1 Contents. Version of EnSilica Ltd, All Rights Reserved

Transcription

1 56/SHA224

2 1 Contents 1 Contents 2 2 Overview 3 3 Hardware Interface Area 4 4 Software Interface Register Map 5 5 SHA256/SHA224 Operation Introduction Cycle counts 8 6 Revision History 9 Version of EnSilica Ltd, All Rights Reserved

3 2 Overview The 56 core is an easy to use SHA hash accelerator peripheral for both SHA256 and SHA224. It supports the following features: ASIC or FPGA target. Simple register based interface 65 clock cycles per 512 bits of input data Operates in APB clock domain AMBA 3 APB slave interface Verilog A variant of this core is available with AHB interfaces to DMA data through the engine for full CPU offload. APB Clock APB Slave 56 APB Registers SHA256 Engine Figure 1: 56 Version of EnSilica Ltd, All Rights Reserved

4 3 Hardware Interface Module Name esi_apb_sha256 HDL Verilog 2001 Technology Generic Source Files esi_sha256_apb.v, esi_sha256_apb_if.v, esi_sha256_serial.v, esi_sha256.v, esi_sha256_message_schedule.v, esi_sha256_compress.v, esi_sha256_include.v APB Port Direction Width Description pclk Input 1 Clock, can be externally gated presetn Input 1 Reset, active-low paddr Input 8 Address psel Input 1 Slave select penable Input 1 Enable pwrite Input 1 Write pwdata Input BITS Write data pready Output 1 Ready prdata Output BITS Read data pslverr Output 1 Slave error pclk_cactive Output 1 Indicator to keep APB clock active Table 1: APB I/O Ports For complete details of the APB signals, please refer to the AMBA 3 APB Protocol v1.0 Specification available at: Area The core is floorplan area is approximately 19,000um^2 (drawn) on TSMC 40nm LP at a target clock speed of 6 MHz. Version of EnSilica Ltd, All Rights Reserved

5 4 Software Interface 4.1 Register Map The software register map is given below. Register Address Access Description offset control 0x00 R/W Control register status 0x04 R/W Status register msg[31:0] 0x08 R/W Message register msg[63:32] 0x0C R/W Message register msg[95:64] 0x10 R/W Message register msg[127:96] 0x14 R/W Message register msg[159:128] 0x18 R/W Message register msg[191:160] 0x1C R/W Message register msg[223:192] 0x20 R/W Message register msg[255:224] 0x24 R/W Message register msg[287:256] 0x28 R/W Message register msg[319:288] 0x2C R/W Message register msg[351:320] 0x30 R/W Message register msg[383:352] 0x34 R/W Message register msg[415:384] 0x38 R/W Message register msg[447:416] 0x3C R/W Message register msg[479:448] 0x40 R/W Message register msg[511:480] 0x44 R/W Message register hash[31:0] 0x48 R/W Hash in/hash out hash[63:32] 0x4C R/W Hash in/hash out hash[95:64] 0x50 R/W Hash in/hash out hash[127:96] 0x54 R/W Hash in/hash out hash[159:128] 0x58 R/W Hash in/hash out hash[191:160] 0x5c R/W Hash in/hash out hash[223:192] 0x60 R/W Hash in/hash out hash[256:224] 0x64 R/W Hash in/hash out Table 2: Register Map For a 16-bit processor configuration the bits can be accessed on aligned 16-bit addresses. For a 32-bit processor configuration the bits must be accessed on aligned 32-bit addresses. Accessing unaligned will generate a bus error Control Register The control register contains configuration fields. Writing a "1" to the start bit starts another 64 iteration round of SHA256 to process the current 256 bit hash and 512 bit msg. The bit is auto cleared one cycle later. A round should only be started if the previous round is complete, indicated by a "0" in the status register busy field. Figure 2: Format of the control register 1 0 S E Version of EnSilica Ltd, All Rights Reserved

6 Register Values Description E 1 Enable 0 - Disable Enables the hardware - sets pclk_cactive true to indicate pclk should remain ungated S 1 Start 0 No effect Start another 64 iteration round of SHA256. Auto cleared Table 3: Fields of the control register Status Register The status_register register contains the busy bit. A new SHA256 round should only be started if the busy bit is false. Figure 3: Format of the status register 0 B Register Values Description B 0 - Not busy Status of the SHA256 round. Round in progress 1 Busy when set true and finished when false Table 4: Fields of the status register Message Registers In SHA256 a long message is padded to a multiple of 512 bits and then operated on in 512 bit blocks. The msg registers contain the current 512 bit block being processed. Once a SHA256 round has been started by writing "1" to the start bit, the message registers can be preloaded with the next 512 bit block, but the start for this block should be delayed until the current block is processed, indicated by busy going false msg[i] Figure 4: Format of the msg registers Register Values Description msg[i] 32-bits of a 512 bit 32-bit part select of a 512 bit message message Table 5: Fields of the msg registers Hash Registers SHA256 has a starting hash value that is preloaded for the first 512 bit block of a message. This is only used in the first round. The subsequent 512 bit message block re-uses the hash from the previous round. After the final message block has been processed the hash registers hold the final hash value. The SHA256 initial hash that should be written is given below hash[0] = 0x6a09e667 hash[1] = 0xbb67ae85 hash[2] = 0x3c6ef372 hash[3] = 0xa54ff53a hash[4] = 0x510e527f hash[5] = 0x9b05688c hash[6] = 0x1f83d9ab Version of EnSilica Ltd, All Rights Reserved

7 hash[7] = 0x5be0cd19 The SHA224 initial hash that should be written is given below hash[0] = 0xc1059ed8 hash[1] = 0x367cd507 hash[2] = 0x3070dd17 hash[3] = 0xf70e5939 hash[4] = 0xffc00b31 hash[5] = 0x hash[6] = 0x64f98fa7 hash[7] = 0xbefa4fa4 For SHA224 only the final value of registers msg[0] to msg[6] are valid hash[i] Figure 5: Format of the hash registers Register Values Description hash[i] 32-bits of a hash 32-bit part select of a hash Table 6: Fields of the hash register Version of EnSilica Ltd, All Rights Reserved

8 5 SHA256/SHA224 Operation 5.1 Introduction SHA2 is a cryptographic hash function designed by the United States National Security Agency and is a U.S. Federal Information Processing Standard published by NIST. The implementation is described in Ref.1. There are various hash lengths that are supported in the NIST standard, but this core only supports SHA256 and SHA224. SHA256 produces a 256-bit hash value from an arbitrary length message but less than bits. SHA224 produces a 224-bit hash value from an arbitrary length message but less than bits. A message is segmented into 512 bit blocks and padded out with zeros on the final block if not a multiple of the block size. A SHA2 round consists of 64 iterations, starting with the current 256-bit hash and operating on a 512-bit message block. At the end of the iterations the hash is updated ready for the next message block, or to be read as the final hash. A new message can be started at any time by preloading the hash registers with a special initial value that is prescribed in the standards. For SHA256 this is: hash[0] = 0x6a09e667 hash[1] = 0xbb67ae85 hash[2] = 0x3c6ef372 hash[3] = 0xa54ff53a hash[4] = 0x510e527f hash[5] = 0x9b05688c hash[6] = 0x1f83d9ab hash[7] = 0x5be0cd19 Whereas for SHA224 it is hash[0] = 0xc1059ed8 hash[1] = 0x367cd507 hash[2] = 0x3070dd17 hash[3] = 0xf70e5939 hash[4] = 0xffc00b31 hash[5] = 0x hash[6] = 0x64f98fa7 hash[7] = 0xbefa4fa4 The interface to the IP is very simple consisting of a control, status, message and hash registers. For a new message hash the hash registers are preloaded with the special initial condition above and the first 512 bit message block is loaded into the message registers. The start bit is set true by writing to the control register. The processor can now start to load the next 512 bit block into the message register and then polls the status register waiting for the busy bit to be false. Once this is the case then the new data can be processed by writing to the start bit again. The hash at the end of every 64 iteration round can be read from the hash registers. For SHA224 only the final msg registers 0 to 6 contain valid data. 5.2 Cycle counts It takes 65 cycles to calculate the 64 iterations and update the hash after a start command. Version of EnSilica Ltd, All Rights Reserved

9 6 Revision History Hardware Software Description Revision Release Initial release Minor updates Table 7: Revision History References 1. Secure Hash Standard Version of EnSilica Ltd, All Rights Reserved