Logic operation circuit, compression circuit of secure hash algorithm, and chip

Abstract

A logic operation circuit, a compression circuit of a secure hash algorithm, and a chip. The logic operation circuit is configured to perform a logical operation on three input operands, and output a bitwise negation value of the sum obtained by adding the three operands, and a bitwise negation value of a carry from addition of the three operands. The compression circuit comprises eight input registers, eight output registers, a first preprocessing circuit, a second preprocessing circuit, an operation circuit of a variable e, and an operation circuit of a variable a. According to embodiments of the present disclosure, the iterative operations of the variables a and e are preprocessed, and balanced as the iterative operations of four variables for implementation, shortening a key path.

Description

A logic operation circuit, a compression circuit and a chip for a secure hash algorithm Technical Field

[0001] The embodiments of the present disclosure relate to, but are not limited to, a secure hash algorithm, and more specifically, to a logic operation circuit, a compression circuit, and a chip for a secure hash algorithm. Background Art

[0002] SHA-2 (Security Hash Algorithm-2) is a cryptographic hash algorithm used to achieve one-way mapping between data. It can map messages of any length into message digests of fixed length, and the mapping process is irreversible. According to the length of the output message digest, SHA-2 is divided into SHA-224, SHA-256, SHA-384, SHA-512 and other algorithms, which are mainly used in digital signatures, fingerprint verification and network security protocols. Among them, SHA-256 is a one-way hash algorithm that can convert any length less than 2 64 The SHA-256 algorithm converts a 256-bit input message into a 256-bit message digest, which has high security. However, when the SHA-256 algorithm is applied in the chip, its performance needs to be improved.

[0003] SUMMARY OF THE INVENTION

[0004] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0005] An embodiment of the present disclosure provides a logic operation circuit, which is configured to perform a logic operation on three input operands and output two operands, one of the two operands being the bitwise inverse value of the sum of the three operands, and the other being the bitwise inverse value of the carry of the addition of the three operands.

[0006] The embodiment of the present disclosure further provides a logic operation circuit, which is configured to perform a logic operation based on two input operands g and a and a constant K, and output two operands s and c, where s is equal to The bitwise inverse of the sum added to K, c is equal to The bitwise inverse of the carry added to K.

[0007] The present disclosure also provides a single-stage compression circuit for the secure hash algorithm SHA-256, including:

[0008] The 8 input-side registers A, B, C, J, E, F, G, and I respectively output the data of variables a, b, c, j, e, f, g, and i before this iteration;

[0009] The 8 output-side registers A', B', C', J', E', F', G', and I' respectively store the data of variables a, b, c, j, e, f, g, and i after this iteration;

[0010] A first pre-processing circuit, having an input terminal connected to the output terminals of A and G and receiving an input message word, an output terminal connected to the input terminal of I', and configured to perform one iterative operation on the variable i;

[0011] A second preprocessing circuit, having an input connected to the output of E and C and an output connected to the input of J', configured to perform one iterative operation on the variable j;

[0012] The operation circuit of the variable e has its input connected to the output of I, E, F, and G, and its output connected to the input of E', and is configured to perform one iterative operation of the variable e;

[0013] The arithmetic circuit of variable a has its input connected to the outputs of A, B, C, and J, and its output connected to the input of A', and is configured to perform one iterative operation of variable a;

[0014] Among them, A and B', B and C', E and F', and F and G' are directly connected.

[0015] An embodiment of the present disclosure also provides a data compression circuit for a secure hash algorithm SHA-256, wherein the nth-level single-stage compression circuit adopts the single-stage compression circuit described in any embodiment of the present disclosure, n=n1, n1+1, n1+1,…, n2, n2>n1≥3.

[0016] An embodiment of the present disclosure further provides a chip including a message expansion circuit and a data compression circuit, wherein the data compression circuit adopts the data compression circuit of the secure hash algorithm SHA-256 described in any embodiment of the present disclosure.

[0017] The present disclosure also provides a chip capable of implementing the secure hash algorithm SHA-256, including a message expansion circuit and a data compression circuit, characterized in that:

[0018] The message expansion circuit is configured to group the padded message blocks to obtain 16 message words; and to expand the 16 message words obtained by grouping to generate 48 message words;

[0019] The data compression circuit includes 66 levels of compression circuits from level 0 to level 65, wherein some or all of the compression circuits from level 3 to level 62 are configured to perform the following first iterative processing on variables a, b, c, j, e, f, g, i: n+1 =e n+2 -c n i n+1 =an-2 +g n +K n+1 +W n+1 g n+1 =f n f n+1 =e n , e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ) c n+1 =b n b n+1 =a n a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0020] Among them, x m Represents the value of variable x after m iterations, where x is a,b,c,j,e,f,g,i; K n+1 is the n+1th fixed message word, W n+1 It is the n+1th message word obtained by grouping or expanding the input message block.

[0021] An embodiment of the present disclosure further provides a chip capable of implementing the secure hash algorithm SHA-256, including a message expansion circuit and a data compression circuit, characterized in that:

[0022] The message expansion circuit is configured to group the padded message blocks to obtain 16 message words; and to expand the 16 message words obtained by grouping to generate 48 message words;

[0023] The data compression circuit includes 66 levels of compression circuits from level 0 to level 65, wherein some or all of the odd-level compression circuits in the compression circuits from level 3 to level 62 are configured to perform the first iterative processing on the variables a, b, c, j, e, f, g, i, and the even-level compression circuits adjacent to the odd-level compression circuits are configured to perform the second iterative processing on the variables a, b, c, j, e, f, g, i; or, some or all of the even-level compression circuits in the compression circuits from level 3 to level 62 are configured to perform the first iterative processing on the variables a, b, c, j, e, f, g, i, and the odd-level compression circuits adjacent to the even-level compression circuits are configured to perform the second iterative processing on the variables a, b, c, j, e, f, g, i;

[0024] The first iterative process includes the following iterative operations: in+1 =a n-2 +g n +K n+1 +W n+1 c n+1 =b n b n+1 =a n a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0025] The second iterative process includes the following iterative operations: j n+1 =e n+2 -c n g n+1 =f n f n+1 =e n , e n+1 =i n +∑1e n +Ch(e n ,f n ,g n )

[0026] Among them, x m Represents the value of variable x after m iterations, where x is a,b,c,j,e,f,g,i; K n+1 is the n+1th fixed message word, W n+1 It is the n+1th message word obtained by grouping or expanding the input message block.

[0027] The single-stage compression circuit, data compression circuit, and chip of the above-mentioned embodiments of the present disclosure can shorten the critical path of SHA-256 operations without adding registers, provide higher performance, lower power consumption, and reduce chip area.

[0028] Still other aspects will become apparent upon reading and understanding the accompanying drawings and detailed description.

[0029] Summary of the Figures

[0030] The accompanying drawings are used to provide an understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the technical solutions of the present disclosure and do not constitute a limitation to the technical solutions of the present disclosure.

[0031] FIG1A is a schematic diagram of message padding in SHA-256;

[0032] FIG1B is a block diagram of a chip capable of implementing SHA-256 according to an embodiment of the present disclosure;

[0033] FIG2 is a structural diagram of the circuits of the data compression part and the data expansion part according to an embodiment of the present disclosure;

[0034] FIG3 is a logic block diagram of a compression structure for implementing the original single-round iterative function;

[0035] FIG4 is a schematic diagram of a compression structure for implementing a single-round iterative function according to an embodiment of the present disclosure;

[0036] FIG5 is a schematic diagram of another compression structure for implementing a single-round iterative function according to an embodiment of the present disclosure;

[0037] FIG6 is a schematic diagram of another compression structure for implementing a single-round iterative function according to an embodiment of the present disclosure;

[0038] FIG7 is a logic block diagram of a single-stage compression circuit for implementing a single-round iterative function according to an embodiment of the present disclosure;

[0039] FIG8 is a logic block diagram of another single-stage compression circuit for implementing a single-round iterative function according to an embodiment of the present disclosure;

[0040] FIG9A is a logic block diagram of a single-stage compression circuit when outputting a bitwise inverted value of a variable according to an embodiment of the present disclosure;

[0041] FIG9B is a logic block diagram of a two-stage compression circuit when outputting bitwise inverted values ​​of a variable according to an embodiment of the present disclosure;

[0042] Figure 10 is a schematic diagram of a CSA;

[0043] FIG11 is a schematic diagram of a FAIN module in a CSN according to an embodiment of the present disclosure;

[0044] FIG12 is a logic block diagram of a two-stage compression structure implemented based on CSN according to an embodiment of the present disclosure;

[0045] FIG13 is a logic block diagram of another structure of the first-level compression structure in FIG12;

[0046] FIG14 is a logic block diagram of the compression circuits of stage 0 and stage 1 according to an embodiment of the present disclosure;

[0047] FIG15 is a logic block diagram of the compression circuits of the second and third stages according to an embodiment of the present disclosure;

[0048] FIG16 is a logic block diagram of a compression circuit from stage 63 to stage 64 according to an embodiment of the present disclosure;

[0049] FIG17 is a logic block diagram of a 65th-stage compression circuit according to an embodiment of the present disclosure.

[0050] Details

[0051] The present disclosure describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present disclosure.

[0052] In the description of the present disclosure, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment described as "exemplary" or "for example" in the present disclosure should not be interpreted as being more preferred or advantageous than other embodiments. "And / or" in this article is a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. "Multiple" refers to two or more than two. In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present disclosure, words such as "first" and "second" are used to distinguish between identical or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different.

[0053] In the description of this application, "including any one or more of the following: option 1, option 2,..." or "including any one or more of option 1, option 2,..." means including any one of the listed options, or any combination of multiple options. For example, "including any one or more of the following: A, B" or "including any one or more of A and B" means including only A, or only B, or including A and B; for another example, "including any one or more of the following: A, B, C" or "including any one or more of A, B, C" means including only A, or only B, or only C, or including A and B, or including A and C, or including B and C, or including A, B and C. The same applies to options with more numbers.

[0054] When describing representative exemplary embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps in the specific order described. As will be understood by those skilled in the art, other sequences of steps are also possible. Therefore, the specific sequence of the steps set forth in the specification should not be interpreted as a limitation to the claims. In addition, the claims for the method and / or process should not be limited to the steps performed in the order written, and those skilled in the art can readily understand that these sequences can vary and still remain within the spirit and scope of the disclosed embodiments.

[0055] The SHA-256 algorithm can convert length less than 2 64 The 256-bit input message (also called input data) is converted into a 256-bit message digest. The message block length is 512 bits, and the message word length of the iterative compression process is 32 bits. SHA-384 and SHA-512 support a maximum length of 2 128 The message word length is 64 bits. The operation during iterative compression is basically the same, except that the initial value used is different.

[0056] The following description uses the SHA-256 algorithm as an example, but the method and apparatus of the embodiments of the present disclosure can also be used to implement other SHA-2 algorithms.

[0057] The SHA-256 algorithm uses functions Ch, Maj, ∑0, and ∑1 for data compression and functions σ0 and σ1 for data expansion. These functions are defined as follows:

[0058] The symbols in the above function have the following meanings: ∧ Bitwise AND operation ∨ Bitwise OR operation Bitwise XOR operation Bitwise inversion operation ROTR n (x) Circular right shift operation, circularly shift x right by n bits SHR n (x) right shift operation\, shift x right by n bits and fill the left side with 0

[0059] The SHA-256 algorithm mainly consists of three parts: message padding, data expansion and data compression.

[0060] Message Filling

[0061] First, a 1-bit is added to the end of a message of length L, followed by K 0-bits, and finally, 64 bits of length information are appended. This is shown in Figure 1A. For example, when padding the plaintext hexadecimal message "616263," according to the padding rule, the first step is to add a 1-bit to the end of the message, and the second step is to add 0 bits, resulting in a total of 512-24-1-64=423 bits. The third step is to add 64 bits of length information. The length of the input message is 6 x 4 = 24 bits, and 24 in decimal is represented as 18 in hexadecimal. Therefore, the 64-bit length information is "0000 0000 0000 0018."

[0062] Data expansion

[0063] The padded message can be divided into multiple 512-bit message blocks. The SHA-256 algorithm uses two message words during iterative compression. One is a 32-bit fixed constant, also called a fixed message word, with a total of 64, represented by K0, K1…, K 63 The other is the message word generated by message block expansion. Each message block is expanded to generate 64 32-bit message words. The rules for message block expansion are as follows:

[0064] Divide the message block into 16 message words W0, W1…, W 15 ;and

[0065] The remaining 48 message words W are obtained according to the following formula: 16 ,W 17 …,W 63 : W j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 j=16,17,…,63

[0066] The functions σ0 and σ1 used are as described above and will not be repeated here.

[0067] Data compression

[0068] The data compression of the SHA-256 algorithm is an iterative compression process. A message block is iteratively compressed at 64 levels to output a 256-bit hash value.

[0069] The iterative compression process uses 8 variables a, b, c, d, e, f, g, h and 64 fixed constant message words K n , and the 64 message words W generated by expansion n , n=0,1,…,63, variables and message words are both 32 bits.

[0070] In the SHA-256 algorithm, each level of iterative compression performs the same compression operation. The single-level iterative function is expressed as follows: n+1 =g n g n+1 =f n f n+1 =e n e n+1 =d n +h n +∑1e n +Ch(e n ,f n ,g n )+K n +W n d n+1 =c n c n+1 =b n b n+1 =a n a n+1 =∑0a n +Maj(a n ,b n ,c n )+h n +∑1e n +Ch(e n ,f n ,g n )+K n +W n

[0071] In this paper, the above single-level iterative function is called the original single-level iterative function. In this paper, a and a, b and b, c and c, d and d, e and e, f and f, g and g, h and h, i and i, j and j, n and n, etc., represent the same variable.

[0072] After the input message is divided into multiple message blocks, when compressing the first message block, the initial values ​​of the eight variables a0, b0, c0, d0, e0, f0, g0, and h0 are fixed. After 64 levels of iterative compression, the output values ​​of the eight variables a 63 ,b 63 ,c 63 ,d 63 ,e 63 ,f 63 ,g 63 ,h 63 Modulo 2 with their respective initial values 32The compressed output of the first message block is obtained by adding and concatenating the two blocks. This output is a 256-bit hash value. Starting from the second message block, the output of the previous message block is used as the initial value of the eight variables when compressing each message block. The compression is repeated in the same way until all message blocks are compressed. The 256-bit message digest of the input message is output.

[0073] FIG1B shows a chip that can implement the SHA-256 algorithm. The chip includes:

[0074] A message filling circuit is configured to fill in an input message;

[0075] a message expansion circuit configured to group the padded message blocks to obtain 16 message words; and to expand the 16 message words obtained by grouping to generate 48 message words;

[0076] a data compression circuit configured to perform 64-level iterative compression based on the 64 message words output by the message grouping module and the message word generation module to generate a message digest converted from the input message;

[0077] The control circuit is configured to work in conjunction with the control message filling circuit, the message expansion circuit, and the data compression circuit to implement conversion of the input message according to the SHA-256 algorithm.

[0078] Among the chip input signals shown in the figure, Rst is the reset signal, Clk is the clock signal, Last_byte is the end signal, data_in is the input message data, data_en = 1 indicates valid input data, and Vbit. Last_byte is the end signal, indicating the last set of valid data input. Among the output signals, digest is the final message digest converted from the input message, bingo_buf is the valid flag for the message digest value, and fifo_read is the control bit for reading data from the external FIFO. The above signals are only exemplary; other signals may be added or removed.

[0079] The chip may be an application specific integrated circuit (ASIC) chip but is not limited thereto.

[0080] High-throughput SHA-256 is typically implemented in hardware using a pipelined architecture. An exemplary SHA-256 fully pipelined circuit architecture is shown in Figure 2, comprising a pipelined data compression circuit and a message expansion circuit. Taking the processing of a message block as an example, upon each clock trigger edge, the message expansion circuit enters a new message block M, splits M into message words W0-W15, and stores them in the data expansion circuit's first-stage register group, Wt Reg. W0 is input to the stage 0 compression circuit (compressor) for first-stage compression. Then, with each clock trigger edge, the message block continues to flow through the pipeline and is progressively expanded by the expander circuit to generate message words W16-W63. Simultaneously, message words W1-W63 are progressively input to the corresponding compression circuit for progressive compression, until 64 levels of compression are completed, resulting in the compressed output data for the message block. After processing the message block, all information related to the message block is removed from the pipelined architecture. The data compression circuit uses a 64-stage variable register, AH Reg, to temporarily store variable values. The data expansion circuit uses a 64-level message word register Wt Reg to temporarily store the expanded message word.

[0081] In the above pipeline structure, the single-stage compression circuit corresponds to the single-stage iterative function of the SHA256 algorithm. An exemplary single-stage compression circuit is shown in Figure 3. The rectangular box in the figure is the variable register. The eight variable registers on the left are called input-side registers, which are used to store the values ​​of variables a, b, c, d, e, f, g, and h after n iterations. n ,b n ,c n ,d n ,e n ,f n ,g n ,h n The eight variable registers on the right are called output side registers, which are used to store the values ​​of variables a, b, c, d, e, f, g, and h after n+1 iterations. n+1 ,b n+1 ,c n+1 ,d n+1 ,e n+1 ,f n+1 ,g n+1 ,h n+1 The output register of the nth compression circuit is the input register of the n+1th compression circuit, n = 0, 1, 2, ..., 63, a0, b0, c0, d0, e0, f0, g0, h0 represent the values ​​of the variables a, b, c, d, e, f, g, h that have not been iterated, that is, the initial values ​​of the variables a, b, c, d, e, f, g, h.

[0082] In this paper, for the sake of convenience, xm Represents the value of variable x after m iterations. x can be any variable, including a, b, c, j, e, f, g, and i, and can also be an intermediate variable, such as i and j in the following embodiment.

[0083] For convenience, input-side and output-side registers are represented in this document using the symbols corresponding to the variables they store. For example, among input-side registers, the register used to store the data for variable a is called register A, abbreviated as A; the register used to store the data for variable b is called register B, abbreviated as B; the register used to store the data for variable c is called register C, abbreviated as C; and so on. Among output-side registers, the register used to store the data for variable a is called register A', abbreviated as A'; the register used to store the data for variable b is called register B', abbreviated as B'; the register used to store the data for variable c is called register C', abbreviated as C'; and so on.

[0084] In some embodiments, the variables stored in the input-side registers and output-side registers may differ at different stages. For example, the compression circuits of stages 0 to 2 have registers storing the data of variables d and h, referred to as registers D and H. The compression circuits of stages 3 to 62 do not have registers storing the data of variables d and h, but instead have registers storing the data of variables i and j, referred to as registers I and J. However, registers I and J can be identical to registers D and H in hardware.

[0085] The boxes in Figure 3 represent various operators, and the lines with arrows represent the data flow. The boxes marked with "+" represent modulo 2. 32 adder; the box marked with "Ch" represents the circuit for implementing the function Ch operation, which is called the Ch operator; the box marked with "Maj" represents the circuit for implementing the function Maj operation, which is called the Maj operator; the box marked with "∑0" represents the circuit for implementing the function ∑0 operation, which is called the ∑0 operator; the box marked with "∑1" represents the circuit for implementing the function ∑1 operation, which is called the ∑1 operator.

[0086] The expressions of functions Ch, Maj, ∑0 and ∑1 are given above as follows:

[0087] According to the above expressions, the Ch operator, the Maj operator, the ∑0 operator, and the ∑1 operator can be implemented using a variety of gate-level circuits. The embodiments of the present disclosure are not limited to a specific implementation method.

[0088] The critical path of a single-stage compression circuit is a n+1 and e n+1In the single-stage compression circuit shown in Figure 3, in order to obtain a n+1 and e n+1 , all need to perform 6 addition operations, the path is long, which will affect the operating frequency of the chip and affect the chip's performance and power consumption.

[0089] The disclosed embodiment optimizes the compression structure of the SHA256 algorithm, spreading the addition operation as evenly as possible over the iterative operations of multiple variables to shorten the critical path.

[0090] To this end, the embodiment of the present disclosure will n ,K n ,d n ,h n Add in advance, introduce variable i, let: i n =d n +h n +K n +W n =c n-1 +g n-1 +K n +W n

[0091] There are: n+1 =c n +g n +K n+1 +W n+1

[0092] Due to: n+1 =d n +h n +∑1e n +Ch(e n ,f n ,g n )+K n +W n

[0093] There is: e n+1 =i n +∑1e n +Ch(e n ,f n ,g n )

[0094] Because: a n+1 =∑0a n +Maj(a n ,b n ,c n )+h n +∑1e n +Ch(e n ,f n ,g n)+K n +W n

[0095] There are: a n+1 =∑0a n +Maj(a n ,b n ,c n )+i n +∑1e n +Ch(e n ,f n ,g n )-d n

[0096] There are: a n+1 =∑0a n +Maj(a n ,b n ,c n )+e n+1 -d n

[0097] Calculate e in advance n+1 -d n , introduce the variable j, let: j n =e n+1 -d n =e n+1 -c n-1

[0098] There are: n+1 =e n+2 -c n

[0099] Because: a n+1 =∑0a n +Maj(a n ,b n ,c n )+e n+1 -d n

[0100] There are: a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0101] The improved single-stage iterative function of the embodiment of the present disclosure is obtained: n+1 =e n+2 -c n i n+1 =c n +g n +Kn+1 +W n+1 h n+1 =g n g n+1 =f n f n+1 =e n e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ) d n+1 =c n c n+1 =b n b n+1 =a n a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0102] In the improved formula above, variables h and d do not participate in the calculation of other variables as intermediate variables, but are simply obtained by beating variables g and c. Therefore, the intermediate calculation process can be temporarily removed. 62 Get h 63 , according to c 62 Get d 63 That's it.

[0103] According to the improved single-stage iterative function above, the optimized compression circuit is shown in Figure 4. n+1 and e n+1 Only two addition operations need to be performed on the critical path, which is much shorter than the previous six.

[0104] The compression structure of Figure 4 requires e n+2 Generate j n+1 In order to make the data flow more reasonable, the variable e can be iterated twice in advance relative to the variable j, so that e n+2 You can n+1 As obtained before, the variables e, f, g, and i are strongly correlated with each other. In this embodiment, the iterative operations of e, f, g, and i are advanced together. The modified compression structure is shown in FIG5 .

[0105] However, after moving, i n+1 Need to use c n , and c n Than i n+1 Then we get: In order to make the data flow more reasonable, we can get:n+1 =b n b n+1 =a n

[0106] We can get c n =a n-2 , so: i n+1 =a n-2 +g n +K n+1 +W n+1

[0107] The corresponding compressed structure is shown in Figure 6.

[0108] By applying the compression structure shown in FIG6 to a single stage, a single-stage compression circuit as shown in FIG7 can be obtained. The single-stage iterative function corresponding to the single-stage compression circuit is as follows: n+1 =e n+2 -c n i n+1 =a n-2 +g n +K n+1 +W n+1 h n+1 =g n g n+1 =f n e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ) c n+1 =b n b n+1 =a n a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0109] The above single-level iterative function can also be added with expressions for variables h and d: n+1 =e n , d n+1 =c n However, as mentioned above, in some single-stage compression circuits, iterative operations on variables d and f may not be performed.

[0110] The single-stage iterative function is based on the variable data being the variable's value. If the variable data is the bitwise inversion of the variable, the expression of the single-stage iterative function will adapt. Furthermore, based on the compression circuit shown in FIG7 , the hardware structure can also be modified to implement the single-stage iterative function using a variety of hardware structures.

[0111] In this article, the bitwise inversion of a variable is the value of a variable such as a n ,b n ,c n The value obtained by bitwise inversion is recorded as

[0112] Based on the above-mentioned single-stage iterative function, an embodiment of the present disclosure provides a data compression circuit for the secure hash algorithm SHA-256, wherein the n-th stage single-stage compression circuit is an iterative circuit with intermediate variables, n=n1, n1+1, n1+1, ..., n2, n2>n1≥3, and the iterative circuit includes:

[0113] 8 input-side registers A, B, C, J, E, F, G, I, where A, B, C, D output the data of variables a, b, c, j after n-2 iterations respectively, and E, F, G, I output the data of variables e, f, g, i after n iterations respectively;

[0114] 8 output-side registers A', B', C', J', E', F', G', I', where A', B', C', J' respectively store the data of variables a, b, c, j after n-1 iterations, and E', F', G', I' respectively store the data of variables e, f, g, i after n+1 iterations;

[0115] The first pre-processing circuit is configured to perform an iterative operation of the variable i based on the input message word and the output of A and G, and obtain i n+1 or And satisfy i n+1 =a n-2 +g n +K n+1 +W n+1 ;

[0116] The operation circuit of variable e is set to perform one iterative operation of variable e based on the output of I, E, F, G, and obtain e n+1 or And satisfy e n+1 =i n +∑1e n +Ch(e n ,f n ,g n );

[0117] The second preprocessing circuit is set to perform one iteration of the variable j based on the output of E and C to obtain j n-1 or And satisfy j n-1 =e n -c n-2 ;

[0118] The operation circuit of variable a is set to perform one iterative operation of variable a based on the output of A, B, C, and J to obtain a n-1 or And satisfy a n-1 =∑0a n-2 +Maj(a n-2 ,b n-2 ,c n-2 )+j n-2 ;

[0119] Among them, A and B', B and C', E and F', and F and G' are directly connected;

[0120] Among them, x m Represents the value of variable x after m iterations, where x is a,b,c,j,e,f,g,i; K n+1 is the n+1th fixed message word, W n+1 It is the n+1th message word obtained by grouping or expanding the input message block.

[0121] In this article, the data of a variable can be the value of the variable such as a n-2 ,b n-2 ,c n-2 , or it can be the bitwise inversion of a variable, such as And so on. "Bitwise negation" is simply called "negation".

[0122] In this embodiment, when the data of the variable obtained by the iterative operation is the bitwise inverted value of the variable, Requirements to meet e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ), refers to bitwise inversion of e n+1 This embodiment optimizes the compression circuit, but the value of any variable after m iterations remains the value of the variable after m iterations of the SHA-256 algorithm and does not change, where m = 0, 1, 2, ..., 63.

[0123] In this embodiment, the calculation path of variables a and e is simplified to two addition operations. Among the two added intermediate variables, the calculation path of i has three additions, but does not have the relatively complex operators Maj, Ch, ∑0, ∑1 on the calculation paths of a and e. There is one subtraction operation on the calculation path of j. Therefore, through the iterative operation of variables i and j, the preprocessing of the calculation of variables a and e is realized, and the iterative operation of two variables is balanced as much as possible to the iterative operation of four variables. Compared with the iterative calculation of six additions of a and e in the original single-stage iterative function, the critical path is significantly shortened.

[0124] Furthermore, because the compression circuit can replace the registers used to store the data of variables h and d in the middle n-th compression circuit with registers that store the data of variables I and j, the number of registers does not increase. Therefore, when implemented on a chip, this improved compression circuit can provide higher performance, lower power consumption, and a smaller chip area.

[0125] In an exemplary embodiment of the present disclosure, the data compression circuit includes 66-stage compression circuits from stage 0 to stage 65, the 66-stage compression circuit is a pipeline structure, n1 is greater than or equal to 3, and n2 is less than or equal to 62;

[0126] Each level of the 66-level compression circuits includes 8 input-side registers and 8 output-side registers. The output-side register group of each level of the compression circuit is the input-side register group of the next level of the compression circuit.

[0127] In an example of this embodiment, n1=3, n2=62, that is, the compression circuits from the 3rd to the 62nd level are all iterative circuits of this embodiment (with intermediate variables), but the present disclosure is not limited to this. It is also possible to use the iterative circuit of this embodiment starting from the 4th level, the 5th level, or one or more levels later. In this case, the multiple single-stage compression circuits before the iterative circuit of this embodiment can be based on the compression circuit shown in Figure 3, but it is necessary to delay the variables a, b, c, d by 2 beats relative to the variables e, f, g, h (that is, perform 2 fewer iterations), and obtain the corresponding data of variables i, j by the iterative formula of the variables i, j in the single-stage iterative function of this embodiment in the previous level of the iterative circuit of this embodiment. Similarly, the iterative circuit of this embodiment can also end at the 61st level, the 60th level, or one or more levels earlier. After the end, the variables a, b, c, d, e, f, g, h can be used to complete the subsequent iterative operations. The specific compression circuit is not limited in this disclosure.

[0128] In an exemplary embodiment of the present disclosure, the iterative circuit includes a first iterative circuit; A, B, C, J, E, F, G, and I of the first iterative circuit respectively output a n-2 ,b n-2 ,cn-2 ,j n-2 ,e n ,f n ,g n ,i n ; A', B', C', J', E', F', G', I' of the first iterative circuit are stored in a n-1 ,b n-1 ,c n-1 ,j n-1 ,e n+1 ,f n+1 ,g n+1 i n+1 .

[0129] An example of this embodiment is shown in FIG7 , in the first iterative circuit:

[0130] The first pre-processing circuit includes an input terminal connected to the output terminals of A and G and receiving W n+1 , the output end is connected to the first adding circuit of I'; the first pre-processing circuit is configured to perform an iterative operation i of the variable i once n+1 =a n-2 +g n +K n+1 +W n+1 Get i n+1 ;K n+1 It is a constant and can be used as an input, or it can be implemented through the internal logic of the circuit like CSK. n+1 The same operation results as when used as input.

[0131] The second pre-processing circuit includes an input terminal connected to the output terminals of C and E, and an output terminal connected to a first subtraction circuit of J'; the second pre-processing circuit is configured to perform one iterative operation j of the variable j n-1 =e n -c n-2 Get j n-1 ;

[0132] The operation circuit of the variable e includes a ∑1 operator whose input terminal is connected to the output terminal of E, a Ch operator whose input terminal is connected to the output terminals of E, F and G, and a second adding circuit whose input terminal is connected to the ∑1 operator, the Ch operator and the output terminal of I, and the output terminal of the second adding circuit is connected to the input terminal of E'; the operation circuit of the variable e is configured to perform one iterative operation e of the variable e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ) to get e n+1 ;

[0133] The operation circuit of the variable a includes a Maj operator whose input terminal is connected to the output terminals of A, B and C, a ∑0 operator whose input terminal is connected to the output terminal of A, and a third adding circuit whose input terminal is connected to the Maj operator, the ∑0 operator and the output terminal of J, and the output terminal of the third adding circuit is connected to the input terminal of A'; the operation circuit of the variable a is configured to perform one iterative operation a of the variable a. n-1 =∑0a n-2 +Maj(a n-2 ,b n-2 ,c n-2 )+j n-2 Get a n-1 .

[0134] The direct connections between A and B', B and C', E and F', and F and G' are set to respectively n-2 ,b n-2 ,e n ,f n Hit a beat to get b n-1 ,c n-1 ,f n+1 ,g n+1 .

[0135] Based on the n-th level compression circuit shown in Figure 7, for additions with more than two inputs, a carry-save adder (CSA) can be used to achieve 3-2 simplification, converting the addition of three numbers into the addition of two numbers. For additions with only two inputs, a carry-propagating adder (CPA) can be used. The CPA accepts two inputs, a1 and a2, and produces an output, b. The CSA (carry-save adder) has two outputs: a carry (cout) and a sum (sum). When adding multiple data points, the CSA preserves the carry, propagating the carry only once, effectively reducing computational latency.

[0136] In one example of this embodiment, using a CSA, the corresponding n-stage compression circuit is shown in Figure 8 . The block labeled "CSA" in the figure represents the CSA. The first adding circuit includes a first CSA, a second CSA, and an adder for adding two numbers, which are connected in series. The adder for adding two numbers is represented by a block with a "+" in the figure, using the CPA as an example. The second and third adding circuits both include a CSA and a CPA connected in series.

[0137] In this embodiment, the input-side register and the output-side register in the n-th stage compression circuit are registers whose output is the same as the input, and the iterative circuit in the n-th stage compression circuit adopts the first iterative circuit shown in FIG. 7 or FIG. 8 .

[0138] In the single-stage compression circuits used in the embodiments shown in Figures 7 and 8, the input-side and output-side registers used can be registers with the same input and output, i.e., registers with Q outputs. However, in another embodiment of the present disclosure, a register whose output is the inverse of its input, i.e., a register with QN outputs, can also be used. Compared to Q-output registers, registers with QN outputs have one less NOT gate (inv), resulting in a smaller area and lower latency.

[0139] When registers output by QN are used as input-side and output-side registers in a data compression circuit, if the data of the variable stored in the input-side register is the value of the variable, such as a0, b0, c0, d0, e0, f0, g0, h0, a2, b2, c2, d2, e2, f2, g2, h2, etc., then the data output from the input-side register will become the bitwise inverted value of the variable.

[0140] After bitwise inversion, the single function changes as follows:

[0141] After adding multiple variables, we can invert them bit by bit:

[0142] Based on the single-level iterative function when the variable data is the value of the variable, we can deduce the single-level iterative function when the variable data is the bitwise inverted value of the variable. The following is a comparison between the two:

[0143] Based on the value of the variable: j n+1 =e n+2 -c n

[0144] Based on the bitwise negation of the variable:

[0145] Based on the value of the variable: i n+1 =a n-2 +g n +K n+1 +W n+1

[0146] Based on the bitwise negation of the variable:

[0147] Based on the value of the variable: e n+1 =i n +∑1e n +Ch(e n ,f n ,g n )

[0148] Based on the bitwise negation of the variable:

[0149] Based on the value of a variable: n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0150] Based on the bitwise negation of the variable:

[0151] In the above expression, the message word output from the message expansion circuit to the data compression circuit is K n+1 and W n+1 In the case of It can be expressed as K n+1 , It can be expressed as W n+1 , this transformation is equivalent.

[0152] Considering that in the nth level compression structure, variables e, f, g, and i have undergone two more iterations than a, b, c, and j, the single-level iterative function based on the bitwise inversion of the variables can be expressed as follows:

[0153] This single-stage iterative function based on bitwise complement of a variable is a variation of a single-stage iterative function based on the value of a variable, both of which satisfy the SHA-256 algorithm. The resulting bitwise complement of the variable is stored in a QN output register, where its output can be converted to the value of the variable or, through a NOT gate, to the value of the variable.

[0154] In an exemplary embodiment of the present disclosure, if the input-side register and output-side register in the n-th stage compression circuit are registers whose outputs are the inverse of their inputs, and the iterative circuit of this embodiment is used, then, in two adjacent iterative circuits, if the input-side register of the first iterative circuit outputs the bitwise inverse value of a variable, then the input-side register of the second iterative circuit outputs the value of the variable. Because the bitwise inverse of the variable is stored in the input-side register of the second iterative circuit after the iterative operation of the first iterative circuit, and the input-side register is a register with QN output, the input-side register of the second iterative circuit outputs the value of the variable. See Figure 9B.

[0155] Therefore, in the embodiment of the present disclosure, the iterative circuit as the nth stage compression circuit includes a first iterative circuit and a second iterative circuit, n = n1, n1+1, n1+2, ..., n2, n2>n1≥3, wherein A, B, C, J, E, F, G, and I of the second iterative circuit are output respectively A', B', C', J', E', F', G', and I' of the second iterative circuit are respectively saved as

[0156] In an example of this embodiment, referring to the circuits on the left side of FIG. 9A and FIG. 9B , in the second iterative circuit:

[0157] The first pre-processing circuit includes a first NOT gate whose input end is connected to the output end of A, and an input end connected to G and the output end of the first NOT gate and receives W n+1 The first subtraction circuit is configured to execute an iterative operation of the variable i once, wherein the output terminal of the first subtraction circuit is connected to the input terminal of I'; the first preprocessing circuit is configured to execute an iterative operation of the variable i once get K n+1 A constant can be used as an input and the corresponding logical operation can be implemented using the internal logic of the circuit.

[0158] The second pre-processing circuit includes a second NOT gate having an input connected to the output of C, an adding circuit having an input connected to the second NOT gate and the output of E, and an output of the adding circuit connected to the input of J'; the second pre-processing circuit is configured to perform one iterative operation on the variable j. get

[0159] The operation circuit of the variable e includes a third NOT gate having an input connected to the output of I, a ∑1 operator having an input connected to the output of E, a Ch operator having an input connected to the outputs of E, F, and G, a fourth NOT gate having an input connected to the output of the ∑1 operator, and a second subtraction circuit having an input connected to the outputs of the Ch operator, the third NOT gate, and the fourth NOT gate, wherein the output of the second subtraction circuit is connected to the input of E'; the operation circuit of the variable e is configured to perform one iterative operation of the variable e get

[0160] The operation circuit of the variable a includes the first NOT gate, a fifth NOT gate whose input terminal is connected to the output terminal of J, a Maj operator whose input terminal is connected to the output terminals of A, B and C, a ∑0 operator whose input terminal is connected to the output terminal of the first NOT gate, and a third subtraction circuit whose input terminal is connected to the Maj operator, the ∑0 operator and the output terminal of the fifth NOT gate, and the output terminal of the third subtraction circuit is connected to the input terminal of A'; the operation circuit of the variable a is configured to perform one iterative operation of the variable a get

[0161] The direct connections between A and B', B and C', E and F', and F and G' are set to After a beat, you get

[0162] The first pre-processing circuit and the operation circuit of the variable a both include a first NOT gate, that is, the first NOT gate is shared by the two circuits.

[0163] Corresponding to the CSA that combines the addition of three numbers into the addition of two numbers, a new device can be designed: the carry save subtracter (CSS). The expression structure of CSS is as follows: xyz = CSS(x,y,z) = sc. In other words, CSS is set to simplify the subtraction operation xyz of three input operands x,y,z into the subtraction operation sc of two output operands, where

[0164] As shown in FIG9A , some or all of the first, second, and third subtraction circuits in the second iterative circuit utilize carry-save subtractors (CSSs) to simplify the subtraction of three operands to two operands. Because the first preprocessing circuit has four operands, two CSSs are first used to perform two 3-2 simplifications to obtain two operands, and then a single conventional subtractor is used to perform the subtraction of these two operands.

[0165] In one example of this embodiment, the input-side register and the output-side register in the n-th stage compression circuit are registers whose output is the inverse of the input; of the two adjacent iterative circuits, one is the first iterative circuit and the other is the second iterative circuit. As shown in Figure 9B , the compression circuit on the left side of Figure 9B is the second iterative circuit, and the compression circuit on the right side is the first iterative circuit.

[0166] In an exemplary embodiment of the present disclosure, an improvement is made to the CSA, and a new device is designed, which is referred to herein as a carry-save adder negation circuit, abbreviated as a CSN circuit or CSN.

[0167] The FA1 module is a 1-bit full adder, the basic unit of a CSA. A full adder is a binary addition circuit capable of calculating carries from the low-order bits. Compared to a half adder, a full adder considers not only whether a carry occurs in the current bit but also any carries from the previous bit into the current bit. Its inputs and outputs are shown in Figure 10. Its inputs include A, B, and CI, where A and B are the numbers to be added, and CI is the carry input. Its outputs include S and CO, where S is the sum and CO is the carry output (referred to as the carry in this article). The truth table for the FA1 module is as follows:

[0168] In the FA1 module, the outputs of S and CO actually have an internal inverter in their physical implementation. Removing this inverter reduces area, power consumption, and latency. The modified device is named the full adder inverting circuit, abbreviated as FA1N, as shown in Figure 11. Its truth table is the opposite of FA1 and is as follows:

[0169] The expression structure of FAIN is: FA1N(COn,Sn)=A+B+CI

[0170] Easy to launch:

[0171] The embodiment of the present disclosure operates on 32-bit data, and 32 FAINs can be used to form a CSN. It is easy to understand that the CSN based on FAIN is set to perform logical operations on the three input operands and output COn and Sn. Sn is the bitwise inverse value of the sum of the three operands, and COn is the bitwise inverse value of the carry of the three operands. In this article, the sum of the three operands refers to the output S obtained by inputting the three numbers into the CSA, and the carry of the three operands refers to the carry CO obtained by inputting the three numbers into the CSA. Sn is also recorded as COn is also recorded as After bitwise inversion of the three numbers A, B, and C, they are input into CSN. The two numbers output are the same as the two numbers output by CSA when A, B, and C are input into CSA.

[0172] Therefore, one embodiment of the present disclosure provides a logic operation circuit, or CSN, configured to perform a logic operation on three input operands and output two operands, one of which is the bitwise inverse of the sum of the three operands, and the other is the bitwise inverse of the carry resulting from the addition of the three operands. The CSN includes one or more 1-bit full adder inversion circuits, each of which is obtained by eliminating one inverter in a 1-bit full adder.

[0173] Based on the register output by QN and combined with the CSN of the embodiment of the present disclosure, the SHA-256 data compression circuit is re-derived as follows:

[0174] First, define several variants of function expressions in sha256 as follows:

[0175] That is, when the input is the same, the Chn operator, Majn operator, ∑ n0 Operator and ∑ n1 The output of the operator is the bitwise inverse of the output of the Ch operator, Maj operator, ∑0 operator and ∑1 operator. Taking the Chn operator as an example, when the input is x, y, z, the output is If the input is Then the output of the Chn operator is the same as the output of inputting x, y, z into the Ch operator. n0 Operator and ∑ n1 The operators are similar and will not be described in detail. In actual physical implementation, the above Chn operator, Majn operator, ∑ n0 Operator and ∑ n1 The size of the operator is comparable to that of the Ch operator, the Maj operator, the ∑0 operator, and the ∑1 operator.

[0176] Using the above Chn operator, Majn operator, ∑ n0 Operator and ∑ n1 operator, and selects a register with QN output. The compression circuit of two adjacent stages in the embodiment of the present disclosure is shown in FIG12 .

[0177] Among the eight input registers of the first stage circuit in Figure 12, the four registers A, B, C, and I used to store the variables a, b, c, and i output the values ​​of a, b, c, and i. n-2 ,b n-2 ,c n-2 ,i n , the four registers J, E, F, G used to store variables j, e, f, g output the bitwise inverted values ​​of j, e, f, g Correspondingly, the eight output side registers A', B', C', J', E', F', G', and I' store the iterated a n-1 ,b n-1 ,c n-1 , i n+1 In the second stage circuit, since the output is the inverse of the input, the four registers A, B, C, and I used to store the variables a, b, c, and i output the bitwise inverse of a, b, c, and i. The four registers J, E, F, and G used to store variables j, e, f, and g output the values ​​of j, e, f, and g. n-1 ,e n+1 ,f n+1 ,g n+1 Correspondingly, in the 8 output side registers, A', B', C', J', E', F', G', I' respectively store the iterated j n-1 ,e n+1 ,f n+1 ,g n+1 ,

[0178] The formulas related to bitwise inversion are:

[0179] Take the iterative operation of variable a in the first-stage compression circuit in FIG12 as an example. Here, the iterative operation of variable a uses the Majn operator, ∑ n0 operator, CSN and an adder. The input of the Majn operator is a n-2 ,b n-2 ,c n-2 , the output is ∑ n0 The input of the operator is a n-2 , the output is Therefore, the input of CSN is and Then the output of CSN is the same as Maj(a n-2 ,b n-2 ,c n-2 ),Σ0(a n-2 ) and j n-2 When inputting CSA, the output of CSA is the same, recorded as S and CO. Then S and CO are added together through an adder to get a n-1 Therefore, a n-1 =∑0a n-2 +Maj(a n-2 ,b n-2 ,c n-2 )+j n-2 .

[0180] Take the iterative operation of the variable e in the first stage compression circuit in FIG12 as an example. Here, the iterative operation of the variable e uses the Chn operator, ∑ n1 operator, CSN and an adder that adds 2 input numbers to 1. The input of the Chn operator is The output can be recorded as Ch(e n ,f n,g n );∑ n1 The input of the operator is The output can be recorded as ∑1e n ; Then the input of CSN is Ch(e n ,f n ,g n ),∑1e n and i n , the output can be written as and In the adder Adding 1, the output is Right now equal According to the formula It can be seen that According to the formula It can be seen that therefore Therefore n+1 =S+CO; Here S, CO is Ch(e n ,f n ,g n ),∑1e n and i n Input the sum and carry obtained by CSA, so we know the variable e n+1 The value of satisfies: e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ).

[0181] Take the iterative operation of variable j in the first stage compression circuit in Figure 12 as an example. Here, the iterative operation of variable j uses an adder, and the input of the adder is and c n-2 , the output is Right now According to the formula It can be seen that It can be seen that j is satisfied n-1 =e n -c n-2 .

[0182] The iterative operation of variable i in the first-stage compression circuit of Figure 12 uses a new device. This new device is based on the CSN. For the case where one input is a constant K and the other input needs to be negated, a corresponding logic circuit is designed based on the truth table between the two inputs and two outputs. It is abbreviated as CSK in this article.

[0183] Referring to FIG13 , the original structure of the CSK is shown in FIG13 , which includes a NOT gate and a first CSN in the bottom row. The first CSN uses the output g of the NOT gate. n and a n-2 There are two inputs, the other input is a fixed message word K n+1 , due to K n+1 is a constant, so the structure has only two inputs, namely the values ​​of variables a and g. Therefore, the two outputs of this CSN are and middle, Equal to g n ,a n-2 and K n+1 The bitwise inverse of the carry in addition, Equal to g n ,a n-2 and K n+1 The bitwise inverse of the sum being added.

[0184] The two inputs and two outputs of CSK are both 32-bit data. For each bit in the 32-bit data, the truth table between the two inputs and outputs can be derived according to the above requirements:

[0185] When K = 0, the truth table between input and output is as follows:

[0186] Right now:

[0187] When K = 1, the truth table between input and output is as follows:

[0188] Right now:

[0189] For each of the 32 bits, a corresponding logic circuit is constructed according to the truth table to obtain CSK.

[0190] Therefore, an embodiment of the present disclosure further provides a logic operation circuit, namely CSK, which is configured to perform a logic operation based on two input operands g and a and a constant K, and output two operands s and c, where s is equal to The bitwise inverse of the sum added to K, c is equal to The bitwise inverse value of the carry added to K. CSK may include one or more 1-bit arithmetic circuits, and the 1-bit arithmetic circuits satisfy: when K=0, the two outputs s and c satisfy: When K=1, the two outputs s and c satisfy:

[0191] In the data compression circuit, the constants used by CSK are different fixed message words Kn+1 , so each CSK will be due to K n+1 However, using CSK can reduce module area, power consumption and improve performance.

[0192] Taking the iterative operation of variable i in the first-stage compression circuit in FIG12 as an example, combined with FIG13, verify whether the iterative operation of variable i satisfies: i n+1 =a n-2 +g n +K n+1 +W n+1 Here, the iterative operation of variable i uses CSK, CSN and adder (unless otherwise specified, the adder in this article is an adder that inputs two operands and outputs a sum). As mentioned above, CSK is equivalent to using the non-gatekeeper becomes g n , and then g n ,a n-2 and K n+1 Input a CSN, the two outputs of the CSK are recorded as and in, It is g n ,a n-2 and K n+1 The bitwise inverse of the sum of the additions, It is g n ,a n-2 and K n+1 The bitwise inversion of the added carry. CSN receives the two outputs of CSK and right and Perform logic operation and output CO2 and S2, where S2 is and The bitwise inverse value of the sum of the additions, CO2 is and The carry bit of the addition is inverted. Then CO2 and S2 are added in the adder to get i n+1 According to the formula above, i n+1 is equal to CO1, S1 and W n+1 Additive, and CO1 and S1 add equal to a n-2 +g n +K n+1 , so we can know that i n+1 =a n-2 +g n +K n+1 +W n+1 .

[0193] It can be seen from this that the first-stage compression circuit (i.e., the third iterative circuit) in FIG12 can implement the single-round iterative function of the embodiment of the present disclosure. For the second-stage compression circuit (i.e., the fourth iterative circuit) in FIG12, the iterative circuits of each variable are similar to those of the third iterative circuit and will not be described in detail. n+1 , and Perform logic operation and output CO1 and S1, where S1 is and The bitwise inverse value of the sum of additions, CO1 is and The input of CSN connected by CSK is the two outputs of CSK and W n+2 , the adder connected to CSN adds the two outputs of CSN and 1 to get i n+2 It can be verified in the same way that the fourth iterative circuit can also implement the single-round iterative function of the embodiment of the present disclosure. In addition, the two-stage compression circuit shown in FIG13 can also respectively implement the single-round iterative function of the embodiment of the present disclosure.

[0194] In the embodiment of the present disclosure, the iterative circuit includes a third iterative circuit; A, B, C, J, E, F, G, and I of the third iterative circuit respectively output a n-2 ,b n-2 ,c n-2 , i n ; A', B', C', J', E', F', G', I' of the third iterative circuit are stored in a n-1 ,b n-1 ,c n-1 , i n+1 .

[0195] In one example of the present disclosure, referring to the first-stage compression circuit of FIG12 , in the third iterative circuit:

[0196] The first pre-processing circuit includes an input terminal connected to the output terminals of A and G and receiving W n+1 The first pre-processing circuit is configured to process the data of a first operation circuit, wherein the output terminal of the first operation circuit is connected to the input terminal of I'; the first pre-processing circuit is configured to process the data of a first operation circuit, wherein the output terminal of the first operation circuit is connected to the input terminal of I'; n-2 , and K n+1 ,W n+1 The data of i is executed once for the iterative operation of variable i to obtain i n+1 ;K n+1 It is a constant and can be used as an input, or it can be implemented through the internal logic of the circuit like CSK. n+1The same operation results as when used as input.

[0197] The input end of the second pre-processing circuit is connected to the output end of C and E, and the output end is connected to J'; the second pre-processing circuit is configured to perform one iterative operation of the variable j get

[0198] The operation circuit of the variable e includes a ∑ n1 operator, the Chn operator whose input terminal is connected to the output terminal of E, F and G, and the Chn operator whose input terminal is connected to ∑ n1 The output terminal of the operator, the Chn operator and the second operation circuit connected to the output terminal of I, the output terminal of the second operation circuit is connected to the input terminal of E'; the operation circuit of the variable e is set to be based on and i n To perform one iteration of the variable e, we get

[0199] The operation circuit of the variable a includes a Majn operator whose input end is connected to the output ends of A, B and C, and a ∑ n0 operator, and the input terminal and the Majn operator, ∑ n0 The output terminal of the operator and J is connected to the third operation circuit, and the output terminal of the third operation circuit is connected to the input terminal of A'; the operation circuit of the variable a is set to be based on a n-2 ,b n-2 ,c n-2 , Execute 1 iteration of variable a to get a n-1 ;

[0200] The direct connections between A and B', B and C', E and F', and F and G' are set to respectively n-2 ,b n-2 , Hit a beat to get b n-1 ,c n-1 ,

[0201] In the embodiment of the present disclosure, the iterative circuit further includes a fourth iterative circuit; A, B, C, J, E, F, G, and I of the fourth iterative circuit are output respectively j n-2 ,e n ,f n ,g n , A', B', C', J', E', F', G', and I' of the fourth iterative circuit are respectively stored j n-1 ,en+1 ,f n+1 ,g n+1 ,

[0202] In an example of this embodiment, referring to the second stage compression circuit of FIG12 , in the fourth iterative circuit:

[0203] The first pre-processing circuit includes an input terminal connected to the output terminals of A and G and receiving W n+1 The output terminal of the fourth operation circuit is connected to the input terminal of I'; the first pre-processing circuit is configured to be based on and K n+1 ,W n+1 The data is iterated once by variable i to obtain

[0204] The input end of the second pre-processing circuit is connected to the output end of C and E, and the output end is connected to J'; the second pre-processing circuit is configured to perform one iterative operation of the variable j Get j n-1 ;

[0205] The operation circuit of the variable e includes a ∑ n1 operator, the Chn operator whose input terminal is connected to the output terminal of E, F and G, and the Chn operator whose input terminal is connected to ∑ n1 The output terminal of the operator, the Chn operator and the third operation circuit are connected to the output terminal of I, and the output terminal of the third operation circuit is connected to the input terminal of E'; the operation circuit of the variable e is set to be based on e n ,f n ,g n and To perform an iterative operation on the variable e once, we get e n+1 ;

[0206] The operation circuit of the variable a includes a Majn operator whose input end is connected to the output ends of A, B and C, and a ∑ n0 operator, and the input terminal and the Majn operator, ∑ n0 The output terminal of the operator and J is connected to the second operation circuit, and the output terminal of the second operation circuit is connected to the input terminal of A'; the operation circuit of the variable a is set to be based on j n-2 Execute 1 iteration of variable a to get

[0207] The direct connections between A and B', B and C', E and F', and F and G' are set to e n ,fn Hit the beat and get f n+1 ,g n+1 .

[0208] It should be noted that the example of the embodiment of the present disclosure still takes the nth stage compression circuit as an example to describe the fourth iterative circuit, while the second stage compression circuit of Figure 12 takes the n+1th stage compression circuit as an example, so the subscripts of the variables of the two are different.

[0209] In an example of an embodiment of the present disclosure, in the third iterative circuit and the fourth iterative circuit:

[0210] The second operation circuit includes a CSN circuit and a fourth adding circuit connected to the CSN circuit, the input end of the CSN circuit is the input end of the second operation circuit, wherein:

[0211] The CSN circuit is configured to perform logic operations on the three input operands and output and is the bitwise inverse of the sum of the three operands. is the bitwise inverse of the carry from the addition of the three operands;

[0212] The fourth adding circuit is configured to and 1, and the obtained sum is output from the output end of the fourth adding circuit, and the output end of the fourth adding circuit is the output end of the second operation circuit.

[0213] In FIG12 , the fourth adding circuit uses an arrow to indicate addition, but does not need to receive input. The logic of addition can be implemented inside the circuit.

[0214] In an example of an embodiment of the present disclosure, in the third iterative circuit and the fourth iterative circuit:

[0215] The third operation circuit includes a CSN circuit and a fifth adding circuit connected to each other, the input end of the CSN circuit is the input end of the third operation circuit, wherein:

[0216] The CSN circuit is configured to perform logic operations on the three input operands and output and is the bitwise inverse of the sum of the three operands. is the bitwise inverse of the carry from the addition of the three operands;

[0217] The fifth adding circuit is configured to and The sum is added and output from the output end of the fifth adding circuit, which is the output end of the third operation circuit.

[0218] In an example of an embodiment of the present disclosure, in the third iterative circuit:

[0219] The first operation circuit includes a first circuit, a first CSN circuit and a sixth adding circuit, wherein:

[0220] The input end of the first circuit is connected to the output end of A and G, and is set to be based on and K n+1 Perform logical operations and output and in, It is g n ,a n-2 and K n+1 The bitwise inverse of the sum of the additions, It is g n ,a n-2 and K n+1 The bitwise inverse of the carry in addition;

[0221] The input end of the first CSN circuit is connected to the output end of the first circuit and receives Set to input and Perform logic operation and output CO2 and S2, where S2 is and The bitwise inverse value of the sum of the additions, CO2 is and The bitwise inverse of the carry in addition;

[0222] The sixth adding circuit is configured to add CO2 and S2 and output the obtained sum to the input terminal of I'.

[0223] In this example, referring to FIG13 , the first circuit includes a sixth NOT gate and a second CSN, wherein: the input end of the sixth NOT gate is connected to the output end of G, and is configured to Invert the bit to get g n The input terminal of the second CSN circuit is connected to the output terminal of the sixth NOT gate and A and receives K n+1 , set to the input g n ,a n-2 and K n+1 Perform logical operations and output and In another example, the first circuit is implemented using CSK, which is based on the input Fixed message word Kn+1 and output and The truth table between .

[0224] In an example of an embodiment of the present disclosure, in the fourth iterative circuit:

[0225] The fourth operation circuit includes a second circuit, a third CSN circuit and a seventh adding circuit, wherein:

[0226] The input end of the second circuit is connected to the output end of A and G, and is set to be based on g n , and Perform logic operation and output CO1 and S1, where S1 is and The bitwise inverse value of the sum of additions, CO1 is and The bitwise inverse of the carry in addition;

[0227] The input end of the third CSN circuit is connected to the output end of the second circuit and receives W n+1 , set to input CO1, S1 and W n+1 Perform logical operations and output and in, CO1, S1 and W n+1 The bitwise inverse of the sum of the additions, CO1, S1 and W n+1 The bitwise inverse of the carry in addition;

[0228] The seventh adding circuit is configured to and 1, and the resulting sum is output to the input of I'.

[0229] In this example, the second circuit includes a seventh NOT gate and a fourth CSN circuit, wherein: the input end of the seventh NOT gate is connected to the output end of G, and is configured to n Invert the bitwise The input end of the fourth CSN circuit is connected to the output end of the seventh NOT gate and A and receives Set to input and Perform logic operation and output CO1 and S1. Alternatively, in another example, the second circuit is implemented using CSK, which is based on the input g n , Fixed message words And the truth table between the output of CO1 and S1 is constructed.

[0230] In one example, the two-stage compression structure shown in Figures 12 and 13 can be used starting from the 4th stage of the entire data compression circuit, for example, when some applications focus on performance starting from the 4th stage. Optimization can be started from the 4th stage (or the 5th, 6th, or even later stages). In this case, in the compression circuit from the 4th to the 62nd stage, the even-numbered stage circuit will use the third iterative circuit on the left, and the odd-numbered stage circuit will use the fourth iterative circuit on the right side of the figure. Starting from the 4th stage, the variable register type (QN output or Q output) can be selected or a NOT gate can be used so that the data of the variable output by the 4th stage input side register is the same as that of the first stage compression circuit or the second stage compression circuit in Figure 12.

[0231] Since e, f, g, i are iterated twice in advance relative to a, b, c, j in the single-stage compression circuit of the disclosed embodiment, the original 64-stage pipeline structure will be reduced to 66 stages. However, the compression circuit structures of at least the first three stages are somewhat different.

[0232] In the embodiment of the present disclosure, the original SHA256 algorithm is used to implement a1, e1, e2, and e3 at level 3, namely: a1 = ∑0a0+Maj(a0,b0,c0)+h0+∑1e0+Ch(e0,f0,g0)+K0+W0 e1 = d0+h0+∑1e0+Ch(e0,f0,g0)+K0+W0 e2 = d1+h1+∑1e1+Ch(e1,f1,g1)+K1+W1 e3 = d2+h2+∑1e2+Ch(e2,f2,g2)+K2+W2

[0233] Since the calculation of a, b, c, d is two beats later than that of e, f, g, i in the improved method of this embodiment, in the first three levels, a, b, c, d need to be delayed by two beats, and only a1, b1, c1, d1 can be obtained. When calculating e3, d2 cannot be used, and d2 = c1. Therefore, e3 is obtained by the following formula instead: e3 = c1 + h2 + ∑1e2 + Ch(e2, f2, g2) + K2 + W2

[0234] Similarly, the value of the variable j after one iteration can be calculated using j1=e2-d1, and the value of the variable i after three iterations can be calculated using i3=b1+g2+K3+W3.

[0235] In this article, the number of iterations for a variable's value depends on the values ​​of other variables from which the variable's value is calculated. Taking i3 as an example, when i3 is obtained based on the iteration of i3=b1+g2+K3+W3, then i3 is the value of variable i after 3 iterations.

[0236] In an exemplary embodiment of the present disclosure, the compression circuits of the 0th to 2nd stages are configured to perform iterative operations on the variables based on the initial values ​​a0, b0, c0, d0, e0, f0, g0, h0 of the variables a, b, c, d, e, f, g, h and the data of K0, K1, K2, K3, W0, W1, W2, W3, to obtain the data of the variables a, b, c, j after 1 iteration and the data of e, f, g, i after 3 iterations, and pass them to the 3rd stage compression circuit, wherein the data of j1 after 1 iteration satisfies j1=e2-d1, and the data of i after 3 iterations satisfies i3=b1+g2+K3+W3; wherein d m represents the value of variable d after m iterations, h m Represents the value of variable h after m iterations, where m is a natural number.

[0237] In this embodiment:

[0238] The 0th level compression circuit is configured to perform one iterative operation of the variables a, b, c, d, e, f, g, h based on the initial values ​​a0, b0, c0, d0, e0, f0, g0, h0 of the variables a, b, c, d, e, f, g, h and the data of K0, W0, obtain the data of the variables a, b, c, d, e, f, g, h after one iteration and pass it to the next level compression circuit;

[0239] The first stage compression circuit is configured to perform an iterative operation of variables e, f, g, h once based on the data of variables d, e, f, g after one iteration and the data of K1 and W1, and pass the obtained data of e, f, g, h after two iterations and the data of a, b, c, d after one iteration together to the next stage compression circuit;

[0240] The second-level compression circuit is configured to perform an iterative operation of the variables e, f, g once based on the data of the variable c after 1 iteration, the data of the variables e, f, g, h after 2 iterations, and the data of K2, W2, to obtain the data of the variables e, f, g after 3 iterations; based on the data of the variable b after 1 iteration, the data of the variable g after 2 iterations, and the data of K2, W2, to perform an iterative operation of the variable i once to obtain the data of the variable i after 3 iterations and satisfying i3=b1+g2+K3+W3; based on the data of the variable d after 1 iteration and the data of the variable e after 2 iterations, to perform an iterative operation of the variable j once to obtain the data of the variable j after 1 iteration and satisfying j1=e2-d1.

[0241] The above-mentioned level 0 compression circuit can be implemented based on the single-level iterative function of SHA-256, which will not be described in detail here.

[0242] In an example of this embodiment, as shown in FIG14 , the first-stage compression circuit includes:

[0243] 8 input side registers A, B, C, D, E, F, G, HI, output a1, b1, c1, d1, e1, f1, g1, h1 respectively;

[0244] 8 output-side registers A', B', C', D', E', F', G', H', storing a1, b1, c1, d1, e2, f2, g2, h2 respectively;

[0245] Perform one iteration of the variable e: e2 = d1 + h1 + ∑1e1 + Ch(e1, f1, g1) + K1 + W1 to obtain the operation circuit of e2;

[0246] Among them, A and A', B and B', C and C', D and D', E and F', F and G' and G and H' are directly connected, and a1, b1, c 1, D1 is directly passed to the output side, and E1, F1, and G1 are combined to obtain F2, G2, and H2.

[0247] In an example of this embodiment, as shown in FIG15 , the second-stage compression circuit includes:

[0248] The 8 input-side registers A, B, C, D, E, F, G, and H output a1, b1, c1, d1, e2, f2, g2, and h2 respectively;

[0249] The 8 output-side registers A', B', C', J', E', F', G', and I' store a1, b1, c1, j1, e3, f3, g3, and i3 respectively;

[0250] Execute one iteration of the variable e: e3=c1+h2+∑1e n +Ch(e2,f2,g2)+K2+W2 to get the operation circuit of e3;

[0251] Perform one iteration of the variable j, j1 = e2 - d1, to obtain the operation circuit of j1;

[0252] Perform an iterative operation i3=b1+g2+K3+W3 on the variable i to obtain the operation circuit of i3;

[0253] Among them, A and A', B and B', C and C', E and F', and F and G' are directly connected, and a1, b1, c1 are directly transmitted to the output side, and e2 and f2 are beat to get f3 and g3;

[0254] In this example, the input-side registers and the output-side registers in the compression circuits of the 0th to 2nd stages are registers whose outputs are the same as their inputs, but the present invention is not limited thereto.

[0255] In another example of this embodiment, when the input-side register outputs a bitwise inverted value of a variable, the second-stage compression circuit includes:

[0256] The 8 input side registers A, B, C, D, E, F, G, H output

[0257] The 8 output side registers A', B', C', J', E', F', G', I' respectively store

[0258] Execute 1 iteration of variable e get Operational circuit;

[0259] Execute 1 iteration of variable j get Operational circuit;

[0260] Execute 1 iteration of variable i get Operational circuit;

[0261] Among them, A and A', B and B', C and C', E and F', and F and G' are directly connected, respectively. Directly transferred to the output side, and Hit the beat and get

[0262] In this example, the input-side registers and the output-side registers in the compression circuits of the 0th to 2nd stages are registers whose outputs are the inverse of their inputs, but the present invention is not limited thereto.

[0263] In some applications, the iterations of the first few stages are not the primary concern. Therefore, these stages can be implemented in various ways, as long as the variable values ​​of the input-side registers of the n-stage single-stage compression circuit of this embodiment can be obtained. When the n-stage single-stage compression circuit employs the third and fourth iterative circuits shown in FIG12 , the input-side registers store the values ​​of some variables and the bitwise inversions of some of the variables. This can also be achieved using the compression circuits shown in FIG14 and FIG15 , where some variables are bitwise inverted using a NOT gate at the final stage. Alternatively, when employing the first-stage compression circuit of the n-stage single-stage compression circuit of this embodiment, the input-side registers can be specially designed, with some registers using QN outputs and some using Q outputs.

[0264] The compression circuits for levels 63 through 65 of the data compression circuit of this embodiment require replacing two intermediate variables with d and h, and some variables have already been iterated. Their structure differs from the aforementioned n-level compression structure. However, the arithmetic circuits used for variable iterative calculations can all use the same arithmetic circuits for the n-level compression structure.

[0265] In an exemplary embodiment of the present disclosure, the compression circuits of levels 63 to 65 are configured to perform iterative operations on the variables based on the data of the variables e, f, g, i after 63 iterations and the data of the variables a, b, c, j after 61 iterations output by level 62, to obtain the data of the variables a, b, c, d after 64 iterations and the data of e, f, g, h after 64 iterations.

[0266] In this embodiment,

[0267] The 63rd stage compression circuit is configured to perform an iterative operation of variables e, f, g once based on the data of variables e, f, g, i after 63 iterations to obtain data of variables e, f, g after 64 iterations, and tap the data of variable g after 63 iterations to obtain data of variable h after 64 iterations; perform an iterative operation of variables a, b, c, j once based on the data of variables a, b, c, j after 61 iterations and the data of variable e after 63 iterations to obtain data of variables a, b, c, j after 62 iterations; and pass the obtained data to the next stage compression circuit;

[0268] The 64th stage compression circuit is configured to perform one iterative operation of the variables a, b, c, j based on the data of the variables a, b, c, j after 62 iterations and the data of the variable e after 64 iterations, thereby obtaining data of the variables a, b, c, j after 63 iterations; and pass the obtained data and the data of the variables e, f, g, h after 64 iterations to the next stage compression circuit;

[0269] The 65th-level compression circuit is set to perform one iterative operation of variables a, b, c based on the data of variables a, b, c, j after 63 iterations, and obtain the data of variables a, b, c after 64 iterations; beat the data of variable c after 63 iterations to obtain the data of variable d after 64 iterations; and output the variables a, b, c, d, e, f, g, h after 64 iterations.

[0270] In an example of this embodiment, referring to FIG. 16 , the 63rd level compression circuit includes:

[0271] The eight input-side registers A, B, C, J, E, F, G, and H output the data of variables a, b, c, and j after 61 iterations and the data of variables e, f, g, and i after 63 iterations, respectively;

[0272] The eight output-side registers A', B', C', J', E', F', G', and H' store the data of variables a, b, c, and j after 62 iterations and the data of variables e, f, g, and h after 64 iterations respectively;

[0273] an operation circuit for the variable e, using the operation circuit for the variable e in the first iterative circuit, the second iterative circuit, the third iterative circuit, or the fourth iterative circuit, configured to perform an iterative operation on the variables e, f, g once based on the data of the variables e, f, g, i after 63 iterations to obtain data of the variable e after 64 iterations;

[0274] an operation circuit for variable a, using the operation circuit for variable a in the first iterative circuit, the second iterative circuit, the third iterative circuit, or the fourth iterative circuit, configured to perform one iterative operation on variable a based on the data of variables a, b, c, and j obtained after 61 iterations, to obtain data of variable a obtained after 62 iterations;

[0275] a second preprocessing circuit, using the second preprocessing circuit in the first iterative circuit, the second iterative circuit, the third iterative circuit, or the fourth iterative circuit, to perform one iterative operation on the variable j based on the data of the variable c after 61 iterations and the data of the variable e after 63 iterations, thereby obtaining data of the variable j after 62 iterations;

[0276] Among them, A and B', B and C', E and F', F and G', and G and H' are directly connected, and the data of variables a and b after 61 iterations and the data of variables e, f, and g after 63 iterations are respectively beat to obtain the data of variables b and c after 62 iterations and the data of variables f, g, and h after 64 iterations.

[0277] The 63rd level compression circuit in Figure 16 has input side registers A, B, C, J, E, F, G, and I that output The output side registers A', B', C', J', E', F', G', H' are stored separately j 62 , e 64 , f 64 , g 64 , h 64 The iterative calculation circuit for variables a, e, and j uses the same circuit for variables a, e, and j as in the fourth iterative circuit. However, compared to the fourth iterative circuit in Figure 12 (i.e., the second-stage compression circuit on the right side of the figure), the 63rd-stage compression circuit does not require iterative calculations for variable i and therefore lacks a corresponding calculation circuit.

[0278] In an example of this embodiment, referring to FIG16 , the 64-level compression circuit includes:

[0279] The eight input-side registers A, B, C, J, E, F, G, and H output the data of variables a, b, c, and j after 62 iterations and the data of variables e, f, g, and h after 64 iterations, respectively;

[0280] The eight output-side registers A', B', C', J', E', F', G', and H' store the data of variables a, b, c, and j after 63 iterations and the data of variables e, f, g, and h after 64 iterations respectively;

[0281] an operation circuit for variable a, using the operation circuit for variable a in the first iterative circuit, the second iterative circuit, the third iterative circuit, or the fourth iterative circuit, configured to perform one iterative operation on variable a based on the data of variables a, b, c, and j obtained after 62 iterations, to obtain data of variable a obtained after 63 iterations;

[0282] a second preprocessing circuit, using the second preprocessing circuit in the first iterative circuit, the second iterative circuit, the third iterative circuit, or the fourth iterative circuit, to perform one iterative operation on the variable j based on the data of the variable c after 62 iterations and the data of the variable e after 64 iterations, thereby obtaining data of the variable j after 63 iterations;

[0283] Among them, A and B', B and C' are directly connected, and the data of variables a and b after 62 iterations are respectively beat to obtain the data of variables b and c after 63 iterations; E and E', F and F', G and G', and H and H' are directly connected, and the data of variables e, f, g, h after 64 iterations are directly passed to the next level.

[0284] The 64-level compression circuit in Figure 16 has input side registers A, B, C, J, E, F, G, and H that output a 62 ,b 62 ,c 62 , The output side registers A', B', C', J', E', F', G', H' respectively store a 63 ,b 63 ,c 63 , The iterative calculation circuit for variables a and e can use the same calculation circuit for variable a in the third iterative circuit. Compared to the third iterative circuit in Figure 12 (i.e., the first-stage compression circuit on the left side of the figure), the 64th-stage compression circuit does not require iterative calculations for variables e and i, and therefore does not have a corresponding calculation circuit.

[0285] In FIG16 , the second pre-processing circuit of the variable j and the circuit for pre-adding H0 are integrated together to form a CSA and an adder. The input of the CSA is and c 62 .Will c 62 And the initial value data of variable a is constant Do the 3-2 simplification of addition, and add the output sum and carry through the adder to get the data of variable j and save it in J'. The data of variable j obtained here is not But The reason for this is to 64 Adding H0 in advance shortens the path of variable a in the 65th level compression circuit. It can be internalized in the circuit of CSA, similar to the design of CSK.

[0286] In an example of this embodiment, the 65th level compression circuit includes:

[0287] The eight input-side registers A, B, C, J, E, F, G, and H output the data of variables a, b, c, and j after 63 iterations and the data of variables e, f, g, and h after 64 iterations, respectively;

[0288] The eight output-side registers A', B', C', J', E', F', G', and H' store the data of variables a, b, c, d, e, f, g, and h after 64 iterations respectively;

[0289] an operation circuit for variable a, using the operation circuit for variable a in the first iterative circuit, the second iterative circuit, the third iterative circuit, or the fourth iterative circuit, configured to perform one iterative operation on variable a based on the data of variables a, b, c, and j obtained after 63 iterations, to obtain data of variable a obtained after 64 iterations;

[0290] Among them, the data of variables a, b, c output by A, B, and C respectively are added to the initial data of variables b, c, and d, and then stored in B', C', and D'; the data of variables e, f, g, h output by E, F, G, and H respectively are added to the initial data of variables e, f, g, and h, and then stored in E', F', G', and H'; or, A and B', B and C', and C' and D' are directly connected, and the data of variables a, b, and c after 63 iterations are respectively beat to obtain the data of variables a, b, and c after 64 iterations; E and E', F and F', G and G', and H and H' are directly connected, and the data of variables e, f, g, and h after 64 iterations are respectively passed directly to the output side.

[0291] The 65th level compression circuit in Figure 17 has input side registers A, B, C, J, E, F, G, and H that output j 62 ,e 64 ,f 64 g 64 ,h64 The arithmetic circuit for the iteration of variable a can adopt the arithmetic circuit for the variable in the fourth iteration circuit, as shown in Figure 12. In the example shown in the figure, at the 65th level, the iteration values ​​of variables b, c, d, e, f, g, h are added to their respective initial data, and the input side registers A, B, C output the bitwise inverted values ​​of variables a, b, c, and then Add constants to the adder and You can get the data of variables b, c, d The values ​​of variables e, f, g, and h are added to the values ​​of registers E, F, G, and H, respectively, to obtain the values ​​e+H4, f+H5, g+H6, h+H7, and stored in output registers E', F', G', and H'. H0 to H7 are the initial values ​​of variables a, b, c, d, e, f, g, and h, respectively.

[0292] The example in Figure 17 is to add the iterative result of the variable to the initial data of the variable in advance, but in other examples, the iterative result of the variable may not be added to the initial data of the variable. At this time, A and B', B and C', C' and D' can be directly connected, and the data of variables a, b, c after 63 iterations can be combined to obtain the data of variables a, b, c after 64 iterations; E and E', F and F', G and G' and H and H' can be directly connected, and the data of variables e, f, g, h after 64 iterations can be directly passed to the output side.

[0293] In the example of FIG17 , after the output side register of the 65th level, the hash value after the input message block compression is completed is obtained. When applied, if the bitwise inverted value of the variable needs to be used, it can be achieved by setting the corresponding NOT gate.

[0294] Figures 16 and 17 illustrate an implementation method for the final three-stage compression circuit when implementing the nth-stage compression circuit (n=n1, n1+1, n1+2, ..., n2, where n2>n1≥3) based on the third and fourth iterative circuits shown in Figure 12. If the nth-stage compression circuit is implemented using the first iterative circuit shown in Figure 8 , or the first and second iterative circuits shown in Figure 9B , the arithmetic circuits for the variable iterations in the final three-stage compression circuits can use the arithmetic circuits for the corresponding variables in the first and / or second iterative circuits. Furthermore, the iterative values ​​of the variables can be pre-added to the initial data of the variables, so that the output of the 65th-stage compression circuit is the hash value obtained by compressing the message block.

[0295] An embodiment of the present disclosure further provides a chip, including a message expansion circuit and a data compression circuit, wherein the data compression circuit adopts the data compression circuit of the secure hash algorithm SHA-256 described in any embodiment of the present disclosure.

[0296] An embodiment of the present disclosure provides a logic operation circuit: the logic operation circuit is configured to perform a logic operation on three input operands and output two operands, one of the two operands being the bitwise inverse value of the sum of the three operands, and the other being the bitwise inverse value of the carry of the addition of the three operands.

[0297] In an example of this embodiment, the logic operation circuit includes one or more 1-bit full adder inversion circuits, and the 1-bit full adder inversion circuit is obtained by eliminating an inverter in a 1-bit full adder.

[0298] The CSN circuits herein, including the first CSN circuit, the second CSN circuit, the third CSN circuit, the fourth CSN circuit, etc., can all be implemented using the logic operation circuit of this embodiment.

[0299] An embodiment of the present disclosure further provides a logic operation circuit, which is configured to perform a logic operation based on two input operands g and a and a constant K, and output two operands s and c, where s is equal to The bitwise inverse of the sum added to K, c is equal to The bitwise inverse of the carry added to K.

[0300] In an example of this embodiment, the logic operation circuit includes one or more 1-bit operation circuits, and the 1-bit operation circuits satisfy: when K=0, the two outputs s and c satisfy: And, when K=1, the two outputs s and c satisfy:

[0301] The CSN circuit in this article can be implemented using the logic operation circuit of this embodiment.

[0302] An embodiment of the present disclosure further provides a single-stage compression circuit for the secure hash algorithm SHA-256, comprising:

[0303] The 8 input-side registers A, B, C, J, E, F, G, and I respectively output the data of variables a, b, c, j, e, f, g, and i before this iteration;

[0304] The 8 output-side registers A', B', C', J', E', F', G', and I' respectively store the data of variables a, b, c, j, e, f, g, and i after this iteration;

[0305] A first pre-processing circuit, having an input terminal connected to the output terminals of A and G and receiving an input message word, an output terminal connected to the input terminal of I', and configured to perform one iterative operation on the variable i;

[0306] A second preprocessing circuit, having an input connected to the output of E and C and an output connected to the input of J', configured to perform one iterative operation on the variable j;

[0307] The operation circuit of the variable e has its input connected to the output of I, E, F, and G, and its output connected to the input of E', and is configured to perform one iterative operation of the variable e;

[0308] The arithmetic circuit of variable a has its input connected to the outputs of A, B, C, and J, and its output connected to the input of A', and is configured to perform one iterative operation of variable a;

[0309] Among them, A and B', B and C', E and F', and F and G' are directly connected.

[0310] In an exemplary embodiment of the present disclosure, the single-stage compression circuit is a first iterative circuit, wherein:

[0311] The first pre-processing circuit includes a first adding circuit having an input terminal connected to the output terminals of A and G and receiving an input message word, and an output terminal connected to the input terminal of I', wherein the first adding circuit is configured to add the data output by A and G and the input message word, and store the result in I';

[0312] The second pre-processing circuit includes a first subtraction circuit having an input connected to the outputs of C and E and an output connected to the input of J', wherein the first subtraction circuit is configured to subtract the data output by C from the data output by E and store the result in J';

[0313] The operation circuit of the variable e includes: a ∑1 operator having an input terminal connected to the output terminal of E, a Ch operator having an input terminal connected to the output terminals of E, F, and G, and a second adding circuit having an input terminal connected to the ∑1 operator, the Ch operator, and the output terminal of I, wherein the output terminal of the second adding circuit is connected to the input terminal of E' and is configured to add data outputted by the ∑1 operator, the Ch operator, and I, and store the result in E';

[0314] The arithmetic circuit for the variable a includes: a Maj operator having an input connected to the outputs of A, B, and C, a ∑0 operator having an input connected to the output of A, and a third adding circuit having an input connected to the Maj operator, the ∑0 operator, and the output of J, wherein the output of the third adding circuit is connected to the input of A' and is configured to add the data output by the Maj operator, the ∑0 operator, and J, and store the result in A';

[0315] The input side register and the output register are registers whose output is the same as the input or registers whose output is the inverse of the input.

[0316] In an exemplary embodiment of the present disclosure, the single-stage compression circuit is a second iterative circuit, wherein:

[0317] The first pre-processing circuit includes a first NOT gate having an input connected to the output of A, a first subtraction circuit having an input connected to G and the output of the first NOT gate and receiving an input message word, the output of the first subtraction circuit being connected to the input of I', and configured to subtract the bitwise inverted value of the data output by A, the fixed message word, and the message block grouping or extended message word from the data output by G, and store the result in I';

[0318] The second pre-processing circuit includes a second NOT gate having an input connected to the output of C, an adding circuit having an input connected to the second NOT gate and the output of E, an output of the adding circuit connected to an input of J', and configured to add the bitwise inverted value of the data output by C to the data output by E, and store the result in J';

[0319] The operation circuit of the variable e includes: a third NOT gate having an input end connected to the output end of I, a ∑1 operator having an input end connected to the output end of E, a Ch operator having an input end connected to the output ends of E, F, and G, a fourth NOT gate having an input end connected to the output end of the ∑1 operator, and a second subtraction circuit having an input end connected to the output ends of the Ch operator, the third NOT gate, and the fourth NOT gate, wherein the output end of the second subtraction circuit is connected to the input end of E' and is configured to subtract the bitwise inverted value of the data output by the ∑1 operator and the bitwise inverted value of the data output by I from the data output by the Ch operator, and store the result in E';

[0320] The operation circuit of the variable a includes: the first NOT gate, a fifth NOT gate having an input connected to the output of J, a Maj operator having an input connected to the outputs of A, B, and C, a ∑0 operator having an input connected to the output of the first NOT gate, and a third subtraction circuit having an input connected to the Maj operator, the ∑0 operator, and the output of the fifth NOT gate, wherein the output of the third subtraction circuit is connected to the input of A' and is configured to subtract the bitwise value of the data output by A and the bitwise inverted value of the data output by J from the data output by the aj operator, and store the result in A';

[0321] The input side register and the output register are registers whose output is the inverse of the input.

[0322] In an exemplary embodiment of the present disclosure, the single-stage compression circuit is a third iterative circuit, wherein:

[0323] The first pre-processing circuit includes a first operation circuit whose input terminal is connected to the output terminals of A and G and receives an input message word, and the output terminal of the first operation circuit is connected to the input terminal of I';

[0324] The input end of the second pre-processing circuit is connected to the output ends of C and E, and the output end is connected to J', and is configured to add the data output by C and E and store the result in J';

[0325] The operation circuit of the variable e includes: a ∑ n1 operator, the Chn operator whose input terminal is connected to the output terminal of E, F and G, and the Chn operator whose input terminal is connected to ∑ n1 operator, Chn operator and a second arithmetic circuit connected to the output terminal of I;

[0326] The operation circuit of the variable a includes a Majn operator whose input end is connected to the output ends of A, B and C, and a ∑ n0 operator, and the input terminal and the Majn operator, ∑ n0 The operator is connected to the output terminal of J and the third operation circuit, and the output terminal of the third operation circuit is connected to the input terminal of A'.

[0327] In an exemplary embodiment of the present disclosure, the single-stage compression circuit is a fourth iterative circuit, wherein:

[0328] The first pre-processing circuit includes an input terminal connected to the output terminals of A and G and receiving W n+1 a fourth operation circuit for processing data of , wherein the output terminal of the fourth operation circuit is connected to the input terminal of I';

[0329] The input end of the second pre-processing circuit is connected to the output ends of C and E, and the output end is connected to J', and is configured to add the data output by C and E plus 1, and store the result in J';

[0330] The operation circuit of the variable e includes: a ∑ n1 operator, the Chn operator whose input terminal is connected to the output terminal of E, F and G, and the Chn operator whose input terminal is connected to ∑ n1 operator, the Chn operator, and a third arithmetic circuit connected to the output terminal of I, wherein the output terminal of the third arithmetic circuit is connected to the input terminal of E';

[0331] The operation circuit of the variable a includes: a Majn operator whose input end is connected to the output ends of A, B and C, a ∑ n0 operator, and the input terminal and the Majn operator, ∑ n0 The operator is connected to the second operation circuit whose output terminal is connected to J, and the output terminal of the second operation circuit is connected to the input terminal of A'.

[0332] In an exemplary embodiment of the present disclosure, the second arithmetic circuit includes the CSN circuit described in any embodiment of the present disclosure and a fourth adding circuit connected to the CSN circuit, and the input end of the CSN circuit is the input end of the second arithmetic circuit, wherein:

[0333] The CSN circuit is configured to perform logic operations on the three input operands and output and is the bitwise inverse of the sum of the three operands. is the bitwise inverse of the carry from the addition of the three operands;

[0334] The fourth adding circuit is configured to and 1, and the obtained sum is output from the output end of the fourth adding circuit, and the output end of the fourth adding circuit is the output end of the second operation circuit.

[0335] In an exemplary embodiment of the present disclosure, the third operation circuit includes a CSN circuit and a fifth adding circuit connected to the CSN circuit, and the input end of the CSN circuit is the input end of the third operation circuit, wherein:

[0336] The CSN circuit is configured to perform logic operations on the three input operands and output and is the bitwise inverse of the sum of the three operands. is the bitwise inverse of the carry from the addition of the three operands;

[0337] The fifth adding circuit is configured to and The sum is added and output from the output end of the fifth adding circuit, which is the output end of the third operation circuit.

[0338] In an exemplary embodiment of the present disclosure, the first operation circuit includes a first circuit, a first CSN circuit, and a sixth adding circuit, wherein:

[0339] The input end of the first circuit is connected to the output end of A and G, and is set to be based on a n-2 and K n+1 Perform logical operations and output and in, It is g n ,a n-2 and K n+1 The bitwise inverse of the sum of the additions, It is g n ,an-2 and K n+1 The bitwise inverse of the carry in addition;

[0340] The input end of the first CSN circuit is connected to the output end of the first circuit and receives Set to input and Perform logic operation and output CO2 and S2, where S2 is and The bitwise inverse value of the sum of the additions, CO2 is and The bitwise inverse of the carry in addition;

[0341] The sixth adding circuit is configured to add CO2 and S2 and output the obtained sum to the input terminal of I'.

[0342] In an exemplary embodiment of the present disclosure, the first circuit is implemented using the CSK circuit described in any embodiment of the present disclosure; or

[0343] The first circuit includes a sixth NOT gate and a second CSN, wherein: the input end of the sixth NOT gate is connected to the output end of G, and is configured to Invert the bit to get g n The input terminal of the second CSN circuit is connected to the output terminal of the sixth NOT gate and A and receives K n+1 , set to the input g n ,a n-2 and K n+1 Perform logical operations and output and

[0344] In an exemplary embodiment of the present disclosure, the fourth operation circuit includes a second circuit, a third CSN circuit, and a seventh adding circuit, wherein:

[0345] The input end of the second circuit is connected to the output end of A and G, and is set to be based on g n , and Perform logic operation and output CO1 and S1, where S1 is and The bitwise inverse value of the sum of additions, CO1 is and The bitwise inverse of the carry in addition;

[0346] The input end of the third CSN circuit is connected to the output end of the second circuit and receives W n+1 , set to input CO1, S1 and Wn+1 Perform logical operations and output and in, CO1, S1 and W n+1 The bitwise inverse of the sum of the additions, CO1, S1 and W n+1 The bitwise inverse of the carry in addition;

[0347] The seventh adding circuit is configured to and 1, and the resulting sum is output to the input of I'.

[0348] In an exemplary embodiment of the present disclosure, the second circuit is implemented using the CSK circuit described in the embodiment of the present disclosure; or

[0349] The second circuit includes a seventh NOT gate and a fourth CSN circuit, wherein: the input end of the seventh NOT gate is connected to the output end of G, and is configured to n Invert the bitwise The input end of the fourth CSN circuit is connected to the output end of the seventh NOT gate and A and receives Set to input and Perform logical operations and output CO1 and S1.

[0350] An embodiment of the present disclosure also provides a data compression circuit for a secure hash algorithm SHA-256, wherein the nth-level single-stage compression circuit adopts the single-stage compression circuit described in any embodiment of the present disclosure, n=n1, n1+1, n1+1,…, n2, n2>n1≥3.

[0351] An embodiment of the present disclosure further provides a chip, including a message expansion circuit and a data compression circuit, wherein the data compression circuit adopts the data compression circuit of the secure hash algorithm SHA-256 described in any embodiment of the present disclosure.

[0352] An embodiment of the present disclosure further provides a chip capable of implementing the secure hash algorithm SHA-256, including a message expansion circuit and a data compression circuit, wherein:

[0353] The message expansion circuit is configured to group the padded message blocks to obtain 16 message words; and to expand the 16 message words obtained by grouping to generate 48 message words;

[0354] The data compression circuit includes 66 levels of compression circuits from level 0 to level 65, wherein some or all of the compression circuits from level 3 to level 62 are configured to perform the following first iterative processing on variables a, b, c, j, e, f, g, i: n+1 =en+2 -c n i n+1 =a n-2 +g n +K n+1 +W n+1 g n+1 =f n f n+1 =e n , e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ) c n+1 =b n b n+1 =a n a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0355] Among them, x m Represents the value of variable x after m iterations, where x is a,b,c,j,e,f,g,i; K n+1 is the n+1th fixed message word, W n+1 It is the n+1th message word obtained by grouping or expanding the input message block.

[0356] The chip of the embodiment of the present disclosure can implement SHA-256, but is not limited to implementing SHA-256. The exemplary circuit structure of the embodiment of the present disclosure that implements the first iterative operation can be seen in Figures 7, 9, 9A and 9B.

[0357] In one example of the embodiment of the present disclosure, some or all of the odd-numbered compression circuits in the compression circuits of the 3rd to 62nd stages are configured to perform the first iterative process on the variables a, b, c, j, e, f, g, i, and the even-numbered compression circuits adjacent to the odd-numbered compression circuits are configured to perform the second iterative process on the variables a, b, c, j, e, f, g, i; or, some or all of the even-numbered compression circuits in the compression circuits of the 3rd to 62nd stages are configured to perform the first iterative process on the variables a, b, c, j, e, f, g, i, and the odd-numbered compression circuits adjacent to the even-numbered compression circuits are configured to perform the second iterative process on the variables a, b, c, j, e, f, g, i;

[0358] The second iterative processing performed on the variables a, b, c, j, e, f, g, i includes the following iterative operations:

[0359] An exemplary circuit structure of this example can be seen in FIG9B .

[0360] In an example of an embodiment of the present disclosure, the compression circuits of the 0th to 2nd stages are configured to perform iterative operations on the variables based on the initial values ​​a0, b0, c0, d0, e0, f0, g0, h0 of the variables a, b, c, d, e, f, g, h and the data of K0, K1, K2, K3, W0, W1, W2, W3, to obtain the data of the variables a, b, c, j after 1 iteration and the data of e, f, g, i after 3 iterations, and pass them to the compression circuit of the 3rd stage, wherein, a1=∑0a0+Maj(a0, b0, c0)+h0+∑1e0+Ch(e0, f0, g0)+K0+W0 e1=d0+h0+∑1e0+Ch(e0, f0, g0)+K0+W0 e2=d1+h1+∑1e1+Ch(e1, f1, g1)+K1+W1 e3=c1+h2+∑1e2+Ch(e2,f2,g2)+K2+W2 j1=e2-d1 i3=b1+g2+K3+W3;

[0361] Among them, variables b, c, d, f, g, h are processed according to the SHA-256 iterative algorithm, d m represents the value of variable d after m iterations, h m It represents the value of variable h after m iterations, where m is a natural number. Variables b, c, d, f, g, and h are iterated according to the SHA-256 algorithm, i.e., b n+1 =a n , c n+1 =b n , f n+1 =e n , g n+1 =f n , h n+1 =g n , d n+1 =c n An exemplary circuit structure of this example is shown in FIG14 and FIG15 .

[0362] In one example of the disclosed embodiment, the 63rd stage compression circuit is configured to perform an iterative operation on the variables e, f, g once based on the data of the variables e, f, g, i after 63 iterations to obtain data of the variables e, f, g after 64 iterations, and to tap the data of the variable g after 63 iterations to obtain data of the variable h after 64 iterations; perform an iterative operation on the variables a, b, c, j once based on the data of the variables a, b, c, j after 61 iterations and the data of the variable e after 63 iterations to obtain data of the variables a, b, c, j after 62 iterations; and pass the obtained data to the next stage compression circuit;

[0363] The 64th stage compression circuit is configured to perform one iterative operation of the variables a, b, c, j based on the data of the variables a, b, c, j after 62 iterations and the data of the variable e after 64 iterations, thereby obtaining data of the variables a, b, c, j after 63 iterations; and pass the obtained data and the data of the variables e, f, g, h after 64 iterations to the next stage compression circuit;

[0364] The 65th stage compression circuit is configured to perform one iteration of the variables a, b, c based on the data of the variables a, b, c, j after 63 iterations, to obtain the data of the variables a, b, c after 64 iterations; to perform one iteration of the variable c after 63 iterations to obtain the data of the variable d after 64 iterations; and to output the variables a, b, c, d, e, f, g, h after 64 iterations;

[0365] Among them, the variables a, b, c, j, e, f, g, and i are iteratively processed according to the iterative operation formula in the first iterative operation or the second iterative operation.

[0366] An embodiment of the present disclosure further provides a chip capable of implementing the secure hash algorithm SHA-256, including a message expansion circuit and a data compression circuit, wherein:

[0367] The message expansion circuit is configured to group the padded message blocks to obtain 16 message words; and to expand the 16 message words obtained by grouping to generate 48 message words;

[0368] The data compression circuit includes 66 levels of compression circuits from level 0 to level 65, wherein some or all of the odd-level compression circuits in the compression circuits from level 3 to level 62 are configured to perform the first iterative processing on the variables a, b, c, j, e, f, g, i, and the even-level compression circuits adjacent to the odd-level compression circuits are configured to perform the second iterative processing on the variables a, b, c, j, e, f, g, i; or, some or all of the even-level compression circuits in the compression circuits from level 3 to level 62 are configured to perform the first iterative processing on the variables a, b, c, j, e, f, g, i, and the odd-level compression circuits adjacent to the even-level compression circuits are configured to perform the second iterative processing on the variables a, b, c, j, e, f, g, i;

[0369] The first iterative process includes the following iterative operations: i n+1 =a n-2 +g n +K n+1 +W n+1 c n+1 =b n b n+1 =a n a n+1 =∑0a n +Maj(a n ,b n ,c n )+j n

[0370] The second iterative process includes the following iterative operations: j n+1 =e n+2 -c n g n+1 =f n f n+1 =e n , e n+1 =i n +∑1e n +Ch(e n ,f n ,g n )

[0371] Among them, x m Represents the value of variable x after m iterations, where x is a,b,c,j,e,f,g,i; K n+1 is the n+1th fixed message word, W n+1The n+1th message word is obtained by grouping or expanding the input message blocks. The exemplary circuit structure of this embodiment can be seen in Figures 12 and 13.

[0372] In one example of this embodiment, the compression circuits of the 0th to 2nd stages are configured to perform iterative operations on the variables based on the initial values ​​a0, b0, c0, d0, e0, f0, g0, h0 of the variables a, b, c, d, e, f, g, h and the data of K0, K1, K2, K3, W0, W1, W2, W3, to obtain the data of the variables a, b, c, j after one iteration and the data of e, f, g, i after three iterations, and pass them to the third stage compression circuit, where: a1 = ∑0a0 + Maj(a0, b0, c0) + h0 + ∑1e0 + Ch(e0, f0, g0) + K0 + W0 e1 = d0 + h0 + ∑1e0 + Ch(e0, f0, g0) + K0 + W0 e2 = d1 + h1 + ∑1e1 + Ch(e1, f1, g1) + K1 + W1 e3=c1+h2+∑1e2+Ch(e2,f2,g2)+K2+W2 j1=e2-d1 i3=b1+g2+K3+W3;

[0373] Among them, variables b, c, d, f, g, h are processed according to the SHA-256 iterative algorithm, d m represents the value of variable d after m iterations, h m 14 and 15 show the circuit structure of the present embodiment.

[0374] In one example of this embodiment, the 63rd stage compression circuit is configured to perform an iterative operation on the variables e, f, g once based on the data of the variables e, f, g, i after 63 iterations to obtain data of the variables e, f, g after 64 iterations, and to tap the data of the variable g after 63 iterations to obtain data of the variable h after 64 iterations; perform an iterative operation on the variables a, b, c, j once based on the data of the variables a, b, c, j after 61 iterations and the data of the variable e after 63 iterations to obtain data of the variables a, b, c, j after 62 iterations; and pass the obtained data to the next stage compression circuit;

[0375] The 64th stage compression circuit is configured to perform one iterative operation of the variables a, b, c, j based on the data of the variables a, b, c, j after 62 iterations and the data of the variable e after 64 iterations, thereby obtaining data of the variables a, b, c, j after 63 iterations; and pass the obtained data and the data of the variables e, f, g, h after 64 iterations to the next stage compression circuit;

[0376] The 65th stage compression circuit is configured to perform one iteration of the variables a, b, c based on the data of the variables a, b, c, j after 63 iterations, to obtain the data of the variables a, b, c after 64 iterations; to perform one iteration of the variable c after 63 iterations to obtain the data of the variable d after 64 iterations; and to output the variables a, b, c, d, e, f, g, h after 64 iterations;

[0377] The variables a, b, c, j, e, f, g, and i are iteratively processed according to the iterative operation formula in the first iterative operation or the second iterative operation. The exemplary circuit structure of this example can be seen in FIG16 and FIG17.

[0378] In the above embodiment, the compression circuits in the third to the 62nd stages that do not use the first iterative operation and the second iterative operation may be implemented using any circuit that can implement the SHA-256 algorithm, such as the circuit shown in FIG3 .

[0379] In one example, the compression circuits from the 3rd stage or the stage after the 3rd stage to the 62nd stage all adopt the first iterative operation of the above embodiment, or adopt the first iterative operation and the second iterative operation.

[0380] In one or more exemplary embodiments above, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored as one or more instructions or codes on a computer-readable medium or transmitted via a computer-readable medium and executed by a hardware-based processing unit. The computer-readable medium may include a computer-readable storage medium corresponding to a tangible medium such as a data storage medium, or a communication medium that facilitates the transfer of a computer program from one place to another, such as according to a communication protocol. In this way, a computer-readable medium may generally correspond to a non-transitory tangible computer-readable storage medium or a communication medium such as a signal or carrier wave. The data storage medium may be any available medium that can be accessed by one or more computers or one or more processors to retrieve instructions, codes, and / or data structures for implementing the technology described in this disclosure. A computer program product may include a computer-readable medium.

[0381] In some aspects, the functionality described herein may be provided within dedicated hardware and / or software modules configured for encoding and decoding, or incorporated into a combined codec. Also, the techniques may be fully implemented in one or more circuits or logic elements.

[0382] The technical solutions of the embodiments of the present disclosure can be implemented in a wide variety of devices or equipment, including wireless mobile phones, integrated circuits (ICs), or a group of ICs (e.g., chipsets). Various components, modules, or units are described in the embodiments of the present disclosure to emphasize the functional aspects of the devices configured to perform the described techniques, but they do not necessarily need to be implemented by different hardware units. Instead, as described above, the various units can be combined in a codec hardware unit or provided by a collection of interoperable hardware units (including one or more processors as described above) in combination with appropriate software and / or firmware.

Claims

1. A logic operation circuit, characterized in that: The logic operation circuit is configured to perform a logic operation on three input operands and output two operands, one of which is a bitwise inverted value of the sum of the three operands, and the other is a bitwise inverted value of the carry of the three operands.

2. The logic operation circuit according to claim 1, wherein: The logic operation circuit includes one or more 1-bit full adder inversion circuits, and the 1-bit full adder inversion circuit is obtained by canceling an inverter in a 1-bit full adder.

3. A logic operation circuit, characterized in that: The logic operation circuit is configured to perform a logic operation based on two input operands g and a and a constant K, and output two operands s and c, where s is equal to The bitwise inversion of the sum added to K, c is equal to The bitwise inversion of the carry added to K.

4. The logic operation circuit according to claim 1, wherein: The logic operation circuit includes one or more 1-bit operation circuits, and the 1-bit operation circuits satisfy: When K=0, the two outputs s and c satisfy: When K=1, the two outputs s and c satisfy:

5. A single-stage compression circuit for a secure hash algorithm SHA-256, characterized in that: include: The 8 input-side registers A, B, C, J, E, F, G, and I respectively output the data of variables a, b, c, j, e, f, g, and i before this iteration; The 8 output-side registers A', B', C', J', E', F', G', and I' store the data of variables a, b, c, j, e, f, g, and i after this iteration respectively; A first preprocessing circuit, having an input terminal connected to the output terminal of A and G and receiving an input message word, an output terminal connected to the input terminal of I', and configured to perform one iteration operation of the variable i; A second preprocessing circuit, having an input connected to the output of E, C, and an output connected to the input of J', configured to perform one iteration of the variable j; The operation circuit of the variable e has an input terminal connected to the output terminals of I, E, F, and G, and an output terminal connected to the input terminal of E', and is set to perform one iteration operation of the variable e; The operation circuit of variable a has an input terminal connected to the output terminals of A, B, C, and J, and an output terminal connected to the input terminal of A', and is set to perform one iteration operation of variable a; Among them, A and B', B and C', E and F', and F and G' are directly connected.

6. The single-stage compression circuit as claimed in claim 5, characterized in that: The single-stage compression circuit is a first iterative circuit, wherein: The first preprocessing circuit includes a first adding circuit whose input end is connected to the output ends of A and G and receives the input message word, and whose output end is connected to the input end of I', wherein the first adding circuit is configured to add the data output by A and G and the input message word, and store the result in I'; The second preprocessing circuit includes a first subtraction circuit having an input end connected to the output ends of C and E and an output end connected to the input end of J', wherein the first subtraction circuit is configured to subtract the data output by C from the data output by E and store the result in J'; The operation circuit of the variable e includes: a ∑1 operator having an input terminal connected to an output terminal of E, a Ch operator having an input terminal connected to output terminals of E, F and G, and a second adding circuit having an input terminal connected to the ∑1 operator, the Ch operator and an output terminal of I, the output terminal of the second adding circuit being connected to an input terminal of E', and being configured to add data outputted from the ∑1 operator, the Ch operator and I, and storing the result in E'; The operation circuit of the variable a includes: a Maj operator having an input terminal connected to the output terminals of A, B and C, a ∑0 operator having an input terminal connected to the output terminal of A, and a third adding circuit having an input terminal connected to the output terminals of the Maj operator, the ∑0 operator and J, wherein the output terminal of the third adding circuit is connected to the input terminal of A' and is configured to add the data outputted by the Maj operator, the ∑0 operator and J, and store the result in A'; The input side register and the output register are registers whose output is the same as the input or registers whose output is the inverse of the input.

7. The single-stage compression circuit according to claim 5, characterized in that: The single-stage compression circuit is a second iterative circuit, wherein: The first preprocessing circuit includes a first NOT gate having an input end connected to the output end of A, a first subtraction circuit having an input end connected to G and the output end of the first NOT gate and receiving an input message word, an output end of the first subtraction circuit connected to an input end of I', and configured to subtract the bitwise inverted value of the data output by A, the fixed message word, and the message block grouping or extended message word from the data output by G, and save the result to I'; The second preprocessing circuit includes a second NOT gate having an input end connected to an output end of C, an adding circuit having an input end connected to the second NOT gate and an output end of E, an output end of the adding circuit connected to an input end of J', and is configured to add a bitwise inverted value of the data output by C to the data output by E, and store the result in J'; The operation circuit of the variable e includes: a third NOT gate having an input end connected to an output end of I, a ∑1 operator having an input end connected to an output end of E, a Ch operator having an input end connected to output ends of E, F and G, a fourth NOT gate having an input end connected to an output end of the ∑1 operator, and a second subtraction circuit having an input end connected to the output ends of the Ch operator, the third NOT gate and the fourth NOT gate, wherein an output end of the second subtraction circuit is connected to an input end of E' and is configured to subtract a bitwise inverted value of the data output by the ∑1 operator and a bitwise inverted value of the data output by I from data output by the Ch operator, and the result is stored in E'; The operation circuit of the variable a comprises: the first NOT gate, a fifth NOT gate whose input end is connected to the output end of J, a Maj operator whose input end is connected to the output ends of A, B and C, a ∑0 operator whose input end is connected to the output end of the first NOT gate, and a third subtraction circuit whose input end is connected to the Maj operator, the ∑0 operator and the output end of the fifth NOT gate, the output end of the third subtraction circuit is connected to the input end of A', and is configured to subtract the bitwise value of the data output by A and the bitwise inverted value of the data output by J from the data output by the aj operator, and store the result in A'; The input side register and the output register are registers whose output is the inverse of the input.

8. The single-stage compression circuit according to claim 5, characterized in that: The single-stage compression circuit is a third iterative circuit, wherein: The first preprocessing circuit includes a first operation circuit whose input terminal is connected to the output terminals of A and G and receives the input message word, and the output terminal of the first operation circuit is connected to the input terminal of I'; The input end of the second pre-processing circuit is connected to the output ends of C and E, and the output end is connected to J', and is configured to add the data output by C and E and store the result in J'; The operation circuit of the variable e includes: a ∑ n1 operator, the Chn operator whose input is connected to the output of E, F and G, and the Chn operator whose input is connected to ∑ n1 operator, the Chn operator and a second operation circuit connected to the output end of I; The operation circuit of the variable a includes a Majn operator whose input end is connected to the output ends of A, B and C, and a ∑ n0 operator, and the input terminal and the Majn operator, ∑ n0 The output terminal of the operator and J is connected to a third operation circuit, and the output terminal of the third operation circuit is connected to the input terminal of A'.

9. The single-stage compression circuit according to claim 5, characterized in that: The single-stage compression circuit is a fourth iterative circuit, wherein: The first preprocessing circuit includes an input terminal connected to the output terminals of A and G and receiving W n+1 a fourth operation circuit for processing the data of , wherein the output end of the fourth operation circuit is connected to the input end of I'; The input end of the second pre-processing circuit is connected to the output ends of C and E, and the output end is connected to J', and is configured to add the data output by C and E and add 1, and store the result in J'; The operation circuit of the variable e includes: a ∑ n1 operator, the Chn operator whose input is connected to the output of E, F and G, and the Chn operator whose input is connected to ∑ n1 A third operation circuit connected to the output terminal of operator, Chn operator and I, wherein the output terminal of the third operation circuit is connected to the input terminal of E'; The operation circuit of the variable a includes: a Majn operator whose input end is connected to the output ends of A, B and C, a ∑ n0 operator, and the input terminal and the Majn operator, ∑ n0 The output end of the operator and J is connected to a second operation circuit, and the output end of the second operation circuit is connected to the input end of A'.

10. The single-stage compression circuit according to claim 8 or 9, characterized in that: The second operation circuit includes a CSN circuit and a fourth adding circuit connected to the CSN circuit, and the input end of the CSN circuit is the input end of the second operation circuit, wherein: The CSN circuit is configured to perform logic operations on the three input operands and output and is the bitwise inverse of the sum of the three operands. is the bitwise inverse of the carry from the addition of the three operands; The fourth adding circuit is configured to and 1, and the obtained sum is output from the output end of the fourth adding circuit, and the output end of the fourth adding circuit is the output end of the second operation circuit; Wherein, the CSN circuit adopts the logic operation circuit as claimed in claim 1 or 2.

11. The single-stage compression circuit according to claim 8 or 9, characterized in that: The third operation circuit includes a CSN circuit and a fifth adding circuit connected to the CSN circuit, the input end of the CSN circuit is the input end of the third operation circuit, wherein: The CSN circuit is configured to perform logic operations on the three input operands and output and is the bitwise inverse of the sum of the three operands. is the bitwise inverse of the carry from the addition of the three operands; The fifth adding circuit is configured to and Adding, the obtained sum is output from the output end of the fifth adding circuit, the output end of the fifth adding circuit is the output end of the third operation circuit; Wherein, the CSN circuit adopts the logic operation circuit as claimed in claim 1 or 2.

12. The single-stage compression circuit according to claim 8, characterized in that: The first operation circuit includes a first circuit, a first CSN circuit and a sixth adding circuit, wherein: The input end of the first circuit is connected to the output end of A and G, and is set based on a n-2 and K n+1 Perform logical operations and output and in, Yes n ,a n-2 and K n+1 The bitwise inversion of the sum being added, Yes n ,a n-2 and K n+1 The bitwise inverse of the carry in addition; The input end of the first CSN circuit is connected to the output end of the first circuit and receives Set to the input and Perform logical operations and output CO2 and S2, where S2 is and The bitwise inversion of the sum, CO2 is and The bitwise inverse of the carry in addition; The sixth adding circuit is configured to add CO2 and S2, and output the obtained sum to the input terminal of I'; Wherein, the first CSN circuit adopts the logic operation circuit as claimed in claim 1 or 2.

13. The single-stage compression circuit according to claim 12, characterized in that: The first circuit is implemented using the logic operation circuit as claimed in claim 3 or 4; or The first circuit includes a sixth NOT gate and a second CSN, wherein: the input end of the sixth NOT gate is connected to the output end of G, and is configured to Invert the bit to get g n The input end of the second CSN circuit is connected to the output end of the sixth NOT gate and A and receives K n+1 , set to the input g n ,a n-2 and K n+1 Perform logical operations and output and Wherein, the second CSN circuit adopts the logic operation circuit as claimed in claim 1 or 2.

14. The single-stage compression circuit according to claim 9, characterized in that: The fourth operation circuit includes a second circuit, a third CSN circuit and a seventh adding circuit, wherein: The input end of the second circuit is connected to the output end of A and G, and is set to be based on g n , and Perform logical operations and output CO1 and S1, where S1 is and The bitwise inverse value of the sum added, CO1 is and The bitwise inverse of the carry in addition; The input end of the third CSN circuit is connected to the output end of the second circuit and receives W n+1 , set to the input CO1, S1 and W n+1 Perform logical operations and output and in, CO1, S1 and W n+1 The bitwise inversion of the sum being added, CO1, S1 and W n+1 The bitwise inverse of the carry in addition; The seventh adding circuit is configured to add Add 1 and output the sum to the input terminal of I'; Wherein, the third CSN circuit adopts the logic operation circuit as claimed in claim 1 or 2.

15. The data compression circuit according to claim 14, wherein: The second circuit is implemented using the logic operation circuit as claimed in claim 3 or 4; or The second circuit includes a seventh NOT gate and a fourth CSN circuit, wherein: the input end of the seventh NOT gate is connected to the output end of G, and is configured to n Bitwise inversion yields The input end of the fourth CSN circuit is connected to the output end of the seventh NOT gate and A and receives Set to the input and Perform logic operation and output CO1 and S1, wherein the fourth CSN circuit adopts the logic operation circuit as claimed in claim 1 or 2.

16. A data compression circuit for secure hash algorithm SHA-256, characterized in that: The nth single-stage compression circuit adopts the single-stage compression circuit as described in any one of claims 5 to 15, n=n1, n1+1, n1+1, ..., n2, n2>n1≥3.

17. A chip capable of implementing secure hash algorithm SHA-256, comprising a message expansion circuit and a data compression circuit, characterized in that: The data compression circuit adopts the data compression circuit of the secure hash algorithm SHA-256 as described in claim 16.

18. A chip capable of implementing secure hash algorithm SHA-256, comprising a message expansion circuit and a data compression circuit, characterized in that: The message expansion circuit is configured to group the padded message blocks to obtain 16 message words; and to expand the 16 message words obtained by grouping to generate 48 message words; The data compression circuit includes 66 levels of compression circuits from level 0 to level 65, wherein: part or all of the compression circuits from level 3 to level 62 are configured to perform the following first iteration processing on variables a, b, c, j, e, f, g, i: j n+1 =e n+2 -c n i n+1 =a n-2 +g n +K n+1 +W n+1 g n+1 =f n f n+1 =e n , e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ) c n+1 =b n b n+1 =a n and n+1 =∑0a n +May(a n ,b n ,c n )+j n Among them, x m Represents the value of variable x after m iterations, where x is a, b, c, j, e, f, g, i; K n+1 is the n+1th fixed message word, W n+1 It is the n+1th message word obtained by grouping or expanding the input message block.

19. The chip according to claim 18, characterized in that: Some or all of the odd-numbered compression circuits in the compression circuits of the 3rd to 62nd stages are set to perform the first iterative processing on the variables a, b, c, j, e, f, g, i, and the even-numbered compression circuits adjacent to the odd-numbered compression circuits are set to perform the second iterative processing on the variables a, b, c, j, e, f, g, i; or, some or all of the even-numbered compression circuits in the compression circuits of the 3rd to 62nd stages are set to perform the first iterative processing on the variables a, b, c, j, e, f, g, i, and the odd-numbered compression circuits adjacent to the even-numbered compression circuits are set to perform the second iterative processing on the variables a, b, c, j, e, f, g, i; The second iterative processing performed on the variables a, b, c, j, e, f, g, i includes the following iterative operations:

20. The chip according to claim 18, characterized in that: The compression circuits of the 0th to 2nd levels are configured to perform iterative operations on the variables based on the initial values ​​a0, b0, c0, d0, e0, f0, g0, h0 of the variables a, b, c, d, e, f, g, h and the data of K0, K1, K2, K3, W0, W1, W2, W3, obtain the data of the variables a, b, c, j after 1 iteration and the data of e, f, g, i after 3 iterations, and pass them to the compression circuit of the 3rd level, wherein, a1=∑0a0+Maj(a0,b0,c0)+h0+∑1e0+Ch(e0,f0,g0)+K0+W0 e1=d0+h0+∑1e0+Ch(e0,f0,g0)+K0+W0 e2=d1+h1+∑1e1+Ch(e1,f1,g1)+K1+W1 e3=c1+h2+∑1e2+Ch(e2,f2,g2)+K2+W2 j1=e2-d1 i3=b1+g2+K3+W3; Among them, variables b, c, d, f, g, h are iterated according to the SHA-256 algorithm, d m represents the value of variable d after m iterations, h m Represents the value of variable h after m iterations, where m is a natural number.

21. The chip according to claim 18 or 19, characterized in that: The 63rd stage compression circuit is configured to perform an iterative operation of variables e, f, g once based on the data of variables e, f, g, i after 63 iterations to obtain data of variables e, f, g after 64 iterations, and tap the data of variable g after 63 iterations to obtain data of variable h after 64 iterations; perform an iterative operation of variables a, b, c, j once based on the data of variables a, b, c, j after 61 iterations and the data of variable e after 63 iterations to obtain data of variables a, b, c, j after 62 iterations; and pass the obtained data to the next stage compression circuit; The 64th stage compression circuit is configured to perform one iteration operation of the variables a, b, c, j based on the data of the variables a, b, c, j after 62 iterations and the data of the variable e after 64 iterations, to obtain the data of the variables a, b, c, j after 63 iterations; and pass the obtained data and the data of the variables e, f, g, h after 64 iterations to the next stage compression circuit; The 65th level compression circuit is set to perform one iteration operation of variables a, b, c based on the data of variables a, b, c, j after 63 iterations, to obtain the data of variables a, b, c after 64 iterations; beat the data of variable c after 63 iterations to obtain the data of variable d after 64 iterations; output the variables a, b, c, d, e, f, g, h after 64 iterations; Among them, the variables a, b, c, j, e, f, g, and i are iteratively processed according to the iterative operation formula in the first iterative operation or the second iterative operation.

22. A chip capable of implementing secure hash algorithm SHA-256, comprising a message expansion circuit and a data compression circuit, characterized in that: The message expansion circuit is configured to group the padded message blocks to obtain 16 message words; and to expand the 16 message words obtained by grouping to generate 48 message words; The data compression circuit includes 66 levels of compression circuits from level 0 to level 65, part or all of the odd-level compression circuits in the compression circuits from level 3 to level 62 are set to perform the first iterative processing on the variables a, b, c, j, e, f, g, i, and the even-level compression circuits adjacent to the odd-level compression circuits are set to perform the second iterative processing on the variables a, b, c, j, e, f, g, i; or, part or all of the even-level compression circuits in the compression circuits from level 3 to level 62 are set to perform the first iterative processing on the variables a, b, c, j, e, f, g, i, and the odd-level compression circuits adjacent to the even-level compression circuits are set to perform the second iterative processing on the variables a, b, c, j, e, f, g, i; The first iterative process includes the following iterative operations: i n+1 =a n-2 +g n +K n+1 +W n+1 c n+1 =b n b n+1 =a n and n+1 =∑0a n +May(a n ,b n ,c n )+j n The second iterative process includes the following iterative operations: j n+1 =e n+2 -c n g n+1 =f n f n+1 =e n , e n+1 =i n +∑1e n +Ch(e n ,f n ,g n ) Among them, x m Represents the value of variable x after m iterations, where x is a, b, c, j, e, f, g, i; K n+1 is the n+1th fixed message word, W n+1 It is the n+1th message word obtained by grouping or expanding the input message block.

23. The chip according to claim 22, characterized in that: The compression circuits of the 0th to 2nd levels are configured to perform iterative operations on the variables based on the initial values ​​a0, b0, c0, d0, e0, f0, g0, h0 of the variables a, b, c, d, e, f, g, h and the data of K0, K1, K2, K3, W0, W1, W2, W3, obtain the data of the variables a, b, c, j after 1 iteration and the data of e, f, g, i after 3 iterations, and pass them to the compression circuit of the 3rd level, wherein, a1=∑0a0+Maj(a0,b0,c0)+h0+∑1e0+Ch(e0,f0,g0)+K0+W0 e1=d0+h0+∑1e0+Ch(e0,f0,g0)+K0+W0 e2=d1+h1+∑1e1+Ch(e1,f1,g1)+K1+W1 e3=c1+h2+∑1e2+Ch(e2,f2,g2)+K2+W2 j1=e2-d1 i3=b1+g2+K3+W3; Among them, variables b, c, d, f, g, h are iterated according to the SHA-256 algorithm, d m represents the value of variable d after m iterations, h m Represents the value of variable h after m iterations, where m is a natural number.

24. The chip according to claim 22, characterized in that: The 63rd stage compression circuit is configured to perform an iterative operation of variables e, f, g once based on the data of variables e, f, g, i after 63 iterations to obtain data of variables e, f, g after 64 iterations, and tap the data of variable g after 63 iterations to obtain data of variable h after 64 iterations; perform an iterative operation of variables a, b, c, j once based on the data of variables a, b, c, j after 61 iterations and the data of variable e after 63 iterations to obtain data of variables a, b, c, j after 62 iterations; and pass the obtained data to the next stage compression circuit; The 64th stage compression circuit is configured to perform one iteration operation of the variables a, b, c, j based on the data of the variables a, b, c, j after 62 iterations and the data of the variable e after 64 iterations, to obtain the data of the variables a, b, c, j after 63 iterations; and pass the obtained data and the data of the variables e, f, g, h after 64 iterations to the next stage compression circuit; The 65th level compression circuit is set to perform one iteration operation of variables a, b, c based on the data of variables a, b, c, j after 63 iterations, to obtain the data of variables a, b, c after 64 iterations; beat the data of variable c after 63 iterations to obtain the data of variable d after 64 iterations; output the variables a, b, c, d, e, f, g, h after 64 iterations; Among them, the variables a, b, c, j, e, f, g, and i are iteratively processed according to the iterative operation formula in the first iterative operation or the second iterative operation.

Images