On The Impact of Target Technology in SHA-3 Hardware Benchmark Rankings

Both FPGAs and ASICs are widely used as the technology for comparing SHA-3 hardware benchmarking process. However, the impact of target technology in SHA-3 hardware benchmark rankings has hardly been considered. A cross-platform comparison between the FPGA and ASIC results of the 14 second round SHA-3 designs demonstrates the gap between two sets of benchmarking results. In this paper we describe a systematic approach to analyze a SHA-3 hardware benchmark process for both FPGAs and ASICs, and we present our latest results for FPGA and ASIC evaluation of the 14 second round SHA-3 candidates. 1 About Paper Version 2.0 This version contains updated FPGA results with Xilinx Virtex-5 XC5VLX3302FF1760 FPGA. All the FPGA area, speed and power results are generated based on Xilinx XFLOW command-line tool (Version 12.2). All the Verilog/VHDL source codes and FPGA/ASIC scripts for 14 SHA-3 algorithms with the SHA256 reference design can be found at VT-SHA3 project website: (http://rijndael.ece.vt.edu/sha3/). 2 Introduction The SHA-3 competition organized by NIST aims to select, in three phases, a successor for the mainstream SHA-2 hash algorithms in use today. By the completion of Phase 1 in July 2009, 14 out of the 51 hash candidate submissions were identified for further consideration as SHA-3 candidates. These 14 candidates will be further analyzed with respect to security, cost and performance, covering both algorithm and implementation characteristics [1]. For the second phase of the competition, NIST is looking for additional cryptanalytic results, as well as for performance evaluation data on hardware platforms. Two major classes of hardware devices, Field Programmable Gate Arrays (FPGAs) and Application Specific Integrated Circuits (ASICs), were extensively studied during Round 2 SHA-3 hardware evaluation [2–12]. It is widely accepted 2 X. Guo, S. Huang, L. Nazhandali and P. Schaumont that FPGAs and ASICs implementing the same design show different characteristics [13]. A hardware benchmarking process, therefore, starts by fixing the target technology, either ASICs or FPGAs, and then report the results based on selected metrics that are appropriate for the target technology. Several SHA-3 hardware rankings have been obtained in this manner. In this paper we intend to address the question if the choice of target technology can affect the resulting ranking between FPGA and ASIC designs built based on the same HDL source code. We motivate our work by the need of the SHA-3 hardware benchmarking process. Different ASIC and FPGA rankings have been provided and implied the superiority of certain algorithms. In general, compared to ASICs, FPGAs offer many advantages including reduced nonrecurring engineering and shorter time to market. These advantages come at the cost of an increase in silicon area, a decrease in performance, and an increase in power consumption when designs are implemented on FPGAs. These inefficiencies in FPGA-based implementations are widely known and accepted, although there have been few attempts to quantify them. One exception is Kuon, who describes the gap between ASIC and FPGA in terms of area, performance, and power consumption [13]. Kuon compares a 90-nm CMOS FPGA and 90-nm CMOS standard-cell ASIC in terms of logic density, circuit speed, and power consumption for core logic. He finds that, for a representative set of benchmarks, the area gap between FPGA and ASIC is 35 times. He points out that the area gap may decrease when “hard” blocks in the FPGA fabric (multipliers, memories, and so on) would be used. The ratio of critical-path delay, from FPGA to ASIC, is roughly three to four times. The dynamic power consumption ratio is approximately 14 times and, with hard blocks, this gap generally becomes smaller. In this work we report on a methodology to provide a consistent comparison between SHA-3 FPGA and ASIC designs with three major steps. First, we select the technology node for both FPGAs and ASICS as the starting point for our cross-platform evaluation. Second, we propose several metrics to approach a comparison between FPGA and ASIC results. Third, present an analysis of such results for 14 candidates implemented in ASIC and FPGA. 3 Related Work The hardware evaluation of SHA-3 candidates has started shortly after the specifications and reference software implementations of 51 algorithms submitted to the contest became available. The majority of initial comparisons were limited to less than five candidates [2, 12]. More comprehensive efforts became feasible only after NIST’s announcement of 14 candidates qualified to the second round of the competition in July 2009. Since then, in both FPGA and ASIC categories, several comprehensive studies have been reported [3–11]. Matsuo et al. [8, 9] focused on the use of FPGA-based SASEBO-GII board from AIST, Japan. All the results are based on the prototyping results and real measurements on a Xilinx Virtex-5 FPGA on board. Gaj et al. [3, 4] conducted a much more comprehensive Technology Impact in SHA-3 Hardware Benchmark Rankings 3 FPGA evaluation based ATHENA, which can generate multiple sets of results for several representative FPGA families from two major vendors. Baldwin et al. compared hardware implementations of different message digest sizes, including hardware padding, on a Xilinx Virtex-5 FPGA. Guo et al. [10] used a consistent and systematic approach to move the SHA-3 hardware benchmark process from the FPGA prototyping by [8, 9] to ASIC implementations based 130nm CMOS standard cell technology. Tillich et al. [6] presented the first ASIC post-synthesis results using 180nm CMOS standard cell technology with high throughput as the optimization goal and further provided post-layout results [5]. Henzen et al. [7] implemented several architectures in a 90nm CMOS standard cell technology, targeting highand moderate-speed constraints separately, and presented a complete benchmark of post-layout results. Table 1 compares these benchmarking efforts, and demonstrates that a comparison between FPGA and ASIC is hard because of several reasons. First, most groups do not share the same source codes. Second, the ASIC benchmarks do not use a common hardware interface. Third, the reported metrics do not allow a cross-platform (ASIC-FPGA) comparison. Although the joint work done by Matsuo et al. [8, 9] and Guo et al. [10] satisfy the first two conditions, still we believe that the chosen metrics are not well-suited for a cross-platform comparison between FPGA and ASIC benchmarks. All of the above issues motivate our work, namely an investigation of the (dis)similarity between FPGA and ASIC benchmarks for SHA-3 hardware candidates with 256 bits digest. 4 Methodology In this section, we describe our efforts in comparing the FPGA and ASIC performance evaluations. We describe the overall design flow that combines FPGA prototyping with ASIC design, and next elaborate the efforts to automate and standardize the ASIC implementation process. 4.1 Standard Interface So far, several research groups have proposed standard hardware interfaces with well supported design flows, including the interfaces defined by [3, 7, 14, 11]. A more detailed discussion on hash interface issues can be found at [9]. The key issue for a fair comparison is to use a common interface for all candidates. Therefore, we selected the interface proposal of Chen et al. [14] (with a data I/O width of 16-bits), but observe that other proposals may be equally valid choices. 4.2 Technology Node Selection for FPGAs and ASICs It’s not the intention of this article to pitch ASIC against FPGA. Instead, we want to evaluate how the performance numbers found on these two different technologies would be different assuming that someoone starts from the same RTL source code. This consideration affects how the target technologies for comparison are selected. 4 X. Guo, S. Huang, L. Nazhandali and P. Schaumont T a b le 1 . C o m p a re th e re la te d S H A -3 h a rd w a re b en ch m a rk in g w o rk in b o th F P G A s a n d A S IC s