View source for SHA-3 Hardware Implementations Round One

From The ECRYPT Hash Function Website

← SHA-3 Hardware Implementations Round One

You do not have permission to edit this page, for the following reason:

---

You can view and copy the source of this page.

== Important Information == This page summarizes key properties of reported hardware implementations of the SHA-3 candidates of round 1. The page with hardware implementations of those SHA-3 candidates which are still under consideration by NIST can be found [[SHA-3_Hardware_Implementations|here]]. The implementations are categorized into FPGA and standard-cell ASIC implementations. Note that the diversity of implementation scope, target technologies, and synthesis tools makes direct comparisions between different hardware implementation difficult. The more of these parameters agree, the more reasonable the comparison becomes. The target technology should be as similar as possible. For FPGA implementation, it is desirable to compare implementations on the same target device (or at least on devices of the same FPGA family). For standard-cell ASIC implementation, at least the minimal gate length of the process (e.g., 0.13 µm) should agree. More ideally, the implementations use the same standard-cell library (which implies the use of the same process technology). In order to facilitate the comparision of hardware modules with different implementation scopes, we classify them into three categories: * [[#Fully_Autonomous_Implementation|Fully autonomous]] * [[#Implementation_with_External_Memory|Using external memory]] * [[#Implementation_of_Core_Functionality|Core functionality]] === Fully Autonomous Implementation === [[Image:HW_type_self-cont.jpg]] Such hardware implementations include the complete functionality of a SHA-3 candidate (or a specific version thereof). That means the input message can be loaded piecewise into the hardware module and it delivers the message digest as output. All hash calculations happen exclusively within the hardware module. If integrated in a system, the achievable throughput of a fully autonomous implementation depends on the speed of the hardware module itself and the speed of the (system dependent) data interface delivering the input message. === Implementation with External Memory === [[Image:HW_type_ext-mem.jpg]] These implementations use external memory to hold intermediate values during the hashing of a message. The implemented hardware itself normally consists of the core logic functionality of the hash function, some registers for short-lived temporary values, and possible a memory controller for access to the external memory. Such implementations can load the input message either over a dedicated interface (similar to a fully autonomous implementation) or from the external memory. In order to reach the maximal throughput of the hardware module, the external memory must be sufficiently fast. === Implementation of Core Functionality === [[Image:HW_type_core-funct.jpg]] Such implementations comprise only important parts of the hash function (e.g., the compression function), which normally allows to get a first-order estimate of the performance figures of full implementations. == High-Speed Implementations (FPGA) == Important note: The size and functionality of slices varies between FPGA families. A direct comparision of the slice count of implementations on different FPGA families is therefore problematic. {| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" |- style="background:#efefef;" ! width="120"| Hash Function Name !! width="150"| Reference !! width="100"| Impl. Scope !! width="200"| Impl. Details !! width="100"| Technology !! width="80"| Size !! width="80"| Throughput !! width="80"| Clock Frequency |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units || Xilinx Virtex-II Pro || align="right"| 3091 slices || align="right"| 1724 Mbit/s || align="right"| 37.0 MHz |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units || Xilinx Virtex 4 || align="right"| 3087 slices || align="right"| 2235 Mbit/s || align="right"| 48.0 MHz |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units || Xilinx Virtex 5 || align="right"| 1694 slices || align="right"| 3103 Mbit/s || align="right"| 67.0 MHz |- | BLAKE-32 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units and I/O registers || Altera Stratix III || align="right"| 5435 ALUTs || align="right"| 2186.2 Mbit/s || align="right"| 46.97 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units || Xilinx Virtex-II Pro || align="right"| 11122 slices || align="right"| 1177 Mbit/s || align="right"| 17.0 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units || Xilinx Virtex 4 || align="right"| 11483 slices || align="right"| 1707 Mbit/s || align="right"| 25.0 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units || Xilinx Virtex 5 || align="right"| 4329 slices || align="right"| 2389 Mbit/s || align="right"| 35.0 MHz |- | Blue Midnight Wish-256 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with f0, f1, and f2 unrolled in sequence and I/O registers || Altera Stratix III || align="right"| 12917 ALUTs || align="right"| 4889.6 Mbit/s || align="right"| 9.55 MHz |- | CHI-224/256 || [http://ehash.iaik.tugraz.at/uploads/2/2c/Chi_submission.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Iterative implementation || Xilinx Virtex 2 || align="right"| 1582 slices || align="right"| 3200 Mbit/s || align="right"| 126.0 MHz |- | CubeHash8/1-256 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 2 compression functions unrolled || Xilinx Spartan 3 || align="right"| 3268 slices || align="right"| 70 Mbit/s || align="right"| 37.9 MHz |- | CubeHash8/1-256 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 1 iterated compression function || Xilinx Virtex 5 || align="right"| 1178 slices || align="right"| 160 Mbit/s || align="right"| 166.8 MHz |- | ECHO-224/256 || [http://www.ucc.ie/en/crypto/CodingandCryptographyWorkshop/TheClaudeShannonWorkshoponCodingCryptography2009/DocumentFile,75649,en.pdf Lu et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || || Xilinx Virtex 5 || align="right"| 9333 slices || align="right"| 14860 Mbit/s || align="right"| 87.1 MHz |- | ECHO-384/512 || [http://www.ucc.ie/en/crypto/CodingandCryptographyWorkshop/TheClaudeShannonWorkshoponCodingCryptography2009/DocumentFile,75649,en.pdf Lu et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || || Xilinx Virtex 5 || align="right"| 9097 slices || align="right"| 7810 Mbit/s || align="right"| 83.9 MHz |- | Grøstl-224/256 || [http://eprint.iacr.org/2009/206.pdf Jungk et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || P & Q permutation in parallel || Xilinx Spartan 3 || align="right"| 6136 slices || align="right"| 4520 Mbit/s || align="right"| 88.3 MHz |- | Grøstl-224/256 || [http://www.groestl.info/Groestl.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || P & Q permutation in parallel || Xilinx Virtex 5 || align="right"| 1722 slices || align="right"| 10276 Mbit/s || align="right"| 200.7 MHz |- | Grøstl-384/512 || [http://www.groestl.info/Groestl.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || P & Q permutation in parallel || Xilinx Spartan 3 || align="right"| 20233 slices || align="right"| 5901 Mbit/s || align="right"| 80.7 MHz |- | Grøstl-384/512 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || P & Q permutation interleaved, S-box in BRAM || Xilinx Spartan 3 || align="right"| 6313 slices || align="right"| 2910 Mbit/s || align="right"| 79.61 MHz |- | Grøstl-384/512 || [http://www.groestl.info/Groestl.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || P & Q permutation in parallel || Xilinx Virtex 5 || align="right"| 5419 slices || align="right"| 15395 Mbit/s || align="right"| 210.5 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-main-1.2.pdf Updated specification (v1.2)] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Core (round function, state register) & IO buffer || Altera Cyclone III || align="right"| 5776 LEs || align="right"| 7500 Mbit/s || align="right"| 133 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-main-1.2.pdf Updated specification (v1.2)] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Core (round function, state register) & IO buffer || Altera Stratix III || align="right"| 4713 ALUTs || align="right"| 12400 Mbit/s || align="right"| 218 MHz |- | Keccak || [http://www.strombergson.com/files/Keccak_in_FPGAs.pdf Joachim Str&ouml;mbergson] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Core (round function, state register) only || Xilinx Spartan 3A || align="right"| 3393 slices || align="right"| 4800 Mbit/s || align="right"| 85 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-main-1.2.pdf Updated specification (v1.2)] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Core (round function, state register) & IO buffer || Xilinx Virtex 5 || align="right"| 1412 slices || align="right"| 6900 Mbit/s || align="right"| 122 MHz |- | LANE-224/256 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 6 parallel permutation units || Xilinx Spartan 3 || align="right"| 19692 slices || align="right"| 1140 Mbit/s || align="right"| 31.3 MHz |- | LANE-224/256 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 6 parallel permutation units || Xilinx Virtex 5 || align="right"| 6888 slices || align="right"| 4490 Mbit/s || align="right"| 123 MHz |- | LANE-384/512 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 2 parallel permutation units || Xilinx Spartan 3 || align="right"| 17499 slices || align="right"| 880 Mbit/s || align="right"| 30.4 MHz |- | LANE-384/512 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 6 parallel permutation units || Xilinx Virtex 5 || align="right"| 14649 slices || align="right"| 4200 Mbit/s || align="right"| 69.8 MHz |- | Luffa-256 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function (1 cycle latency) and I/O registers || Altera Stratix III || align="right"| 16552 ALUTs || align="right"| 12042.2 Mbit/s || align="right"| 47.04 MHz |- | MD6 || [http://groups.csail.mit.edu/cis/md6/submitted-2008-10-27/Supporting_Documentation/md6_report.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 16 parallel steps || Xilinx Virtex-II Pro || align="right"| 5313 slices || align="right"| 1232 Mbit/s || align="right"| 150.3 MHz |- | MD6 || [http://groups.csail.mit.edu/cis/md6/submitted-2008-10-27/Supporting_Documentation/md6_report.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 32 parallel steps || Xilinx Virtex-II Pro || align="right"| 7529 slices || align="right"| 1894 Mbit/s || align="right"| 141.6 MHz |- | MD6-256 || [http://www.131002.net/data/papers/HCAOF09.pdf Henzen et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Sequential mode (L=0), compression function with 16 parallel steps || Xilinx Virtex-4 || align="right"| 4465 slices || align="right"| 8440 Mbit/s || align="right"| 286 MHz |- | MD6-512 || [http://www.131002.net/data/papers/HCAOF09.pdf Henzen et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Sequential mode (L=0), compression function with 16 parallel steps || Xilinx Virtex-4 || align="right"| 4515 slices || align="right"| 5254 Mbit/s || align="right"| 286 MHz |- | Shabal || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 36 adders in permutation || Xilinx Spartan 3 || align="right"| 2223 slices || align="right"| 740 Mbit/s || align="right"| 71.48 MHz |- | Shabal || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 36 adders in permutation || Xilinx Virtex 5 || align="right"| 2768 slices || align="right"| 1450 Mbit/s || align="right"| 138.87 MHz |- | Shabal-256 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with I/O registers (latency of 16 clock cycles) || Altera Stratix III || align="right"| 1440 ALUTs || align="right"| 3125.6 Mbit/s || align="right"| 195.35 MHz |- | Skein-256 || [http://www.skein-hash.info/sites/default/files/skein_fpga.pdf Men Long] || [[#Implementation_of_Core_Functionality|Core functionality]] || UBI component || Xilinx Virtex 5 || align="right"| 1001 slices || align="right"| 408.7 Mbit/s || align="right"| 114.9 MHz |- | Skein-256 || [http://eprint.iacr.org/2009/159.pdf Stefan Tillich] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 8 Threefish rounds unrolled || Xilinx Virtex 5 || align="right"| 937 slices || align="right"| 1751 Mbit/s || align="right"| 68.4 MHz |- | Skein-256 || [http://eprint.iacr.org/2009/159.pdf Stefan Tillich] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 8 Threefish rounds unrolled || Xilinx Spartan 3 || align="right"| 2421 slices || align="right"| 669 Mbit/s || align="right"| 26.14 MHz |- | Skein-512 || [http://www.skein-hash.info/sites/default/files/skein_fpga.pdf Men Long] || [[#Implementation_of_Core_Functionality|Core functionality]] || UBI component || Xilinx Virtex 5 || align="right"| 1877 slices || align="right"| 817.4 Mbit/s || align="right"| 114.9 MHz |- | Skein-512 || [http://eprint.iacr.org/2009/159.pdf Stefan Tillich] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 8 Threefish rounds unrolled || Xilinx Virtex 5 || align="right"| 1632 slices || align="right"| 3535 Mbit/s || align="right"| 69.04 MHz |- | Skein-512 || [http://eprint.iacr.org/2009/159.pdf Stefan Tillich] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 8 Threefish rounds unrolled || Xilinx Spartan 3 || align="right"| 4273 slices || align="right"| 1365 Mbit/s || align="right"| 26.66 MHz |- | Spectral Hash || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || Single-cycle compression function, 16 8-point DFT units || Xilinx Virtex 5 || align="right"| 14601 slices || align="right"| 16040 Mbit/s || align="right"| 31.34 MHz |} <br><br> == Low-Area Implementations (FPGA) == {| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" |- style="background:#efefef;" ! width="120"| Hash Function Name !! width="150"| Reference !! width="100"| Impl. Scope !! width="200"| Implementation Details !! width="100"| Technology !! width="80"| Size !! width="80"| Throughput !! width="80"| Clock Frequency |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 1 G function unit || Xilinx Virtex-II Pro || align="right"| 958 slices || align="right"| 371 Mbit/s || align="right"| 59.0 MHz |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 1 G function unit || Xilinx Virtex 4 || align="right"| 960 slices || align="right"| 430 Mbit/s || align="right"| 68.0 MHz |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 1 G function unit || Xilinx Virtex 5 || align="right"| 390 slices || align="right"| 575 Mbit/s || align="right"| 91.0 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 1 G function unit || Xilinx Virtex-II Pro || align="right"| 1802 slices || align="right"| 326 Mbit/s || align="right"| 36.0 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 1 G function unit || Xilinx Virtex 4 || align="right"| 1856 slices || align="right"| 381 Mbit/s || align="right"| 42.0 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 1 G function unit || Xilinx Virtex 5 || align="right"| 939 slices || align="right"| 533 Mbit/s || align="right"| 59.0 MHz |- | Grøstl-224/256 || [http://eprint.iacr.org/2009/206.pdf Jungk et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 64-bit datapath, P & Q permutation in parallel || Xilinx Spartan 3 || align="right"| 2486 slices || align="right"| 404 Mbit/s || align="right"| 63.2 MHz |- | Grøstl-224/256 || [http://eprint.iacr.org/2009/206.pdf Jungk et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 64-bit datapath, P & Q permutation in parallel || Xilinx Virtex 2 Pro || align="right"| 2754 slices || align="right"| 512 Mbit/s || align="right"| 81.5 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-main-1.2.pdf Updated specification (v1.2)] || [[#Implementation_with_External_Memory|Using external memory]] || Small core using system memory || Altera Stratix III || align="right"| 855 ALUTs || align="right"| 96.8 Mbit/s || align="right"| 366 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-main-1.2.pdf Updated specification (v1.2)] || [[#Implementation_with_External_Memory|Using external memory]] || Small core using system memory || Altera Cyclone III || align="right"| 1559 LEs || align="right"| 47.8 Mbit/s || align="right"| 181 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-main-1.2.pdf Updated specification (v1.2)] || [[#Implementation_with_External_Memory|Using external memory]] || Small core using system memory || Xilinx Virtex 5 || align="right"| 444 slices || align="right"| 70.1 Mbit/s || align="right"| 265 MHz |- | LANE-224/256 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 1 permutation unit || Xilinx Spartan 3 || align="right"| 5725 slices || align="right"| 520 Mbit/s || align="right"| 50.2 MHz |- | LANE-224/256 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 1 permutation unit || Xilinx Virtex 5 || align="right"| 3442 slices || align="right"| 1380 Mbit/s || align="right"| 133 MHz |- | LANE-384/512 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 1 permutation unit || Xilinx Spartan 3 || align="right"| 6635 slices || align="right"| 660 Mbit/s || align="right"| 41 MHz |- | LANE-384/512 || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 1 permutation unit || Xilinx Virtex 5 || align="right"| 3439 slices || align="right"| 2300 Mbit/s || align="right"| 142 MHz |- | Shabal || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 1 adder in permutation || Xilinx Spartan 3 || align="right"| 1933 slices || align="right"| 540 Mbit/s || align="right"| 89.71 MHz |- | Shabal || [http://eprint.iacr.org/2009/342.pdf Baldwin et al.] || [[#Implementation_of_Core_Functionality|Core functionality]] || 1 adder in permutation || Xilinx Virtex 5 || align="right"| 2307 slices || align="right"| 1330 Mbit/s || align="right"| 222.22 MHz |- | Skein-256-256 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || One round of Threefish iterated || Altera Stratix III || align="right"| 1385 ALUTs || align="right"| 573.9 Mbit/s || align="right"| 161.42 MHz |} <br><br> == High-Speed Implementations (ASIC) == {| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" |- style="background:#efefef;" ! width="120"| Hash Function Name !! width="150"| Reference !! width="100"| Impl. Scope !! width="200"| Implementation Details !! width="100"| Technology !! width="80"| Size !! width="80"| Throughput !! width="80"| Clock Frequency |- | AURORA-224/256 || [http://ehash.iaik.tugraz.at/uploads/b/ba/AURORA.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One round of one MSM and one CPM in parallel with 1 cycle latency (Type-H1), table-lookup S-box || 0.13 µm || align="right"| 35.02 kGates || align="right"| 10352 Mbit/s || align="right"| 363.9 MHz |- | AURORA-384/512 || [http://ehash.iaik.tugraz.at/uploads/b/ba/AURORA.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One round of one MSM and two CPMs in parallel with 1 cycle latency (Type-H1), table-lookup S-box || 0.13 µm || align="right"| 56.75 kGates || align="right"| 9132 Mbit/s || align="right"| 361.2 MHz |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units || UMC 0.18 µm || align="right"| 58.30 kGates || align="right"| 5295 Mbit/s || align="right"| 114 MHz |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 4 G function units || UMC 0.18 µm || align="right"| 41.31 kGates || align="right"| 4153 Mbit/s || align="right"| 170 MHz |- | BLAKE-32 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units and I/O registers || STM 90 nm || align="right"| 53 kGates || align="right"| 4475 Mbit/s(*) || align="right"| 96.15 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 8 G function units || UMC 0.18 µm || align="right"| 132.47 kGates || align="right"| 5910 Mbit/s || align="right"| 87 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 4 G function units || UMC 0.18 µm || align="right"| 82.73 kGates || align="right"| 4810 Mbit/s || align="right"| 136 MHz |- | Blue Midnight Wish-256 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with f0, f1, and f2 unrolled in sequence and I/O registers || STM 90 nm || align="right"| 164 kGates || align="right"| 26665 Mbit/s(*) || align="right"| 52.08 MHz |- | CHI-224/256 || [http://ehash.iaik.tugraz.at/uploads/2/2c/Chi_submission.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Iterative implementation || 0.13 µm || align="right"| 101.46 kGates || align="right"| 4800 Mbit/s || align="right"| 188 MHz |- | ECHO-224/256 || [http://www.ucc.ie/en/crypto/CodingandCryptographyWorkshop/TheClaudeShannonWorkshoponCodingCryptography2009/DocumentFile,75649,en.pdf Lu et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || || 0.13 µm || align="right"| 521.1 kGates || align="right"| 14850 Mbit/s || align="right"| 87.1 MHz |- | ECHO-384/512 || [http://www.ucc.ie/en/crypto/CodingandCryptographyWorkshop/TheClaudeShannonWorkshoponCodingCryptography2009/DocumentFile,75649,en.pdf Lu et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || || 0.13 µm|| align="right"| 516.8 kGates || align="right"| 7750 Mbit/s || align="right"| 83.3 MHz |- | Fugue-256 || [http://domino.research.ibm.com/comm/research_projects.nsf/pages/fugue.index.html/$FILE/NIST-submission-Oct08-fugue.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Four SMIX transformations parallel (SUPER4_P) || IBM 90 nm || align="right"| 109.85 kGates || align="right"| 13913 Mbit/s || align="right"| 869.5 MHz |- | Grøstl-224/256 || [http://www.groestl.info Grøstl website] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One shared permutation for P & Q, one pipeline stage || UMC 0.18 µm || align="right"| 58.4 kGates || align="right"| 6290 Mbit/s || align="right"| 270.2 MHz |- | Grøstl-384/512 || [http://www.groestl.info/Groestl.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || P & Q permutation in parallel || UMC 0.18 µm || align="right"| 341 kGates || align="right"| 6225 Mbit/s || align="right"| 85.1 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-main-1.2.pdf Updated specification (v1.2)] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Core (round function, state register) & IO buffer || ST 0.13 µm || align="right"| 48 kGates || align="right"| 29900 Mbit/s || align="right"| 526 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-specifications.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Core (round function, state register) only || ST 0.13 µm || align="right"| 40 kGates || align="right"| 15000 Mbit/s || align="right"| 500 MHz |- | LANE-224/256 || [http://www.cosic.esat.kuleuven.be/publications/article-1181.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Six permutation blocks in parallel (two full AES engines each) || 0.13 µm || align="right"| 243.49 kGates || align="right"| 14191 Mbit/s || align="right"| 305 MHz |- | LANE-384/512 || [http://www.cosic.esat.kuleuven.be/publications/article-1181.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Six permutation blocks in parallel (four full AES engines each) || 0.13 µm || align="right"| 466.19 kGates || align="right"| 20958 Mbit/s || align="right"| 286 MHz |- | Lesamnta-256 || [http://www.sdl.hitachi.co.jp/crypto/lesamnta/Proposal_doc_1.0.1_Jan2009.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || || 90 nm || align="right"| 190.1 kGates || align="right"| 6026 Mbit/s || align="right"| 282.5 MHz |- | Lesamnta-512 || [http://www.sdl.hitachi.co.jp/crypto/lesamnta/Proposal_doc_1.0.1_Jan2009.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || || 90 nm || align="right"| 393 kGates || align="right"| 9992 Mbit/s || align="right"| 234.2 MHz |- | Luffa-224/256 || [http://www.sdl.hitachi.co.jp/crypto/luffa/Luffa_SupportingDocument.pdf Supporting document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Three permutation blocks in parallel (64 S-boxes, 4 MixWord blocks each) || 0.13 µm || align="right"| 26.85 kGates || align="right"| 12642 Mbit/s || align="right"| 444 MHz |- | Luffa-256 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function (1 cycle latency) and I/O registers || STM 90 nm || align="right"| 122 kGates || align="right"| 25702 Mbit/s(*) || align="right"| 100.4 MHz |- | Luffa-384 || [http://www.sdl.hitachi.co.jp/crypto/luffa/Luffa_SupportingDocument.pdf Supporting document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Four permutation blocks in parallel (64 S-boxes, 4 MixWord blocks each) || 0.13 µm || align="right"| 34.99 kGates || align="right"| 12642 Mbit/s || align="right"| 444 MHz |- | Luffa-512 || [http://www.sdl.hitachi.co.jp/crypto/luffa/Luffa_SupportingDocument.pdf Supporting document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Five permutation blocks in parallel (64 S-boxes, 4 MixWord blocks each) || 0.13 µm || align="right"| 44.16 kGates || align="right"| 12642 Mbit/s || align="right"| 444 MHz |- | MD6 || [http://groups.csail.mit.edu/cis/md6/submitted-2008-10-27/Supporting_Documentation/md6_report.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with 48 parallel steps || GPDSK 90 nm || align="right"| 145 kGates || align="right"| N/A || align="right"| 200 MHz |- | MD6 || [http://groups.csail.mit.edu/cis/md6/submitted-2008-10-27/Supporting_Documentation/md6_report.pdf Submission document] || [[#Implementation_with_External_Memory|Using external memory]] || Compression function with 16 parallel steps & memory control logic || GPDSK 90 nm || align="right"| 105 kGates || align="right"| N/A || align="right"| 200 MHz |- | MD6-256 || [http://www.131002.net/data/papers/HCAOF09.pdf Henzen et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Sequential mode (L=0), compression function with 16 parallel steps || 0.18 µm || align="right"| 69.78 kGates || align="right"| 16320 Mbit/s || align="right"| 552 MHz |- | MD6-512 || [http://www.131002.net/data/papers/HCAOF09.pdf Henzen et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Sequential mode (L=0), compression function with 16 parallel steps || 0.18 µm || align="right"| 69.78 kGates || align="right"| 10103 Mbit/s || align="right"| 552 MHz |- | Shabal-256 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with I/O registers (latency of 16 clock cycles) || STM 90 nm || align="right"| 20 kGates || align="right"| 6612 Mbit/s(*) || align="right"| 413.22 MHz |- | Skein-256-256 || [http://eprint.iacr.org/2009/159.pdf Stefan Tillich] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 8 Threefish rounds unrolled || UMC 0.18 µm || align="right"| 53.87 kGates || align="right"| 1762 Mbit/s || align="right"| 68.8 MHz |- | Skein-256-256 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || All 72 Threefish rounds unrolled || STM 90 nm || align="right"| 369 kGates || align="right"| 3126 Mbit/s(*) || align="right"| 12.21 MHz |- | Skein-512-512 || [http://eprint.iacr.org/2009/159.pdf Stefan Tillich] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 8 Threefish rounds unrolled || UMC 0.18 µm || align="right"| 102.35 kGates || align="right"| 2501 Mbit/s || align="right"| 48.8 MHz |} (*) Estimated peak throughput for the minimal delay of compression function: 1000 * (Input Size in bits) / [(Compression Function Delay in ns) * (Number of Cycles)] = Throughput in Mbit/s <br><br> == Low-Area Implementations (ASIC) == {| border="1" cellpadding="4" cellspacing="0" align="center" class="wikitable" |- style="background:#efefef;" ! width="120"| Hash Function Name !! width="150"| Reference !! width="100"| Impl. Scope !! width="200"| Implementation Details !! width="100"| Technology !! width="80"| Size !! width="80"| Throughput !! width="80"| Clock Frequency |- | ARIRANG-256 || [http://eprint.iacr.org/2009/349.pdf Tillich et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One compression function step per cycle || AMS 0.35 µm || align="right"| 23.73 kGates || align="right"| 713.3 Mbit/s || align="right"| 61.3 MHz |- | AURORA-224/256 || [http://ehash.iaik.tugraz.at/uploads/b/ba/AURORA.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One round of one MSM or one CPM with 2 cycles latency (Type-H4) || 0.13 µm || align="right"| 11.11 kGates || align="right"| 2179 Mbit/s || align="right"| 306.4 MHz |- | AURORA-384/512 || [http://ehash.iaik.tugraz.at/uploads/b/ba/AURORA.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One round of one MSM or one CPM with 2 cycles latency (Type-H4) || 0.13 µm || align="right"| 14.61 kGates || align="right"| 1191 Mbit/s || align="right"| 293.1 MHz |- | BLAKE-32 || [http://eprint.iacr.org/2009/349.pdf Tillich et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One G function in 11 cycles || AMS 0.35 µm || align="right"| 25.57 kGates || align="right"| 15.4 Mbit/s || align="right"| 31.25 MHz |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with a single G function unit || UMC 0.18 µm || align="right"| 10.54 kGates || align="right"| 253 Mbit/s || align="right"| 40 MHz |- | BLAKE-32 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with a half G function unit || UMC 0.18 µm || align="right"| 9.89 kGates || align="right"| 127 Mbit/s || align="right"| 40 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with a single G function unit || UMC 0.18 µm || align="right"| 20.61 kGates || align="right"| 181 Mbit/s || align="right"| 20 MHz |- | BLAKE-64 || [http://131002.net/blake/blake.pdf Submission document] || [[#Implementation_of_Core_Functionality|Core functionality]] || Compression function with a half G function unit || UMC 0.18 µm || align="right"| 19.46 kGates || align="right"| 91 Mbit/s || align="right"| 20 MHz |- | CHI-224/256 || [http://ehash.iaik.tugraz.at/uploads/2/2c/Chi_submission.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || Iterative implementation || 0.13 µm || align="right"| 62.99 kGates || align="right"| 968 Mbit/s || align="right"| 38 MHz |- | ECHO-224/256 || [http://www.ucc.ie/en/crypto/CodingandCryptographyWorkshop/TheClaudeShannonWorkshoponCodingCryptography2009/DocumentFile,75649,en.pdf Lu et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || || 0.13 µm || align="right"| 82.2 kGates || align="right"| 373 Mbit/s || align="right"| 66.6 MHz |- | Fugue-256 || [http://domino.research.ibm.com/comm/research_projects.nsf/pages/fugue.index.html/$FILE/NIST-submission-Oct08-fugue.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One SMIX transformation (SUPER1_L) || IBM 90 nm || align="right"| 59.22 kGates || align="right"| 2000 Mbit/s || align="right"| 500 MHz |- | Grøstl-224/256 || [http://eprint.iacr.org/2009/349.pdf Tillich et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 64-bit datapath, P & Q permutation shared || AMS 0.35 µm || align="right"| 14.62 kGates || align="right"| 145.9 Mbit/s || align="right"| 55.87 MHz |- | Grøstl-224/256 || [http://www.groestl.info Grøstl website] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 64-bit datapath, P & Q permutation shared || UMC 0.18 µm || align="right"| 17 kGates || align="right"| 645 Mbit/s || align="right"| 246.9 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-main-1.2.pdf Updated specification (v1.2)] || [[#Implementation_with_External_Memory|Using external memory]] || Small core using system memory || ST 0.13 µm || align="right"| 6.5 kGates || align="right"| 176.4 Mbit/s(*) || align="right"| 666.7 MHz |- | Keccak || [http://keccak.noekeon.org/Keccak-main-1.2.pdf Updated specification (v1.2)] || [[#Implementation_with_External_Memory|Using external memory]] || Small core using system memory, clock freq. limited to 200 MHz || ST 0.13 µm || align="right"| 5 kGates || align="right"| 52.9 Mbit/s(**) || align="right"| 200 MHz |- | LANE-224/256 || [http://www.cosic.esat.kuleuven.be/publications/article-1181.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One permutation block (one S-box and MixColumns block) || 0.13 µm || align="right"| 16.46 kGates || align="right"| 23.3 Mbit/s || align="right"| 100 MHz |- | Lesamnta-256 || [http://www.sdl.hitachi.co.jp/crypto/lesamnta/Proposal_doc_1.0.1_Jan2009.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || || 90 nm || align="right"| 20.7 kGates || align="right"| 336.9 Mbit/s || align="right"| 169.8 MHz |- | Lesamnta-512 || [http://www.sdl.hitachi.co.jp/crypto/lesamnta/Proposal_doc_1.0.1_Jan2009.pdf Submission document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || || 90 nm || align="right"| 44.3 kGates || align="right"| 571.9 Mbit/s || align="right"| 144.1 MHz |- | Luffa-224/256 || [http://www.sdl.hitachi.co.jp/crypto/luffa/Luffa_SupportingDocument.pdf Supporting document] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || One permutation block (One S-box, one MixWord block) || 0.13 µm || align="right"| 10.16 kGates || align="right"| 28.7 Mbit/s || align="right"| 100 MHz |- | Skein-256-256 || [http://eprint.iacr.org/2009/349.pdf Tillich et al.] || [[#Fully_Autonomous_Implementation|Fully autonomous]] || 64-bit datapath || AMS 0.35 µm || align="right"| 12.89 kGates || align="right"| 19.8 Mbit/s || align="right"| 80 MHz |- | Skein-256-256 || [http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html Namin and Hasan] || [[#Implementation_of_Core_Functionality|Core functionality]] || One round of Threefish iterated || STM 90 nm || align="right"| 21 kGates || align="right"| 1018.8 Mbit/s(***) || align="right"| 286.53 MHz |} (*) Estimation for 64-bit memory interface: (1024 bits/permutation) * (666.7 * 10^6 cycles/s) / (3870 cycles/permutation) = 176.41 * 10^6 bits/s <br /> (**) Estimation for 64-bit memory interface: (1024 bits/permutation) * (200 * 10^6 cycles/s) / (3870 cycles/permutation) = 52.92 * 10^6 bits/s <br /> (***) Estimated peak throughput for the minimal delay of compression function: 1000 * (Input Size in bits) / [(Compression Function Delay in ns) * (Number of Cycles)] = Throughput in Mbit/s <br /> <br />

Return to SHA-3 Hardware Implementations Round One.