Haralambos Michail

High-Speed FPGA Implementation of Secure Hash Algorithm for IPSec and VPN Applications

Hash functions are special cryptographic algorithms, which are applied wherever message integrity and authentication are critical. Implementations of these functions are cryptographic primitives widely used in common cryptographic schemes and security protocols such as Internet Protocol Security (IPSec) and Virtual Private Network (VPN). In this paper, a novel FPGA implementation of the Secure Hash Algorithm 1 (SHA-1) is proposed. The proposed architecture exploits the benefits of pipeline and re-timing of execution through pre-computation of intermediate temporal values. Pipeline allows division of the calculation of the hash value in four discreet stages, corresponding to the four required rounds of the algorithm. Re-timing is based on the decomposition of the SHA-1 expression to separate information dependencies and independencies. This allows pre-computation of intermediate temporal values in parallel to the calculation of other independent values. Exploiting the information dependencies, the fundamental operational block of SHA-1 is modified so that maximum operation frequency is increased by 30% approximately with negligible area penalty compared to other academic and commercial implementations. The proposed SHA-1 hash function was prototyped and verified using a XILINX FPGA device. The implementation’s characteristics are compared to alternative implementations proposed by the academia and the industry, which are available in the international IP market. The proposed implementation achieved a throughput that exceeded 2,5 Gbps, which is the highest among all similar IP cores for the targeted XILINX technology.

Implementation of HSSec: a high-speed cryptographic co-processor

In this paper a high-speed cryptographic coprocessor, named HSSec, is presented. The core embeds two hash functions, SHA-1 and SHA-512, and the symmetric block cipher AES. The architecture of HSSec renders it suitable for widely spread applications with security demands. The presented co-processor can be used in every system integrating standards such as IPSec or the upcoming JPSec and P1619. The main characteristic of the proposed implementation is common use of the available resources, to minimize further area requirements. Additionally the cryptographic primitives can operate in parallel, providing high throughput whenever needed. Finally the system can operate in ECB or CBC modes. The HSSec co-processor has relatively small area and its performance reaches 1 Gbps (AES, SHA-1 and SHA-512) for XILINXs Virtex II FPGA family.

Throughput Optimization of the Cipher Message Authentication Code

A new algorithm for producing message authenticating code (MAC) was recently proposed by NIST. The MAC protects both a messages integrity - by ensuring that a different MAC will be produced if the message has changed - as well as its authenticity - because only someone who knows the secret key could be able to generate a valid MAC. The proposed process incorporates a FIPS approved and secure block cipher algorithm which was standardized by NIST in May, 2005. The first implementation of the CMAC is presented in this paper. Throughput has been the main design target. The proposed implementation goes one step further introducing an optimized ciphering core to achieve competitive throughput for CMAC, compared to alternative MACs.

A novel high-throughput implementation of a partially unrolled SHA-512

A design approach to create small-sized high-speed implementation of the new version of secure hash algorithm is proposed. The resulted design can be easily embedded to operate in HMAC IP cores, providing a high degree of security. The proposed implementation does not introduce significant area penalty, compared to other competitive designs. However the achieved throughput presents an increase compared to commercially available IP cores that range from 48%-1912%

High throughput implementation of the new secure hash algorithm through partial unrolling

A design approach to create small-sized high-speed implementation of the new version of secure hash algorithm is proposed. The resulted design can be easily embedded to operate in HMAC IP cores, providing a high degree of security. The proposed implementation does not introduce significant area penalty, compared to other competitive designs. However the achieved throughput presents an increase compared to commercially available IP cores that range from 43%-1830%.

Application of novel technique in RIPEMD-160 aiming at high-throughput

Hash functions, form a special family of cryptographic algorithms that satisfy current requirements for security, confidentiality and validity for several applications in technology. Many applications like PKI, IPSec, DSA, MACpsilas need the requirements mentioned before. All the previous applications incorporate hash functions and address, as the time passes, to more and more users-clients and thus the increase of their throughput is quite necessary. In this paper we propose an implementation that increases throughput and frequency significantly and at the same time keeps the area small enough for the hash function RIPEMD-160, which is emanated from the necessity for existence of very strong algorithms in cryptanalysis. This technique involves the application of spatial and temporal pre-computation. The proposed technique leads to an implementation with more than 35% higher throughput.

Integration of a concurrent signature monitoring mechanism in a System-on-a-Chip

In this work, an IP infrastructure is presented that provides concurrent signature monitoring to the designed system-on-a-chip (SoC). Such mechanisms ensure application code consistency and research focus integration inside high performance processor cores. A low-cost but very effective approach is offered, which has been successfully integrated in a prototype targeting safety critical applications. The advantages of the integration of this simple unit in a SoC and its characteristics are also presented.