Architecture configured for providing compression function from hash function

Abstract

The present disclosure relates to an architecture configured for providing a compression function from a hash function, comprising:-a message input (MT) configured for receiving a message block (Mi) from a group of message blocks (M1,..., Mn); -a hash output (HT) configured for outputting a final state (FS) representative of the hash values of the groups of message blocks (M1,..., Mn); -a compression block (CB) for processing data blocks (Mi) from the groups of message blocks (M1,..., Mn) and gradually compressing them into hash values of fixed size; characterized in that the architecture is further configured to temporarily store the compression values between calls of the compression functions.

Description

Technical Field

[0001] The present invention relates to the field of encryption and secure communications. The present invention relates to an architecture configured for providing a compression function from a hash function and also to a method for providing a compression function from a hash function. Background Art

[0002] Hash functions are used for data integrity verification, data storage, password storage, and various cryptographic applications. A hash function is a mathematical function that takes an input (or "message") and returns a fixed-size string. The output (the "hash value") is unique to the input data, and even small changes in the input will produce significantly different hash values.

[0003] The advent of quantum computers changes the landscape for asymmetric cryptography. In fact, quantum computers can defeat today’s classical cryptographic algorithms, namely RSA and elliptic curve-based cryptography (ECC). This applies to all function constructions (including hash functions), namely key exchange, asymmetric encryption, and digital signatures.

[0004] Therefore, there is a strong push to develop quantum-resistant algorithms that can replace these algorithms. The general term for quantum-resistant algorithms is "post-quantum cryptography" (PQC). Digital signatures can be specified based on hash functions. These are called HPQC (Hash-based Post-Quantum Cryptography).

[0005] However, one of the reasons for the inefficiency of HPQC is that hash primitives (such as SHA2, see [SHA2]) operate in a strict mode of operation, hashing extremely large amounts of data in a stereotyped manner.

[0006] That is, the classic operating modes include:

[0007] - Initialization: prepares the hash function to accept the data to be hashed, i.e. provided;

[0008] - Update: continuously submitting blocks of data to be hashed; this operation can be stopped in the middle and resumed later - only the intermediate state (called "context") needs to be known to perform the computation;

[0009] -Finish: Ends the calculation and publishes the results.

[0010] This way of operating the hash function incurs overhead, i.e., it forces the use of a prelude (or postlude) function to prepare the hash function (initialize, or complete), which is detrimental to the simplicity of the hash calculation. The corresponding hardware implementation is disclosed in the paper [LMS_23]. However, when the message contains multiple blocks of data to be hashed, this way of operating the data is only effective in the long run, because the prelude / postlude will be amortized.

[0011] In addition, from a safety perspective, the device must be able to restart when performing a task. For example, the chip components of a car driving on the road must be able to reestablish its functionality in a very short time in the event of any danger. It is difficult for a simple implementation of HPQC [AFRICACRYPT20] to achieve the "1 millisecond" constraint (see the last column of Table 4, where all numbers are > 1 million clock cycles, i.e. > 1 millisecond, assuming a clock frequency of 1 GHz is already a favorable case) because the evaluation time of the hash function is very long. Summary of the invention

[0012] Therefore, it is necessary to provide an architecture that can overcome the above problems.

[0013] The object of the present invention is to provide an architecture and a method according to the appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Other features and advantages of the present invention will become apparent from the following description in conjunction with the accompanying drawings:

[0015] Figure 1 shows the chaining mode when handling messages longer than one block.

[0016] Figure 2a A first embodiment of an architecture according to the invention is shown.

[0017] Figure 2b A second embodiment of an architecture according to the invention is shown.

[0018] Figure 3 An example of a Boolean mixing function unit is shown.

[0019] Figure 4 An implementation example of the architecture of the present invention is shown. DETAILED DESCRIPTION

[0020] Figure 1 A chaining-based mode of operation is shown, which is implemented when the message is too long to be input to the hash function.

[0021] The compression function usually starts with an initial state IS, which is called the "link value". This initial state IS is set to a predefined constant. Each message block (M1, M2, ..., Mn) is processed by a compression block CB, and the compression function merges this block into the current state.

[0022] Once all message blocks have been processed, the final state FS represents the hash value. This state is formatted as a fixed-length sequence to produce a hash output.

[0023] A state is maintained (also called hash internal context, or simply "context" when there is no ambiguity). It allows the computation to be interrupted in case of data starvation (hashing will be slower due to lack of data to hash) or when another hash function should be executed with higher priority (the context CO is then stored so that it can be resumed after preemption).

[0024] Finally, the plaintext is padded. The padding value (which does not depend on the manipulated data) can be injected via the input of the message blocks (M1, M2, ..., Mn). In particular, it allows to insert information about the message size to avoid prefix attacks. Padding allows to accommodate messages of (almost) arbitrary size (i.e.: L < 264). However, padding causes performance loss for small messages. For example, in SHA2, when the message size L is less than the block size (512) and the length L ≥ 512-64 = 448, then instead of hashing only one block, at least two blocks have to be hashed, which is definitely suboptimal (a factor 2 loss in performance).

[0025] Figure 2a The architecture of the present invention is shown, which is configured to provide a compression function from a hash function. The architecture comprises: a message input MT, which receives a message block Mi from a group of message blocks (M1, ..., Mn); a hash output HT, which outputs a final state FS, which represents the hash value of the group of message blocks (M1, ..., Mn). A compression block CB processes each data block Mi from the group of message blocks (M1, ..., Mn) and gradually compresses it into a hash value of a fixed size. The architecture temporarily stores the compressed values ​​between calls of the compression function. The call of the hash function is an inherent feature of the HPQC algorithm (which implements a hash tree); therefore, the present invention is very suitable for the HPQC algorithm.

[0026] Superhashing (i.e. hashing the hash output) is not natural because the output of the hash function already contains multiple iterations of the compression function; it is even less intuitive when considering repeatedly reapplying the hash function (repeatedly combining multiple hash functions).

[0027] The combinations are more artificial because of the size mismatch (the input is larger than the output). For example, SHA-256 (or SHA-224) takes 512 bits as input and outputs a 256-bit (or 224-bit) digest, or SHA-512 (or SHA-384) takes 1024 bits as input and outputs a 512-bit (or 384-bit) digest.

[0028] Local memory resources can temporarily store hash results, thus avoiding lengthy data transfers back and forth between memory. Adding a data context can be achieved by adding an internal state register for temporarily storing compressed values ​​between calls to the compression function. The size of the register can be adapted to the primitive used (e.g., SHA2, SHA3, Haraka, ASCON ([ASCON]), or Quark ([QUARK_10])).

[0029] The feedback path FB is connected to the compression function output HT in order to mix the function output HT with the message input MT. Thus, a direct path from the hash output to the text input allows traditional multi-block hashing (feedback from Hout to Hin), but also allows iterative hashing.

[0030] Figure 2a The combined cycle CO in the circuit ensures memory.

[0031] However, alternatively, it may also be implemented explicitly by an instance of a context saving unit CSU.

[0032] This unit is optional and Figure 2b as shown in .

[0033] The depth of the cell can be 1, 2 or more. Generally, d is considered to be its depth.

[0034] Then, the case of d = 0 (no context saving unit CSU) is the same as Figure 2a The embodiment shown is consistent.

[0035] The case of d=1 allows the calculation to be paused / interrupted only once, but it can be resumed at any time by using the hash result HT of the saved HT1 recovery cache.

[0036] The case d>1 corresponds to multiple nested interrupts.Restoration can be done by splitting the context (the context saving unit CSU is then a FIFO=first in first out queue) or by selecting the computation to be resumed (eg based on a Quality of Service (QoS) concept).

[0037] In any case, it can be noted that through the external path (the connection outside the hash block, from the output intermediate hash value H out Feedback to the input M in the compressed block CB would be too slow. In fact, the final state FS and the message block Mi are usually connected to a data bus, which causes delays and requires data serialization (the hash value is at least 256 bits long in SHA2-256), and the bus usually carries double words (i.e. 32-bit words). Serialization consists in cutting the 256-bit word into 8 double words to be submitted to the bus in sequence.

[0038] Advantageously, the cached hash results (HT1, HT2, ...) may be inter-hash contexts.

[0039] This is the case when the store is performed at the end of the hash function (after all iterations that make up the hash function calculation have finished).

[0040] This means that the value of the cached hash result HT is not the value that appears in an iteration of the hash function (referred to as the "intra-hash" context in this invention), but the final value of the hash function that appears between consecutive calls of the hash function (referred to as the "inter-hash" context in this invention).

[0041] In this case, what is stored in the context saving unit CSU is the intermediate hash ("the output of the hash function").

[0042] This mechanism is of particular interest in HPQC because these algorithms are slow (they typically require hundreds to thousands of calls to the hash function).

[0043] By allowing them to be interrupted, it is ensured that they do not block the system in the event that important HPQC operation requests are accidentally serviced at a higher priority.

[0044] Furthermore, a direct path is inserted from the hash primitive output to the hash primitive text input, allowing for on-the-fly chaining of hashes. In this respect, keeping the hash value local to the compressed block CB offers a decisive advantage in terms of performance. Indeed, the hash values ​​are large (e.g., 256, 384, or 512 for SHA2 hash function variants), so copying this data back and forth requires a lot of time, which can be saved by implementing a shortcut for the feedback path FB, which outputs the intermediate hash value H out The message input MT is directly connected to the compression block CB.

[0045] The architecture advantageously comprises a first multiplexer MX1 ​​having as input the feedback path FB and the message input MT. The first multiplexer MX1 ​​selects the input of the link mode (the feedback path FB or the message input MT) based on the first control signal CS1. It is to be reminded that a multiplexer is a component that allows to select one value from a plurality of values ​​(two or more) based on a control signal. It can be implemented in hardware as a logic gate within the data path so that the appropriate input is selected within the same clock cycle, so that the clock cycle is not loosed to make a decision. It can save time in storing and copying the selected data, because it just flows through the multiplexer.

[0046] The output OMX1 of the first multiplexer MX1 ​​is connected to the input of a Boolean mixing function unit BM which applies at least one Boolean function between the output OMX1 of the first multiplexer MX1 ​​and the internal data ID for the compression function. The Boolean mixing function unit BM is connected to a dedicated message block M=(m0, m1, ..., m 63 The output of the Boolean mixing function unit BM depends on the third control signal CS3.

[0047] The second multiplexer MX2 takes as input the feedback path FB and the initial state IS of the compression function. Based on the second control signal CS2, it selects one of the input signals as the input intermediate hash value (H in ). Output the intermediate hash value (H out ) is provided at the function output HT.

[0048] Therefore, the first multiplexer MX1 ​​and the second multiplexer MX2 allow different paths, for example depending on the supported HPQC algorithm (XMSS [IETF RFC 8391], LMS [IETF RFC 8554], Sphincs+ or SLH-DSA [FIPS205], etc.) and its sub-functions (HPQC protocol key generation, signature generation or signature verification).

[0049] Figure 3 An implementation example of a Boolean mix function unit BM is shown. The inputs are the output of the first multiplexer OMX1 and the internal data ID.

[0050] The Boolean mixing function unit BM may include at least one XOR (exclusive OR). The first XOR (XOR1) may take the output of the first multiplexer OMX1 and the internal data ID as input. It corresponds to an exclusive OR between two data, i.e. it produces a true output (1) when the inputs are different, and a false output (0) when the inputs are the same. The second XOR (XOR2) may take the output of the first multiplexer OMX1 and a constant K as input, so as to add the constant value to the output of the first multiplexer OMX1, for example by using a bitwise XOR.

[0051] The Boolean mix function unit BM may also include arithmetic addition. To this end, the addition operator ADD takes as input the output of the first multiplexer OMX1 and a constant value K. Thus, integer addition in a modular ring (ie modular addition) is implemented.

[0052] The Boolean mix function unit BM may also include at least one "merging" unit MER. The merging unit MER connects the output of the first multiplexer OMX1 with a constant value K (the ordering of the two buses is also indicated as "||" in IETF RFC 8554).

[0053] In another embodiment, the Boolean function unit BM comprises at least one "sub-range" unit SUB, which selects a part of the output of the first multiplexer OMX1. For example, a bit segment of the feedback path FB can be extracted by the sub-range unit SUB.

[0054] All outputs of the Boolean mix function unit BM can be connected to a multiplexing tree CF, which includes:

[0055] - a third multiplexer MX3 connected to the merging unit MER and to the second XOR (XOR2);

[0056] - a fourth multiplexer MX4 connected to the output of the third multiplexer MX3 and to the output of the adder ADD;

[0057] - a fifth multiplexer MX5 connected to the output of the first XOR (XOR1) and to the output of the sub-range unit SUB;

[0058] - a sixth multiplexer MX6 connected to the outputs of the fourth multiplexer MX4 and the fifth multiplexer MX5.

[0059] Therefore, the multiplex tree CF selectively activates one of the inputs of each multiplexer based on the external control signal CS transmitted in time. The Boolean mixing function unit BM coupled to the multiplex tree CF is able to adjust the hash block on the fly, which avoids any interruption of the hash function and also reduces the calculation time. In addition, since the processor performs fewer operations, the size of the source code is also reduced.

[0060] Figure 4 The following is an example of an implementation of the architecture of the present invention in the form of a data flow, which is particularly suitable for XMSS (Extended Merkle Signature Scheme, which is a type of hash-based cryptography). Four 256-bit inputs (In1, In2, In3 and auth k ) allows the implementation of "random tree hashing" (called RAND_HASH in the XMSS specification, see [IETF RFC 8391] §4.1.4, Alg.7). Input In1 holds the parameter KEY, input In2 holds BM_0, and input In3 holds BM_1. auth kThe input contains the data auth[k] as defined, for example, in §4.1.8 of the above-mentioned XMSS standard. The output node0 is the intermediate value being calculated at the node of the hash tree. Figure 4 SHA-256 is used as a hash primitive. For teaching purposes, multiple SHA compression blocks CB are shown. In practice, it can be the same but reused multiple times, as shown in Figure 2. The initial state IS includes the standard initial values ​​(h0, ..., h7) of the SHA2 hash function.

[0061] The 256-bit internal status registers (C1, C2 and C3) enable the addition of (data) context. The context registers (A1, A2) of the HPQC algorithm are delegated to the upper layer. They contain the right and left halves of the previous calculation (value node0), or the external auth k value. This choice is determined by the control of the XMSS algorithm, which is implemented as D1 and D2 multiplexers. The Boolean function of the Boolean mix function unit BM is embodied by Boolean operators (B1 and B2). Therefore, the definition of additional operating modes required in addition to the basic operating modes (i.e.: initialization / update / completion), including the Boolean mix function unit in the feedback loop, is implemented by the strategy of context registers (A1, A2) and Boolean operators (B1 and B2).

[0062] The first multiplexer MX1 ​​selects the input of the link mode through the multiplexers (D1 and D2) for input selection, which enables a flexibility strategy. The input register E is suitable for the HPQC algorithm. The SHA compression block CB has a status register configured by the multiplexer.

[0063] The feedback path FB in FIG. 2 , which corresponds to the path from the hash output to the hash message input, can be viewed as the input of the compression block CB.

[0064] Figure 4 The representation shows the details of the exact feedback pattern of the data, as well as the exact size of the status register. That is, it shows how many 256-bit registers are needed, and how many registers of other sizes (i.e., 65 bits and 447 bits) are also needed. The register represented as "256(1)" corresponds to the following constant values ​​(in hexadecimal format) that implement padding:

[0065] 0x00000000_00000000_00000000_00000000_00000000_00000000_00000000_00000000_00000001

[0066] SEED and ADRS refer to corresponding inputs that are standardized in XMSS.

[0067] The invention is particularly suitable for integration into secure boot devices for firmware integrity, firmware management or authentication. In fact, it is able to perform a secure boot very quickly, in less than 1 millisecond. Speed ​​of firmware integrity / authenticity is mandatory for safety-critical applications, such as those compliant with IEC 61508 or ISO 26262, which require a fast restart process when a hazard is detected. In fact, the restart is done in mission mode and the system can withstand service interruptions of up to 1 millisecond (for example a car traveling at high speed). The architecture of the invention uses local memory resources, which saves time for digital signature verification.

[0068] References cited:

[0069] [SHA2] Secure Hash Algorithm (SHA). FIPS PUB 180-2; NIST / ITL / CSD, November 2001. http: / / csrc.nist.gov / publications / fips / fips180-2 / fips180-2withchangenotice.pdf

[0070] [LMS_23] Yifeng Song, Xiao Hu, Jing Tian, ​​Zhongfeng Wang: A High-Speed ​​FPGA-Based Hardware Implementation for Leighton-Micali Signature. IEEE Transactions on Circuits and Systems. I Regul. 70(1):241-252 (2023)

[0071] [AFRICACRYPT20] Fabio Campos, Tim Kohlstadt, Steffen Reith, Marc LMS vs XMSS: Comparison of Stateful Hash-Based Signature Schemes on ARM Cortex-M4 (LMS vs XMSS: Comparison of Stateful Hash-Based Signature Schemes on ARM Cortex-M4). AFRICACRYPT 2020: 258-277

[0072] [IETF RFC 8391] A. Huelsing et al., XMSS: eXtended Merkle Signature Scheme, https: / / datatracker.ietf.org / doc / html / rfc8391; Date: May 2018

[0073] [IETF RFC 8554] D. McGrew et al., Leighton-Micali Hash-Based Signatures, https: / / datatracker.ietf.org / doc / html / rfc8554

[0074] [FIPS205] Stateless Hash-Based Digital Signature Standard (SLH-DSA) developed by the National Institute of Standards and Technology (NIST). Release date: August 13, 2024

[0075] [QUARK_10] Jean-Philippe Aumasson, Luca Henzen, Willi Meier, and Maria Naya-Plasencia, “Quark: a lightweight hash”, CHES 2010, https: / / www.iacr.org / archive / ches2010 / 62250001 / 62250001.pdf

[0076] ([ASCON] C. Dobraunig et al., ASCON v1.2, https: / / csrc.nist.gov / CSRC / media / Projects / lightweight-cryptography / documents / round-2 / spec-doc-rnd2 / ascon-spec-round2.pdf

Claims

1. An architecture configured to provide a compression function from a hash function, comprising: - a message input (MT) configured to receive a message block (Mi) from the group of message blocks (M1, ..., Mn); - a hash output (HT) configured to output a final state (FS) representing a hash value of said group of message blocks (M1, ..., Mn); - a compression block (CB) for processing data blocks (Mi) from said set of message blocks (M1, ..., Mn) and compressing them progressively into hash values ​​of fixed size; Characterized in that the architecture is also configured to temporarily store compressed values ​​between calls to the compression function.

2. Architecture according to claim 1, comprising a feedback path (FB) connected to the compression function output (HT), the feedback path (FB) being configured to mix with the message input (MT).

3. An architecture according to any one of the preceding claims, wherein: The temporary storage is implemented by a context saving unit (CSU), which is configured to restore the cached hash result (HT).

4. The architecture of claim 3, wherein: The cached hash results (HT1, HT2, . . . ) correspond to the inter-hash context.

5. The architecture according to any one of the preceding claims 2 to 4, comprising: a first multiplexer (MX1) configured to take as input the feedback path (FB) and the message input (MT); and a second multiplexer (MX2) configured to take the feedback path (FB) and the initial state (IS) of the compression function as inputs, the first multiplexer (MX1) and the second multiplexer (MX2) being configured to enable multiple operation modes of the compression function based on control signals (CS1-CS3).

6. Architecture according to claim 5, comprising a Boolean mix function unit (BM) configured to apply at least one Boolean function between the output (OMX1) of the first multiplexer (MX1) and the internal data (ID) used in the compression function.

7. The architecture of claim 6, wherein: The Boolean functions include at least one XOR.

8. The architecture according to any one of claims 6 or 7, wherein: The Boolean functions include at least one ADD operator corresponding to integer addition in a modular ring.

9. The architecture according to any one of claims 4 to 6, wherein: The Boolean function comprises at least one “merge”, wherein a “merge” corresponds to the concatenation of two inputs of the Boolean mixing function unit (BM).

10. The architecture according to any one of claims 6 to 9, wherein: The Boolean function comprises at least one "sub-range", wherein a "sub-range" corresponds to a selection of a portion of the bits of one of the inputs.

11. An architecture according to any one of the preceding claims, wherein: The compression comes from the standard hash functions SHA2, SHA3, Haraka, ASCON, or Quark.

12. A secure boot device comprising an architecture according to any one of the preceding claims, for firmware integrity or authentication.

13. A method for providing a compression function from a hash function, comprising: - receiving at a message input (MT) a message block (Mi) from the group of message blocks (M1, ..., Mn); - outputting from the hash output (HT) a final state (FS) representing the hash value of the group of message blocks (M1, . . . , Mn); - processing a data block (Mi) from said group of message blocks (M1, ..., Mn) and gradually compressing it into a hash value of a fixed size; Characterized in that the method also includes temporarily storing compressed values ​​between calls of the compression function.

14. The method according to claim 13, wherein: A feedback path (FB) is mixed with the message input (MT).

15. The method according to claim 14, wherein: A first multiplexer (MX1) takes the feedback path (FB) and the message input (MT) as inputs, and a second multiplexer (MX2) takes the feedback path (FB) and an initial state (IS) of the compression function as inputs, the first multiplexer (MX1) and the second multiplexer (MX2) enabling multiple operation modes of the compression function based on control signals (CS1-CS3).

16. The method according to claim 15, wherein: A Boolean mix function unit (BM) applies at least one Boolean function between the output (OMX1) of the first multiplexer (MX1) and internal data (ID) used in the compression function.

17. A computer program product comprising computer executable instructions for causing a computer system to perform the method according to any one of claims 13 to 16.

Images