| // Copyright lowRISC contributors. |
| // Licensed under the Apache License, Version 2.0, see LICENSE for details. |
| // SPDX-License-Identifier: Apache-2.0 |
| // |
| // This module is the single round keccak permutation module |
| // It supports Keccak with up to 1600b of state |
| |
| `include "prim_assert.sv" |
| |
| module keccak_2share |
| import prim_mubi_pkg::*; |
| #( |
| parameter int Width = 1600, // b= {25, 50, 100, 200, 400, 800, 1600} |
| |
| // Derived |
| localparam int W = Width/25, |
| localparam int L = $clog2(W), |
| localparam int MaxRound = 12 + 2*L, // Keccak-f only |
| localparam int RndW = $clog2(MaxRound+1), // Representing up to MaxRound |
| |
| // Control parameters |
| parameter bit EnMasking = 0, // Enable secure hardening |
| localparam int Share = EnMasking ? 2 : 1 |
| ) ( |
| input clk_i, |
| input rst_ni, |
| |
| input lc_ctrl_pkg::lc_tx_t lc_escalate_en_i, // Used to disable SVAs when escalating. |
| |
| input [RndW-1:0] rnd_i, // Current round index |
| input mubi4_t phase_sel_i, // Output mux contol. Used when EnMasking := 1 |
| input [1:0] cycle_i, // Current cycle index. Used when EnMasking := 1 |
| input rand_aux_i, // Auxiliary randomness input. Used when EnMasking := 1 |
| input [Width/2-1:0] rand_i, // Randomness for remasking. Used when EnMasking := 1 |
| input [Width-1:0] s_i [Share], |
| output logic [Width-1:0] s_o [Share] |
| ); |
| /////////// |
| // Types // |
| /////////// |
| // x y z |
| typedef logic [4:0][4:0][W-1:0] box_t; // (x,y,z) state |
| typedef logic [W-1:0] lane_t; // (z) |
| typedef logic [4:0] [W-1:0] plane_t; // (x,z) |
| typedef logic [4:0][4:0] slice_t; // (x,y) |
| typedef logic [4:0][W-1:0] sheet_t; // (y,z) identical to plane_t |
| typedef logic [4:0] row_t; // (x) |
| typedef logic [4:0] col_t; // (y) identical to row_t |
| |
| ////////////// |
| // Keccak_f // |
| ////////////// |
| box_t state_in [Share]; |
| box_t state_out [Share]; |
| box_t theta_data [Share]; |
| box_t rho_data [Share]; |
| box_t pi_data [Share]; |
| box_t chi_data [Share]; |
| box_t iota_data [Share]; |
| |
| box_t phase1_in [Share]; |
| box_t phase1_out [Share]; |
| box_t phase2_in [Share]; |
| box_t phase2_out [Share]; |
| |
| ///////////////// |
| // Unused nets // |
| ///////////////// |
| // Tie off input signals that aren't used in the unmasked implementation. |
| if (!EnMasking) begin : gen_tie_unused |
| logic unused_clk; |
| logic unused_rst_n; |
| mubi4_t unused_phase_sel; |
| logic [1:0] unused_cycle; |
| logic unused_rand_aux; |
| logic [Width/2-1:0] unused_rand; |
| assign unused_clk = clk_i; |
| assign unused_rst_n = rst_ni; |
| assign unused_phase_sel = phase_sel_i; |
| assign unused_cycle = cycle_i; |
| assign unused_rand_aux = rand_aux_i; |
| assign unused_rand = rand_i; |
| end |
| |
| ////////////////////////////////////////////////// |
| // Input/output type conversion and interfacing // |
| ////////////////////////////////////////////////// |
| for (genvar i = 0 ; i < Share ; i++) begin : g_state_inout |
| assign state_in[i] = bitarray_to_box(s_i[i]); |
| assign s_o[i] = box_to_bitarray(state_out[i]); |
| end : g_state_inout |
| |
| if (EnMasking) begin : g_2share_data |
| assign phase1_in = state_in; |
| assign phase2_in = state_in; |
| |
| always_comb begin |
| unique case (phase_sel_i) |
| MuBi4False: state_out = phase1_out; |
| MuBi4True: state_out = phase2_out; |
| default: state_out = phase1_out; |
| endcase |
| end |
| end else begin : g_single_data |
| assign phase1_in = state_in; |
| assign phase2_in = phase1_out; |
| assign state_out = phase2_out; |
| end |
| |
| ////////////// |
| // Datapath // |
| ////////////// |
| // This module has two phases. First phase, it calculates Theta, Rho, Pi steps |
| // in SHA3. At the second phase, it computes Chi and Iota steps. If masking is |
| // not enabled, the two phases are completed within a single clock cycle. |
| // |
| // If masking is enabled, the first phase (Phase1) completes in one cycle. |
| // Then, the output should be stored in the state and given to the input of |
| // this module again. The second phase in the masked version needs three |
| // clock cycles to complete. In the first clock cycle, the first stage of Chi |
| // is computed for the first lane halves. In the second clock cycle, the |
| // module then outputs the updated first lane halves. In the third clock |
| // cycle, the new second lane halves are output. To aggravate SCA, we |
| // randomly decide which lane halves to process first on a per-round basis. |
| // We use additional randomness generated by the PRNG to take this decision |
| // (rand_aux_i). For more details, refer to the comments in the "MUX control" |
| // section below. |
| |
| for (genvar i = 0 ; i < Share ; i++) begin : g_datapath |
| |
| // Phase 1: |
| assign theta_data[i] = theta(phase1_in[i]); |
| // Commented out rho function as vcs complains z-Offset%W isn't constant |
| // assign rho_data[i] = rho(theta_data[i]); |
| |
| assign pi_data[i] = pi(rho_data[i]); |
| |
| // Phase 2 (Cycles 1, 2 and 3): |
| // Chi : See below |
| // Iota: See below |
| end : g_datapath |
| |
| assign phase1_out = pi_data; |
| |
| // Iota adds Round Constants(RC), so only one share should be XORed |
| if (EnMasking) begin : g_2share_iota |
| assign iota_data[0] = iota(chi_data[0], rnd_i); |
| assign iota_data[1] = chi_data[1]; |
| end else begin : g_single_iota |
| assign iota_data[0] = iota(chi_data[0], rnd_i); |
| end |
| |
| if (EnMasking) begin : g_2share_chi |
| // Domain-Oriented Masking |
| // reference: https://eprint.iacr.org/2017/395.pdf |
| |
| localparam int unsigned WSheetHalf = $bits(sheet_t)/2; |
| logic [4:0][WSheetHalf-1:0] in_prd, out_prd; |
| |
| logic low_then_high_d, low_then_high_q; |
| logic in_data_low, out_data_low; |
| logic in_rand_ext; |
| logic update_dom; |
| |
| ///////////////// |
| // MUX control // |
| ///////////////// |
| |
| // Update lane-half processing order in Phase 1 and keep the value constant |
| // for the entire round. |
| assign low_then_high_d = |
| mubi4_test_false_strict(phase_sel_i) ? rand_aux_i : low_then_high_q; |
| |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) begin |
| low_then_high_q <= 1'b 0; |
| end else begin |
| low_then_high_q <= low_then_high_d; |
| end |
| end |
| |
| // This implementation uses both randomness provided from an external PRNG |
| // as well as intermediate results for remasking the DOM multipliers below. |
| // Per clock cycle, 800b of pseudo-random data (PRD) are required. The |
| // following schedule is used to only ever update the input data when also |
| // providing fresh randomness and vice versa. |
| // |
| // Cycle 0: Compute Theta, Rho, Pi - The DOM multipliers are not evaluated |
| // at all: the inputs are driven by the first lane halves (same |
| // values as in Cycle 3). Also the intermediate results we already |
| // had in Cycle 3 didn't change. |
| // Cycle 1: Compute first stage of Chi for first lane halves using the DOM |
| // multipliers. We use the fresh randomness provided from the |
| // PRNG for remasking. |
| // Cycle 2: Compute second stage of Chi and Iota for first lane halves. |
| // Compute first stage of Chi for second lane halves. We use the |
| // fresh randomness provided from the PRNG for remasking the |
| // DOM multipliers. |
| // Cycle 3: Compute second stage of Chi and Iota for second lane halves. |
| // Feed again first lane halves to DOM multiplier inputs (now |
| // the updated values become visible) together with intermediate |
| // results of Cycle 2. Don't update the register stage inside |
| // the DOM multipliers. |
| always_comb begin |
| unique case (cycle_i) |
| 2'h0: begin |
| in_data_low = low_then_high_q; |
| in_rand_ext = 1'b0; |
| update_dom = 1'b0; |
| end |
| 2'h1: begin |
| in_data_low = low_then_high_q; |
| in_rand_ext = 1'b1; |
| update_dom = 1'b1; |
| end |
| 2'h2: begin |
| in_data_low = ~low_then_high_q; |
| in_rand_ext = 1'b1; |
| update_dom = 1'b1; |
| end |
| 2'h3: begin |
| in_data_low = low_then_high_q; |
| in_rand_ext = 1'b0; |
| update_dom = 1'b0; |
| end |
| default: begin |
| in_data_low = low_then_high_q; |
| in_rand_ext = 1'b0; |
| update_dom = 1'b0; |
| end |
| endcase |
| end |
| |
| // When taking the lower lane halves in, the upper lane halves are output |
| // and vice versa. |
| assign out_data_low = ~in_data_low; |
| |
| ///////////////////// |
| // DOM multipliers // |
| ///////////////////// |
| |
| for (genvar x = 0 ; x < 5 ; x++) begin : g_chi_w |
| localparam int X1 = (x + 1) % 5; |
| localparam int X2 = (x + 2) % 5; |
| |
| sheet_t sheet0[Share]; // Inverted input X1 |
| sheet_t sheet1[Share]; // X2 |
| sheet_t sheet2[Share]; // DOM output |
| |
| assign sheet0[0] = ~phase2_in[0][X1]; |
| assign sheet0[1] = phase2_in[1][X1]; |
| |
| assign sheet1[0] = phase2_in[0][X2]; |
| assign sheet1[1] = phase2_in[1][X2]; |
| |
| // Convert sheet_t to 1D arrays, one for the upper and lower half lane. |
| logic [WSheetHalf-1:0] a0_l, a1_l, b0_l, b1_l; |
| logic [WSheetHalf-1:0] a0_h, a1_h, b0_h, b1_h; |
| logic [WSheetHalf-1:0] a0, a1, b0, b1, q0, q1; |
| |
| assign a0_l = {sheet0[0][0][W/2-1:0], |
| sheet0[0][1][W/2-1:0], |
| sheet0[0][2][W/2-1:0], |
| sheet0[0][3][W/2-1:0], |
| sheet0[0][4][W/2-1:0]}; |
| assign a1_l = {sheet0[1][0][W/2-1:0], |
| sheet0[1][1][W/2-1:0], |
| sheet0[1][2][W/2-1:0], |
| sheet0[1][3][W/2-1:0], |
| sheet0[1][4][W/2-1:0]}; |
| |
| assign a0_h = {sheet0[0][0][W-1:W/2], |
| sheet0[0][1][W-1:W/2], |
| sheet0[0][2][W-1:W/2], |
| sheet0[0][3][W-1:W/2], |
| sheet0[0][4][W-1:W/2]}; |
| assign a1_h = {sheet0[1][0][W-1:W/2], |
| sheet0[1][1][W-1:W/2], |
| sheet0[1][2][W-1:W/2], |
| sheet0[1][3][W-1:W/2], |
| sheet0[1][4][W-1:W/2]}; |
| |
| assign b0_l = {sheet1[0][0][W/2-1:0], |
| sheet1[0][1][W/2-1:0], |
| sheet1[0][2][W/2-1:0], |
| sheet1[0][3][W/2-1:0], |
| sheet1[0][4][W/2-1:0]}; |
| assign b1_l = {sheet1[1][0][W/2-1:0], |
| sheet1[1][1][W/2-1:0], |
| sheet1[1][2][W/2-1:0], |
| sheet1[1][3][W/2-1:0], |
| sheet1[1][4][W/2-1:0]}; |
| |
| assign b0_h = {sheet1[0][0][W-1:W/2], |
| sheet1[0][1][W-1:W/2], |
| sheet1[0][2][W-1:W/2], |
| sheet1[0][3][W-1:W/2], |
| sheet1[0][4][W-1:W/2]}; |
| assign b1_h = {sheet1[1][0][W-1:W/2], |
| sheet1[1][1][W-1:W/2], |
| sheet1[1][2][W-1:W/2], |
| sheet1[1][3][W-1:W/2], |
| sheet1[1][4][W-1:W/2]}; |
| |
| // Input muxing |
| assign a0 = in_data_low ? a0_l : a0_h; |
| assign a1 = in_data_low ? a1_l : a1_h; |
| assign b0 = in_data_low ? b0_l : b0_h; |
| assign b1 = in_data_low ? b1_l : b1_h; |
| |
| // Randomness muxing |
| // Intermediate results are rotated across rows. The new Row x depends on |
| // data from Rows x + 1 and x + 2. Hence we don't want to use intermediate |
| // results from Rows x, x + 1, and x + 2 for remasking. |
| assign in_prd[x] = in_rand_ext ? rand_i[x * WSheetHalf +: WSheetHalf] : |
| out_prd[rot_int(x, 5)]; |
| |
| prim_dom_and_2share #( |
| .DW (WSheetHalf), // a half sheet |
| .Pipeline(1) // Process the full sheet in 3 clock cycles. This reduces |
| // SCA leakage. |
| ) u_dom ( |
| .clk_i, |
| .rst_ni, |
| |
| .a0_i (a0), |
| .a1_i (a1), |
| .b0_i (b0), |
| .b1_i (b1), |
| .z_valid_i (update_dom), |
| .z_i (in_prd[x]), |
| .q0_o (q0), |
| .q1_o (q1), |
| .prd_o (out_prd[x]) |
| ); |
| |
| // Output conversion from q0, q1 to sheet_t |
| // For simplicity, we forward the generated lane half to both the upper |
| // and lower lane halves at this point. The actual output muxing/selection |
| // happens after the Iota step when generating phase2_out from iota_data |
| // and state_in below. |
| assign sheet2[0][4] = {2{q0[W/2*0+:W/2]}}; |
| assign sheet2[0][3] = {2{q0[W/2*1+:W/2]}}; |
| assign sheet2[0][2] = {2{q0[W/2*2+:W/2]}}; |
| assign sheet2[0][1] = {2{q0[W/2*3+:W/2]}}; |
| assign sheet2[0][0] = {2{q0[W/2*4+:W/2]}}; |
| |
| assign sheet2[1][4] = {2{q1[W/2*0+:W/2]}}; |
| assign sheet2[1][3] = {2{q1[W/2*1+:W/2]}}; |
| assign sheet2[1][2] = {2{q1[W/2*2+:W/2]}}; |
| assign sheet2[1][1] = {2{q1[W/2*3+:W/2]}}; |
| assign sheet2[1][0] = {2{q1[W/2*4+:W/2]}}; |
| |
| // Final XOR to generate the output |
| assign chi_data[0][x] = sheet2[0] ^ phase2_in[0][x]; |
| assign chi_data[1][x] = sheet2[1] ^ phase2_in[1][x]; |
| end : g_chi_w |
| |
| // Since Chi and thus Iota are separately applied to the lower and upper half |
| // lanes, we need to forward the input to the other half. |
| for (genvar x = 0 ; x < 5 ; x++) begin : g_2share_phase2_out_row |
| for (genvar y = 0 ; y < 5 ; y++) begin : g_2share_phase2_out_col |
| assign phase2_out[0][x][y] = out_data_low ? |
| { state_in[0][x][y][W-1:W/2], iota_data[0][x][y][W/2-1:0]} : |
| {iota_data[0][x][y][W-1:W/2], state_in[0][x][y][W/2-1:0]}; |
| assign phase2_out[1][x][y] = out_data_low ? |
| { state_in[1][x][y][W-1:W/2], iota_data[1][x][y][W/2-1:0]} : |
| {iota_data[1][x][y][W-1:W/2], state_in[1][x][y][W/2-1:0]}; |
| end |
| end |
| |
| end else begin : g_single_chi |
| assign chi_data[0] = chi(phase2_in[0]); |
| assign phase2_out = iota_data; |
| end |
| |
| // Rho ====================================================================== |
| // As RhoOffset[x][y] is considered as variable int in VCS, |
| // it is replaced with generate statement. |
| // Revised to meet verilator lint. Now RhoOffset is 1-D array |
| localparam int RhoOffset [25] = '{ |
| //y 0 1 2 3 4 x |
| 0, 36, 3, 105, 210, // 0: 0 1 2 3 4 |
| 1, 300, 10, 45, 66, // 1: 5 6 7 8 9 |
| 190, 6, 171, 15, 253, // 2: 10 11 12 13 14 |
| 28, 55, 153, 21, 120, // 3: 15 16 17 18 19 |
| 91, 276, 231, 136, 78 // 4: 20 21 22 23 24 |
| }; |
| for (genvar i = 0 ; i < Share ; i++) begin : g_rho |
| box_t rho_in, rho_out; |
| assign rho_in = theta_data[i]; |
| assign rho_data[i] = rho_out; |
| |
| for (genvar x = 0 ; x < 5 ; x++) begin : gen_rho_x |
| for (genvar y = 0 ; y < 5 ; y++) begin : gen_rho_y |
| localparam int Offset = RhoOffset[5*x+y]%W; |
| localparam int ShiftAmt = W- Offset; |
| if (Offset == 0) begin : gen_offset0 |
| assign rho_out[x][y][W-1:0] = rho_in[x][y][W-1:0]; |
| end else begin : gen_others |
| assign rho_out[x][y][W-1:0] = {rho_in[x][y][0+:ShiftAmt], |
| rho_in[x][y][ShiftAmt+:Offset]}; |
| end |
| end |
| end |
| end : g_rho |
| |
| //////////////// |
| // Assertions // |
| //////////////// |
| |
| `ASSERT_INIT(ValidWidth_A, |
| EnMasking == 0 && Width inside {25, 50, 100, 200, 400, 800, 1600} || |
| EnMasking == 1 && Width inside {50, 100, 200, 400, 800, 1600}) |
| `ASSERT_INIT(ValidW_A, W inside {1, 2, 4, 8, 16, 32, 64}) |
| `ASSERT_INIT(ValidL_A, L inside {0, 1, 2, 3, 4, 5, 6}) |
| `ASSERT_INIT(ValidRound_A, MaxRound <= 24) // Keccak-f only |
| |
| // phase_sel_i shall stay for two cycle after change to 1. |
| lc_ctrl_pkg::lc_tx_t unused_lc_sig; |
| assign unused_lc_sig = lc_escalate_en_i; |
| if (EnMasking) begin : gen_selperiod_chk |
| `ASSUME(SelStayTwoCycleIfTrue_A, |
| ($past(phase_sel_i) == MuBi4False) && (phase_sel_i == MuBi4True) |
| |=> phase_sel_i == MuBi4True, clk_i, !rst_ni || lc_escalate_en_i != lc_ctrl_pkg::Off) |
| end |
| |
| /////////////// |
| // Functions // |
| /////////////// |
| |
| // Convert bitarray to 3D box |
| // Please take a look at FIPS PUB 202 |
| // https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf |
| // > For all triples (x,y,z) such that 0<=x<5, 0<=y<5, and 0<=z<w, |
| // > A[x,y,z]=S[w(5y+x)+z] |
| function automatic box_t bitarray_to_box(logic [Width-1:0] s_in); |
| automatic box_t box; |
| for (int y = 0 ; y < 5 ; y++) begin |
| for (int x = 0 ; x < 5 ; x++) begin |
| for (int z = 0 ; z < W ; z++) begin |
| box[x][y][z] = s_in[W*(5*y+x) + z]; |
| end |
| end |
| end |
| return box; |
| endfunction : bitarray_to_box |
| |
| // Convert 3D cube to bitarray |
| function automatic logic [Width-1:0] box_to_bitarray(box_t state); |
| automatic logic [Width-1:0] bitarray; |
| for (int y = 0 ; y < 5 ; y++) begin |
| for (int x = 0 ; x < 5 ; x++) begin |
| for (int z = 0 ; z < W ; z++) begin |
| bitarray[W*(5*y+x)+z] = state[x][y][z]; |
| end |
| end |
| end |
| return bitarray; |
| endfunction : box_to_bitarray |
| |
| // Rotate integer indices |
| function automatic integer rot_int(integer in, integer num); |
| integer out; |
| if (in == 0) begin |
| out = num - 1; |
| end else begin |
| out = in - 1; |
| end |
| return out; |
| endfunction |
| |
| // Step Mapping ============================================================= |
| // theta |
| // XOR each bit in the state with the parity of two columns |
| // C[x,z] = A[x,0,z] ^ A[x,1,z] ^ A[x,2,z] ^ A[x,3,z] ^ A[x,4,z] |
| // D[x,z] = C[x-1,z] ^ C[x+1,z-1] |
| // theta = A[x,y,z] ^ D[x,z] |
| parameter int ThetaIndexX1 [5] = '{4, 0, 1, 2, 3}; // (x-1)%5 |
| parameter int ThetaIndexX2 [5] = '{1, 2, 3, 4, 0}; // (x+1)%5 |
| function automatic box_t theta(box_t state); |
| plane_t c; |
| plane_t d; |
| box_t result; |
| for (int x = 0 ; x < 5 ; x++) begin |
| c[x] = state[x][0] ^ state[x][1] ^ state[x][2] ^ state[x][3] ^ state[x][4]; |
| end |
| for (int x = 0 ; x < 5 ; x++) begin |
| for (int z = 0 ; z < W ; z++) begin |
| int index_z; |
| index_z = (z == 0) ? W-1 : z-1; // (z+1)%W |
| d[x][z] = c[ThetaIndexX1[x]][z] ^ c[ThetaIndexX2[x]][index_z]; |
| end |
| end |
| for (int x = 0 ; x < 5 ; x++) begin |
| for (int y = 0 ; y < 5 ; y++) begin |
| result[x][y] = state[x][y] ^ d[x]; |
| end |
| end |
| return result; |
| endfunction : theta |
| |
| // rho |
| |
| // Commented out entire rho function due to VCS elaboration error. |
| // (z-RhoOffset[x][y]%W) isn't considered as a constant in VCS. |
| // Even changing it to W-RhoOffset[x][y]%W and assign to ShiftAmt |
| // creates same error. |
| |
| // Offset : Look at Table 2 in FIPS PUB 202 |
| //localparam int RhoOffset [5][5] = '{ |
| // //y 0 1 2 3 4 x |
| // '{ 0, 36, 3, 105, 210},// 0 |
| // '{ 1, 300, 10, 45, 66},// 1 |
| // '{ 190, 6, 171, 15, 253},// 2 |
| // '{ 28, 55, 153, 21, 120},// 3 |
| // '{ 91, 276, 231, 136, 78} // 4 |
| //}; |
| |
| // rotate bits of each lane by offset |
| // 1. rho[0,0,z] = A[0,0,z] |
| // 2. Offset swap |
| // a. (x,y) := (1,0) |
| // b. for t [0..23] |
| // i. rho[x,y,z] = A[x,y,z-(t+1)(t+2)/2] |
| // ii. (x,y) = (y, (2x+3y)) |
| //function automatic box_t rho(box_t state); |
| // box_t result; |
| // for (int x = 0 ; x < 5 ; x++) begin |
| // for (int y = 0 ; y < 5 ; y++) begin |
| // for (int z = 0 ; z < W ; z++) begin |
| // automatic int index_z; |
| // index_z = (z-RhoOffset[x][y])%W; |
| // result[x][y][z] = state[x][y][(z-RhoOffset[x][y])%W]; |
| // end |
| // end |
| // end |
| // return result; |
| //endfunction : rho |
| |
| // pi |
| // rearrange the position of lanes |
| // pi[x,y,z] = state[(x+3y),x,z] |
| localparam int PiRotate [5][5] = '{ |
| //y 0 1 2 3 4 x |
| '{ 0, 3, 1, 4, 2},// 0 |
| '{ 1, 4, 2, 0, 3},// 1 |
| '{ 2, 0, 3, 1, 4},// 2 |
| '{ 3, 1, 4, 2, 0},// 3 |
| '{ 4, 2, 0, 3, 1} // 4 |
| }; |
| function automatic box_t pi(box_t state); |
| box_t result; |
| for (int x = 0 ; x < 5 ; x++) begin |
| for (int y = 0 ; y < 5 ; y++) begin |
| result[x][y][W-1:0] = state[PiRotate[x][y]][x][W-1:0]; |
| end |
| end |
| return result; |
| endfunction : pi |
| |
| // chi |
| // chi[x,y,z] = state[x,y,z] ^ ((state[x+1,y,z] ^ 1) & state[x+2,y,z]) |
| parameter int ChiIndexX1 [5] = '{1, 2, 3, 4, 0}; // (x+1)%5 |
| parameter int ChiIndexX2 [5] = '{2, 3, 4, 0, 1}; // (x+2)%5 |
| function automatic box_t chi(box_t state); |
| box_t result; |
| for (int x = 0 ; x < 5 ; x++) begin |
| result[x] = state[x] ^ ((~state[ChiIndexX1[x]]) & state[ChiIndexX2[x]]); |
| end |
| return result; |
| endfunction : chi |
| |
| // iota |
| // XOR (x,y) = (0,0) with Round Constant (RC) |
| |
| // RC parameter: Precomputed by util/keccak_rc.py. Only up-to 0..L-1 is used |
| // RC = '0 |
| // RC[2**j-1] = rc(j+7*rnd) |
| // rc(t) = |
| // 1. t%255 == 0 -> 1 |
| // 2. R[0:7] = 'b10000000 |
| // 3. for i = [1..t%255] |
| // a. R = 0 || R |
| // b. R[0] = R[0] ^ R[8] |
| // c. R[4] = R[4] ^ R[8] |
| // d. R[5] = R[5] ^ R[8] |
| // e. R[6] = R[6] ^ R[8] |
| // f. R = R[0:7] |
| // 4. return R[0] |
| // RC has L = [0..6] |
| // for lower L case, only chopping lower part of 64bit RC is sufficient. |
| localparam logic [63:0] RC [24] = '{ |
| 64'h 0000_0000_0000_0001, // Round 0 |
| 64'h 0000_0000_0000_8082, // Round 1 |
| 64'h 8000_0000_0000_808A, // Round 2 |
| 64'h 8000_0000_8000_8000, // Round 3 |
| 64'h 0000_0000_0000_808B, // Round 4 |
| 64'h 0000_0000_8000_0001, // Round 5 |
| 64'h 8000_0000_8000_8081, // Round 6 |
| 64'h 8000_0000_0000_8009, // Round 7 |
| 64'h 0000_0000_0000_008A, // Round 8 |
| 64'h 0000_0000_0000_0088, // Round 9 |
| 64'h 0000_0000_8000_8009, // Round 10 |
| 64'h 0000_0000_8000_000A, // Round 11 |
| 64'h 0000_0000_8000_808B, // Round 12 |
| 64'h 8000_0000_0000_008B, // Round 13 |
| 64'h 8000_0000_0000_8089, // Round 14 |
| 64'h 8000_0000_0000_8003, // Round 15 |
| 64'h 8000_0000_0000_8002, // Round 16 |
| 64'h 8000_0000_0000_0080, // Round 17 |
| 64'h 0000_0000_0000_800A, // Round 18 |
| 64'h 8000_0000_8000_000A, // Round 19 |
| 64'h 8000_0000_8000_8081, // Round 20 |
| 64'h 8000_0000_0000_8080, // Round 21 |
| 64'h 0000_0000_8000_0001, // Round 22 |
| 64'h 8000_0000_8000_8008 // Round 23 |
| }; |
| |
| // iota: XOR with RC for (x,y) = (0,0) |
| function automatic box_t iota(box_t state, logic [RndW-1:0] rnd); |
| box_t result; |
| result = state; |
| result[0][0][W-1:0] = state[0][0][W-1:0] ^ RC[rnd][W-1:0]; |
| |
| return result; |
| endfunction : iota |
| |
| // Round function : Rnd(A,i_r) |
| // Not used due to rho function issue described above. |
| |
| //function automatic box_t keccak_rnd(box_t state, logic [RndW-1:0] rnd); |
| // box_t keccak_state; |
| // keccak_state = iota(chi(pi(rho(theta(state)))), rnd); |
| // |
| // return keccak_state; |
| //endfunction : keccak_rnd |
| |
| endmodule |
