基于RISC-V的Grain密码算法可重构并行化协处理器设计

南龙梅; 王浩宇; 杜怡然; 李伟; 陈韬

doi:10.11999/JEIT260391

基于RISC-V的Grain密码算法可重构并行化协处理器设计

doi: 10.11999/JEIT260391 cstr: 32379.14.JEIT260391

信息工程大学郑州 450000

详细信息

作者简介:
南龙梅：女，副教授，研究方向为可重构专用芯片设计，邮箱　lnan13@fudan.edu.cn

王浩宇：男，硕士生，研究方向为可重构专用芯片设计，邮箱　2741615670@qq.com

杜怡然：男，副教授，研究方向为可重构专用芯片设计

李伟：男，教授，研究方向为密码处理器设计

陈韬：男，副教授，研究方向为安全专用芯片设计

通讯作者:
王浩宇　2741615670@qq.com

中图分类号: TN47
计量
- 文章访问数: 58
- HTML全文浏览量: 22
- PDF下载量: 2
- 被引次数: 0
出版历程
- 收稿日期: 2026-04-01
- 修回日期: 2026-07-28
- 录用日期: 2026-07-28
- 网络出版日期: 2026-08-07

A Reconfigurable Parallelised Coprocessor Design for the RISC-V-Based Grain Cryptographic Algorithm

College of Cryptography Engineering, Information Engineering University, Zhengzhou 450000, China

摘要

摘要: Grain系列密码算法广泛应用于RFID、物联网等资源受限的硬件环境，但通用处理器(GPP)实现性能低，专用集成电路(ASIC)实现灵活性差且成本高。针对该问题，本文采用专用指令扩展方式，提出一种基于RISC-V协处理器的Grain密码算法可重构并行化实现方案。该方案分析Grain系列算法中线性反馈移位寄存器和非线性反馈移位寄存器结构共性与差异，采用相同移位寄存器架构与面向算法的抽头网络，设计可重构并行化实现架构及相应的扩展指令，可高效支持Grain-80、Grain-128、Grain-128a与Grain-128AEAD四种算法，并行粒度1～8灵活可调。实验结果表明，与无指令扩展的软件实现相比，基于蜂鸟E203平台，该方案完成密码处理流程的时钟周期数与指令条数由数万级降至129 个与53条，吞吐率由0.33～9.18 Mbps提升至约200 Mbps；硬件综合表明，该方案在65 nm工艺下面积为7252.55 μm²，吞吐率达1.56 Gbps，虽较单算法ASIC实现面积略有增加，但可在同一架构上支持四种算法。本文提出的实现方案在灵活性、处理效率与硬件开销之间实现了良好平衡。
- RISC-V /
- 协处理器 /
- 指令扩展 /
- Grain密码算法 /
- 可重构并行化
Abstract: Objective To overcome the performance bottleneck of Grain cryptographic algorithms on general-purpose processors (GPPs), as well as the inflexibility and high overhead of application-specific inte-grated circuit (ASIC) implementations, this work integrates dedicated cryptographic hardware accel-erators into a RISC-V coprocessor via a custom instruction extension approach. A reconfigurable and parallelisable implementation architecture is proposed specifically for the Grain algorithm family, lev-eraging the RISC-V coprocessor interface. Corresponding custom instructions are designed to enable flexible and efficient execution of Grain-80, Grain-128, Grain-128a, and Grain-128AEAD on the same hardware platform. The proposed architecture achieves a favourable trade-off between processing throughput and hardware flexibility, making it suitable for resource-constrained embedded systems. Methods This paper employs a unified feedback shift register architecture to support flexible swi-tching between the Grain-80, Grain-128, and Grain-128a, Grain-128AEAD algorithms, while enabling parallelisation granularity to be flexibly configured between 1 and 8 steps, thereby further enhancing throughput and resource utilisation, When extending specialised instructions for the Grain cryptogra-phic algorithm, the software and hardware functional modules are analysed, dividing the entire crypt-ographic process into software and hardware components to efficiently complete the encryption proc-edure. The coprocessor implementation proposed in this study features a streamlined architecture, ac-hieving reconfigurable parallel realisations of all four Grain algorithms with minimal hardware resou-rce expansion. Results and Discussions By invoking specialised instructions for the reconfigurable parallelised Grain cryptographic algorithm, three distinct cryptographic algorithms can be flexibly implemented. Comp-aring results with nonextended instructions (Table 7) demonstrates that specialised instructions enh-ance both the execution rate of cryptographic algorithms and reduce the number of required instruc-tions. Contrasting with results from other literature (Table 8) reveals the advantages of this approach in resource reuse and design flexibility. Compared to purely software implementations, this approach achieves significant optimisation in both the number of executed instructions and the number of ope-rational cycles. When contrasted with general-purpose reconf-igurable hardware implementations, this solution demonstrates superior resource utilisation. Conclusions To address the demand for agile deployment and resource-efficient implementation of cryptographic algorithms in lightweight embedded systems, this paper designs a hardware-software co-operative, reconfigurable parallelisation scheme for accelerating the Grain cryptogra-phic algorith-m. This approach leverages the RISC-V coprocessor instruction extension mechanism. Through a unif-ied shift register architecture, configurable feedback tap selection network, and feedback logic tailored for a deterministic algorithm set, the solution enables dynamic switching and parallel processing of four algorithms—Grain-80, Grain-128, Grain-128a and Grain-128AEAD—on a single hardware platfo-rm. This approach effectively reduces hardware resource consumption while maintaining functional flexibility. The present work primarily focuses on the reconfigurable parallelisation of the Grain algor-ithm family. Future research will explore universal reconfigurable architectures for nonlinear Boolean functions, incorporating reconfigurable units such as lookup tables (LUTs) or programmable logic ar-rays. By flexibly adapting to multiple stream cipher algorithms through configuration information, th-is approach aims to enhance algorithm compatibility and scalability within hardware modules while maintaining high throughput and low resource overhead.
- RISC-V /
- coprocessor /
- instruction extension /
- Grain cryptographic algorithm /
- reconfigura-ble parallelisation

HTML全文

图 1 NICE接口通道示意图

下载: 全尺寸图片幻灯片

图 2 可重构并行化Grain密码算法整体实现架构

下载: 全尺寸图片幻灯片

图 3 可重构LFSR单元

下载: 全尺寸图片幻灯片

图 4 LFSR可重构并行化模块图

下载: 全尺寸图片幻灯片

图 5 可重构NFSR非线性部分单元

下载: 全尺寸图片幻灯片

图 6 NFSR可重构并行化模块图

下载: 全尺寸图片幻灯片

图 7 软硬件协同总体结构框架

下载: 全尺寸图片幻灯片

图 8 协处理器各模块资源分布图

下载: 全尺寸图片幻灯片

图 9 实验环境

下载: 全尺寸图片幻灯片

表 1 硬件加速器的自定义扩展指令集

专用指令名称	内嵌汇编指令	功能
start_80	asm volatile(“.insn r 0x0b,0,7,x0,x0,x0”:“=r”(zero))	启动Grain-80算法
start_128/128AEAD	asm volatile(“.insn r 0x0b,0,15,x0,x0,x0”:“=r”(zero))	启动Grain-128算法或Grain-128AEAD算法
start_128a	asm volatile(“.insn r 0x0b,0,23,x0,x0,x0”:“=r”(zero))	启动Grain-128a算法
data_load_I	asm volatile(“.insn r 0x0b,3,0,x0,%1,%2”:“=r”(zero):“r”(lfsr[31:0]),“r”(nfsr[31:0]))	第一轮参数输入
data_load_II	asm volatile(“.insn r 0x0b,3,1,x0,%1,%2”:“=r”(zero):“r”(lfsr[63:32]),“r”(nfsr[63:32]))	第二轮参数输入
data_load_III	asm volatile(“.insn r 0x0b,3,2,x0,%1,%2”:“=r”(zero):“r”(lfsr[95:33]),“r”(nfsr[95:33]))	第三轮参数输入
data_load_IV	asm volatile(“.insn r 0x0b,3,3,x0,%1,%2”:“=r”(zero):“r”(lfsr[127:96]),“r”(nfsr[127:96]))	第四轮参数输入
initial_80	asm volatile(“.insn r 0x0b,0,2,x0,x0,x0”:“=r”(zero))	执行FSR指定轮的预热
initial_128/128a	asm volatile(“.insn r 0x0b,0,10,x0,x0,x0”:“=r”(zero))	执行FSR指定轮的预热
initial_128AEAD	asm volatile(“.insn r 0x0b,0,18,x0,x0,x0”:“=r”(zero))	执行FSR指定轮的预热
repeat_initial	asm volatile(“.insn r 0x0b,0,19,x0,x0,x0”:“=r”(zero))	执行密钥重引入
read_data_80	asm volatile(“.insn r 0x0b,4,0,%0,x0,x0”:“=r”(product))	将密钥写入目的寄存器
read_data_128/128a	asm volatile(“.insn r 0x0b,4,8,%0,x0,x0”:“=r”(product))
read_data_128AEAD	asm volatile(“.insn r 0x0b,4,16,%0,x0,x0”:“=r”product))

下载: 导出CSV

表 2 协处理器各模块资源使用情况

硬件单元	硬件资源(LUTs)	触发器(FFs)
LFSR	55 (26.1%)	128
NFSR	93 (44.2%)	128
密钥流生成模块h(x)	24 (11.3%)	0
其他	39 (18.4%)	92
协处理器	211 (100%)	348

下载: 导出CSV

表 3 协处理器各模块资源占用情况

硬件单元	占用面积(um²)	标准单元数(个)
LFSR	1671.47	297
NFSR	1896.83	384
密钥流生成模块h(x)	544.67	192
其他	3139.58	794
协处理器	7252.55	1667

下载: 导出CSV

表 4 不同平台下的性能对比

实现方案	密码算法	实现方式	并行度	吞吐率 (Mbps)	时钟周期数 (cycles)	指令数 (instrets)	执行时间 (us)
无扩展指令	Grain-80	纯软件	4	0.646	35868	28963	358.68
	Grain-128/128a	纯软件	4	0.474	48918	39208	489.18
	Grain-128AEAD	纯软件	4	0.334	69412	52868	694.12
有扩展指令	Grain-80	软硬件协同	4	220.67	105	53	1.05
	Grain-128/128a	软硬件协同	4	179.74	129	53	1.29
	Grain-128AEAD	软硬件协同	4	126.70	183	61	1.83
文献[9]	Grain-80	Intel	1	46.12	25590	20606	7.31
	Grain-80	MSM8660	1	12.31	27843	22447	11.65
	Grain-128	Intel	1	26.54	40788	32894	16.38
	Grain-128	MSM8660	1	6.05	44431	35832	26.14

下载: 导出CSV

表 5 不同RISC-V平台的性能对比

实现平台	有无扩展指令	密码算法	时钟周期数 (cycles)	吞吐率 (Mbps)
蜂鸟E203	无扩展指令	Grain-80	35868	0.646
		Grain-128/128a	48918	0.474
		Grain-128AEAD	69412	0.334
	有扩展指令	Grain-80	105	220.67
		Grain-128/128a	129	179.74
		Grain-128AEAD	183	126.70
CVA6	无扩展指令	Grain-80	26058	0.889
		Grain-128/128a	34337	0.675
		Grain-128AEAD	50436	0.459
	有扩展指令	Grain-80	72	321.81
		Grain-128/128a	96	241.53
		Grain-128AEAD	159	145.82
Rocket	无扩展指令	Grain-80	29652	0.781
		Grain-128/128a	37694	0.615
		Grain-128AEAD	53804	0.431
	有扩展指令	Grain-80	96	241.36
		Grain-128/128a	118	196.5
		Grain-128AEAD	172	134.8

下载: 导出CSV

表 6 不同实现工艺的结果对比

实现方案	密码算法	工艺/器件	并行度	频率(MHz)	吞吐率(Gbps)	面积	门电路总数(个)
本文方案	可重构Grain	ASIC 65nm	4	392	1.56	7252.55 um²	-
本文方案	可重构Grain	ASIC 65nm	8	392	3.12	7252.55 um²	-
文献[4]	Grain-80	ALTERA MAX II EPM570T100C3	1	200	0.2	-	1435
			2	211	0.422	-	1607
			4	158	0.632	-	1950
			8	148	1.18	-	2636
			16	133	2.12	-	4008
文献[5]	Grain-80	ASIC 90nm	4	2800	11.2	5984 um²	-
	Grain-80	ASIC 90nm	8	2300	18.4	8658 um²	-
	Grain-128	ASIC 90nm	4	3000	12.0	7316 um²	-
	Grain-128	ASIC 90nm	8	2900	23.2	9450 um²	-
文献[6]	Grain-80	Virtex 7	1	592	0.592	169 slices	-
文献[6]	Grain-80	Virtex 7	16	571	9.14	180 slices	-
文献[7]	Grain-80	Artix-7	1	543	0.543	99 slices	-
文献[7]	Grain-80	Artix-7	16	543	8.69	1121 slices	-
文献[8]	可重构Grain80/128	Altera Cyclone EP1C12	1	220	0.220	332 LE	-
		Altera Cyclone EP1C12	16	140	2.24	552 LE	-
		ASIC 0.18um	1	330	0.330	11967 um²	-
		ASIC 0.18um	16	218	3.48	22543 um²	-

下载: 导出CSV

参考文献(17)

[1]	ZHU Yufei, XING Zuocheng, XUE Jinhui, et al. Area-efficient parallel reconfigurable stream processor for symmetric cryptograph[J]. IEEE Access, 2021, 9: 28377–28392. doi: 10.1109/ACCESS.2021.3057866.
[2]	陈艺文. 基于Grain类算法结构的流密码设计与分析[D]. [硕士论文], 桂林电子科技大学, 2023. doi: 10.27049/d.cnki.ggldc.2023.001518. CHEN Yiwen. Design and analysis of stream ciphers based on grain-like algorithm structure[D]. [Master dissertation], Guilin University of Electronic Technology, 2023. doi: 10.27049/d.cnki.ggldc.2023.001518.
[3]	MANSOURI S S and DUBROVA E. An improved hardware implementation of the grain stream cipher[C]. Proceedings of the 2010 13th Euromicro Conference on Digital System Design: Architectures, Methods and Tools, Lille, France, 2010: 433–440. doi: 10.1109/DSD.2010.49.
[4]	LI Wei, ZENG Xiaoyang, DAI Zibin, et al. A high energy-efficient reconfigurable VLIW symmetric cryptographic processor with loop buffer structure and chain processing mechanism[J]. Chinese Journal of Electronics, 2017, 26(6): 1161–1167. doi: 10.1049/cje.2017.06.010.
[5]	ANANTH R, RAO P R M V, and RAMAIAH N S. An efficient Grain-80 stream cipher with unrolling features to enhance the throughput on hardware platform[J]. Indonesian Journal of Electrical Engineering and Computer Science, 2024, 33(1): 218–226. doi: 10.11591/ijeecs.v33.i1.pp218-226.
[6]	GILL V K, CHENNA R T, KANDULA N K, et al. High throughput efficient implementation of grain v1, lizard and plantlet stream ciphers for resource constraint devices[J]. International Journal of Computing and Digital Systems, 2022, 12(1): 1051–1061. doi: 10.12785/ijcds/120184.
[7]	LI Bohan, ZHANG Hailong, and LIN Dongdai. Efficient (masked) hardware implementation of grain-128AEADv2[J]. Security and Communication Networks, 2023, 2023(1): 8044164. doi: 10.1155/2023/8044164.
[8]	MANSOURI S S and DUBROVA E. An improved hardware implementation of the grain-128a stream cipher[C]. International Conference on Information Security and Cryptology, Seoul, Korea, 2013: 278–292. doi: 10.1007/978-3-642-37682-5_20.
[9]	NAN Longmei, YANG Xuan, ZENG Xiaoyang, et al. A VLIW architecture stream cryptographic processor for information security[J]. China Communications, 2019, 16(6): 185–199. doi: 10.23919/jcc.2019.06.015.
[10]	刘小罗, 林洪怡, 刘盼. RISC-V指令集架构及其应用综述[J]. 中国集成电路, 2025, 34(3): 16–20,49. doi: 10.3969/j.issn.1681-5289.2025.03.003. LIU Xiaoluo, LIN Hongyi, and LIU Pan. An overview of the RISC-V instruction set architecture and its applications[J]. China Integrated Circuit, 2025, 34(3): 16–20,49. doi: 10.3969/j.issn.1681-5289.2025.03.003.
[11]	李伟, 别梦妮, 陈韬, 等. RISCV密码专用处理器能效概率模型与体系结构研究[J]. 电子与信息学报, 2021, 43(6): 1541–1549. doi: 10.11999/JEIT210004. LI Wei, BIE Mengni, CHEN Tao, et al. Research on energy efficiency probability model and architecture of RISCV cryptographic processor[J]. Journal of Electronics & Information Technology, 2021, 43(6): 1541–1549. doi: 10.11999/JEIT210004.
[12]	于斌, 闵玉新, 张自豪, 等. 基于RISC-V指令扩展的双线性对协处理器设计[J]. 电子与信息学报, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367. YU Bin, MIN Yuxin, ZHANG Zihao, et al. Design of a bilinear pairing coprocessor based on RISC-V instruction extension[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367.
[13]	王明登, 严迎建, 郭朋飞, 等. 基于RISC-V指令扩展方式的国密算法SM2、SM3和SM4的高效实现[J]. 电子学报, 2024, 52(8): 2850–2865. doi: 10.12263/DZXB.20230391. WANG Mingdeng, YAN Yingjian, GUO Pengfei, et al. Efficient implementation of national security algorithms SM2, SM3, and SM4 based on RISC-V instruction extension method[J]. Acta Electronica Sinica, 2024, 52(8): 2850–2865. doi: 10.12263/DZXB.20230391.
[14]	李伟, 陈億, 陈韬, 等. 面向边缘计算的可重构CNN协处理器研究与设计[J]. 电子与信息学报, 2024, 46(4): 1499–1512. doi: 10.11999/JEIT230509. LI Wei, CHEN Yi, CHEN Tao, et al. A research and design of reconfigurable CNN co-processor for edge computing[J]. Journal of Electronics & Information Technology, 2024, 46(4): 1499–1512. doi: 10.11999/JEIT230509.
[15]	HELL M, JOHANSSON T, MAXIMOV A, et al. Grain-128AEADv2: Strengthening the initialization against key reconstruction[C]. 20th International Conference on Cryptology and Network Security, Vienna, Austria, 2021: 24–41. doi: 10.1007/978-3-030-92548-2_2.
[16]	陈韬, 赵旺鹏, 别梦妮, 等. 格基后量子密码双域可重构多项式乘法运算单元架构研究[J]. 电子与信息学报, 2026, 48(4): 1646–1658. doi: 10.11999/JEIT250929. CHEN Tao, ZHAO Wangpeng, BIE Mengni, et al. Research on the architecture of dual-field reconfigurable polynomial multiplication unit for lattice-based post-quantum cryptography[J]. Journal of Electronics & Information Technology, 2026, 48(4): 1646–1658. doi: 10.11999/JEIT250929.
[17]	李伟. 面向序列密码的反馈移位寄存器可重构并行化设计技术研究[D]. [硕士论文], 解放军信息工程大学, 2009. LI Wei. Research on technology of reconfigurable parallel feedback shift register targeted at stream ciphers[D]. [Master dissertation], PLA Information Engineering University, 2009.