USOO6829355B2

(12) United States Patent (10) Patent No.: US 6,829,355 B2

Lilly (45) Date of Patent: Dec. 7, 2004

(54) DEVICE FOR AND METHOD OF ONE-WAY 6,141,421 A * 10/2000 Takaragi et al. .............. 380/30
CRYPTOGRAPHC HASHING 6,307.938 B1 * 10/2001 Matyas et al. ................ 380/44
6,370.247 B1 * 4/2002 Takaragi et al. .............. 380/28
(75) Inventor: Glenn M. Lilly, Sykesville, MD (US) 6,408,273 B1 * 6/2002 Quagliaro et al. .......... 704/271
(73) Assignee: The United States of America as OTHER PUBLICATIONS
represented by the National Security Bruce Schneier, "Applied Cryptography, 2nd. ed., John
Agency, Washington, DC (US) Wiley & Sons, New York, 1996, pps. 429–459.
(*) Notice: Subject to any disclaimer, the term of this FIPSPOB 180-1, Secure Hash Standard, Apr. 17, 1995, pps.
patent is extended or adjusted under 35 1-16.
U.S.C. 154(b) by 822 days. * cited by examiner
(21) Appl. No.: 09/799,432 Primary Examiner-Ly V. Hua
(22) Filed: Mar. 5, 2001 (74) Attorney, Agent, or Firm-Robert D. Morelli
(65) Prior Publication Data (57) ABSTRACT
US 2002/0122554 A1 Sep. 5, 2002 The present invention is a device for and method of gener
7 ating a hash value for a message by padding the message,
(51) Int. C. - ------ ----- --------- -- --- --- HO4L 900, H04. 9/28; loading the padded meSSage into first shift register that
H04H 9/00; G06F 7/00 generates values according to a first rule of motion, initial
(52) U.S. Cl. ............................. 380/28; 380/30; 380/46; izing eight registers a, b, c, d, e, f, g, and h with user
380/37; 380/42; 380/262; 380/255; 713/189; definable values, converting the contents of the registers to
713/192; 713/200; 713/180; 711/216 h = g-1; g = f; 1; f = e, 1, e = d. 1+T 1, where
(58) Field of Search .............................. 380/28, 46, 30, T1=h1+X (e-)+Ch(e, 1, f, g, )+K+W.; d-c. 1;
380/37, 42, 262, 255; 713/189, 192, 200, c;=b_1,b,-a-1; and al-T1+T, where T =Xo(a)+Maj(a 1,
168, 180; 711/216 b-1, c. 1); computing ''g'). H(I)=b+H(i-1);
(56) References Cited Ha?i)=c+H
(j) C- 3(j(i-1);); HA(i)
(i)=d-i-Ha
- 4(j(i-1):); H(i)=e--H?i-1):
s(i) C- s(j );
H(i)=f-H(-1); H.(i)=g+H (i-1); and H(I)=h-i-H(i-1);
U.S. PATENT DOCUMENTS and either performing additional conversions of the registers
5,606,616 A 2/1997 Sprunk et al. or returning (H (), H2(j), H(), H(), H(), H(), H., (),
5,608,801. A * 3/1997 Aiello et al................... 380/46 Hs()) as the hash value of the message.
5,892.829 A * 4/1999 Aiello et al................. 713/18O
6,021.201 A 2/2000 Bakhle et al. 19 Claims, 2 Drawing Sheets

PADDING MESSAGE TO 512M BITS

PARSING Message INTO 1632M-BIT BLOCKS - ?

| GENERATING J VALUES Wi-Mi, OR 3
Wi = G, (W,-2)+W,+ co(W,-1)+W, is
INITIALIZING 8 REGISTERSA-H-4
CONVERTING 8 REGISTERS: H=G, G-F, 5
F=E, E=D+T1, D=C, B=A, A=T1+T2 6
COMPUTE VALUES: H1=A+H1, H2=B+H2,H3=C+H3,
H4=D+H4, H5=E+H5, H6=F+H6, H7=G+H7, H8=H+H8
RETURN PORTION OF LAST STEPAS HASH VALUE 7
MW
U.S. Patent Dec. 7, 2004 Sheet 1 of 2 US 6,829,355 B2

PADDING MESSAGE TO 512M BITS l

PARSING MESSAGE INTO 1632M-BIT BLOCKS 2

GENERATING JVALUES Wi=Mj, OR

- 15

NITIALIZING 8 REGISTERS Al-H H4

CONVERTING 8 REGISTERS: H=G, G=F, 5

F=E, E=D+T1, D=C, B=A, A=T1+T2 6

—
RETURN PORTION OF LAST STEPAS HASH WALUE H 7
FIG. 1
U.S. Patent Dec. 7, 2004 Sheet 2 of 2 US 6,829,355 B2

52 ACCUMULATOR

43.44, 45.46 s 47 50
ABC-D - E Gil H
53. 55 s It 56
so ; Maj(A, B, C) X. Ch(E, F, G)

s -- + 57
- 58 42 KEY
60
-

36 |35 34 33 32 31 30 29 28

27 26 25 24 23 22 21

FIG 2
 US 6,829,355 B2
1 2
DEVICE FOR AND METHOD OF ONE-WAY tions for its hash function such as MD5 and SHA (now
CRYPTOGRAPHC HASHING known as SHA-1) and does not disclose a new hash function
as does the present invention. U.S. Pat. No. 6,021,201 is
hereby incorporated by reference into the Specification of the
FIELD OF THE INVENTION present invention.
The present invention relates, in general, to cryptography SUMMARY OF THE INVENTION
and, in particular, to block/data Stream enciphering.
It is an object of the present invention to hash a value in
BACKGROUND OF THE INVENTION a one-way cryptographic manner.
An n-bit hash function produces an n-bit hash value from It is another object of the present invention to hash a value
an input of arbitrary length. An n-bit cryptographic hash in a manner that meets the Security requirements of AES and
is more secure than MD5 and SHA-1.
function is a one-way n-bit hash function that is collision
resistant. A one-way cryptographic hash function is one that The present invention is a method of generating a hash
requires 2n hash computations to be performed before an 15 value, or message digest, for a message. The first Step is
input is found that produces a given hash value from a given padding the message for which a hash value is desired So
hash function. Collision-resistance indicates that about 2(n/ that the padded message has a bit length of 512m, where m
2) hash computations must be performed before two differ is a user-definable positive integer. If m=1, the hash value
ent inputs are found that produce the same have value. The generated is 256 bits. If m=2, the hash value is 512 bits.
collision-resistance factor is taken as the amount of Security The Second Step of the method is parsing the result of the
provided by the hash function. first step into 1632m-bit blocks M.
Presently, the only one-way cryptographic hash function The third step of the method is generating j values W.
approved by the National Institute of Standards and Tech from the parsed message of the Second Step.
nology (NIST) is SHA-1 which is disclosed in Federal The fourth step of the method is initializing eight blocks
Information Processing Standards Publication 180-1 (FIPS 25
a, b, c, d, e, f, g, and h with user-definable values H., H., H.,
PUB 180-1), entitled “Secure Hash Standard.” FIPS PUB Hi, Hs, H., H-7, and Hs, respectively, where H-H collec
180-1 is hereby incorporated by reference into the specifi tively represent the initial value for the hash value.
cation of the present invention. The fifth step of the method is converting the contents of
SHA-1 produces a 160-bit hash value with a correspond a, b, c, d, e, f, g, and h.
ing collision resistance of 2 (160/2), whereas MD4 and The Sixth Step of the method is computing values that
MD5 each produce a 128-bit hash value with a correspond make up the hash value.
ing collision resistance of 2 (128/2). The Seventh, and last, Step of the method is either accept
NIST requires a one-way cryptographic hash function ing a portion of the contents of H(I)-H() as the hash value
with 128, 192, and 256 bits of security to go along with three 35 of the message or returning to the fifth Step for another Step
versions of its proposed Advanced Encryption Standard of the Second shift register.
(AES). The present invention is in response to this require The device of the present invention includes a user
ment.
U.S. Pat. No. 5,606,616, entitled “CRYPTOGRAPHIC definable number of registers, a first mod 2" adder, a first
APPARATUS WITH DOUBLE FEEDFORWARD HASH nonlinear function block, a Second nonlinear function block,
40 a first shift function block, a second shift function block, a
FUNCTION,” discloses, amongst other things, a device that Second mod 2" adder, a third mod 2" adder, a fourth mod 2"
uses a 64-bit DES algorithm to produce a hash value. Since adder, a fifth mod 2" adder, a sixth mod 2" adder, and an
the hash value is, effectively, 56 bits long, the cryptographic accumulator.
strength of this hash function is no more than 2(56/2). This The device may also include a message-Scheduler device
hash function is not adequate for use with AES and does not 45
disclose the one-way cryptographic hash function of the that includes a user-definable number of registers, a third
present invention. U.S. Pat. No. 5,606,616 is hereby incor shift function block, a fourth shift function block, a seventh
porated by reference into the Specification of the present mod 2" adder, an eighth mod 2" adder, and a ninth mod 2"
invention. adder.
U.S. Pat. No. 5,892.829, entitled “METHOD AND APPA 50 The device of the present invention includes n 32m-bit
RATUS FOR GENERATING SECURE HASH blocks as a first shift register; a first function block Oo(X); a
FUNCTIONS, discloses a device for and a method of Second function block O(x); a first logic block; a second
dividing a String to be hashed into a number of blocks and logic block, a third logic block, a fourth logic block, p
hashing each block along with another value using an 32m-bit blocks connected as a Second shift register; an
existing hash algorithm such as MD4, MD5, SHA-1, or 55 accumulator; a third function block X(x), a fourth function
DES. U.S. Pat. No. 5,892.829 provides no more security block X(x); a fifth function block Maj(x); a sixth function
than the hash function employed therein, none of which are block Ch (x); a sixth logic block; a seventh logic block; an
Suitable for use in AES. Furthermore, U.S. Pat. No. 5,892, eighth logic block, and a ninth logic block.
829 does not disclose the one-way cryptographic hash BRIEF DESCRIPTION OF THE DRAWINGS
function of the present invention. U.S. Pat. No. 5,892,829 is 60
hereby incorporated by reference into the Specification of the FIG. 1 is a list of the steps of the present invention; and
present invention. FIG. 2 is a block diagram of the present invention; and
U.S. Pat. No. 6,021,201, entitled “METHOD AND APPA DETAILED DESCRIPTION
RATUS FOR INTEGRATED CIPHERING AND
HASHING,” discloses a device for and method of perform 65 The present invention is a device for and method of
ing ciphering and hashing in parallel instead of in Series. generating a hash Value, or message digest, for a message of
However, U.S. Pat. No. 6,021,201 uses existing hash func length 1 that has a collision resistance greater than 280. In
 US 6,829,355 B2
3 4
two preferred embodiments, the present invention has col preferred embodiment, the number of times the shift register
lision resistance of 2128 and 2256, respectively. These two is stepped (i.e.,j) is 64 if m=1 (i.e., 256-bit hash) and 80 if
embodiments meet the requirements of NIST's Advanced m=2 (i.e., 512-bit hash).
Encryption Standard (AES). The fourth step 4 of the method is initializing eight blocks
FIG. 1 is a list of the steps of the present invention. The a, b, c, d, e, f, g, and h with user-definable values H., H., H.,
first Step 1 of the method is padding the message to a bit Hi, Hs, H., H-7, and Hs, respectively, where H-H collec
length of 512m bits, where m is a user-definable positive tively represent the initial value for the hash value. The eight
integer. appending a 1 bit to the end of the message for blocks are represent components in a Second shift register.
which a hash value is desired. In the preferred embodiment, Each Step of the shift register produces an intermediate hash
the message is appended with a 1 bit followed by k Zero bits, value. However, the blocks must be initialized to Some
where k is the Smallest non-negative Solution to 1+1+k= user-definable Starting point. The fourth Step 4 provides Such
(448m) mod (512m). Alternatively, the message may be initialization.
pre-pended or appended with Zero bits, one bits, or any The fifth step 5 of the method is converting the contents
combination thereof. The bits padded may include informa of a, b, c, d, e, f, g, and has follows:
tion as well (e.g., length of the message and/or padded bits). 15
In the preferred embodiment, m is either 1 or 2. If m=1, the
hash value generated by the present invention is 256 bits. If
m=2, the hash value is 512 bits. Other hash lengths are also
possible. In an alternate embodiment, a Subset of a hash
value generated by the present invention may be used as the
final hash value. For example, 384 bits out of the 512-bit
hash value generated when m=2 may be used in those where X, (e)=S(e-)eS'(e)éPS(e) if m=1,
Situations when a 384-bit hash value is required. Generating where X, (e)=S'(e)(DS"(e)(BS'(e) if m=2,
a hash value of greater than 160 bits will result in a hash where Ch(e; if g )=(e; if 1)éD(e.g. ),
value having collision resistance greater than 280. This is 25
where K is at least one key, where is bitwise AND, and
greater than the collision resistance of SHA-1 which is, where - is bitwise complement;
presently, the only hash function that is approved by NIST
in a FIPS publication. In two preferred embodiments, the
message is hashed to either 256 bits or 512 bits. The two
embodiments result in collision resistance of 2128 and
2256, respectively, both of which meet the requirements of
NISTS AES.
The Second Step 2 of the method is parsing the result of
the first step 1 into 1632m-bit blocks M. If m=1, indicating
a 256-bit hash value, the padded message is parsed into 16 35 where X(a)=S(a)éPS'(a)€BS (a) for m=1,
32-bit blocks. If m=2, indicating a 512-bit hash value, the where X(a)=S(a)éBS'(a)éDS'(a) for m=2,
padded message is parsed into 16 64-bit blockS. and yer Maj(a, b, c,1)=(a,b)6D(a ?c, )6(b.
1 C-1).
The third step 3 of the method is generating jvalues W. The fifth step 5 describes the operation, or rule of motion,
from the parsed message of the Second step 2 according to 40 of the Second shift register as it is Stepped.
the following equations: The sixth step 6 of the method is computing values that
W=M, for j=0,1,..., 15; and make up the hash value as follows:
W=o, (W, 2)+W, 7+Oo(W, 1s)+W, is for j=16.17. . . . .j,
where j is a user-definable positive integer, 45
where O(x)=S(x)eS'(x)eR'(x), if m=1;
where O(x)=S(x)eS'(x)eR(x), if m=2;
where + is addition mod 2";
where €D is bitwise XOR;
where O(x)=S(x)eS'(x)eR(x), if m=1; 50
where O(x)=S(x)eS(x)eR'(x), if m=2;
where S(x) is a right rotation of the contents of block X by
ibits, leaving block X unchanged afterwards, and
where R'(x) is a right shift of block X by ibits, leaving block
X unchanged afterwards. 55
The equations of the third step 3 describe a linear
Sequence generator, where the 1632m-bit blocks are con The Sixth Step 6 indicates that after each Step of the Second
nected as a shift register, and where various functions (i.e., register, the contents of blocks a-h are mod 2" added to
addition and XOR) are performed on specified blocks and the previous hash value contained in H(i-1)-H(i-1).
provided as feedback into the input of the first block in the 60 The seventh, and last, step 7 of the method is either
shift register. The output of the last block in the shift register. accepting at least 161 bits of the contents of H. (j)-H() as
In the preferred embodiment, the shift register shifts from the hash value of the message or returning to the fifth Step
right to left, and the blocks are numbered 0-15 from left to 5 for another step of the second shift register. Each step of
right. So, the first block into which feedback is received is the Second register provides more Scrambling of the message
block number 15, and the block from which values are 65 and, therefore, more collision resistance. In the preferred
produced per Step, or clock cycle, of the shift register as embodiment, the entire contents of H. (j)-H() is accepted
described in the third step 3 is block number 0. In the as the hash value, and the Second register is Stepped a total
 US 6,829,355 B2
S 6
of 64 times for m=1 (i.e., 256-bit hash) and 80 times for m=2 register between two of the p 32m-bit blocks 43-50. In the
(i.e., 512-bit hash). preferred embodiment, the first input of the fifth logic block
FIG. 2 is a block diagram of the preferred embodiment 20 51 is connected to the output of the fourth 32m-bit block 46,
of the present invention. FIG. 2 is only an example of one and the second input of the fifth logic block 51 is connected
possible configuration of the present invention. Other con to the input of the fifth 32m-bit block 47.
figurations are possible. The device 20 for generating a hash An accumulator 52 has inputs connected to corresponding
value of a message includes in 32m-bit blocks 21-36 con outputs of the 32m-bit blocks 43-50 in the second shift
nected as a first shift register, where each block 21-36 has register, and has an output at which the generated hash value
an input and an output. In the preferred embodiment, n is 16 appears. The accumulator 52 Saves the current State of the
and m is either 1 or 2. If m is 1, the device 20 produces a Second shift register and adds this value to Subsequent States
256-bit hash value. If m is 2, the device 20 generates a of the Second shift register produced by Stepping the first and
512-bit hash value. Second shift registers a user-definable number of times. The
A first function block Oo(X) 37, having an input and an last value Stored in the accumulator is the hash value
output, has its input connected to the output of a user generated by the device 20 and appears at the output of the
definable 32m-bit block in the first shift register. In the 15 accumulator 52.
preferred embodiment, the input of the first function block A third function block X(x) 53, has an input connected to
Oo(x) 37 is connected to the next to last 32m-bit block 35 in the output of the 32m-bit block 43 that is first in the second
the first shift register. The function of the first function block shift register, has an output, and performs the following
Oo(x) 37 is as follows: function:

where S(x) is a right rotation of X by ibits; and A fourth function block X(x) 54, has an input connected
where R'(x) is a right shift of X by ibits. 25 to a user-definable output of the 32m-bit block, has an
A second function blocka O(x)38 has an input connected output, and performs the following function:
to the output of a user-definable 32m-bit block in the first
shift register, and has an output. In the preferred
embodiment, the input of the Second function block a O(x)
38 is connected to the second 32m-bit block 22 in the first
shift register. The function of the second function block In the preferred embodiment, the input of the fourth
O,(x) 38 is as follows: function block X(x) 54 is connected to the output of the fifth
32m-bit block 47.
35
A fifth function block Maj(x) 55 has at least one input
connected to at least one output of a user-definable 32m-bit
blocks in the Second shift register and has an output. In the
A first logic block 39 has a first input connected to the preferred embodiment, the fifth function block Maj(x) 55
output of the 32m-bit block 36 that is last in the first shift has three inputs connected to the outputs of the first, Second,
register, has a Second input connected to the output of the and third 32m-bit blocks 43-45 in the second shift register,
first function block O'(x) 37, and has an output. Each logic 40 and performs the following function:
block of the present invention is Selected from the group of
logic functions consisting of XOR, AND, OR, NOT, NAND,
and NOR. In the preferred embodiment, each of the logic
blocks are XOR. However, the logic blocks do not all have A sixth function block Ch(x) 56 has at least one input
to be the same logic function. 45 connected to at least one output of a user-definable 32m-bit
A Second logic block 40 has a first input connected to the blocks in the Second shift register and has an output. In the
output of a user-definable 32m-bit block in the first shift preferred embodiment, the sixth function block Ch(x) 56 has
register, has a Second input connected to the output of the three inputs connected to the outputs of the fifth, Sixth, and
first logic block 39, and has an output. In the preferred seventh 32m-bit blocks 47-49 in the second shift register,
embodiment, the first input is connected to the output of the 50 and performs the following function:
seventh 32m-bit block 27 in the first shift register.
A third logic block 41 has a first input connected to the
output of the Second logic block 40, has a Second input A sixth logic block 57 has a first input connected to the output of
connected to the output of the Second function block O(x) the 32m-bit block 50 that is last in the second shift register, has a second input
38, and has an output connected to the input of the 32m-bit 55 connected to the output of the sixth function block Ch(x) 56, has a third input
block 21 that is first in the first shift register. connected to the output of the fourth logic block, and has an output.
A fourth logic block 42 has a first input connected to the A seventh logic block 58 has a first input connected to the
output of the 32m-bit block 36 that is last in the first shift output of the Sixth logic block, has a Second input connected
register, has a Second input for receiving a user-definable to the output of the fourth function block X(x) 54, and has
key value, and has an output. The user-definable key value 60 an output connected to the Second input of the fifth logic
may be fixed to a constant or may be changed as often as the block 51.
user desires. An eighth logic block 59 has a first input connected to the
The device 20 includes p 32m-bit blocks (43–50 in FIG. output of the fifth function block Maj(x) 55, has a second
2) connected as a second shift register, where each block has input connected to the output of the third function block
an input and an output. In the preferred embodiment, p is 8. 65 X(x) 53, and has an output.
In addition, a fifth logic block 51, having a first input, a A ninth logic block 60 has a first input connected to the
Second input, and an output, is included in the Second shift output of the eighth logic block 59, has a second input
 US 6,829,355 B2
7
connected to the output of the seventh logic block 58, and
has an output connected to the input of the 32m-bit block 43
that is first in the Second shift register.
What is claimed is:
1. A method of generating a hash value for a message of 5
length 1, comprising the Steps of:
a) padding the message to a length of 512m bits, where m g) returning to step (f) if additional processing is desired,
is a user-definable positive integer, otherwise, returning at least 161 bits of (H (), H2(j),
b) parsing the result of step (a) into 1632m-bit blocks M: 1O H(), H(), H(), H(), H-(), H(j)) as the hash value
c) generating j values W, from the result of step (b) of the message.
according to the following equations: 2. The method of claim 1, wherein Said Step of padding
the message to a length of 512m bits is comprised of the Step
W=M, for j=0,1,..., 15; and of appending a 1 bit to the message along with k Zero bits,
15 where k is the Smallest non-negative Solution to 1+1+k=
(448m) mod (512m).
3. The method of claim 1, wherein said step of padding
where j is a user-definable positive integer, the message to a length of 512m bits is comprised of the Step
where O(x)=S(x)eS'(x)eR'(x), if m=1; of padding the message to a length of 512m bits, where m
where O(x)=S(x)eS'(x)eR(x), if m=2; is 1.
where + is addition mod 2"; 4. The method of claim 3, wherein Said Step of generating
where €D is bitwise XOR; jkeys W, from the result of step (b) where j is 64.
5. A method of claim 1, wherein Said Step of padding the
where O(x)=S(x)eS'(x)eR(x), if m=1; message to a length of 512m bits is comprised of the Step of
where O(x)=S(x)eS(x)eR'(x), if m=2; 25
padding the message to a length of 512m bits, where m is 2.
where S(x) is a right rotation of block X by ibits, leaving 6. The method of claim 5, wherein Said Step of generating
block X unchanged afterwards, and jkeys W, from the result of step (b) where j is 80.
where R'(x) is a right shift of block X by ibits, leaving 7. A device for generating a hash value, comprising:
block X unchanged afterwards, a) in 32m-bit blocks connected as a first shift register,
d) initializing a, b, c, d, e, f, g, and h with user-definable where n and m are user-definable positive integers, and
values H., H., H., H., Hs, H., H-7, and Hs, respectively; where each 32m-bit block has an input and an output;
e) converting a, b, c, d, e, f, g, and has follows: b) a first function block O(x) having an input and an
output, where the input is connected to the output of a
h;=g_1: user-definable 32m-bit block in the first shift register;
gif, 1:
35 c) a Second function block O(X) having an input and an
output, where the input is connected to the output of a
f=e_1: user-definable 32m-bit block in the first shift register;
d) a first logic block, having a first input connected to the
output of the 32m-bit block that is last in the first shift
40 register, having a Second input connected to the output
where X, (e)=S(e-)eBS'(e-)eS-(e-) if m=1; of the first function block Oo(X), and having an output;
where X, (e)=S(e-)eS(e-)eS'(e) if m=2; e) a second logic block, having a first input connected to
Where Ch(e;-1, f-1, g_1)=(e-f-1)6(e-g-1); the output of a user-definable 32m-bit block in the first
where K is at least one key; shift register, having a Second input connected to the
45 output of the first logic block, and having an output;
where is bitwise AND, f) a third logic block, having a first input connected to the
and where - is bitwise complement; output of the Second logic block, having a Second input
connected to the output of the Second function block
50
O(X), and having an output connected to the input of
the 32m-bit block that is first in the first shift register;
g) a fourth logic block, having a first input connected to
the output of the 32m-bit block that is last in the first
shift register, a Second input for receiving a user
55 definable key value, and an output;
where x(a)=S(a)(BS'(a)(BS’(a) for m=1; h) a fifth logic block, having a first input, having a second
input, and having an output;
and where Maj(a 1, b 1, c. 1)=(a_1b_1)éD(a, c. 1)0 i) p 32m-bit blocks connected as a Second shift register,
where the first input and the output of the fifth logic
(b-e- 1); 60 block are placed between the input and the output of
f) computing values as follows: two user-definable 32m-bit blocks in the second shift
register, where p is a user-definable positive integer,
and where each 32m-bit block in the second shift
register has an input and an output;
65 j) an accumulator having a plurality of inputs connected
to the outputs of each 32m-bit block in the second shift
register, and having an output;
 US 6,829,355 B2
9 10
k) a third function block X(x), having an input connected 11. The device of claim 10, wherein the input of said
to the output of the 32m-bit block that is first in the Second function block O(X) is connected to the output of the
Second shift register, and having an output; second 32m-bit block W. in the first shift register, and
l) a fourth function block X(x), having an input con where O(x)=S(x)eS'(x)eR'(x), if m=1; and
nected to the output of a user-definable 32m-bit block 5
where O(x)=S'(x)eS'(x)eR(x), if m=2.
in the Second shift register, and having an output; 12. The device of claim 11, wherein each of said first logic
m) a fifth function block Maj(x), having at least one input block, Said Second logic block, Said third logic block, Said
connected to at least one output of a user-definable fourth logic block, Said fifth logic block, Said Sixth logic
32m-bit blockS in the Second shift register, and having block, Said Seventh logic block, Said eighth logic block, and
an Output, Said ninth logic block are each Selected from the group of
n) a sixth function block ChCX), having at least one input logic functions consisting of XOR, AND, OR, NOT, NAND,
connected to at least one output of a user-definable and NOR.
32m-bit blockS in the Second shift register, and having 13. The device of claim 12, wherein the first input of said
an Output, Second logic block is connected to the output of the Seventh
15
O) a sixth logic block, having a first input connected to the 32m-bit block in the first shift register.
output of the 32m-bit block that is last in the second 14. The device of claim 13, wherein said p 32m-bit blocks
shift register, having a Second input connected to the are comprised of eight 32m-bit blockS connected as a Second
output of the sixth function block Ch(x), having a third shift register.
input connected to the output of the fourth logic block, 15. The device of claim 14, wherein the first input of said
and having an output; fifth logic block is connected to the output of the fourth
p) a Seventh logic block, having a first input connected to 32m-bit block in the second shift register, and where the
the output of the Sixth logic block, having a Second output of the fifth logic block is connected to the input of the
input connected to the output of the fourth function fifth 32m-bit block in the second shift register.
block X(x), and having an output connected to the 25
16. The device of claim 15, wherein said third function
second input of the fifth logic block; block X(x) is comprised of
q) an eighth logic block, having a first input connected to
the output of the fifth function block Maj(x), having a
Second input connected to the output of the third
function block X(x), and having an output; and
r) a ninth logic block, having a first input connected to the 17. The device of claim 16, wherein said fourth function
output of the eighth logic block, having a second input block X(x) is connected to the fifth 32m-bit block in the
connected to the output of the Seventh logic block, and Second shift register is comprised of
having an output connected to the input of the 32m-bit
block that is first in the second shift register. 35
8. The device of claim 7, wherein said in 32m-bit blocks
connected as a first shift register, are comprised of 16
32m-bit blockS connected as a first shift register, where each
32m-bit block has an input and an output. 18. The device of claim 17, wherein said fifth function
9. The device of claim 8, wherein each of said 1632m-bit 40 block Maj(x) is comprised of
blocks are comprised of a 32m-bit block where m is selected
from the group of numbers consisting of 1 and 2.
10. The device of claim 9, wherein the input of said first
function block Oo(X) is connected to the output of a 32m-bit 19. The device of claim 18, wherein said sixth function
block W, is that is next to last in the first shift register, and 45 block Ch(x) is comprised of
where O(x)=S(x)eS'(x)eR(x), if m=1;
where O(x)=S(x)eS(x)eR'(x), if m=2;
where S(x) is a right rotation of X by ibits; and
where R'(x) is a right shift of X by ibits. k k k k k