//------------------------------------------------------------------------------ // // ecdsa256_modular_multiplier.v // ----------------------------------------------------------------------------- // Modular multiplier for P-256 prime. // // Authors: Pavel Shatov // // Copyright (c) 2015-2016, 2018 NORDUnet A/S // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // - Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // - Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // - Neither the name of the NORDUnet nor the names of its contributors may be // used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE // POSSIBILITY OF SUCH DAMAGE. // //------------------------------------------------------------------------------ module ecdsa256_modular_multiplier ( clk, rst_n, ena, rdy, a_addr, b_addr, p_addr, p_wren, a_din, b_din, p_dout ); // // Settings // `include "cryptech_primitive_switch.vh" // // Constants // localparam OPERAND_NUM_WORDS = 8; localparam WORD_COUNTER_WIDTH = 3; // // Handy Numbers // localparam [WORD_COUNTER_WIDTH-1:0] WORD_INDEX_ZERO = 0; localparam [WORD_COUNTER_WIDTH-1:0] WORD_INDEX_LAST = OPERAND_NUM_WORDS - 1; // // Handy Functions // function [WORD_COUNTER_WIDTH-1:0] WORD_INDEX_NEXT_OR_ZERO; input [WORD_COUNTER_WIDTH-1:0] WORD_INDEX_CURRENT; begin WORD_INDEX_NEXT_OR_ZERO = (WORD_INDEX_CURRENT < WORD_INDEX_LAST) ? WORD_INDEX_CURRENT + 1'b1 : WORD_INDEX_ZERO; end endfunction function [WORD_COUNTER_WIDTH-1:0] WORD_INDEX_PREVIOUS_OR_LAST; input [WORD_COUNTER_WIDTH-1:0] WORD_INDEX_CURRENT; begin WORD_INDEX_PREVIOUS_OR_LAST = (WORD_INDEX_CURRENT > WORD_INDEX_ZERO) ? WORD_INDEX_CURRENT - 1'b1 : WORD_INDEX_LAST; end endfunction // // Ports // input wire clk; // system clock input wire rst_n; // active-low async reset input wire ena; // enable input output wire rdy; // ready output output wire [WORD_COUNTER_WIDTH-1:0] a_addr; // index of current A word output wire [WORD_COUNTER_WIDTH-1:0] b_addr; // index of current B word output wire [WORD_COUNTER_WIDTH-1:0] p_addr; // index of current P word output wire p_wren; // store current P word now input wire [ 31:0] a_din; // A input wire [ 31:0] b_din; // B output wire [ 31:0] p_dout; // P = A * B mod N // // Word Indices // reg [WORD_COUNTER_WIDTH-1:0] index_a; reg [WORD_COUNTER_WIDTH-1:0] index_b; /* map registers to output ports */ assign a_addr = index_a; assign b_addr = index_b; // // FSM // localparam FSM_SHREG_WIDTH = (1 * OPERAND_NUM_WORDS + 1) + (2 * OPERAND_NUM_WORDS + 1) + (2 * OPERAND_NUM_WORDS + 2) + (0 * OPERAND_NUM_WORDS + 2) + 1; reg [FSM_SHREG_WIDTH-1:0] fsm_shreg; assign rdy = fsm_shreg[0]; wire [1 * OPERAND_NUM_WORDS-1:0] fsm_shreg_inc_index_a = fsm_shreg[FSM_SHREG_WIDTH - (0 * OPERAND_NUM_WORDS + 1) : FSM_SHREG_WIDTH - (1 * OPERAND_NUM_WORDS + 0)]; wire [1 * OPERAND_NUM_WORDS-1:0] fsm_shreg_store_word_a = fsm_shreg[FSM_SHREG_WIDTH - (0 * OPERAND_NUM_WORDS + 2) : FSM_SHREG_WIDTH - (1 * OPERAND_NUM_WORDS + 1)]; wire [2 * OPERAND_NUM_WORDS-1:0] fsm_shreg_inc_index_b = fsm_shreg[FSM_SHREG_WIDTH - (1 * OPERAND_NUM_WORDS + 1) : FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 1)]; wire [2 * OPERAND_NUM_WORDS-2:0] fsm_shreg_store_si_msb = fsm_shreg[FSM_SHREG_WIDTH - (1 * OPERAND_NUM_WORDS + 2) : FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 1)]; wire [0 * OPERAND_NUM_WORDS-0:0] fsm_shreg_store_si_lsb = fsm_shreg[FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 2) : FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 2)]; wire [2 * OPERAND_NUM_WORDS-2:0] fsm_shreg_shift_si = fsm_shreg[FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 3) : FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 1)]; wire [0 * OPERAND_NUM_WORDS-0:0] fsm_shreg_mask_cw1_sum = fsm_shreg[FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 4) : FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 4)]; wire [2 * OPERAND_NUM_WORDS-1:0] fsm_shreg_store_c_word = fsm_shreg[FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 5) : FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 4)]; wire [0 * OPERAND_NUM_WORDS-0:0] fsm_shreg_reduce_start = fsm_shreg[FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 5) : FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 5)]; wire [0 * OPERAND_NUM_WORDS-0:0] fsm_shreg_reduce_stop = fsm_shreg[FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 6) : FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 6)]; wire inc_index_a = |fsm_shreg_inc_index_a; wire store_word_a = |fsm_shreg_store_word_a; wire inc_index_b = |fsm_shreg_inc_index_b; wire clear_mac_ab = |fsm_shreg_inc_index_b; wire shift_wide_a = |fsm_shreg_inc_index_b; wire enable_mac_ab = |fsm_shreg_inc_index_b; wire store_si_msb = |fsm_shreg_store_si_msb; wire store_si_lsb = fsm_shreg_store_si_lsb; wire shift_si = |fsm_shreg_shift_si; wire mask_cw1_sum = fsm_shreg_mask_cw1_sum; wire store_c_word = |fsm_shreg_store_c_word; wire reduce_start = fsm_shreg_reduce_start; wire reduce_stop = fsm_shreg_reduce_stop; // // FSM Logic // wire reduce_done; always @(posedge clk or negedge rst_n) // if (rst_n == 1'b0) // fsm_shreg <= {{FSM_SHREG_WIDTH-1{1'b0}}, 1'b1}; // else begin // if (rdy) fsm_shreg <= {ena, {FSM_SHREG_WIDTH-2{1'b0}}, ~ena}; // else if (!reduce_stop || reduce_done) fsm_shreg <= {1'b0, fsm_shreg[FSM_SHREG_WIDTH-1:1]}; // end // // Word Index Increment Logic // reg index_b_ff; always @(posedge clk) // if (inc_index_b) index_b_ff <= ~index_b_ff; else index_b_ff <= 1'b0; always @(posedge clk) // if (rdy) begin // index_a <= WORD_INDEX_ZERO; index_b <= WORD_INDEX_LAST; // end else begin // if (inc_index_a) index_a <= WORD_INDEX_NEXT_OR_ZERO(index_a); if (inc_index_b && !index_b_ff) index_b <= WORD_INDEX_PREVIOUS_OR_LAST(index_b); // end // // Wide Operand Buffer // reg [255:0] buf_a_wide; always @(posedge clk) // if (store_word_a) buf_a_wide <= {buf_a_wide[16 +: 256 - 3 * 16], {a_din[15:0], a_din[31:16]}, buf_a_wide[256 - 2 * 16 +: 16]}; else if (shift_wide_a) buf_a_wide <= {buf_a_wide[256-(16+1):0], buf_a_wide[256-16+:16]}; // // Multiplier Array // wire mac_inhibit; // control signal to pause all accumulators wire [46: 0] mac[0:15]; // outputs of all accumulators reg [15: 0] mac_clear; // individual per-accumulator clear flag assign mac_inhibit = ~enable_mac_ab; always @(posedge clk) // if (!clear_mac_ab) mac_clear <= {16{1'b1}}; else begin if (mac_clear == {16{1'b1}}) mac_clear <= {{14{1'b0}}, 1'b1, {1'b0}}; else mac_clear <= (mac_clear[15] == 1'b0) ? {mac_clear[14:0], 1'b0} : {16{1'b1}}; end // // Array of parallel multipliers // genvar i; generate for (i=0; i<16; i=i+1) begin : gen_mac_array // `CRYPTECH_PRIMITIVE_MAC16 mac16_inst ( .clk (clk), .ce (~mac_inhibit), .clr (mac_clear[i]), .a (buf_a_wide[16*i+:16]), .b (index_b_ff ? b_din[15:0] : b_din[31:16]), .s (mac[i]) ); // end endgenerate // // Intermediate Words // reg [47*(2*OPERAND_NUM_WORDS-1)-1:0] si_msb; reg [47*(2*OPERAND_NUM_WORDS-0)-1:0] si_lsb; wire [47*(2*OPERAND_NUM_WORDS-1)-1:0] si_msb_new; wire [47*(2*OPERAND_NUM_WORDS-0)-1:0] si_lsb_new; generate for (i=0; i<16; i=i+1) begin : gen_si_lsb_new assign si_lsb_new[47*i+:47] = mac[15-i]; end endgenerate generate for (i=1; i<16; i=i+1) begin : gen_si_msb_new assign si_msb_new[47*(15-i)+:47] = mac_clear[i] ? mac[i] : si_msb[47*(15-i)+:47]; end endgenerate always @(posedge clk) begin // if (shift_si) begin si_msb <= {{2*47{1'b0}}, si_msb[15*47-1:2*47]}; si_lsb <= {si_msb[2*47-1:0], si_lsb[16*47-1:2*47]}; end else begin if (store_si_msb) si_msb <= si_msb_new; if (store_si_lsb) si_lsb <= si_lsb_new; end end // // Accumulators // wire [46: 0] add47_cw0_s; wire [46: 0] add47_cw1_s; // // cw0, b, cw1, b // reg [30: 0] si_prev_dly; reg [15: 0] si_next_dly; always @(posedge clk) // if (shift_si) si_prev_dly <= si_lsb[93:63]; else si_prev_dly <= {31{1'b0}}; always @(posedge clk) // si_next_dly <= si_lsb[62:47]; wire [46: 0] add47_cw0_a = si_lsb[46:0]; wire [46: 0] add47_cw0_b = {{16{1'b0}}, si_prev_dly}; wire [46: 0] add47_cw1_a = add47_cw0_s; wire [46: 0] add47_cw1_b = {{15{1'b0}}, si_next_dly, mask_cw1_sum ? {16{1'b0}} : {1'b0, add47_cw1_s[46:32]}}; `CRYPTECH_PRIMITIVE_ADD47 add47_cw0_inst ( .clk (clk), .a (add47_cw0_a), .b (add47_cw0_b), .s (add47_cw0_s) ); `CRYPTECH_PRIMITIVE_ADD47 add47_cw1_inst ( .clk (clk), .a (add47_cw1_a), .b (add47_cw1_b), .s (add47_cw1_s) ); // // Full-Size Product // reg [WORD_COUNTER_WIDTH:0] bram_c_addr; wire [WORD_COUNTER_WIDTH:0] reduce_c_addr; wire [ 31:0] reduce_c_word; always @(posedge clk) // if (store_c_word) bram_c_addr <= bram_c_addr + 1'b1; else bram_c_addr <= {2*WORD_COUNTER_WIDTH{1'b0}}; bram_1rw_1ro_readfirst # ( .MEM_WIDTH (32), .MEM_ADDR_BITS (WORD_COUNTER_WIDTH + 1) ) bram_c_inst ( .clk (clk), .a_addr (bram_c_addr), .a_wr (store_c_word), .a_in (add47_cw1_s[31:0]), .a_out (), .b_addr (reduce_c_addr), .b_out (reduce_c_word) ); // // Reduction Stage // ecdsa256_modular_reductor mod_redc_inst ( .clk (clk), .rst_n (rst_n), .ena (reduce_start), .rdy (reduce_done), .x_addr (reduce_c_addr), .p_addr (p_addr), .p_wren (p_wren), .x_din (reduce_c_word), .p_dout (p_dout) ); endmodule //------------------------------------------------------------------------------ // End-of-File //------------------------------------------------------------------------------