INSTRUCTIONS PROCESSORS, METHODS, AND SYSTEMS TO PROCESS SECURE HASH ALGORITHMS

• US 20140185793A1
• Filed: 12/28/2012
• Published: 07/03/2014
• Est. Priority Date: 12/28/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Gilbert M. Wolrich
• Inventors: WOLRICH, GILBERT M., Yap, Kirk S., Gopal, Vinodh, Guilford, James D.
• Granted Patent: US 9,251,377 B2
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 9/30007 to perform operations on data operands
• CPC Class Codes: G06F 9/30036 Instructions to perform operations on packed data, e.g. vector, tile or matrix operations
• CPC Class Codes: G06F 9/30038 using a mask
• CPC Class Codes: G06F 9/30101 Special purpose registers
• CPC Class Codes: G06F 9/30145 Instruction analysis, e.g. decoding, instruction word fields
• CPC Class Codes: G06F 9/3016 Decoding the operand specifier, e.g. specifier format
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC

Abstract

A method of an aspect includes receiving an instruction. The instruction indicates a first source of a first packed data including state data elements a_i, b_i, e_i, and f_i for a current round (i) of a secure hash algorithm 2 (SHA2) hash algorithm. The instruction indicates a second source of a second packed data. The first packed data has a width in bits that is less than a combined width in bits of eight state data elements a_i, b_i, c_i, d_i, e_i, f_i, g_i, h_i of the SHA2 hash algorithm. The method also includes storing a result in a destination indicated by the instruction in response to the instruction. The result includes updated state data elements a_i+, b_i+, e_i+, and f_i+ that have been updated from the corresponding state data elements a_i, b_i, e_i, and f_i by at least one round of the SHA2 hash algorithm.

Claims

1. A method comprising:

receiving an instruction, the instruction indicating a first source of a first packed data including state data elements a_i, b_i, e_i, and f_i for a current round (i) of a secure hash algorithm 2 (SHA2) hash algorithm, the instruction also indicating a second source of a second packed data, wherein the first packed data has a width in bits that is less than a combined width in bits of eight state data elements the a_i, the b_i, c_i, d_i, the e_i, the f_i, g_i, and h_i of the SHA2 hash algorithm; and

storing a result in a destination indicated by the instruction in response to the instruction, the result including updated state data elements a_i+, b_i+, e_i+, and f_i+ that have been updated from the corresponding state data elements a_i, b_i, e_i, and f_i by at least one round of the SHA2 hash algorithm.

2. The method of claim 1, wherein storing comprises storing updated state data elements a_i+2, b_i+2, e_i+2, and f_i+2 that have been updated from the corresponding state data elements a_i, b_i, e_i, and f_i, f_i by two rounds of the SHA2 hash algorithm.

3. The method of claim 1, wherein storing comprises storing updated state data elements a_i+4, b_i+4, e_i+4, and f_i+4 that have been updated from the corresponding state data elements a_i, b_i, e_i, and f_i, f_i by four rounds of the SHA2 hash algorithm.

4. The method of claim 1, wherein the instruction indicates as sources only the first and second sources, and wherein the second packed data includes:

the state data element c_i;

the state data element d_l;

a first sum including the state element h_l added to a message input for the current round W(i) added to a constant input for the current round K(i) added to an evaluation of a Ch function with the state elements e_i, f_i, and g_i for the current round added to an evaluation of a Σ

_l function with the state element e_i for the current round; and

a second sum including the state element g_i added to a message input for one round after the current round W(i+1) added to a constant input for one round after the current round K(i+1).

5. The method of claim 1, wherein the second packed data includes the state data elements c_i, g_i, and h_i.

6. The method of claim 5, wherein the instruction indicates a third source of a third packed data, wherein the third packed data represents message and constant inputs for the current round and for one round after the current round.

7. The method of claim 1, wherein storing the result includes:

storing updated state data elements a_i+2, b_i+2, e_i+2, and f_i+2 that have been updated from the corresponding state data elements a_i, b_i, e_i, and f_i, f_i by two rounds of the SHA2 hash algorithm; and

storing updated state data elements a_i+4, e_i+4, and f_i+4 that have been updated from the corresponding state data elements a_i, b_i, e_i, and f_i, f_i by four rounds of the SHA2 hash algorithm.

8. The method of claim 1, wherein the first packed data has only four of the eight state data elements.

9. The method of claim 1, further comprising receiving another instruction that is to use the state data elements a_i, b_i, e_i, and f_i, f_i as state data elements c_i+2, d_i+2, g_i+2, and h_i+2, respectively, wherein the state data elements c_i+2, d_i+2, g_i+2, and h_i+2 represent the corresponding state data elements c_i, g_i, and h_i updated by two rounds of the SHA2 hash algorithm.

10. The method of claim 1, further comprising, in response to the instruction, for the current round performing operations comprising:

(a_i ROTR

     2) XOR (a_i ROTR

     13) XOR (a_i ROTR

     22); and

(a_i AND b_i) XOR (a_i AND c_i) XOR (a_i AND c_i),

in which ROTR represents a rotate right operation, AND represents a logical AND operation, and XOR represents a logical exclusive OR operation.

11. An apparatus comprising:

a plurality of packed data registers; and

an execution logic coupled with the plurality of the packed data registers, the execution logic operable, in response to an instruction that is to indicate a first source of a first packed data that is to include state data elements a_i, b_i, e_i, and f_i for a current round (i) of a secure hash algorithm 2 (SHA2) hash algorithm, and the instruction to also indicate a second source of a second packed data, wherein the first packed data is to have a width in bits that is less than a combined width in bits of eight state data elements the a_i, the b_i, c_i, d_i, the e_i, the f_i, g_i, and h_i of the SHA2 hash algorithm, the execution logic operable to store a result in a destination indicated by the instruction, the result to include updated state data elements a_i+, b_i+, e_i+, and f_i+ that are to be updated from the corresponding state data elements a_i, b_i, e_i, and f_i by at least one round of the SHA2 hash algorithm.

12. The apparatus of claim 11, wherein the execution logic is operable, in response to the instruction, to store updated state data elements a_i+2, b_i+2, e_i+2, and f_i+2 that are to be updated from the corresponding state data elements a_i, b_i, e_i, and f_i by two rounds of the SHA2 hash algorithm.

13. The apparatus of claim 11, wherein the execution logic is operable, in response to the instruction, to store updated state data elements a_i+4, b_i+4, e_i+4, and f_i+4 that are to be updated from the corresponding state data elements a_i, b_i, e_i, and f_i by four rounds of the SHA2 hash algorithm.

14. The apparatus of claim 11, wherein the instruction is to indicate as sources only the first and second sources, and wherein the second packed data is to include:

the state data element c_i;

the state data element d_i;

a first sum that is to include the state element h_i added to a message input for the current round W(i) added to a constant input for the current round K(i) added to an evaluation of a Ch function with the state elements e_i, f_i, and g_i for the current round added to an evaluation of a Σ

_l function with the state element e_i, f_i, g_i for the current round; and

a second sum that is to include the state element g_i added to a message input for one round after the current round W(i+1) added to a constant input for one round after the current round K(i+1).

15. The apparatus of claim 11, wherein the second packed data includes the state data elements c_i, d_i, g_i, and h_i.

16. The apparatus of claim 15, wherein the instruction indicates a third source of a third packed data, wherein the third packed data represents message and constant inputs for the current round and for one round after the current round.

17. The apparatus of claim 11, wherein storing the result includes:

storing updated state data elements a_i+2, b_i+2, e_i+2, and f_i+2 that have been updated from the corresponding state data elements a_i, b_i, e_i, and f_i by two rounds of the SHA2 hash algorithm; and

storing updated state data elements a_i+4, e_i+4, and f_i+4 that have been updated from the corresponding state data elements a_i, b_i, e_i, and f_i by four rounds of the SHA2 hash algorithm.

18. The apparatus of claim 11, wherein the first packed data is to include only four of the eight state data elements.

19. The apparatus of claim 11, wherein the execution logic is operable, in response to the instruction, to perform operations comprising:

(a_i ROTR

     2) XOR (a_i ROTR

     13) XOR (a_i ROTR

     22); and

(a_i AND b_i) XOR (a_i AND c_i) XOR (a_i AND c_i),

in which ROTR represents a rotate right operation, AND represents a logical AND operation, and XOR represents a logical exclusive OR operation.

20. A system comprising:

an interconnect;

a processor coupled with the interconnect, the processor to receive an instruction that is to indicate a first source of a first packed data that is to include state data elements a_i, b_i, e_i, and f_i for a current round (i) of a secure hash algorithm 2 (SHA2) hash algorithm, the instruction also to indicate a second source of a second packed data, wherein the first packed data is to have a width in bits that is less than a combined width in bits of eight state data elements of the SHA2 hash algorithm, the processor operable, in response to the instruction, to store a result in a destination indicated by the instruction, the result to include updated state data elements a_i+, b_i+, e_i+, and f_i+ that are to be updated from the corresponding state data elements a_i, b_i, e_i, and f_i by at least one round of the SHA2 hash algorithm; and

a dynamic random access memory (DRAM) coupled with the interconnect.

21. The system of claim 20, wherein the processor is operable, in response to the instruction, to store updated state data elements a_i+2, b_i+2, e_i+2, and f_i+2 that are to be updated from the corresponding state data elements a_i, b_i, e_i, and f_i by two rounds of the SHA2 hash algorithm

22. The system of claim 20, wherein the second packed data is to include:

a state data element c_i;

a state data element d_i;

a first sum that is to include a state element h_i added to a message input for the current round W(i) added to a constant input for the current round K(i) added to an evaluation of a Ch function with state elements e_i, f_i, and g_i for the current round added to an evaluation of a Σ

_l function with the state element e, for the current round; and

a second sum that is to include a state element g_i added to a message input for one round after the current round W(i+1) added to a constant input for one round after the current round K(i+1).

23. An article of manufacture comprising:

a tangible non-transitory machine-readable storage medium, the tangible non-transitory machine-readable storage medium storing an instruction,

the instruction to indicate a first source of a first packed data including state data elements a_i, b_i, e_i, and f_i for a current round (i) of a secure hash algorithm 2 (SHA2) hash algorithm, the instruction also to indicate a second source of a second packed data, wherein the first packed data is to have a width in bits that is less than a combined width in bits of eight state data elements of the SHA2 hash algorithm, and

the instruction if executed by a machine operable to cause the machine to perform operations comprising storing a result in a destination to be indicated by the instruction, the result including updated state data elements a_i+, b_i+, e_i+, and f_i+ that have been updated from the corresponding state data elements a_i, b_i, e_i, and f_i by at least one round of the SHA2 hash algorithm.

24. The article of claim 23, wherein the processor is operable, in response to the instruction, to store updated state data elements a_i+2, b_i+2, e_i+2, and f_i+2 that are to be updated from the corresponding state data elements a_i, b_i, e_i, and f_i by two rounds of the SHA2 hash algorithm

25. The article of claim 23, wherein the second packed data is to include:

a state data element c_i;

a state data element d_i;

a first sum that is to include a state element h_i added to a message input for the current round W(i) added to a constant input for the current round K(i) added to an evaluation of a Ch function with state elements e_i, f_i, and g_i for the current round added to an evaluation of a Σ

_l function with the state element e, for the current round; and

a second sum that is to include a state element g_i added to a message input for one round after the current round W(i+1) added to a constant input for one round after the current round K(i+1).

26. An apparatus comprising:

a plurality of packed data registers; and

execution logic coupled with the plurality of the packed data registers, the execution logic operable, in response to an instruction that is to indicate a first source of a first packed data that is to include state data elements g_i and h_i for a current round (i) of a secure hash algorithm 2 (SHA2) hash algorithm, wherein the first packed data is to have a width in bits that is less than a combined width in bits of eight state data elements a_i, b_i, c_i, d_i, e_i, f_i, the g_i, and the h_i of the SHA2 hash algorithm, and the instruction to indicate a second source of a second packed data that is to represent message and constant inputs for the current round and for one round after the current round, wherein at least one of the first source and the second source are to include the state data elements e_i and f_i, the execution logic operable to store a result in a destination indicated by the instruction, the result to include;

a first sum that is to include the state element h_i added to a message input for the current round (W(i)) added to a constant input for the current round (K(i)) added to an evaluation of a Ch function with the state elements e_i, f_i, and g_i for the current round added to an evaluation of a Σ

_l function with the state element e_i for the current round; and

a second sum that is to include the state element g_i added to a message input for one round after the current round W(i+1) added to a constant input for one round after the current round K(i+1).

27. The apparatus of claim 26, wherein the first packed data is to include the state data element c_i and the state data element d_i.

28. The apparatus of claim 26, wherein the first packed data is to include the state data element e, and the state data element f_i.

29. The apparatus of claim 26, wherein the execution unit is operable to store two additional state data elements from the first packed data to the result.

30. The apparatus of claim 26, wherein the width in bits of the first packed data is half the combined width in bits of the eight state data elements, and wherein the instruction indicates as sources only the first and second sources.