An accelerator / codesign for SLH-DSA ("Stateless Hash-Based Digital Signature Standard") as described in FIPS 205 Initial Public Draft from August 2023.
To cite this work, and the related CRYPTO 2024 Paper, please use:
@InProceedings{ Sa24,
author = {Markku-Juhani O. Saarinen},
title = {Accelerating {SLH}-{DSA} by Two Orders of Magnitude with a
Single Hash Unit},
booktitle = {Advances in Cryptology - {CRYPTO} 2024 - 44th Annual
International Cryptology Conference, {CRYPTO} 2024, Santa
Barbara, CA, USA, August 18-2, 2024, Proceedings},
note = {Available as IACR ePrint Report 2024/367},
url = {https://eprint.iacr.org/2024/367},
pages = {to appear},
year = {2024}
}
To clone the repository:
git clone https://github.com/slh-dsa/sloth.git
What's where
sloth
├── slh # Self-Contained C Implementation of SLH-DSA
├── rtl # Verilog HDL source code
├── drv # Accelerator drivers and test code
├── kat # SLH-DSA Known Answer Test data
├── flow # Misc files for FPGA and ASIC flows
├── Makefile # Convenience Makefile for the Accelerator
├── LICENSE
└── README.md
The SLotH accelerator uses a core SLH-DSA algorithm implementation contained in the
slh directory. The core implementation is self-contained ANSI C code and should be able to run on pretty much any target. There are no prerequisites except for make and a C compiler.
cd sloth/slh
make test
See slh/README.md for more information.
As a prerequisite for simulation, you'll need:
- Verilator verilog simulator.
- A RISC-V cross-compiler that supports bare-metal targets. You can build a suitable riscv-gnu-toolchain
with
./configure --enable-multilibandmake newlib.
Both of these may be available as packages for Linux operating systems. The name of your toolchain is set in XCHAIN variable in the Makefile.
To build and run a quick end-to-end test, try:
make veri
After a successful compilation the output should look something like this:
./_build/Vsim_tb
[GPIO] 00 x 0
[RESET] ______ __ __ __
/ __/ / ___ / /_/ // / SLotH Accelerator Test 2024/05
_\ \/ /__/ _ \/ __/ _ / SLH-DSA / FIPS 205 ipd
/___/____/\___/\__/_//_/ [email protected]
[INFO] === Basic health test ===
[CLK] 775 sha256_compress()
[PASS] sha256 ( chk= 55F39AFA )
[CLK] 1462 sha512_compress()
[PASS] sha512 ( chk= 1F59A287 )
[CLK] 1467 keccak_f1600()
[PASS] shake256 ( chk= 07C97065 )
[INFO] === Testbench ===
[INFO] SLH-DSA-SHAKE-128f
[INFO] kat test count = 0
[CLK] SLH-DSA-SHAKE-128f 204310 slh_keygen()
[STK] SLH-DSA-SHAKE-128f 3156 slh_keygen()
[PASS] sk ( chk= BCA6B2C3 )
[CLK] SLH-DSA-SHAKE-128f 4943111 slh_sign()
[STK] SLH-DSA-SHAKE-128f 3380 slh_sign()
[PASS] sm ( chk= C03DA016 )
[CLK] SLH-DSA-SHAKE-128f 434660 slh_verify()
[STK] SLH-DSA-SHAKE-128f 3284 slh_verify()
[PASS] slh_verify() flip bit = 12389
[PASS] All tests ok.
UART Test. Press x to exit.
GPIO 0xAA
UART 0x78 x
exit()
[**TRAP**] 8392281
- rtl/sim_tb.v:36: Verilog $finish
The readout from this particular execution of SLH-DSA-SHAKE-128f is that KeyGen was 204310 cycles, signing was 4943111 cycles, and verification was 434660 cycles. Furthermore, the self-tests were a PASS; the output matched the Known Answer Tests. Modify the end of test_bench.c to have broader test behavior.
make prog_cw305: Create and program the bitstream on CW305 (program using ChipWhisperer.)make prog_vcu118: Ditto for on VCU118 (program using Vivado's hardware manager.)make synth: Run a Nangate45 synthesis and timing (using Yosys/OpenSTA. See flow/yosys-sys.)make prof: Profiling (see the per-code line instruction counts in annotated source files created in directory_prof).
I collect traces from the 20dB low amplified SMA connector (X4). Bit 0 of the GPIO register connects to the SMA connector T13 "CLKOUT" on the board, and this is used as a trigger by test_leak.c. The trace collection and analysis stuff is not included, and anyway works only with my oscilloscope.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent