The Keccak sponge function family

Guido Bertoni1, Joan Daemen1,2, Michaël Peeters1 and Gilles Van Assche1

1STMicroelectronics
2Radboud University

Pages

Documents

Notes

Software and other files

Figures

The figures above are available under the Creative Commons Attribution license. In short, they can be freely used, provided that attribution is properly done in the figure caption, either by linking to this webpage or by citing the article where the particular figure first appeared.

Links

Hardware performance figures

On this page, we summarize the performance figures of Keccak[r=1024,c=576] as they can be found in various implementation reports made in the scope of the SHA-3 contest.

All the displayed throughput are for long messages. In this case, the speed is directly proportional to the bitrate r. The figures below have been normalized for the nominal value r=1024, even though some of the implementations referred to below used a different rate in their reports. To estimate the performance for other bitrate values, one can simply multiply the throughput by r/1024.

ASIC

ReferenceTechnologySynthesisArea
(kGE)
FrequencyThroughputClock cyclesEnergy
(mJ/Gbit)
[9] SugawaraSTM 90nmGate level55.91030 MHz44 Gbps24
[4] Henzen et al.UMC 90nmPlace and route50.0949 MHz(*)40 Gbps242.4
[9] AISTSTM 90nmGate level50.6781 MHz33 Gbps24
[9] SugawaraSTM 90nmGate level26.5553 MHz24 Gbps24
[9] AISTSTM 90nmGate level33.6541 MHz23 Gbps24
Keccak teamSTM 130nmGate level48.0526 MHz22 Gbps24
[7] Tillich et al.UMC 0.18μmGate level56.3488 MHz(*)20 Gbps25
[3] Guo et al.UMC 130nmPlace and route47.4377 MHz15 Gbps25
[9] SugawaraSTM 90nmGate level25.1356 MHz15 Gbps24
[9] AISTSTM 90nmGate level29.5355 MHz15 Gbps24
[8] Tillich et al.UMC 0.18μmPlace and route56.7267 MHz(*)11 Gbps25
[3] Guo et al.UMC 130nmPlace and route34.9161 MHz6600 Mbps25
[4] Henzen et al.UMC 90nmPlace and route27.5149 MHz(*)6362 Mbps245.5
Keccak teamSTM 130nmGate level(a)9.3200 MHz39 Mbps5160
[5] Kavun et al.130nmGate level20.0100 kHz(*)85 kbps1200
Table 1: Performance of Keccak in ASIC

FPGA

ReferenceTypeAreaFrequencyThroughput
[6] StrömbergsonCyclone III2670 registers, 5842 LE123 MHz7000 Mbps
Keccak teamCyclone III2670 registers, 5770 LE145 MHz6100 Mbps
Keccak teamCyclone III242 registers, 1570 LE183 MHz39 Mbps
[6] StrömbergsonCyclone III242 registers, 1769 LE85 MHz22 Mbps
Table 2: Performance of Keccak on Cyclone FPGA
ReferenceTypeAreaFrequencyThroughput
[6] StrömbergsonSpartan 3A2780 registers, 3393 slices85 MHz4800 Mbps
[2] Gai et al.Spartan III3339 CLB83 MHz(*)3161 Mbps
Table 3: Performance of Keccak on Spartan FPGA
ReferenceTypeAreaFrequencyThroughput
[2] Gai et al.Stratix III4458 ALUT296 MHz(*)13 Gbps
[6] StrömbergsonStratix III2670 registers, 4550 ALUT176 MHz10 Gbps
Keccak teamStratix III2641 registers, 4684 ALUT206 MHz8700 Mbps
Keccak teamStratix III242 registers, 855 ALUT359 MHz70 Mbps
[6] StrömbergsonStratix III242 registers, 1026 ALUT133 MHz35 Mbps
Table 4: Performance of Keccak on Stratix FPGA
ReferenceTypeAreaFrequencyThroughput
[2] Gai et al.Virtex V1229 CLB238 MHz(*)10 Gbps
[9] AISTVirtex V2666 registers, 1433 slices205 MHz8397 Mbps
[2] Gai et al.Virtex V1412 CLB195 MHz(*)7840 Mbps
[6] StrömbergsonVirtex V2669 registers, 1483 slices118 MHz6700 Mbps
[10] Guo et al.Virtex V1556 slices154 MHz6570 Mbps
[1] BaldwinVirtex V1117 slices189 MHz(*)5895 Mbps
[1] BaldwinVirtex V1971 slices195 MHz(*)5895 Mbps
Keccak teamVirtex V2640 registers, 1330 slices122 MHz5200 Mbps
Keccak teamVirtex V244 registers, 448 slices265 MHz5 Mbps
Table 5: Performance of Keccak on Virtex FPGA

Notes

References

[1] B. Baldwin, N. Hanley, M. Hamilton, L. Lu, A. Byrne, M. O’Neill and W. P. Marnane, FPGA Implementations of the Round Two SHA-3 Candidates, IEEE FPL 2010

[2] K. Gaj, E. Homsirikamol and M. Rogawski, Fair and Comprehensive Methodology for Comparing Hardware Performance of Fourteen Round Two SHA-3 Candidates using FPGAs, CHES2010

[3] X. Guo, S. Huang, L. Nazhandali and P. Schaumont, Fair and Comprehensive Performance Evaluation of 14 Second Round SHA-3 ASIC Implementations, Second SHA-3 Candidate Conference, 2010

[4] L. Henzen, P. Gendotti, P. Guillet, E. Pargaetzi, M. Zoller and F. K. Gürkaynak, Developing a Hardware Evaluation Method for SHA-3 Candidates, CHES2010

[5] E. B. Kavun and T. Yalcin, A Lightweight Implementation of Keccak Hash Function for Radio-Frequency Identification Applications, RFIDsec’10

[6] J. Strömbergson, Implementation of the Keccak Hash Function in FPGA Devices

[7] S. Tillich, M. Feldhofer, M. Kirschbaum, T. Plos, J.-M. Schmidt and A. Szekely, High-Speed Hardware Implementations of BLAKE, Blue Midnight Wish, CubeHash, ECHO, Fugue, Grostl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein, ePrint Archive, report 2009/510 v2.0, 2009

[8] S. Tillich, M. Feldhofer, M. Kirschbaum, T. Plos, J.-M. Schmidt and A. Szekely, Uniform Evaluation of Hardware Implementations of the Round-Two SHA-3 Candidates, Second SHA-3 Candidate Conference, 2010

[9] AIST RCIS, SHA-3 Hardware Project, 2010

[10] X. Guo, S. Huang, L. Nazhandali and P. Schaumont, On The Impact of Target Technology in SHA-3 Hardware Benchmark Rankings, ePrint Archive, report 2010/536, 2010