基于RISC-V的Grain密码算法可重构并行化协处理器设计

南龙梅; 王浩宇; 杜怡然; 李伟; 陈韬

doi:10.11999/JEIT260391

基于RISC-V的Grain密码算法可重构并行化协处理器设计

doi: 10.11999/JEIT260391 cstr: 32379.14.JEIT260391

信息工程大学郑州 450000

详细信息

作者简介:
南龙梅：女，副教授，研究方向为可重构专用芯片设计

王浩宇：男，硕士生，研究方向为可重构专用芯片设计

杜怡然：男，副教授，研究方向为可重构专用芯片设计

李伟：男，教授，研究方向为密码处理器设计

陈韬：男，副教授，研究方向为安全专用芯片设计

通讯作者:
王浩宇　2741615670@qq.com

中图分类号: TN47
计量
- 文章访问数: 211
- HTML全文浏览量: 94
- PDF下载量: 9
- 被引次数: 0
出版历程
- 收稿日期: 2026-04-02
- 修回日期: 2026-07-23
- 录用日期: 2026-07-28
- 网络出版日期: 2026-08-07

A Reconfigurable Parallelized Coprocessor Design for the RISC-V-based Grain Cryptographic Algorithm

College of Cryptography Engineering, Information Engineering University, Zhengzhou 450000, China

摘要

摘要: Grain系列密码算法广泛应用于射频识别(RFID)、物联网等资源受限的硬件环境，但通用处理器(GPP)实现性能低，专用集成电路(ASIC)实现灵活性差且成本高。针对该问题，本文采用专用指令扩展方式，提出一种基于RISC-V协处理器的Grain密码算法可重构并行化实现方案。该方案分析Grain系列算法中线性反馈移位寄存器和非线性反馈移位寄存器结构共性与差异，采用相同移位寄存器架构与面向算法的抽头网络，设计可重构并行化实现架构及相应的扩展指令，可高效支持Grain-80, Grain-128, Grain-128a与Grain-128AEAD 4种算法，并行粒度1～8灵活可调。实验结果表明，与无指令扩展的软件实现相比，基于蜂鸟E203平台，该方案完成密码处理流程的时钟周期数与指令条数由数万级降至129个与53条，吞吐率由0.33～9.18 Mbit/(s·Hz)提升至约200 Mbit/(s·Hz)；硬件综合表明，该方案在65 nm工艺下面积为7252.55 μm²，吞吐率达1.56 Gbit/(s·Hz)，虽较单算法ASIC实现面积略有增加，但可在同一架构上支持4种算法。该文所提实现方案在灵活性、处理效率与硬件开销之间实现了良好平衡。
- RISC-V /
- 协处理器 /
- 指令扩展 /
- Grain密码算法 /
- 可重构并行化
Abstract: Objective To address the performance limitations of Grain cryptographic algorithms on General-Purpose Processors (GPPs), as well as the inflexibility and high hardware overhead of Application-Specific Integrated Circuit (ASIC) implementations, a dedicated cryptographic hardware accelerator is integrated into a RISC-V coprocessor through a custom instruction extension mechanism. A reconfigurable parallelized architecture is proposed for the Grain algorithm family based on the RISC-V coprocessor interface. Corresponding custom instructions are designed to support the flexible and efficient execution of Grain-80, Grain-128, Grain-128a, and Grain-128AEAD on a unified hardware platform. The proposed architecture provides a favorable balance between processing efficiency, design flexibility, and hardware resource overhead, making it suitable for resource-constrained embedded systems. Methods A unified shift-register architecture is adopted to support flexible switching among Grain-80, Grain-128, Grain-128a, and Grain-128AEAD, with a configurable parallelization degree of 1 to 8. To implement the custom instructions for the Grain cryptographic algorithms, the software and hardware functions are analyzed, and the cryptographic process is divided between the processor and coprocessor to achieve efficient execution. The proposed coprocessor uses a streamlined architecture that reuses common hardware resources across the four algorithms. Combined with a configurable feedback tap selection network and feedback logic tailored to a predefined set of algorithms, the architecture enables reconfigurable parallel execution with limited additional hardware resource overhead. Results and Discussions The proposed custom instructions enable flexible implementation of four Grain cryptographic algorithms on the same hardware platform. Compared with implementations without instruction extensions, the proposed custom instructions reduce the number of clock cycles and instructions required for cryptographic processing while improving throughput (Table 7). On the Hummingbird E203 platform with a parallelization degree of 4, the proposed implementation requires 105, 129, and 183 clock cycles for Grain-80, Grain-128/Grain-128a, and Grain-128AEAD, respectively, with corresponding throughputs of 220.67, 179.74, and 126.70 Mbit/(s·Hz). Compared with purely software-based implementations, the proposed approach substantially reduces both the number of executed instructions and the number of clock cycles (Table 7). Synthesis results further demonstrate that the coprocessor occupies 7 252.55 μm² in a 65 nm process and achieves a throughput of 1.56 Gbit/(s·Hz) at a parallelization degree of 4. Although the reconfigurable architecture requires slightly more area than a dedicated single-algorithm implementation, it supports four Grain algorithms on a unified hardware platform and provides improved hardware resource reuse and design flexibility. Conclusions A hardware-software cooperative reconfigurable parallelization scheme is designed to accelerate the Grain cryptographic algorithm family in lightweight embedded systems. The scheme exploits the RISC-V custom instruction extension mechanism and combines a unified shift-register architecture, a configurable feedback tap selection network, and feedback logic tailored to a predefined set of algorithms. Four algorithms, namely Grain-80, Grain-128, Grain-128a, and Grain-128AEAD, can therefore be flexibly selected and processed in parallel on a single hardware platform. This design improves processing efficiency while maintaining design flexibility and limiting hardware resource overhead. The present work focuses on reconfigurable parallelization for the Grain algorithm family. Future research will investigate more general reconfigurable architectures for nonlinear Boolean functions by incorporating configurable units, such as LookUp Tables (LUTs) or programmable logic arrays. Such architectures may further improve compatibility with multiple stream cipher algorithms while maintaining high throughput and low hardware resource overhead.
- RISC-V /
- Coprocessor /
- Instruction extension /
- Grain cryptographic algorithm /
- Reconfigurable parallelization

HTML全文

图 1 NICE接口通道示意图

下载: 全尺寸图片幻灯片

图 2 可重构并行化Grain密码算法整体实现架构

下载: 全尺寸图片幻灯片

图 3 可重构LFSR单元

下载: 全尺寸图片幻灯片

图 4 LFSR可重构并行化模块图

下载: 全尺寸图片幻灯片

图 5 可重构NFSR非线性部分单元

下载: 全尺寸图片幻灯片

图 6 NFSR可重构并行化模块图

下载: 全尺寸图片幻灯片

图 7 软硬件协同总体结构框架

下载: 全尺寸图片幻灯片

图 8 协处理器各模块资源分布图

下载: 全尺寸图片幻灯片

图 9 实验环境

下载: 全尺寸图片幻灯片

表 1 硬件加速器的自定义扩展指令集

专用指令名称	内嵌汇编指令	功能
start_80	asm volatile(“.insn r 0x0b,0,7,x0,x0,x0”:“=r”(zero))	启动Grain-80算法
start_128/128AEAD	asm volatile(“.insn r 0x0b,0,15,x0,x0,x0”:“=r”(zero))	启动Grain-128算法或 Grain-128AEAD算法
start_128a	asm volatile(“.insn r 0x0b,0,23,x0,x0,x0”:“=r”(zero))	启动Grain-128a算法
data_load_I	asm volatile(“.insn r 0x0b,3,0,x0,%1,%2”:“=r”(zero):“r”(lfsr[31:0]),“r”(nfsr[31:0]))	第1轮参数输入
data_load_II	asm volatile(“.insn r 0x0b,3,1,x0,%1,%2”:“=r”(zero):“r”(lfsr[63:32]),“r”(nfsr[63:32]))	第2轮参数输入
data_load_III	asm volatile(“.insn r 0x0b,3,2,x0,%1,%2”:“=r”(zero):“r”(lfsr[95:33]),“r”(nfsr[95:33]))	第3轮参数输入
data_load_IV	asm volatile(“.insn r 0x0b,3,3,x0,%1,%2”:“=r”(zero):“r”(lfsr[127:96]),“r”(nfsr[127:96]))	第4轮参数输入
initial_80	asm volatile(“.insn r 0x0b,0,2,x0,x0,x0”:“=r”(zero))	执行FSR指定轮的预热
initial_128/128a	asm volatile(“.insn r 0x0b,0,10,x0,x0,x0”:“=r”(zero))	执行FSR指定轮的预热
initial_128AEAD	asm volatile(“.insn r 0x0b,0,18,x0,x0,x0”:“=r”(zero))	执行FSR指定轮的预热
repeat_initial	asm volatile(“.insn r 0x0b,0,19,x0,x0,x0”:“=r”(zero))	执行密钥重引入
read_data_80	asm volatile(“.insn r 0x0b,4,0,%0,x0,x0”:“=r”(product))	将密钥写入目的寄存器
read_data_128/128a	asm volatile(“.insn r 0x0b,4,8,%0,x0,x0”:“=r”(product))
read_data_128AEAD	asm volatile(“.insn r 0x0b,4,16,%0,x0,x0”:“=r”product))

下载: 导出CSV

表 2 协处理器各模块资源使用情况

硬件单元	硬件资源(LUTs)	触发器(FFs)
LFSR	55 (26.1%)	128
NFSR	93 (44.2%)	128
密钥流生成模块h(x)	24 (11.3%)	0
其他	39 (18.4%)	92
协处理器	211 (100%)	348

下载: 导出CSV

表 3 协处理器各模块资源占用情况

硬件单元	占用面积(um²)	标准单元数(个)
LFSR	1671.47	297
NFSR	1896.83	384
密钥流生成模块h(x)	544.67	192
其他	3139.58	794
协处理器	7252.55	1667

下载: 导出CSV

表 4 不同平台下的性能对比

实现方案	密码算法	实现方式	并行度	吞吐率 (Mbps)	时钟周期数 (cycles)	指令数 (instrets)	执行时间 (us)
无扩展指令	Grain-80	纯软件	4	0.646	35868	28963	358.68
	Grain-128/128a	纯软件	4	0.474	48918	39208	489.18
	Grain-128AEAD	纯软件	4	0.334	69412	52868	694.12
有扩展指令	Grain-80	软硬件协同	4	220.67	105	53	1.05
	Grain-128/128a	软硬件协同	4	179.74	129	53	1.29
	Grain-128AEAD	软硬件协同	4	126.70	183	61	1.83
文献[9]	Grain-80	Intel	1	46.12	25590	20606	7.31
	Grain-80	MSM8660	1	12.31	27843	22447	11.65
	Grain-128	Intel	1	26.54	40788	32894	16.38
	Grain-128	MSM8660	1	6.05	44431	35832	26.14

下载: 导出CSV

表 5 不同RISC-V平台的性能对比

实现平台	有无扩展指令	密码算法	时钟周期数 (cycles)	吞吐率 (Mbit/(s·Hz))
蜂鸟E203	无扩展指令	Grain-80	35868	0.646
		Grain-128/128a	48918	0.474
		Grain-128AEAD	69412	0.334
	有扩展指令	Grain-80	105	220.67
		Grain-128/128a	129	179.74
		Grain-128AEAD	183	126.70
CVA6	无扩展指令	Grain-80	26058	0.889
		Grain-128/128a	34337	0.675
		Grain-128AEAD	50436	0.459
	有扩展指令	Grain-80	72	321.81
		Grain-128/128a	96	241.53
		Grain-128AEAD	159	145.82
Rocket	无扩展指令	Grain-80	29652	0.781
		Grain-128/128a	37694	0.615
		Grain-128AEAD	53804	0.431
	有扩展指令	Grain-80	96	241.36
		Grain-128/128a	118	196.5
		Grain-128AEAD	172	134.8

下载: 导出CSV

表 6 不同实现工艺的结果对比

实现方案	密码算法	工艺/器件	并行度	频率(MHz)	吞吐率(Gbit/(s·Hz))	面积	门电路总数(个)
本文方案	可重构Grain	ASIC 65nm	4	392	1.56	7252.55 um²	-
本文方案	可重构Grain	ASIC 65nm	8	392	3.12	7252.55 um²	-
文献[4]	Grain-80	ALTERA MAX II EPM570T100C3	1	200	0.2	-	1435
			2	211	0.422	-	1607
			4	158	0.632	-	1950
			8	148	1.18	-	2636
			16	133	2.12	-	4008
文献[5]	Grain-80	ASIC 90 nm	4	2800	11.2	5984 um²	-
	Grain-80	ASIC 90 nm	8	2300	18.4	8658 um²	-
	Grain-128	ASIC 90 nm	4	3000	12.0	7316 um²	-
	Grain-128	ASIC 90 nm	8	2900	23.2	9450 um²	-
文献[6]	Grain-80	Virtex 7	1	592	0.592	169 slices	-
文献[6]	Grain-80	Virtex 7	16	571	9.14	180 slices	-
文献[7]	Grain-80	Artix-7	1	543	0.543	99 slices	-
文献[7]	Grain-80	Artix-7	16	543	8.69	1121 slices	-
文献[8]	可重构Grain80/128	Altera Cyclone EP1C12	1	220	0.220	332 LE	-
		Altera Cyclone EP1C12	16	140	2.24	552 LE	-
		ASIC 0.18um	1	330	0.330	11967 um²	-
		ASIC 0.18um	16	218	3.48	22543 um²	-

下载: 导出CSV

参考文献(17)

[1]	ZHU Yufei, XING Zuocheng, XUE Jinhui, et al. Area-efficient parallel reconfigurable stream processor for symmetric cryptograph[J]. IEEE Access, 2021, 9: 28377–28392. doi: 10.1109/ACCESS.2021.3057866.
[2]	陈艺文. 基于Grain类算法结构的流密码设计与分析[D]. [硕士论文], 桂林电子科技大学, 2023. doi: 10.27049/d.cnki.ggldc.2023.001518. CHEN Yiwen. Design and analysis of stream ciphers based on grain-like algorithm structure[D]. [Master dissertation], Guilin University of Electronic Technology, 2023. doi: 10.27049/d.cnki.ggldc.2023.001518.
[3]	MANSOURI S S and DUBROVA E. An improved hardware implementation of the grain stream cipher[C]. The 2010 13th Euromicro Conference on Digital System Design: Architectures, Methods and Tools, Lille, France, 2010: 433–440. doi: 10.1109/DSD.2010.49.
[4]	LI Wei, ZENG Xiaoyang, DAI Zibin, et al. A high energy-efficient reconfigurable VLIW symmetric cryptographic processor with loop buffer structure and chain processing mechanism[J]. Chinese Journal of Electronics, 2017, 26(6): 1161–1167. doi: 10.1049/cje.2017.06.010.
[5]	ANANTH R, RAO P R M V, and RAMAIAH N S. An efficient Grain-80 stream cipher with unrolling features to enhance the throughput on hardware platform[J]. Indonesian Journal of Electrical Engineering and Computer Science, 2024, 33(1): 218–226. doi: 10.11591/ijeecs.v33.i1.pp218-226.
[6]	GILL V K, CHENNA R T, KANDULA N K, et al. High throughput efficient implementation of grain v1, lizard and plantlet stream ciphers for resource constraint devices[J]. International Journal of Computing and Digital Systems, 2022, 12(1): 1051–1061. doi: 10.12785/ijcds/120184.
[7]	LI Bohan, ZHANG Hailong, and LIN Dongdai. Efficient (masked) hardware implementation of grain-128AEADv2[J]. Security and Communication Networks, 2023, 2023(1): 8044164. doi: 10.1155/2023/8044164.
[8]	MANSOURI S S and DUBROVA E. An improved hardware implementation of the grain-128a stream cipher[C]. International Conference on Information Security and Cryptology, Seoul, Korea, 2013: 278–292. doi: 10.1007/978-3-642-37682-5_20.
[9]	NAN Longmei, YANG Xuan, ZENG Xiaoyang, et al. A VLIW architecture stream cryptographic processor for information security[J]. China Communications, 2019, 16(6): 185–199. doi: 10.23919/jcc.2019.06.015.
[10]	刘小罗, 林洪怡, 刘盼. RISC-V指令集架构及其应用综述[J]. 中国集成电路, 2025, 34(3): 16–20,49. doi: 10.3969/j.issn.1681-5289.2025.03.003. LIU Xiaoluo, LIN Hongyi, and LIU Pan. An overview of the RISC-V instruction set architecture and its applications[J]. China Integrated Circuit, 2025, 34(3): 16–20,49. doi: 10.3969/j.issn.1681-5289.2025.03.003.
[11]	李伟, 别梦妮, 陈韬, 等. RISCV密码专用处理器能效概率模型与体系结构研究[J]. 电子与信息学报, 2021, 43(6): 1541–1549. doi: 10.11999/JEIT210004. LI Wei, BIE Mengni, CHEN Tao, et al. Research on energy efficiency probability model and architecture of RISCV cryptographic processor[J]. Journal of Electronics & Information Technology, 2021, 43(6): 1541–1549. doi: 10.11999/JEIT210004.
[12]	于斌, 闵玉新, 张自豪, 等. 基于RISC-V指令扩展的双线性对协处理器设计[J]. 电子与信息学报, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367. YU Bin, MIN Yuxin, ZHANG Zihao, et al. Design of a bilinear pairing coprocessor based on RISC-V instruction extension[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367.
[13]	王明登, 严迎建, 郭朋飞, 等. 基于RISC-V指令扩展方式的国密算法SM2、SM3和SM4的高效实现[J]. 电子学报, 2024, 52(8): 2850–2865. doi: 10.12263/DZXB.20230391. WANG Mingdeng, YAN Yingjian, GUO Pengfei, et al. Efficient implementation of national security algorithms SM2, SM3, and SM4 based on RISC-V instruction extension method[J]. Acta Electronica Sinica, 2024, 52(8): 2850–2865. doi: 10.12263/DZXB.20230391.
[14]	李伟, 陈億, 陈韬, 等. 面向边缘计算的可重构CNN协处理器研究与设计[J]. 电子与信息学报, 2024, 46(4): 1499–1512. doi: 10.11999/JEIT230509. LI Wei, CHEN Yi, CHEN Tao, et al. A research and design of reconfigurable CNN co-processor for edge computing[J]. Journal of Electronics & Information Technology, 2024, 46(4): 1499–1512. doi: 10.11999/JEIT230509.
[15]	HELL M, JOHANSSON T, MAXIMOV A, et al. Grain-128AEADv2: Strengthening the initialization against key reconstruction[C]. 20th International Conference on Cryptology and Network Security, Vienna, Austria, 2021: 24–41. doi: 10.1007/978-3-030-92548-2_2.
[16]	陈韬, 赵旺鹏, 别梦妮, 等. 格基后量子密码双域可重构多项式乘法运算单元架构研究[J]. 电子与信息学报, 2026, 48(4): 1646–1658. doi: 10.11999/JEIT250929. CHEN Tao, ZHAO Wangpeng, BIE Mengni, et al. Research on the architecture of dual-field reconfigurable polynomial multiplication unit for lattice-based post-quantum cryptography[J]. Journal of Electronics & Information Technology, 2026, 48(4): 1646–1658. doi: 10.11999/JEIT250929.
[17]	李伟. 面向序列密码的反馈移位寄存器可重构并行化设计技术研究[D]. [硕士论文], 解放军信息工程大学, 2009. LI Wei. Research on technology of reconfigurable parallel feedback shift register targeted at stream ciphers[D]. [Master dissertation], PLA Information Engineering University, 2009.