a concatenation symbol, and X(L) is a data block formed by concatenating len(A) and len(C), i.e., len(A)||len(C), wherein len(A) indicates the length of the AAD data block, i.e., the total length of the data blocks A1, A2, and len(C) is the length of the data payload, i.e., the total length of the data blocks X1, X2, X3, and X4; in the case of enabling CRC data, the data sequence for performing the GHASH operation can be represented as:

[0036] X = A1||A2||X1||X2||X3||X4||X(CRC)||X(L), wherein X(CRC) indicates the CRC data.

[0037] The GHASH operation circuit and the GHASH operation process of the present application will be described in detail below with reference to the accompanying drawings.

[0038] Figure 2 is a schematic diagram of a GHASH-based verification circuit 10 according to an embodiment of the present application.

[0039] The circuit 10 can include a controller 20, an additional verification data calculation circuit 100, a ciphertext calculation circuit 200, a bubble processing circuit 300, a multiplexer 220, a multiplexer 400, and an adder 500. It should be noted that the adder and the multiplier mentioned in the embodiments of the present application can be a Galois adder and a Galois multiplier, respectively.

[0040] The controller 20 can be coupled to the additional authentication data calculation circuit 100, the ciphertext calculation circuit 200, the bubble processing circuit 300, the multiplexer 220, and the multiplexer 400. The additional authentication data calculation circuit 100, the ciphertext calculation circuit 200, the bubble processing circuit 300, the multiplexer 220, or the multiplexer 400 can receive corresponding data and perform calculation under the control of the controller 20. The controller 20 is, for example, a central processing unit (CPU), or other programmable general purpose or special purpose micro control unit (MCU), microprocessor, digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processing unit (GPU), image signal processor (ISP), image processing unit (IPU), arithmetic logic unit (ALU), complex programmable logic device (CPLD), field programmable gate array (FPGA), or other similar elements or combination of the above elements.

[0041] The output of the additional authentication data calculation circuit 100 can be coupled to the adder 500. The additional authentication data calculation circuit 100 can be configured to receive one or more data blocks I1 corresponding to AAD (header in flit) in the data stream under the control of the controller 20, perform calculation based on the data blocks I1, and shift the calculation result based on the total length of data payload and bubble data to generate the output O1. Specifically, the additional authentication data calculation circuit 100 can include a shift unit 110 and a calculation unit 120. The calculation unit 120 is configured to perform GHASH operation on the data blocks I1. The shift unit 110 is connected to the calculation unit 120 to shift the calculation result of the calculation unit 120 to the left under the control of the controller 20. The number of bits to be shifted to the left (i.e., the shift amount) depends on the total bit width of data payload and bubble data (i.e., the total data length).

[0042] The output of the ciphertext computation circuit 200 can be coupled to the input of the multiplexer 220 and the input of the multiplexer 400. The ciphertext computation circuit 200 can be configured to receive (e.g., under the control of the controller 20) a plurality of data blocks I2, which can include data blocks corresponding to data flits (ciphertext or plaintext) and / or bubble data. The ciphertext computation circuit 200 can be configured to generate an output O2 based on the plurality of data blocks I2. In particular, the ciphertext computation circuit 200 can include a plurality of computation units 210 configured to receive the data blocks I2 and perform GHASH operations on the data blocks I2. The output of each computation unit 210 can be coupled to the input of the multiplexer 220 and the input of the multiplexer 400, respectively, and the output of the multiplexer 220 can be coupled to the bubble processing circuit 300.

[0043] The output of the bubble processing circuit 300 can be coupled to the input of the multiplexer 400. The bubble processing circuit 300 can be configured to receive the computation results of the ciphertext computation circuit 200 output by the multiplexer 220 as data blocks I3, and generate an output O3 based on the data blocks I3 and bubble data. In particular, the bubble processing circuit 300 can include a computation unit 310 and a computation unit 320 configured to receive the bubble data and the data blocks I3 from the ciphertext computation circuit 200, and generate the output O3 based on the data blocks I3 and the bubble data.

[0044] The input of the multiplexer 400 can be coupled to the output of the ciphertext computation circuit 200 and the output of the bubble processing circuit 300, respectively, and the output of the multiplexer 400 can be coupled to the adder 500. The multiplexer 400 can be coupled to the controller 20, and under the control of the controller 20, the multiplexer 400 can be configured to select a corresponding output from the output of the ciphertext computation circuit 200 and the output of the bubble processing circuit 300 to be transmitted to the adder 500. The adder 500 can be configured to perform Galois addition on the output of the additional verification data computation circuit 100, the output of the multiplexer 400, and the 0th packet sequence of the AES-GCM (i.e., ciph-j0-value, which can also be referred to as J0) to generate and output a message authentication code (MAC) MAC.

[0045] Referring to Figure 3A and 3B , Figure 3A is a circuit diagram of the additional verification data computation circuit 100 according to an embodiment of the present application, and Figure 3B is a flowchart of the additional verification data computation circuit 100 generating an output O1 according to an embodiment of the present application.

[0046] The computation unit 120 of the additional verification data computation circuit 100 includes an adder 21, a multiplier 22, a register 23, and a multiplexer 24. As shown in FIG. 1A, the adder 21 can be configured to receive a first input I1 and a second input I2, and generate an output O1 based on the first input I1 and the second input I2. In particular, the first input I1 can be the output of the additional verification data computation circuit 100, and the second input I2 can be the output of the GHASH computation circuit 200. Figure 3AAs shown, one input of the adder 21 can be coupled to receive (e.g., under the control of the controller 20) a data block I1, and the other input can be coupled to the output of the register 23. The input of the multiplier 22 can be coupled to the output of the adder 21 and the output of the multiplexer 24. The output of the multiplier 22 can be coupled to the input of the register 23. The output of the register 23 can be coupled to the adder 500 to deliver the output O1 to the adder 500. The initial value stored in the register 23 can be 0. One input of the multiplexer 24 can be coupled to the output of the shift unit 110, and the other input can receive a hash subkey H used in the GHASH operation. The multiplexer 24 can be coupled to the controller 20 and controlled by the controller 20 to output the hash subkey H or the output of the shift unit 110 to the multiplier 22.

[0047] The shift unit 110 of the additional verification data calculation circuit 100 includes a multiplier 25, a register 26, and a multiplexer 27. The input of the multiplier 25 can be coupled to the output of the multiplexer 27 and the output of the register 26. The output of the multiplier 25 can be coupled to the input of the register 26. The initial value stored in the register 26 can be 1. The multiplexer 27 can be coupled to the controller 20, and the inputs of the multiplexer 27 can be used to receive different power functions of H, which are H, 2 power of H, 3 power of H, …, (k+2) power of H, respectively, where k is the number of the calculation units 210 in the ciphertext calculation circuit 200, and the multiplexer 27 is controlled by the controller 20 to select a corresponding power function of H to output to the multiplier 25.

[0048] The process of the additional verification data calculation circuit 100 performing the GHASH operation on the AAD will be described below. Figure 3A 3B The process of the additional verification data calculation circuit 100 performing the GHASH operation on the AAD will be described below.

[0049] In step S201, the adder 21 can receive a data block I1 in a data stream and the value in the register 23 for calculation, where the data block I1 can be a data block corresponding to the AAD.

[0050] In step S202, the multiplier 22 can receive the output value of the adder 21 from the adder 21, and the multiplexer 24 can deliver the hash subkey H to the multiplier 22 under the control of the controller 20. The multiplier 22 can calculate the product of the output value of the adder 21 and H to update the value in the register 23.

[0051] It should be noted that each flit includes at most one data block corresponding to the AAD, and thus the additional verification data calculation circuit 100 receives and calculates at most one data block corresponding to the AAD in each round.

[0052] ​For example, if the data block corresponding to the AAD in the current received flit is A1, the calculation process of the data block A1 is as follows:

[0053] The adder 21 receives the data block A1 and obtains the value of the register 23, which is the initial value 0. The adder 21 adds the data block A1 and the initial value 0 of the register 23 to obtain A1. The multiplier 22 multiplies the calculation result A1 of the adder 21 by H to obtain A1·H. At this time, the value of the register 23 is updated to A1·H.

[0054] If there are multiple data blocks corresponding to the AAD in the current data stream, the above steps S201-S202 can be repeated to receive and calculate each data block corresponding to the AAD. Assuming that the CXL data stream currently received includes 3 data blocks corresponding to the AAD, in the order of reception, the 3 data blocks are A1, A2, and A3 in turn, the calculation unit 120 needs to perform 3 rounds of calculation.

[0055] The first round of calculation is the data block A1. As known from the above, after the calculation of the data block A1 is completed, the value of the register 23 is updated to A1·H.

[0056] The second round, the adder 21 receives the data block A2 and obtains the value of the register 23, which is A1·H. The adder 21 adds the data block A2 and the value A1·H of the register 23 to obtain A1·H+A2. The multiplier 22 multiplies the calculation result of the adder 21 by H to obtain (A1·H+A2)·H. At this time, the value of the register 23 is updated to (A1·H+A2)·H.

[0057] The third round, the adder 21 receives the data block A3 and obtains the value of the register 23, which is (A1·H+A2)·H. The adder 21 adds the data block A3 and the value (A1·H+A2)·H of the register 23 to obtain (A1·H+A2)·H+A3. The multiplier 22 multiplies the calculation result of the adder 21 by H to obtain ((A1·H+A2)·H+A3)·H. At this time, the value of the register 23 is updated to ((A1·H+A2)·H+A3)·H.

[0058] In step S203, the controller 20 can control the multiplexer 27 to transmit H Li to the multiplier 25, and the multiplier 25 multiplies H Li by the value of the register 26 to update the value of the register 26, where i is the calculation round, Li is the number of data blocks of the data load and the bubble data received by the ciphertext calculation circuit 200 and the bubble processing circuit 300 in the i-th round of calculation, and i is an integer greater than or equal to 1.

[0059] Specifically, the GHASH algorithm requires the calculation to be performed in the order of the operation sequence (e.g., X = A1||A2||X1||X2||X3||X4||X(L)), that is, the AAD is calculated first, then the data payload is calculated, and finally the bubble data is calculated. In the transmission protocol of the CXL IDE, there is no time sequence between the AAD and the data payload when inputting. In the embodiment of the present application, the additional verification data calculation circuit 100 is used to separately calculate the AAD, and then the calculation result of the AAD is left shifted as a whole, and the shift amount is the total length value of the data payload and the bubble data, so as to meet the requirements of the GHASH algorithm.

[0060] The data blocks corresponding to the data payload are received and processed by the ciphertext calculation circuit 200, and the number of data blocks that can be received by the ciphertext calculation circuit 200 per round is not more than the number k of calculation units 210 in the ciphertext calculation circuit 200. When the number of data blocks corresponding to the data payload in the data stream exceeds k, the ciphertext calculation circuit 200 needs to receive and process in multiple rounds. Whether the bubble data is processed by the ciphertext calculation circuit 200 or the bubble processing circuit 300 or processed by both depends on the relationship between the number of data blocks of the data payload received by the ciphertext calculation circuit 200 in the last round, the number of data blocks of the bubble data, and the number k of calculation units 210. For example, if the number of data blocks of the data payload received by the ciphertext calculation circuit 200 in the last round is r (r is less than or equal to k), the number of data blocks included in the bubble data is t (t is 1 or 2), and (r+t) is less than or equal to the number k of calculation units 210, at this time the ciphertext calculation circuit 200 can calculate the data payload and the bubble data in the last round together, without enabling the bubble processing circuit 300; when (r+t) is greater than the number k of calculation units 210, the ciphertext calculation circuit 200 cannot calculate all the bubble data in the last round, and needs to increase a new calculation round to calculate the remaining bubble data. In this case, the remaining bubble data can be transmitted to the bubble processing circuit 300 for processing, so that the ciphertext calculation circuit 200 does not need to increase a new calculation round and can directly process the next operation sequence. In other words, if the sum of the number of data blocks of the data payload and the number of data blocks included in the bubble data received by the circuit 10 in the last round (for example, m, m = r+t) is greater than the number k of calculation units 210, the controller 20 can input the last (m-k) data blocks in the bubble data to the bubble processing circuit 300 for processing, wherein the (m-k) data blocks can include all the bubble data or part of the bubble data.

[0061] For example, if the sequence of the data load and the bubble data is X1||X2||X3||X4||X5||X6||X7||X(L), and the number of the calculation units 210 in the ciphertext calculation circuit 200 is 4. In the first round, the ciphertext calculation circuit 200 can receive four data blocks, i.e., X1, X2, X3, and X4, and no data block is transmitted to the bubble processing circuit 300, so the number of the data blocks L1=4, and the controller 20 can control the multiplexer 27 to transmit H 4 to the multiplier 25, and the multiplier 25 multiplies H 4 by the initial value 1 of the register 26 to update the value in the register 26 as H 4 . Then, in the second round, the ciphertext calculation circuit 200 can receive the data blocks X5, X6, and X7, and since the sum of the number of the data blocks X5, X6, X7, and X(L) is equal to the number of the calculation units 210, the ciphertext calculation circuit 200 can calculate the data blocks X5, X6, X7, and X(L) in the second round, and the bubble processing circuit 300 still does not receive any data, so the number of the data blocks L2=4 in the second round, and the controller 20 can control the multiplexer 27 to transmit H 4 to the multiplier 25. The multiplier 25 can multiply H 4 by the value H 4 in the register 26 to update the value in the register 26 as H 8 , where the number 8 in H 8 is the sum of the number of the data blocks included in the data load and the bubble data.

[0062] In another example, if the sequence of the data load and the bubble data is X1||X2||X3||X4||X5||X6||X7||X(CRC)||X(L), and the number of the calculation units 210 in the ciphertext calculation circuit 200 is 4. In the first round, the ciphertext calculation circuit 200 can receive four data blocks, i.e., X1, X2, X3, and X4, and no data is input into the bubble processing circuit 300, so the number of the data blocks L1=4, and the controller 20 can control the multiplexer 27 to transmit H 4 to the multiplier 25, and the multiplier 25 multiplies H 4 by the initial value 1 of the register 26 to update the value in the register 26 as H 4 . In the second round, the sum of the number of the data blocks X5, X6, X7 of the data load and the data blocks X(CRC) and X(L) is greater than the number of the calculation units 210, so the controller 20 can control the ciphertext calculation circuit 200 to calculate four data blocks (the data blocks X5, X6, X7, and X(CRC)), and the remaining X(L) can be calculated by the bubble processing circuit 300, and the number of the data blocks L2=5, and the controller 20 can control the multiplexer 27 to transmit H5 to the multiplier 25. The multiplier 25 can multiply the value H 5 of the register 26 by the value H 4 to update the value in the register 26 to H 9 , where the number 9 in H 9 is the sum of the total number of data blocks included in the data payload and the bubble data.

[0063] After the circuit 10 receives all of the data payload and the bubble data, the process can proceed to step S204.

[0064] In step S204, the controller 20 can control the multiplexer 24 to transfer the value in the register 26 to the multiplier 22. The multiplier 22 can multiply the output of the adder 21 by the value in the register 26 to update the value in the register 23.

[0065] For example, if the operation sequence of GHASH is X = A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(L)], it is known from the aforementioned steps S201 and S202 that, after receiving and calculating the data blocks A1, A2, and A3, the value in the register 23 is ((A1•H + A2)•H + A3)•H. It is known from step S203 that, after receiving the data payload and the bubble data, the value in the register 26 is H 8 . The value in the register 23 is multiplied by the value in the register 26 to obtain ((A1•H + A2)•H + A3)•H 9 , and the value in the register 23 is updated to ((A1•H + A2)•H + A3)•H 9 . It can be understood that multiplying the value in the register 23 by the value in the register 26 is equivalent to shifting the result of the calculation of the AAD (the value in the register 23) to the left by a length equal to the total length value of the data payload and the bubble data.

[0066] In step S205, the controller 20 can output the value in the register 23 as the output O1 and transfer the output O1 to the adder 500.

[0067] Continuing the example, the output O1 is ((A1•H + A2)•H + A3)•H 9 .

[0068] Referring to Figure 2 , 4A , and 4B, Figure 4A is a circuit diagram of a calculation unit 210 of the ciphertext calculation circuit 200 according to an embodiment of the present application, and Figure 4Bis a flowchart of the ciphertext calculation circuit 200 generating an output O2 according to an embodiment of the present application. The ciphertext calculation circuit 200 can include k calculation units 210, where k is a positive integer greater than 1, and in some embodiments, k can be preferably 2, 4, 8, 16, …. The output of each calculation unit 210 can be coupled to an input of a multiplexer 220, 400. The calculation unit 210 can include an adder 31, a multiplier 32, a register 33, a register 34, and a multiplexer 35. One input of the adder 31 can receive a data block I21 under the control of the controller 20, and the other input can be coupled to the output of the register 33. The input of the multiplier 32 can be coupled to the output of the adder 31 and the output of the multiplexer 35. The output of the multiplier 32 can be coupled to the input of the register 33. The output of the register 33 as the first output of the calculation unit 210 can be coupled to the input of the adder 31, the input of the register 34, and the input of the multiplexer 220, 400. The output of the register 34 as the second output of the calculation 210 can be coupled to the input of the multiplexer 400. The initial values of the register 33 and the register 34 can be 0. The multiplexer 35 can be coupled to the controller 20 and controlled by the controller 20 to output the power function of H of different powers (i.e., H 2 , …, H k , where k is the number of calculation units 210 in the ciphertext calculation circuit 200) to the multiplier 32.

[0069] Specifically, in step S301, the ciphertext calculation circuit 200 can receive parallel data blocks I2, where the parallel data blocks I2 can include one or more data blocks corresponding to the data payload, and can also include all or a portion of the data blocks corresponding to the bubble data, and the number of data blocks included in the parallel data blocks I2 is less than or equal to the number k of the plurality of calculation units 210. Each data block in the parallel data blocks I2 (e.g., data blocks I21 in Figure 4A ) can be received by each calculation unit 210, respectively.

[0070] For example, if the sequence of the data payload and the bubble data is: X1||X2||X3||X4||X5||X6||X7||X(L), and the number k of the calculation units 210 is 4, each calculation unit 210 in the ciphertext calculation circuit 200 can receive data blocks X1, X2, X3, X4, respectively, in the first round. Each calculation unit 210 of the ciphertext calculation circuit 200 can receive data blocks X5, X6, X7, X(L), respectively, in the second round.

[0071] In step S302, the adder 31 in the calculation unit 210 adds the received data block to the value in the register 33 and outputs the calculation result to the multiplier 32.

[0072] Taking one of the calculation units 210 as an example, if in the first round, the data block received by the adder 31 is data block X1, the initial value of the register 33 is 0, and thus the calculation result of the adder 31 is X1. The calculation processes of other calculation units are similar to this and will not be described herein again.

[0073] In step S303, under the control of the controller 20, the multiplexer 35 transmits the power function of the corresponding hash sub-key H to the multiplier 32, wherein the selection of the multiplexer 35 (i.e., the selection of the power function of the hash sub-key H) is determined according to the position of the data block received by the calculation unit 210 in the entire sequence (or the order in which the circuit 10 receives the data block) and the number k of the calculation unit 210. The multiplier 32 can multiply the output of the adder 31 with the power function of H output by the multiplexer 35 to update the value in the register 33.

[0074] Specifically, if the controller 20 determines that the data block received by the adder 31 is one of the last (k-1) data blocks in the operation sequence, i.e., the data block is one of the last (k-1) data blocks received by the circuit 10, the controller 20 determines the power function of H output by the multiplexer 35 according to the order of the data block in the last (k-1) data blocks. Taking ki to represent the order of the data block in the last (k-1) data blocks, the multiplexer 35 outputs the power function of H as H k-ki , where ki = 1, 2, …, (k-1). That is, if the data block is ranked first in the last (k-1) data blocks, i.e., ki = 1, the multiplexer 35 outputs the power function of H as H k-1 , if the data block is ranked second in the last (k-1) data blocks, i.e., ki = 2, the multiplexer 35 outputs the power function of H as H k-2 , and so on, if the data block is ranked last in the last (k-1) data blocks, i.e., ki = (k-1), the multiplexer 35 outputs the power function of H as H.

[0075] If the controller 20 determines that the data block received by the adder 31 is not one of the last (k-1) data blocks in the operation sequence, the controller 20 determines the power function of H output by the multiplexer 35 as H k .

[0076] For example, if the operation sequence of GHASH is X = A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(L), and the number k of the calculation unit 210 is 4, it can be seen that the last (k-1) data blocks are X6, X7, and X(L), and for these three data blocks, the power functions of H output by the multiplexer 35 are H 3 , H 2H, and for data blocks X1, X2, X3, X4, X5, the power function of H output by multiplexer 35 is uniformly H 4 .

[0077] It can be understood that circuit 10 first receives data blocks in the data stream (e.g., data blocks of AAD and data blocks in data payload), and then receives data block X(L) of bubble data, i.e., data block X(L) is the last data block received by circuit 10, and thus the power function of H corresponding to data block X(L) is H. In the case of enabling CRC data, data block X(CRC) is the second last data block received by circuit 10, and thus the power function of H corresponding to data block X(L) is H 2 That is, for data blocks of bubble data, only the position of the data block in the entire sequence (or the order in which circuit 10 receives the data block) is needed.

[0078] In step S304, after receiving all data payload, controller 20 can determine whether to calculate at least part of bubble data by bubble processing circuit 300.

[0079] As described above, controller 20 can determine according to the relationship between the number of data blocks of the last received data payload and the number of data blocks of bubble data and the number k of calculation units 210 of ciphertext calculation circuit 200. If the determination result of controller 20 is that bubble processing circuit 300 is needed to calculate at least part of bubble data (for example, the sum of the number of data blocks of data payload received in the last round and the number of data blocks of bubble data is greater than k), step S305 can be entered, and if the determination result of controller 20 is that bubble processing circuit 300 is not needed to calculate bubble data (for example, the sum of the number of data blocks of data payload received in the last round and the number of data blocks of bubble data is less than or equal to k), step S307 can be entered.

[0080] In step S305, the controller 20 controls the multiplexer 220 to output the values in the registers 33 of the corresponding s number of calculation units 210 among the k number of calculation units of the ciphertext calculation unit 200 (for example, the data blocks I3) to the bubble processing circuit 300, and controls the remaining (k-s) number of calculation units 210 to output the values in the registers 33 to the registers 34 to wait for the calculation results of the bubble processing circuit 300. After the bubble processing circuit 300 generates the calculation results, the values in the registers 34 can be transmitted as the output O21 together with the calculation results of the bubble processing circuit 300 to the multiplexer 400 and transmitted by the multiplexer 400 to the adder 500. The value of s is equal to the number of data blocks of the bubble data transmitted to the bubble processing circuit 300. Since the bubble data can include the length data, or can include the length data and the CRC check data, the number of data blocks of the bubble data transmitted to the bubble processing circuit 300 is at most 2, that is, s can be equal to 1 or 2.

[0081] In step S306, after the bubble processing circuit 300 finishes the calculation, under the control of the controller 20, the multiplexer 400 outputs the values in the registers 34 of the (k-s) number of calculation units 210 (that is, the output O2 of the ciphertext calculation circuit 200, wherein the output O2 includes the output O21 of the registers 33 or the registers 34) and the calculation results of the bubble processing circuit 300 (that is, the output O3 of the bubble processing circuit 300) to the adder 500.

[0082] In step S307, the controller 20 controls the multiplexer 400 to output the values in the registers 33 of the k number of calculation units 210 to the adder 500.

[0083] For example, if the operation sequence of GHASH is X = A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(L), the number k of the calculation units 210 in the ciphertext calculation circuit 200 is 4, and the 4 calculation units are 210-1, 210-2, 210-3, 210-4, respectively, then the calculation of the ciphertext calculation circuit 200 is as follows.

[0084] In the first round of calculation, the calculation units 210-1, 210-2, 210-3, 210-4 receive the data blocks X1, X2, X3, X4, respectively, and perform parallel calculation. Taking the calculation unit 210-1 receiving the data block X1 as an example, the adder 31 adds X1 and the initial value 0 in the register 33 to obtain X1; the multiplier 32 multiplies the calculation result of the adder 31 with H 4 to obtain X1·H 4 At this time, the value in the register 33 is updated to X1·H 4Similarly, the values in the registers 33 in the other three computing units 210-2, 210-3, 210-4 are updated to X2·H 4 , X3·H 4 , X4·H 4 .

[0085] In the second round of computation, the computing units 210-1, 210-2, 210-3, 210-4 receive data blocks X5, X6, X7, X(L) respectively and perform parallel computation. Take the computing unit 210-1 receiving data block X1 as an example. The adder 31 in the computing unit 210-1 adds X5 and the value X1·H 4 in the register 33 to obtain X5+X1·H 4 . The multiplier 32 multiplies the result of the adder 31 with H 4 to obtain (X1·H 4 +X5)·H 4 . At this time, the value in the register 33 is updated to (X1·H 4 +X5)·H 4 . The values in the registers 33 in the other three computing units 210-2, 210-3, 210-4 are updated to (X2·H 4 +X6)·H 3 , (X3·H 4 +X7)·H 2 , (X4·H 4 +X(L))·H respectively.

[0086] At this time, the controller 20 can control the multiplexer 400 to output the values in the registers 33 in the four computing units to the adder 500.

[0087] As the input sequence X=A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(CRC)||X(L), in the first round, the computing units 210-1, 210-2, 210-3, 210-4 receive data blocks X1, X2, X3, X4 respectively. At the end of the first round, the values in the registers 33 in the computing units 210-1, 210-2, 210-3, 210-4 are updated to X1·H 4 , X2·H 4 , X3·H 4 , X4·H 4 .

[0088] In the second round, the computation units 210-1, 210-2, 210-3, 210-4 receive the data blocks X5, X6, X7, X(CRC) respectively. At the end of the second round, the values in the registers 33 in the computation units 210-1, 210-2, 210-3, 210-4 are updated to (X1•H 4 +X5)•H 4 , (X2•H 4 +X6)•H 4 , (X3•H 4 +X7)•H 3 , (X4•H 4 +X(CRC))•H 2 .

[0089] After the second round, there is only one bubble data left, i.e. the data block X(L). In order to empty the ciphertext computation circuit 200 to welcome the next input sequence, the controller 20 can control the bubble processing circuit 300 to receive the data block X(L), and at the same time control the multiplexer 220 to output the value in the register 33 of the computation unit 210-1 (i.e. (X1•H 4 +X5)•H 4 ) to the bubble processing circuit 300. In addition, in order to synchronize the outputs of the ciphertext computation circuit 200 and the bubble processing circuit 300, the controller 20 can control the other computation units (computation units 210-2, 210-3, 210-4) to output the values in their registers 33 to the corresponding registers 34 respectively, to wait for the output of the bubble processing circuit 300.

[0090] Figure 5 A circuit diagram of the bubble processing circuit 300 according to an embodiment of the present application is shown. The bubble processing circuit 300 can include two computation units 310, 320. In the computation unit 310, one input of the adder 41 is used to receive a data block I31 (e.g. the output value of one computation unit 210) from the ciphertext computation circuit 200, and the other input is coupled to the multiplexer 44, which can output the data block X(CRC) or X(L) to the adder 41 under the control of the controller 20; one input of the multiplier 42 is coupled to the output of the adder 41, and the other input is coupled to the multiplexer 45, which can output H or H 2to the multiplexer 44. The output of the register 43 is coupled to the input of the multiplexer 44. In the computation unit 310, one input of the adder 41 is used to receive the data block I31 (e.g., the output value of another computation unit 210) from the ciphertext computation circuit 200, and another input of the adder 41 is used to receive the data block X(CRC) if the multiplexer 44 outputs the data block X(CRC) to the adder 41. One input of the multiplier 42 is coupled to the output of the adder 41, and another input of the multiplier 42 is used to receive H. The output of the multiplier 42 is coupled to the input of the register 43, and the output of the register 43 is coupled to the input of the multiplexer 44. In the computation unit 320, one input of the adder 46 is used to receive the data block I31 (e.g., the output value of another computation unit 210) from the ciphertext computation circuit 200, and another input of the adder 46 is used to receive the data block X(L) if the multiplexer 44 outputs the data block X(L) to the adder 41. One input of the multiplier 47 is coupled to the output of the adder 46, and another input of the multiplier 47 is used to receive H. The output of the multiplier 47 is coupled to the input of the register 48, and the output of the register 48 is coupled to the input of the multiplexer 44.

[0091] The controller 20 can determine to enable the computation unit 310, or the computation units 310 and 320, according to the number of data blocks of the bubble data to be processed by the bubble processing circuit 300. In addition, the controller 20 can determine the data block (X(CRC) or X(L)) outputted by the multiplexer 44 and the data (H or the power function H 2 ) outputted by the multiplexer 45 according to the number of data blocks of the bubble data to be processed by the bubble processing circuit 300.

[0092] If the controller 20 determines that only one data block of bubble data (i.e., the data block X(L)) is to be processed by the bubble processing circuit 300, the computation unit 310 can be enabled. Specifically, the controller 20 can control the multiplexer 44 to input the data block X(L) into the adder 41. The adder 41 can calculate the sum of the data block I31 and the data block X(L), and output the calculation result to the multiplier 42. The controller 20 can control the multiplexer 45 to transmit H (X(L) is the last data block in the input sequence) to the multiplier 42. The multiplier 42 can calculate the product of the output of the adder 41 (i.e., the sum of the data block I31 and the data block X(L)) and H, and store the product in the register 43, wherein the data block I31 is the value in the register 33 in the computation unit 210-1 transmitted by the multiplexer 220. The controller 20 can transmit the output O31 of the register 43 as the output O3 of the bubble processing circuit 300 to the multiplexer 400.

[0093] If the controller 20 determines that two data blocks of bubble data (i.e., X(CRC) and X(L)) are inputted to the bubble processing circuit 300, the computation units 310 and 320 can be enabled simultaneously, wherein the computation unit 310 is used to calculate X(CRC), and the computation unit 320 is used to calculate X(L). Specifically, the controller 20 can control the multiplexer 44 to input the data block X(CRC) into the adder 41. The adder 41 can calculate the sum of the data block I31 and the data block X(CRC). The controller 20 can control the multiplexer 45 to transmit H 2(X(CRC) is the second-to-last data block in the input sequence) to multiplier 42. Multiplier 42 can calculate the product of the output of adder 41 (i.e., the sum of data block I31 and data block X(CRC)) and H 2 , and store the product in register 43, where data block I31 is the value in register 33 in the computation unit 210-1 transferred by multiplexer 220. Meanwhile, controller 20 can control the input of data block X(L) into adder 46. Adder 46 can calculate the sum of data block I32 and data block X(L), where data block I32 is the value in register 33 in the computation unit 210-2 transferred by multiplexer 220. Controller 20 can transfer H to multiplier 47. Multiplier 47 can calculate the product of the output of adder 46 (i.e., the sum of data block I32 and data block X(L)) and H, and store the product in register 48. Controller 20 can transfer the output O31 of register 43 and the output O32 of register 48 as the output O3 of bubble processing circuit 300 to multiplexer 400, where output O3 = O31 + O32.

[0094] Adder 500 performs Galois addition operation on the output O1 of additional verification data calculation circuit 100, the output O2 of ciphertext calculation circuit, the output O3 of bubble processing circuit 300, and the 0th packet sequence (J0) of AES-GCM to generate and output message authentication code MAC.

[0095] For example, as the input sequence X = A1||A2||A3||X1||X2||X3||X4||X5||X6||X7||X(CRC)||X(L), the number of computation units 210 in ciphertext calculation circuit 200 is 4, and the four computation units are 210-1, 210-2, 210-3, and 210-4, respectively. As described above, after the second round of calculation, the values in registers 33 of computation units 210-1, 210-2, 210-3, and 210-4 are (X1·H 4 +X5)·H 4 , (X2·H 4 +X6)·H 4 , (X3·H 4 +X7)·H 3 , and (X4·H 4 +X(CRC))·H 2 , respectively. The value in register 33 of computation unit 210-1 (i.e., (X1·H 4 +X5)·H 4 ) is output to computation unit 310 in bubble processing circuit 300, and the values in registers 33 of the other computation units are output to corresponding registers 34, respectively.

[0096] The adder 41 in the calculation unit 310 adds (X1·H 4 +X5)·H 4 to X(L) output by the multiplexer 44 to obtain (X1·H 4 +X5)·H 4 +X(L), and the multiplier 42 multiplies the calculation result of the adder 41 with H output by the multiplexer 45 to obtain ((X1·H 4 +X5)·H 4 +X(L))·H, and stores it in the register 43.

[0097] The controller 20 can control the multiplexer 400 to output the value of the register 34 and the value in the register 43 to the adder 500.

[0098] In summary, the circuit of the present application is provided with a bubble processing circuit specially used for processing bubble data, which makes the circuit of the present application be able to process the continuously input data stream without interval. In addition, the present application processes the AAD and the data load separately, receives and processes the AAD by using the additional verification data calculation circuit, and receives and processes the data load by using the ciphertext calculation circuit, which makes the present application have no any requirement on the input order of the AAD and the data load, and the AAD and the data load can be input in the order or in parallel, that is, the present application can simultaneously support different requirements of different GHASH standards on data order. Therefore, the present application can not only be applied to the CXL protocol format, but also be applied to other data formats, such as Figure 1A Ethernet.

[0099] For the data stream of the Ethernet protocol, since the additional verification data comes from the packet header of the data packet, and the data load comes from the packet payload of the data packet, the additional verification data and the data load are input in the order of time, and therefore, when the circuit in the Figure 2 performs GHASH operation on the data stream of the Ethernet protocol, it only needs to use the ciphertext calculation circuit of the circuit in the Figure 2 to sequentially calculate the additional verification data and the data load according to the data input data, without enabling the additional verification data calculation circuit.

[0100] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A circuit based on Galois Hash Verification, the circuit being configured to perform computation on a data sequence comprising a first data block, a second data block and a third data block, the circuit comprising: an additional verification data computation circuit configured to receive the first data block in a data stream and perform computation based on the first data block, and to left shift the computation result based on a total length of the second data block and the third data block to generate a first output; a ciphertext computation circuit comprising k first computation units configured to receive the second data block in the data stream in parallel in each round of computation of the ciphertext computation circuit, and to perform parallel computation on the received data blocks to generate a second output, wherein k is a positive integer greater than 1; a bubble processing circuit configured to receive a first number of the third data blocks after the last round of computation of the ciphertext computation circuit and perform computation to generate a third output; a controller coupled to the additional verification data computation circuit, the ciphertext computation circuit and the bubble processing circuit; and a first adder configured to perform computation based on the first output, the second output and the third output to generate a message authentication code. In the last round of computation, the first computation units are further configured to receive a second number of the third data blocks in parallel, and the values of the first number and the second number are determined by the controller based on the value of k, the number of the third data blocks and the number of the second data blocks received in the last round of computation. The first computation units are configured to perform computation based on the received second data block or third data block and a first power function of a hash sub-key. The power of the first power function of the hash sub-key is determined by the controller based on the order of the received second data block or third data block in the data sequence and the value of k. 4.The circuit of claim 3, wherein: when the received second data block or third data block is the last (k-1) data blocks in the data sequence, the power of the first power function of the hash sub-key is determined by the controller based on the order of the second data block or third data block in the last (k-1) data blocks; and when the received second data block or third data block is not the last (k-1) data blocks in the data sequence, the power of the first power function of the hash sub-key is determined by the controller based on the value of k. The first computation units comprise: a third adder; a third multiplier coupled to the third adder; a third register coupled to the third adder and the third multiplier; a fourth register coupled to the third register; and a third multiplexer coupled to the third multiplier and the controller. The third adder is configured to perform computation on the received second data block or third data block and the value of the third register and output the computation result to the third multiplier.

2. The circuit of claim 1, wherein, The third multiplexer is configured to output the first power function of the hash sub-key to the third multiplier under the control of the controller.

3. The circuit of claim 2, wherein, ​ ​ ​ ​ ​ 5. The circuit of claim 3, wherein, ​ ​ ​ ​ ​ ​ ​ ​ The third multiplier calculates according to the calculation result of the third adder and the first power function of the hash sub-key, and stores the calculation result to the third register to update the value of the third register; when the ciphertext calculation circuit receives and calculates all the second data blocks and the second number of third data blocks, the controller controls to output the value of the third register as the second output.

6. The circuit of claim 5, wherein, When the bubble processing circuit receives the first number of third data blocks, the controller outputs the value in the third register of the corresponding first number of first calculation units in the k first calculation units to the bubble processing circuit, while controlling the remaining first calculation units to output the value in the third register to the fourth register for storage, and when the bubble processing circuit generates the third output, outputs the value of the fourth register as the second output, and synchronously outputs the second output and the third output.

7. The circuit of claim 1, wherein, The bubble processing circuit generates the third output according to the received first number of third data blocks, the output of the first number of first calculation units, and at least the second power function of the hash sub-key; The power of the second power function of the hash sub-key is determined by the controller according to the order of the third data block in the data sequence.

8. The circuit of claim 7, wherein, The bubble processing circuit includes a third calculation unit and a fourth calculation unit; The controller selectively enables the third calculation unit according to the first number of values, or enables the third calculation unit and the fourth calculation unit.

9. The circuit of claim 8, wherein, The third calculation unit includes: A fourth adder coupled to the ciphertext calculation circuit; A fourth multiplier coupled to the fourth adder; A fifth register coupled to the fourth multiplier; A fourth multiplexer coupled to the fourth adder; and A fifth multiplexer coupled to the fourth multiplier; The fifth multiplexer outputs the second power function of the hash sub-key to the fourth multiplier under the control of the controller; and The fourth multiplier calculates the calculation result of the fourth adder and the second power function of the hash sub-key, and stores the calculation result to the fifth register.

10. The circuit of claim 9, wherein, The fourth calculation unit includes: A fifth adder coupled to the ciphertext calculation circuit; A fifth multiplier coupled to the fifth adder; and A sixth register coupled to the fifth multiplier; The fifth multiplier receives the calculation result of the fifth adder and the second power function of the hash sub-key for calculation and stores the calculation result to the sixth register.

11. The circuit of claim 1, wherein, The additional verification data calculation circuit includes: A second calculation unit for receiving the first data block and calculating according to the first data block and the hash sub-key to generate a first result; A shift unit for determining a shift amount and transmitting the shift amount to the second calculation unit, so that the second calculation unit left shifts the first result according to the shift amount to generate the first output; and A third calculation unit for receiving the first output and calculating according to the first output and the hash sub-key to generate a second result. When all the second data blocks and the third data blocks are received by the circuit based on the Galois hash verification, the controller controls the shift unit to output the shift amount to the second calculation unit.

12. The circuit of claim 11, wherein, The second calculation unit comprises: a second adder; a first multiplier coupled to the second adder; a first register coupled to the second adder, the first multiplier and the first adder; and a first multiplexer coupled to the first multiplier, the shift unit and the controller.

13. The circuit of claim 12, wherein, The shift unit comprises: a second multiplier; a second register coupled to the second multiplier and the first multiplexer; and a second multiplexer coupled to the second multiplier and the controller; wherein the controller determines a power of a third power function of a hash sub-key output by the second multiplexer according to a total length of the second data blocks and the third data blocks, the second multiplier calculates according to the third power function of the hash sub-key and a value of the second register, and stores a calculation result to the second register to update the value of the second register; and When all the second data blocks and the third data blocks are received by the circuit based on the Galois hash verification, the controller controls the first multiplexer to output the value of the second register as the shift amount to the second calculation unit.

14. The circuit of claim 7, wherein, The circuit based on the Galois hash verification further comprises a sixth multiplexer, an input end of the sixth multiplexer is coupled to the ciphertext calculation circuit, an output end of the sixth multiplexer is coupled to the bubble processing circuit, and the sixth multiplexer is used to transmit the output of the first number of first calculation units to the bubble processing circuit under the control of the controller.

15. The circuit of claim 1, wherein, The circuit based on the Galois hash verification further comprises a seventh multiplexer, an input end of the seventh multiplexer is coupled to the ciphertext calculation circuit and the bubble processing circuit, and an output end of the seventh multiplexer is coupled to the first adder; The seventh multiplexer is used to transmit the second output and the third output to the first adder under the control of the controller.

Images