LM-SHA3

Features

Cryptographic hashing

• SHA3-224, SHA3-256, SHA3-384, SHA3-512

Extendable-output functions

• SHAKE128, cSHAKE128
• SHAKE256, cSHAKE256

Message authentication

• KMAC128, KMAC256

Engine

• One Keccak-f[1600] permutation every 24 clock cycles, fixed
• Message absorbed at a full 64-bit lane per clock — the engine does not stall for data
• Domain suffix and pad10*1 applied in hardware
• Context switching: the full 1600-bit state saved and restored through the register map
• Capability register — the driver discovers the configuration rather than being told

Integration

• AMBA AXI4-Lite control and three AXI4-Stream data interfaces
• Two delivery tops: complete AXI product, or bare sponge for a custom fabric
• Single clock domain, single reset — no false paths, no multicycle paths
• ANSI C driver, UVM RAL, IP-XACT, SystemRDL register description
• Portable to any AMD, Altera or Efinix device from one source

---

Applications

• Digital signature and certificate processing
• Post-quantum cryptography — ML-KEM and ML-DSA use SHAKE and cSHAKE throughout
• Key derivation and message authentication
• Secure boot and firmware verification
• Encrypted data storage
• Secure communications

---

Block diagram

---

SHA-3 functions

The ten functions differ only in a rate, a domain suffix and an output length; one engine serves all of them.

Rates follow FIPS 202 section 6, r = 1600 − 2s. Suffixes follow appendix B.2 for SHA-3 and SHAKE; the derived functions absorb 00 because the cSHAKE prefix separates their domain instead.

---

Interfaces

The IP core includes two 64-bit AXI4-Stream interfaces for high-speed transfer of the input message and the output hash value, and an 8-bit AXI4-Stream interface carrying the cSHAKE and KMAC parameter strings. The AXI4-Lite interface provides access to the register map for selecting the SHA-3 function, the digest length of the XOFs and the cSHAKE/KMAC parameters.

tkeep qualifies bytes on the final message beat, so a message is any number of bytes. Parameter strings arrive as N then S for cSHAKE, and S then K for KMAC.

---

Throughput

Throughput follows directly from the architecture and can be computed for any clock frequency without a lookup table:

one permutation              24 clock cycles
one rate-block per permutation
throughput  =  rate_bytes  x  f_clk  /  24

For SHA3-256 at 300 MHz this gives 136 × 300 × 10⁶ / 24 ≈ 1.7 GB/s.

The permutation is fixed-latency. Every permutation is 24 cycles regardless of message content, and this is proved formally rather than measured — the round-count property is carried by a dedicated proof. Execution time is therefore a function of message length alone. No masking, randomisation or fault-detection countermeasures are implemented; where an application requires resistance to power analysis or fault injection, that belongs in the surrounding system.

---

Configuration

Everything that distinguishes a hash from a MAC on this core is a register write. There is no elaboration-time function subsetting to get wrong.

---

Resources and performance

Resource utilisation and maximum clock frequency for each target device are measured out of context and published per target in the measured results on this page. AMD and Efinix rows report LUTs; Altera rows report ALMs, and the two are never combined.

---

Deliverables