SHA-3 Hardware Acceleration: Keccak Implementation Guide
SHA-3 is the latest member of the Secure Hash Algorithm family, standardized by NIST in FIPS 202 (2015). Unlike its predecessors, it is built on the Keccak permutation and a fundamentally different structure called the sponge construction. For VLSI designers, SHA-3 is exceptionally attractive: it maps cleanly to hardware, requires no message-schedule expansion, and achieves multi-gigabit throughput in a compact area. This guide covers the algorithm internals and the architectural choices that drive a high-performance Keccak accelerator.
Quick Summary
| Core Engine | Keccak-f[1600] permutation over a 5x5x64-bit state, run for 24 rounds |
| Construction | Sponge: absorb phase XORs message into rate; squeeze phase extracts output |
| HW Advantage | Pure bit-permutations and XOR/AND logic; no adders, no message expansion |
SHA-3 / Keccak vs SHA-2
SHA-2 (SHA-256, SHA-512) is based on a Merkle-Damgard construction with an ARX (Add-Rotate-Xor) compression function. SHA-3 was selected specifically because its design is structurally independent, providing an alternative should a weakness ever be found in SHA-2.
- Structure: SHA-2 uses Merkle-Damgard with length padding; SHA-3 uses the sponge construction.
- Core operations: SHA-2 relies on modular addition (carry-propagate adders, long critical paths); SHA-3 uses only XOR, AND, NOT, and bit rotations.
- Length-extension attacks: SHA-2 (raw) is vulnerable and requires HMAC; the sponge structure makes SHA-3 inherently resistant.
- Hardware cost: SHA-3 avoids wide adders, giving shorter critical paths and excellent energy-per-bit, but its 1600-bit state needs more flip-flops than SHA-256's 256-bit state.
- Flexibility: The same Keccak core directly yields the variable-length SHAKE output functions.
The Sponge Construction: Absorb and Squeeze
The sponge is a simple, elegant mode of operation. The internal state of b = 1600 bits is partitioned into two logical regions: the rate (r), which interacts with the message, and the capacity (c), which is never directly touched by input or output and provides the security margin, where b = r + c.
Absorb Phase
The padded message is split into r-bit blocks. Each block is XORed into the first r bits of the state, after which the full Keccak-f[1600] permutation is applied. This repeats until all message blocks are consumed.
Squeeze Phase
Output is produced by reading the first r bits of the state. If more output is needed, the permutation is applied again and another r bits are read. For fixed-length SHA-3 a single squeeze block is sufficient; for XOFs the squeeze loop continues to any desired length.
01 (and 1111 for SHAKE) followed by the multi-rate pad 10*1 so the message length becomes a multiple of r. This domain separation is what cryptographically distinguishes SHA3-256 from SHAKE128 even when they share the rate.
State Representation: 1600 bits as 5 x 5 x 64
The Keccak state is best visualized as a three-dimensional array A[x][y][z] of 5 x 5 x 64 = 1600 bits. The naming of the sub-structures is central to understanding the step mappings:
- Lane: a 64-bit word indexed by fixed (x, y) — the natural unit for a 64-bit datapath. There are 25 lanes.
- Row: 5 bits along the x-axis at fixed (y, z).
- Column: 5 bits along the y-axis at fixed (x, z) — operated on by theta.
- Slice: the 5 x 5 plane at a fixed z (25 bits).
The lane size w = 64 gives the round count via l = log2(w) = 6, and the number of rounds nr = 12 + 2l = 24. In hardware the state is typically held in a 1600-bit register (or 25 x 64-bit lane registers), updated once per round.
The Five Step Mappings
Each of the 24 rounds applies the same sequence of five invertible mappings: theta, rho, pi, chi, iota. Together they provide diffusion, dispersion, and non-linearity.
1. Theta (θ) - Diffusion
Computes the parity of each of the 5 columns, then XORs into each bit the parity of two neighbouring columns (one rotated by 1 bit in z). This step diffuses every input bit across the state. In hardware it is a tree of XOR gates and contributes the longest portion of the theta critical path.
2. Rho (ρ) - Inter-lane Rotation
Rotates each of the 25 lanes by a fixed, distinct offset (the triangular-number offsets, e.g. 0, 1, 3, 6, 10, ...). Because the offsets are constant, rho is free in hardware — it is realised purely by wire routing with zero gates and zero delay.
3. Pi (π) - Lane Permutation
Reorders the 25 lanes according to A[x][y] → A[y][2x+3y mod 5]. Like rho, this is pure rewiring with no logic cost.
4. Chi (χ) - Non-linearity
The only non-linear step: each bit is combined with its two row neighbours as A[x] = A[x] XOR ((NOT A[x+1]) AND A[x+2]). This single layer of AND/NOT gates provides the algorithm's confusion and is the cryptographic heart of Keccak.
5. Iota (ι) - Symmetry Breaking
XORs a round-specific constant into lane A[0][0] to break the symmetry that would otherwise make all rounds identical and the state susceptible to fixed-point attacks. The 24 constants are derived from a simple LFSR and can be hard-coded into a small ROM or LUT.
Rate, Capacity and the SHA-3 Variants
All variants share the identical Keccak-f[1600] permutation; they differ only in how the 1600-bit state is split between rate and capacity, and in the output length. The capacity is always set to twice the target security level (c = 2 x security), which directly fixes the rate as r = 1600 - c.
| Variant | Rate r (bits) | Capacity c (bits) | Output (bits) | Security (collision) |
|---|---|---|---|---|
| SHA3-224 | 1152 | 448 | 224 | 112-bit |
| SHA3-256 | 1088 | 512 | 256 | 128-bit |
| SHA3-384 | 832 | 768 | 384 | 192-bit |
| SHA3-512 | 576 | 1024 | 512 | 256-bit |
| SHAKE128 | 1344 | 256 | arbitrary (XOF) | 128-bit |
| SHAKE256 | 1088 | 512 | arbitrary (XOF) | 256-bit |
Note the design trade-off: a larger rate (e.g. SHAKE128) absorbs more message per permutation and is therefore faster, while a larger capacity (e.g. SHA3-512) gives stronger security at lower throughput. This rate/throughput relationship is the key knob for sizing an accelerator to an application.
SHAKE: Extendable-Output Functions (XOFs)
SHAKE128 and SHAKE256 use the same sponge but keep squeezing to produce an output of any requested length. This makes them ideal building blocks for:
- Post-quantum cryptography: ML-KEM (Kyber) and ML-DSA (Dilithium) use SHAKE extensively for hashing and as a deterministic pseudorandom generator.
- Key derivation and mask generation: producing arbitrary-length keystreams or masks from a seed.
- Deterministic random bit generation in protocol implementations.
For a hardware engineer, SHAKE costs almost nothing extra: the squeeze loop is simply the same permutation already in the datapath, gated to run additional iterations. This is why a single Keccak core can serve hashing, XOF, and PQC duties simultaneously.
Hardware Architecture: Round-Based vs Unrolled
Because rho and pi are free wiring and theta/chi/iota are shallow logic, the entire round function fits in a short combinational path. This gives the designer a clean area-versus-throughput dial.
Round-Based (Iterative)
A single physical round-function instance is reused for all 24 rounds, with the state register feeding back on itself. One round completes per clock cycle, so a full permutation takes 24 cycles (plus 1 for I/O). This is the most area-efficient approach and reaches high clock frequencies, making it the default for embedded and constrained designs.
Unrolled
Two or more round functions are cascaded combinationally so that k rounds complete per cycle, reducing latency to 24/k cycles. This increases throughput at the cost of a longer critical path and proportionally more area. A common compromise is 2x unrolling.
Pipelined
Registers are inserted between unrolled round stages so multiple independent messages flow through the engine concurrently. Pipelining delivers the highest aggregate throughput and is used in blockchain mining and high-volume server offload, but only helps when many parallel hashing jobs are available.
Throughput Calculation
Throughput is governed by how many message bits (the rate) are processed per permutation and how many cycles each permutation costs. For a round-based core, cycles-per-block equals the round count (24) plus any I/O overhead.
SHA-3 Throughput Formula
Throughput = (rbits / cycles_per_block) x fclk
Where: rbits = rate of the variant, cycles_per_block = nr / unroll_factor (+ I/O), fclk = clock frequency
Example (SHA3-256, round-based): r = 1088, cycles = 24, f = 500 MHz
Throughput = (1088 / 24) x 500 x 106 ≈ 22.7 Gbps
Example (SHA3-512, round-based): r = 576, cycles = 24, f = 500 MHz
Throughput = (576 / 24) x 500 x 106 ≈ 12.0 Gbps
The formula makes the design levers explicit: raising fclk, choosing a higher-rate variant, or unrolling rounds (reducing cycles_per_block) all increase throughput. Unrolling, however, lengthens the critical path and may force fclk down, so the product must be optimised holistically.
Implementation Best Practices
- Exploit free permutations: Implement rho and pi as wiring only — never instantiate logic or registers for them.
- Hard-code iota constants: Store the 24 round constants in a small ROM or generate them with the FIPS-202 LFSR; index by a 5-bit round counter.
- Reuse one core for all variants: Parameterise only the rate, padding suffix, and squeeze length; the permutation is identical across SHA3 and SHAKE.
- Balance the critical path: Profile theta's column-parity XOR tree and chi's AND layer; insert pipeline registers only where they pay for themselves.
- Handle padding in hardware: Apply pad10*1 plus the correct domain suffix (01 for SHA-3, 1111 for SHAKE) so software passes raw messages.
- Protect against side channels: For keyed modes (KMAC), add masking/threshold implementations of the non-linear chi step to resist DPA.
- Validate with NIST vectors: Verify against the FIPS-202 / CAVP test vectors, including empty-message and multi-block edge cases, before tape-out.
- Plan the interface: Provide a streaming AXI-Stream or FIFO front end so absorb can overlap with upstream data movement and avoid stalls.
Conclusion
SHA-3 / Keccak is one of the most hardware-friendly cryptographic primitives ever standardized. Its sponge construction, free bit-permutations, and adder-free logic let a single compact core deliver tens of gigabits per second while serving fixed-length hashing, variable-length SHAKE output, and post-quantum workloads from the same datapath.
The architectural choice — round-based for area efficiency, unrolled or pipelined for raw throughput — should follow directly from the throughput equation and the target application, whether that is an embedded SoC, a blockchain ASIC, or a PQC accelerator.
Vcores offers silicon-proven cryptographic IP, including configurable SHA-3 / Keccak and SHAKE cores with selectable performance points, side-channel-hardened options, and complete FIPS-202 verification for seamless integration into your FPGA and ASIC designs.
