Calculation device

Abstract

To provide an arithmetic unit having a hash function circuit with a smaller circuit scale in executing a plurality of hash functions.SOLUTION: An arithmetic unit includes: an input data editing circuit that edits input data according to the input data width of second hash function processing when executing the first hash function processing; a hash calculation circuit that performs hash calculation using a logic function on the basis of the input data and can select a logic function of the first hash function and a logic function of the second hash function; an output data editing circuit that edits, when an output value output from the hash operation circuit is an output value of the first hash function, the output value according to the output data width of the first hash function; and a hash value output circuit that outputs the output value output by the hash calculation circuit or the output data editing circuit as a hash value.SELECTED DRAWING: Figure 7

Description

[Technical field]

[0001] SUMMARY OF THE DISCLOSURE The present invention relates to a computing device. [Background technology]

[0002] Conventionally, a hash function is used in digital signature processing. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] US Patent Application Publication No. 2020 / 349866 Summary of the Invention [Problem to be solved by the invention]

[0004] An object of one embodiment is to provide an arithmetic device having a hash function circuit with a smaller circuit scale when executing a plurality of hash functions. [Means for solving the problem]

[0005] According to one embodiment, the computing device calculates a first hash function and a second hash function having an input data width larger than that of the first hash function, Adjust the input data to the input data width of the second hash function Convert and generate second input data an input data editing circuit for a selection circuit that selects and outputs the second input data converted by the input data editing circuit when the selection signal indicates the first hash function, and selects and outputs the first input data when the selection signal indicates the second hash function; The above The second input data or the first input data output from the selection circuit In the input data In contrast , Based on the selection signal, A logic function of the first hash function and a logic function of the second hash function and generate output data according to the output data width of the second hash function. A hash calculation circuit; The selection signal is the first hash function Show case To , The width of the output data by the second hash function is smaller than the width of the output data by the second hash function. The output data width of the first hash function is Also convert the output data an output data editing circuit for if the selection signal indicates the first hash function; The output data editing circuit The converted output data output and outputting the output data generated by the hash calculation circuit when the selection signal indicates the second hash function. and a hash value output circuit for outputting the hash value. [Brief description of the drawings]

[0006] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a memory system to which a computing device according to the present embodiment is applied. [Diagram 2] FIG. 2 is a block diagram showing an example of a functional configuration of the memory system according to the present embodiment. [Diagram 3] FIG. 3 is a flowchart showing a hash value calculation procedure performed by a computing device according to a comparative example. [Figure 4] FIG. 4 is a diagram illustrating an example of an extension processing circuit that is a circuit that executes the extension processing of a calculation device according to a comparative example. [Diagram 5] FIG. 5 is a diagram illustrating an example of a compression processing circuit that is a circuit that executes compression processing in a computing device according to a comparative example. [Figure 6] FIG. 6 is a diagram showing the contents of SHA-256 and SHA-512. [Figure 7] FIG. 7 is a circuit diagram for realizing the hash value calculation unit according to this embodiment. [Figure 8] FIG. 8 is a diagram for explaining an example of editing block data according to the present embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of an extension processing circuit according to the present embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of a compression processing circuit according to this embodiment. [Figure 11] FIG. 11 is a flowchart showing the procedure of the hash value calculation process according to the present embodiment. [Figure 12] FIG. 12 is a flowchart showing the procedure of the signature generation process according to the present embodiment. [Figure 13] FIG. 13 is a flowchart showing the procedure of the signature verification process according to the present embodiment. [Figure 14] FIG. 14 is a diagram illustrating an expansion processing circuit of an expansion and compression circuit according to the second embodiment. [Figure 15]FIG. 15 is a diagram illustrating a compression processing circuit of an expansion compression circuit according to the second embodiment. [Figure 16] FIG. 16 is a diagram illustrating a compression processing circuit of an expansion compression circuit according to the third embodiment. [Figure 17] FIG. 17 is a diagram illustrating an example of a compression processing circuit according to the fourth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] In the following, as an example, a memory system to which the arithmetic device according to the embodiment is applied will be described. Note that the device to which the arithmetic device according to the embodiment can be applied is not limited to a memory system. The arithmetic device according to the embodiment can be applied to any device including a memory in which a computer program is stored and a processor that executes the computer program. Below, a memory system to which the arithmetic device according to the embodiment is applied will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to this embodiment.

[0008] (First embodiment) 1 is a diagram showing an example of the configuration of a memory system to which the arithmetic device according to the present embodiment is applied. The memory system 1 is, for example, an SSD (Solid State Drive). In the following, a case where a NAND type flash memory (hereinafter, referred to as a NAND memory) is used as a non-volatile memory is taken as an example.

[0009] The memory system 1 is configured to be connectable to a host 2. For example, the host 2 may be a CPU (Central Processing Unit), a personal computer, a portable information device, a server, etc. Any interface standard may be adopted as an interface standard for communication between the memory system 1 and the host 2. Two or more hosts 2 may be connected to the memory system 1 at the same time. The host 2 and the memory system 1 may be connected via a network.

[0010] The memory system 1 transmits and receives data to and from the host 2 in response to an access command from the host 2 .

[0011] The memory system 1 includes a NAND memory 12 and a memory controller 10. The memory controller 10 includes, for example, a host interface unit 11, the NAND memory 12, a NAND controller 13, a RAM (Random Access Memory) 14, and a control unit 15.

[0012] The control unit 15 includes, for example, one or more processors. The control unit 15 executes control of the memory system 1 by executing a program that is stored in advance at a predetermined location in the memory system 1. The storage location of the program is designed arbitrarily. For example, the program is stored in the NAND memory 12 in advance and loaded into the RAM 14 at startup. The control unit 15 executes the program loaded into the RAM 14. The control of the memory system 1 is configured by a plurality of processes. Some or all of the plurality of processes executed by the control unit 15 may be realized by a hardware circuit. The control unit 15 may also be configured by a control circuit, which is a hardware circuit. Each process executed by the control unit 15 will be described later.

[0013] The host interface unit 11 is an interface device for the memory system 1 to communicate with the host 2. For example, the host interface unit 11 transfers user data between the host 2 and the RAM 14 under the control of the control unit 15.

[0014] The NAND controller 13 is an interface device for accessing the NAND memory 12. Under the control of the control unit 15, the NAND controller 13 transfers user data or management information between the RAM 14 and the NAND memory 12. Although details will be omitted, the NAND controller 13 can perform error correction processing.

[0015] The NAND memory 12 is a non-volatile storage medium that functions as a storage device. The NAND memory 12 is composed of one or more chips.

[0016] The RAM 14 is a storage medium for temporarily storing data. The RAM 14 may be built in the memory controller 10 or may be mounted outside the memory controller 10. For example, a storage medium faster than the NAND memory 12 may be used as the RAM 14. For example, a volatile or non-volatile storage medium may be used as the RAM 14. For example, a dynamic RAM (DRAM), a static RAM (SRAM), a ferroelectric RAM (FeRAM), a magnetoresistive RAM (MRAM), a phase change RAM (PRAM), etc. may be used as the RAM 14.

[0017] 2 is a block diagram showing an example of a functional configuration of the memory system 1 according to the present embodiment. As shown in FIG. 2, the memory system 1 includes a storage unit 30, a signature processing unit 31, a hash value calculation unit 32, and a public key encryption processing unit 33.

[0018] The storage unit 30 stores various types of information. For example, the storage unit 30 stores a private key, a public key, a message, and signature information. The storage unit 30 is realized by the RAM 14 and the NAND memory 12.

[0019] The signature processing unit 31 performs signature processing. The signature processing unit 31 is realized by the control unit 15. The signature processing unit 31 generates a signature based on a hash value and verifies the signature.

[0020] The hash value calculation unit 32 is a circuit that calculates a hash value. The hash value calculation unit 32 is included in, for example, the memory controller 10. Details of the hash value calculation unit 32 will be described later. The public key encryption processing unit 33 performs public key encryption processing. The public key encryption processing unit 33 is included in, for example, the memory controller 10.

[0021] (Hash value calculation method by a computing device according to a comparative example) Before describing the details of the hash value calculation unit 32, a hash value calculation procedure by a calculation device according to a technique (comparative example) compared to the calculation device of this embodiment will be described with reference to Fig. 3. Fig. 3 is a flowchart showing the hash value calculation procedure by the calculation device according to the comparative example. First, the calculation device acquires input data (step S1). The calculation device divides the input data into blocks of 512 bits or 1024 bits (step S2). Next, the calculation device performs an extension process that extends the data of the block (step S3). For example, when the input data is 512 bits, the calculation device divides it into 2048 bits.

[0022] Next, the arithmetic unit performs a compression process to compress the extended data (step S4). For example, the arithmetic unit compresses the data extended to 2048 bits by the extension process to 256 bits.

[0023] Next, the calculation device adds the compressed data to the result of the previous processing and holds the result (step S5). It is determined whether the calculation is completed for all blocks (step S6). If the calculation is not completed for all blocks (step S6: No), the process proceeds to step S2. If the calculation is completed for all blocks (step S6: Yes), the calculation device outputs a hash value (step S7).

[0024] As described above, the arithmetic unit has a circuit for performing the expansion process and a circuit for performing the compression process. An example of the circuit for performing the expansion process is shown in FIG.

[0025] 4 is a diagram showing an example of an extension processing circuit that executes extension processing in a calculation device according to a comparative example. As shown in FIG 4, the extension processing circuit has registers w0 to w15, a logic function calculator 51, a logic function calculator 52, and adders 53 to 56.

[0026] The logic function calculator 51 and the logic function calculator 52 perform different processing depending on the type of hash function. That is, the processing of the logic function calculator differs between when executing the SHA-256 hash function and when executing the SHA-512 hash function.

[0027] Next, an example of a circuit that executes compression processing is shown in Fig. 5. Fig. 5 is a diagram showing an example of a compression processing circuit that executes compression processing of a calculation device according to a comparative example. As shown in Fig. 5, the compression processing circuit has registers r0 to r8, an addition calculator 71, a logic function calculator 72, a logic function calculator 73, a logic function calculator 74, a logic function calculator 75, addition calculators 76 to 80, and an addition calculator 88.

[0028] The logic function calculator 72 and the logic function calculator 74 perform different processing depending on the type of hash function. That is, the processing of the logic function calculator differs between when executing the hash function of SHA-256 and when executing the hash function of SHA-512.

[0029] Here, the execution contents in the logic function calculator 72 in the case of SHA-256 are shown in the following formula 1.

number

[0030] Next, the execution contents in the logic function calculator 73 are shown in the following formula 2.

number

[0031] Next, the execution contents in the logic function calculator 74 are shown in the following formula 3.

number

[0032] Here, the execution contents in the logic function calculator 75 in the case of SHA-256 are shown in the following formula 4.

number

[0033] In the compression processing circuit, the input of the expanded input data and a constant to the adder 76 is used as a trigger to execute the compression processing.

[0034] Here, in this embodiment, we consider executing the hash function of SHA-256 and the hash function of SHA-512. Here, Fig. 6 shows the difference between SHA-256 and SHA-512. Fig. 6 is a diagram showing the contents of SHA-256 and SHA-512.

[0035] As shown in Figure 6, SHA256 has smaller output data width, input data width, calculation width, and round count than SHA512. Also, SHA512 has a higher security level because it has a larger input data width and output data width than SHA256. Considering usability and security, it is desirable to be able to apply both SHA256 and SHA512.

[0036] Simply combining a circuit for executing the SHA-256 hash function with a circuit for executing the SHA512 hash function would result in a large circuit area. Therefore, in this embodiment, a memory system 1 having a hash function circuit with a smaller circuit scale will be described.

[0037] First, a circuit showing the hash value calculation unit 32 will be described with reference to Fig. 7. Fig. 7 is a circuit diagram realizing the hash value calculation unit 32 according to this embodiment. As shown in Fig. 7, the hash value calculation unit 32 has an input buffer 321, a rearrangement circuit 322, a selector 323, an expansion compression circuit 324, a rearrangement circuit 325, and an output buffer 326.

[0038] The input buffer 321 obtains input data from the signature processing unit 31. The input buffer 321 also obtains a selection signal indicating the hash function to be applied. The selection signal is also output to the selector 323, the expansion compression circuit 324, and the output buffer 326. The signature processing unit 31 may output the selection signal to the hash value calculation unit 32.

[0039] The input buffer 321 outputs block data obtained by dividing the input data based on a selection signal. For example, when the selection signal indicates that a SHA-256 hash function is to be executed, the input buffer 321 outputs the block data to the rearrangement circuit 322. On the other hand, when the selection signal indicates that a SHA-512 hash function is to be executed, the input buffer 321 outputs the block data to the selector 323.

[0040] The rearrangement circuit 322 edits the block data acquired from the input buffer 321. An example of the rearrangement circuit 322 editing the block data will now be described with reference to FIG. 8. FIG. 8 is a diagram for explaining an example of editing the block data according to this embodiment. The rearrangement circuit 322 acquires 32-bit×16 block data. The rearrangement circuit 322 edits the data into 64-bit×16 block data. Here, the rearrangement circuit 322 sets half of the 64-bit data as dummy data. For example, as shown in FIG. 8, in the 64-bit×16 block data, the 32-bit×16 data before editing is placed in the shaded area, and the dummy data is placed in the blank area.

[0041] The rearrangement circuit 322 outputs the edited block data to the selector 323. The selector 323 outputs the block data to the extended compression circuit 324 based on a selection signal. When the selection signal indicates that the SHA-256 hash function is to be executed, the selector 323 outputs the block data output from the rearrangement circuit 322 to the extended compression circuit 324. When the selection signal indicates that the SHA-512 hash function is to be executed, the selector 323 outputs the block data output from the input buffer 321 to the extended compression circuit 324.

[0042] The extension compression circuit 324 is a circuit that performs extension processing and compression processing. The extension compression circuit 324 has a register size of 64 bits. Here, the extension processing circuit part of the extension compression circuit 324 is shown in FIG. 9. FIG. 9 is a diagram showing an example of the extension processing circuit according to this embodiment. As shown in FIG. 9, the extension processing circuit 41 has registers w0 to w15, logic function calculators 51a, 51b, 52a, 52b, adders 53 to 55, selectors 57 and 58.

[0043] The logic function calculator 51a is a calculator compatible with SHA-256, and the logic function calculator 51b is a calculator compatible with SHA-512. The logic function calculator 51a and the logic function calculator 51b output the calculation results to the selector 57.

[0044] Moreover, the logic function calculator 52a is a calculator compatible with SHA-256, and the logic function calculator 52b is a calculator compatible with SHA-512. The logic function calculator 52a and the logic function calculator 52b output the calculation results to the selector 58.

[0045] When the selection signal indicates that the SHA-256 hash function is to be executed, the selector 57 outputs the operation result output from the logic function calculator 51a to the adder 53. When the selection signal indicates that the SHA-512 hash function is to be executed, the selector 57 outputs the operation result output from the logic function calculator 51b to the adder 53.

[0046] When the selection signal indicates that the SHA-256 hash function is to be executed, the selector 58 outputs the operation result output from the logic function calculator 52a to the adder 55. When the selection signal indicates that the SHA-512 hash function is to be executed, the selector 58 outputs the operation result output from the logic function calculator 52b to the adder 55.

[0047] In this way, the extension processing circuit 41, which is the circuit for the extension processing portion of the extension compression circuit 324, shares the register parts and addition operators and is equipped with only the logic function operator 51 and the logic function operator 52, whose processing contents differ between SHA256 and SHA512, thereby making it possible to reduce the circuit area compared to the case where multiple extension processing circuits are equipped.

[0048] Next, the compression processing circuit portion of the extension compression circuit 324 is shown in Fig. 10. Fig. 10 is a diagram showing an example of the compression processing circuit according to this embodiment. As shown in Fig. 10, the compression processing circuit 42 has registers r0 to r8, an adder 71, a logic function calculator 72a, a logic function calculator 72b, a logic function calculator 73, a logic function calculator 74a, a logic function calculator 74b, a logic function calculator 75, adders 76 to 80, a selector 81, a selector 82, and an adder 88.

[0049] The logic function calculator 72a is a calculator compatible with SHA-256, and the logic function calculator 72b is a calculator compatible with SHA-512. The logic function calculator 72a and the logic function calculator 72b output the calculation results to the selector 81.

[0050] Moreover, the logic function calculator 74a is a calculator compatible with SHA-256, and the logic function calculator 74b is a calculator compatible with SHA-512. The logic function calculator 74a and the logic function calculator 74b output the calculation results to the selector .

[0051] When the selection signal indicates that the SHA-256 hash function is to be executed, the selector 81 outputs the operation result output from the logic function calculator 72a to the adder 80. When the selection signal indicates that the SHA-512 hash function is to be executed, the selector 81 outputs the operation result output from the logic function calculator 72b to the adder 80.

[0052] When the selection signal indicates that the SHA-256 hash function is to be executed, the selector 82 outputs the operation result output from the logic function calculator 74a to the adder 78. When the selection signal indicates that the SHA-512 hash function is to be executed, the selector 82 outputs the operation result output from the logic function calculator 74b to the adder 78.

[0053] In this way, the compression processing circuit 42, which is the circuit for the compression processing portion of the extended compression circuit 324, shares the register parts and addition operators and is equipped with only the logic function operator 72 and the logic function operator 74, whose processing contents differ between SHA256 and SHA512, thereby making it possible to reduce the circuit area compared to the case where multiple compression processing circuits are equipped.

[0054] Returning to FIG. 7, when the selection signal indicates that the SHA-256 hash function is to be executed, the extended compression circuit 324 outputs the 512-bit value resulting from the operation to the rearrangement circuit 325. When the selection signal indicates that the SHA-512 hash function is to be executed, the extended compression circuit 324 outputs the 512-bit value resulting from the operation to the output buffer 326. The rearrangement circuit 325 converts the 512-bit block data into 32-bit×8 data. That is, the rearrangement circuit 325 extracts only the valid data portion, assuming that the SHA-256 hash function is executed. The rearrangement circuit 325 outputs the converted 32-bit×8 data to the output buffer 326.

[0055] The output buffer 326 obtains the hash values ​​from the rearrangement circuit 325 and the extended compression circuit 324. When the selection signal indicates that the SHA-256 hash function is to be executed, the output buffer 326 outputs the hash value obtained from the rearrangement circuit 325 to the signature processing unit 31. When the selection signal indicates that the SHA-512 hash function is to be executed, the output buffer 326 outputs the hash value obtained from the extended compression circuit 324 to the signature processing unit 31.

[0056] Next, the hash value calculation process performed by the hash value calculation unit 32 will be described with reference to Fig. 11. Fig. 11 is a flowchart showing the hash value calculation process according to this embodiment. First, the input buffer 321 acquires input data (step S11). Here, if the selection signal indicates that the SHA-512 hash function is to be executed (step S12: Yes), the input buffer 321 outputs a 1024-bit block to the extension compression circuit 324 (step S15).

[0057] If the selection signal does not indicate that the SHA-512 hash function is to be executed (step S12: No), the input buffer 321 outputs the 512-bit block data to the rearrangement circuit 322 (step S13). Then, the rearrangement circuit 322 generates a 1024-bit block and outputs it to the extension compression circuit 324 (step S14).

[0058] The expansion / compression circuit 324 performs the expansion process based on the selection signal (step S16), and performs the compression process (step S17).

[0059] If the selection signal indicates that the SHA-512 hash function is to be executed (step S18: Yes), the rearrangement circuit 325 outputs a 512-bit hash value to the output buffer 326 (step S21). If the selection signal does not indicate that the SHA-512 hash function is to be executed (step S18: No) in step S18, the rearrangement circuit 325 generates 8 pieces of converted 32-bit data (step S19) and outputs the data to the output buffer 326 (step S20).

[0060] (Explanation of signature generation process) Next, the procedure of the signature generation process will be described with reference to Fig. 12. Fig. 12 is a flowchart showing the procedure of the signature generation process according to this embodiment.

[0061] First, the signature processing unit 31 reads out a message from the storage unit 30 (step S31). The message is an object of signature processing, such as a computer program code.

[0062] The signature processing unit 31 inputs the message to the hash value calculation unit 32. The hash value calculation unit 32 uses the message as input data and outputs a hash value (step S32).

[0063] Next, the signature processing unit 31 reads the private key from the storage unit 30 (step S33).

[0064] The signature processing unit 31 inputs the hash value and the private key to the public key encryption processing unit 33, and generates signature data by applying publicly known techniques based on the data output by the public key encryption processing unit 33 (step S34), and outputs the signature data to the memory unit 30 (step S35).

[0065] (Explanation of signature verification) Next, the procedure of signature verification will be described with reference to Fig. 13. Fig. 13 is a flowchart showing the procedure of signature verification processing according to this embodiment.

[0066] First, the signature processing unit 31 reads a message from the storage unit 30 (step S41).

[0067] Next, the signature processing unit 31 inputs the message to the hash value calculation unit 32. The hash value calculation unit 32 outputs a hash value using the message as input data (step S42).

[0068] Next, signature processing unit 31 reads out the signature data and the public key from storage unit 30 (step S43).

[0069] Next, the signature processing unit 31 performs signature verification. For example, the signature processing unit 31 inputs the signature data and the public key to the public key encryption processing unit 33, and performs signature verification by applying a known technique based on the data and hash value output by the public key encryption processing unit 33 (step S44). The signature processing unit 31 outputs a result indicating whether the signatures match (step S45).

[0070] In the above-described embodiment, the hash value calculation unit 32 includes a sorting circuit 322 that edits input data to fit the input data width of SHA-512 when executing the SHA-256 hash function, an extended compression circuit 324 that can select between a SHA-256 logic function and a SHA-512 logic function, and a sorting circuit 325 that, when the output value output from the extended compression circuit 324 is an output value obtained by the SHA-256 hash function, edits the output value to fit the output data width of SHA-256.

[0071] In this case, when executing the SHA-256 hash function, the hash value calculation unit 32 edits the input data to match the input data width of SHA-512, and in the extended compression circuit 324, a logic function of SHA-256 and a logic function of SHA-512 are selected for processing, so that the register portion and the adding operator in the extended compression circuit 324 can be shared, thereby making it possible to reduce the circuit area.

[0072] Second embodiment In the first embodiment, the extension and compression circuit 324 has a register size of 64 bits, but in the second embodiment, the extension and compression circuit 324 has two modules with a register size of 32 bits. An extension processing circuit of the extension and compression circuit 324 according to the second embodiment is shown in FIG.

[0073] As shown in Fig. 14, the extension processing circuit has an extension processing circuit 41a and an extension processing circuit 41b. That is, the extension processing circuit according to the second embodiment has two extension processing circuits shown in Fig. 9. The extension processing circuit 41a is a lower 32-bit module, and the extension processing circuit 41b is a higher 32-bit module.

[0074] 14, the extension and compression circuit 324 in the second embodiment has an interface L1, an interface L2, an interface L4, and an interface L5 for sharing data between the lower 32 bits and the upper bits. The extension and compression circuit 324 in the second embodiment also has an interface L3 for carrying the addition result.

[0075] Next, the compression processing circuit of the extension compression circuit 324 in the second embodiment is shown in Fig. 15. As shown in Fig. 15, it has a compression processing circuit 42a and a compression processing circuit 42b. That is, the compression processing circuit according to the second embodiment has two compression processing circuits shown in Fig. 10. The compression processing circuit 42a is a lower 32-bit module, and the compression processing circuit 42b is an upper 32-bit module.

[0076] 15, the compression circuit in the second embodiment has an interface L12, an interface L13, an interface L15, and an interface L16 for sharing data between the lower 32 bits and the upper bits. The compression circuit in the second embodiment also has an interface L11 and an interface L14 for carrying the addition result.

[0077] In this way, the extended compression circuit 324 in the second embodiment is provided with multiple circuits with a register size of 32 bits, and an interface for sharing information and carrying the addition results, making it possible to execute not only hash functions with a register size of 32 bits, but also hash functions with a register size of 64 bits.

[0078] In addition, the extended compression circuit 324 in the second embodiment may further include, as a selection signal, a signal indicating that the SHA-256 hash function is to be executed in parallel. In this manner, the extended compression circuit 324 in the second embodiment has a configuration including a plurality of circuits for executing a 32-bit hash function, and therefore can execute the SHA-256 hash function in parallel.

[0079] Third embodiment The compression circuit in the second embodiment has an interface L11 and an interface L14 for carrying the addition result, but the compression circuit in the third embodiment has an interface L21 having a holding mechanism 85 and an interface L22 having a holding mechanism 83, as shown in Fig. 16. In addition, the interfaces L21 and L22 are connected to an addition calculator 86 and an addition calculator 84, respectively.

[0080] In this way, since the interface L21 and the interface L22 carry the addition result via the holding mechanism 85 and the holding mechanism 83, the timing of carrying the addition result can be delayed by one cycle, and the critical path can be shortened.

[0081] (Fourth embodiment) The compression processing circuit in the fourth embodiment executes a plurality of round processes collectively. An example of the compression processing circuit according to the fourth embodiment is shown in Fig. 17. As shown in Fig. 17, the compression processing circuit has registers r1 to r8, a first round processing circuit 90, and a second round processing circuit 91.

[0082] Here, each of the first round processing circuit 90 and the second round processing circuit 91 has the logic function calculator 72a, logic function calculator 72b, logic function calculator 73, logic function calculator 74a, logic function calculator 74b, logic function calculator 75, addition calculators 76 to 80, selector 81, selector 82, and addition calculator 88 shown in FIG. 10.

[0083] As described above, the compression processing circuit in the fourth embodiment has a first round processing circuit 90 and a second round processing circuit 91, and therefore can execute multiple rounds of logical operations and additions together, thereby improving processing efficiency.

[0084] The extension processing circuit may also be configured to execute a plurality of round processes collectively. For example, the extension processing circuit may have the registers w1 to w15, the first round processing circuit, and the second round processing circuit shown in FIG. 9, and the first round processing circuit and the second round processing circuit may have logic function calculators 51a, 51b, 52a, 52b, adders 53 to 55, selectors 57, and 58.

[0085] In the above embodiment, the circuit of the extended processing portion of the extended compression circuit 324 has a common register portion and an addition calculator, and only the logic function calculator 51 and the logic function calculator 52, which have different processing contents for SHA256 and SHA512, have logic function calculators for SHA256 and SHA512, respectively. However, it may be configured to simply connect an extension circuit for SHA256 or an extension circuit for SHA512 of a calculation device according to a comparative example, as shown in FIG. 4.

[0086] In addition, in the above embodiment, the hash value calculation unit 32 executes the SHA256 hash function and the SHA512 hash function. However, the hash value calculation unit 32 may execute the SHA256 hash function and the SHA384 hash function.

[0087] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0088] 1 memory system, 2 host, 10 memory controller, 11 host interface unit, 12 NAND memory, 13 NAND controller, 14 RAM, 15 control unit, 30 storage unit, 31 signature processing unit, 32 hash value calculation unit, 33 public key encryption processing unit, 41 extension processing circuit, 42 compression processing circuit, 321 input buffer, 322 sorting circuit, 324 extension compression circuit, 325 sorting circuit, 326 output buffer.

Claims

1. 1. A computing device capable of executing a first hash function and a second hash function having an input data width larger than that of the first hash function, an input data editing circuit that converts first input data in response to a selection signal indicating the first hash function so as to match the input data width of the second hash function and generates second input data; a selection circuit that selects and outputs the second input data converted by the input data editing circuit when the selection signal indicates the first hash function, and selects and outputs the first input data when the selection signal indicates the second hash function; a hash calculation circuit that executes a logic function of the first hash function or a logic function of the second hash function on the second input data or the first input data output from the selection circuit based on the selection signal, and generates output data that matches an output data width of the second hash function; an output data editing circuit that converts the output data to match an output data width by the first hash function that is smaller than an output data width by the second hash function when the selection signal indicates the first hash function; a hash value output circuit that outputs output data converted by the output data editing circuit when the selection signal indicates the first hash function, and outputs output data generated by the hash calculation circuit when the selection signal indicates the second hash function; A computing device comprising:

2. The hash operation circuit selects a circuit that executes either a logic function of the first hash function or a logic function of the second hash function. The computing device of claim 1 .

3. The hash calculation circuit includes: an extension processing circuit that increases the number of bits of input data input to the hash calculation circuit; a compression processing circuit for compressing the input data input from the expansion processing circuit; Equipped with The computing device of claim 1 .

4. the compression processing circuit has a module that performs calculations in a 64-bit width and is capable of selecting a logic function of the first hash function and a logic function of the second hash function. The computing device according to claim 3.

5. the compression processing circuit executes a logical operation and an addition operation including the logic function for a plurality of rounds at a time; The computing device according to claim 3.

6. the extended processing circuit has a module that performs calculations in a 64-bit width and is capable of selecting a logic function of the first hash function and a logic function of the second hash function; The computing device according to claim 3.

7. The extension processing circuit executes a logical operation and an addition operation including the logic function for a plurality of rounds at a time. The computing device according to claim 3.

8. a signature processing unit that performs a signature process using the hash value output by the hash value output circuit, The computing device of claim 1 .

9. The first hash function is a SHA-256 function, and the second hash function is a SHA-512 function. The computing device of claim 1 .

10. The input data editing circuit converts the first input data by adding dummy data to the first input data. The computing device of claim 1 .

11. When the size of the first input data is 32 bits x 16, the size of the second input data to which the dummy data is added is 64 bits x 16. The computing device of claim 10.

Images