1 Call for Contributions

Implementers (both submitters and non-submitters): You have results that complement this site? Let us know at sha3zoo-hardware@iaik.tugraz.at If you are making your HDL code available, please also provide us with according information.

2 Important Information

This page summarizes key properties of reported hardware implementations of those SHA-3 candidates, which are currently under consideration by NIST (final round 3). This is work in progress. If you know of any implementations which should be mentioned on this page, refer to our call for contributions.

A list of hardware implementations of the round 1 candidates can be found here. A list of hardware implementations of the round 2 candidates is archived here. Please note that the pages for round 1 and 2 candidates are provided for reference and will not be updated.

The implementations are categorized into FPGA and standard-cell ASIC implementations. Note that the diversity of implementation scope, target technologies, and synthesis tools makes direct comparisons between different hardware implementations difficult. The more of these parameters agree, the more reasonable the comparison becomes.

The target technology should be as similar as possible. For FPGA implementation, it is desirable to compare implementations on the same target device (or at least on devices of the same FPGA family). For standard-cell ASIC implementation, at least the minimal gate length of the process (e.g., 0.13 µm) should agree. More ideally, the implementations use the same standard-cell library (which implies the use of the same process technology).

In order to facilitate the comparison of hardware modules with different implementation scopes, we classify them into three categories:

For suggestions regarding the structure of this site, let us know at sha3zoo-hardware@iaik.tugraz.at

2.1 Fully Autonomous Implementation

Such hardware implementations include the complete functionality of a SHA-3 candidate (or a specific version thereof). That means the input message can be loaded piecewise into the hardware module and it delivers the message digest as output. All hash calculations happen exclusively within the hardware module. If integrated in a system, the achievable throughput of a fully autonomous implementation depends on the speed of the hardware module itself and the speed of the (system dependent) data interface delivering the input message.





2.2 Implementation with External Memory

These implementations use external memory to hold intermediate values during the hashing of a message. The implemented hardware itself normally consists of the core logic functionality of the hash function, some registers for short-lived temporary values, and possible a memory controller for access to the external memory. Such implementations can load the input message either over a dedicated interface (similar to a fully autonomous implementation) or from the external memory. In order to reach the maximal throughput of the hardware module, the external memory must be sufficiently fast.





2.3 Implementation of Core Functionality

Such implementations comprise only important parts of the hash function (e.g., the compression function), which normally allows to get a first-order estimate of the performance figures of full implementations.

The main tweaks for round three consist of the adaption of round numbers for some of the candidates. For implementations of round 2 variants (cf. round two results), we extrapolated to the performance of round 3 variants. Extrapolated results are marked in orange . If the tweaks for an algorithm are expected to be negligible for performance (e.g. just a change of constants), we include the results for the round 2 variant verbatim.

BLAKE: The round three versions of BLAKE have been renamed to BLAKE-224, BLAKE-256, BLAKE-384, and BLAKE-512. The number of rounds has been increased from 10 to 14 for BLAKE-224 and BLAKE-256, and from 14 to 16 for BLAKE-384 and BLAKE-512. Thus, throughput for BLAKE-224 and BLAKE-256 is expected to decrease by a factor of 10/14 (reduction by about 28.5%), and for BLAKE-384 and BLAKE-512 by a factor of 14/16 (reduction by 12.5%).

Grøstl: The shift distances for the Q permutation have been changed and the round constants for both P and Q permutation have been modified. The first is not expected to have an impact on hardware performance, whereas the latter is likely to increase overall hardware size and/or decrease throughput slightly.

JH: The number of rounds has been increased from 35.5 to 42. Thus, throughput of JH is expected to decrease by a factor of 35.5/42 (reduction by about 15.5%).

Keccak: The padding rule has been simplified and some parameters have been redefined. No significant impact on hardware performance is expected.

Skein: A single 64-bit constant has been changed. No significant impact on hardware performance is expected.

4 Ongoing Hardware Benchmarking Efforts

To describe it in the words of the initiators and maintainers: "ATHENa: Automated Tool for Hardware EvaluatioN is a project started at George Mason University, aimed at fair, comprehensive, and automated evaluation of cryptographic cores developed using hardware description languages, such as VHDL and Verilog." More information about the project and the current results can be found on the ATHENa webpage. Note: As each hash module submitted to ATHENAa is implemented on several FPGA platforms, the SHA-3 zoo pages will not replicate all results produced by the ATHENa project on this webpage. Instead please refer directly to the ATHENa webpage.

5 Summary of All Results

This section includes four categories of implementations (high-speed, low-area, both for FPGA and ASIC) which include known published results. If the HDL sourcecode is available, a link is provided as well.

5.1 High-Speed Implementations (FPGA)

Important note: The size and functionality of slices varies between FPGA families. A direct comparison of the slice count of implementations on different FPGA families is therefore problematic.







5.2 Low-Area Implementations (FPGA)







5.3 High-Speed Implementations (ASIC)





(*) Estimated peak throughput for the minimal delay of compression function: 1000 * (Input Size in bits) / [(Compression Function Delay in ns) * (Number of Cycles)] = Throughput in Mbit/s.







5.4 Low-Area Implementations (ASIC)

(*) Estimation for 64-bit memory interface: (1024 bits/permutation) * (666.7 * 10^6 cycles/s) / (3870 cycles/permutation) = 176.41 * 10^6 bits/s

(**) Estimation for 64-bit memory interface: (1024 bits/permutation) * (200 * 10^6 cycles/s) / (3870 cycles/permutation) = 52.92 * 10^6 bits/s

(***) Estimated peak throughput for the minimal delay of compression function: 1000 * (Input Size in bits) / [(Compression Function Delay in ns) * (Number of Cycles)] = Throughput in Mbit/s







6 Comparative Studies

This section summarizes the reported results of publications which examined more than one round-three candidate in a similar setup.

6.1 BLAKE, Skein





Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 Compression function with 8 G function units and I/O registers 5435 ALUTs 1562 Mbit/s 46.97 MHz Skein-256-256 All 72 Threefish rounds unrolled (device too small) N/A N/A N/A













Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 Compression function with 8 G function units and I/O registers 53 kGates 3196 Mbit/s(*) 96.15 MHz Skein-256-256 All 72 Threefish rounds unrolled 369 kGates 3126 Mbit/s(*) 12.21 MHz

(*) Estimated peak throughput for the minimal delay of compression function: 1000 * (Input Size in bits) / [(Compression Function Delay in ns) * (Number of Cycles)] = Throughput in Mbit/s.







6.2 BLAKE, Grøstl, Skein





Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 1660 slices 1911 Mbit/s 115 MHz Grøstl-256 4057 slices 5171 Mbit/s 101 MHz Skein-256 854 slices 1482 Mbit/s 115 MHz







Reported results are post-synthesis. An interactive graphical comparison of various area-performance tradeoffs of this study can be found here.









Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 Compression function with 4 G function units with CSAs 45.64 kGates 2836 Mbit/s 170.64 MHz Grøstl-256 One shared permutation for P & Q, one pipeline stage 58.40 kGates 6290 Mbit/s 270.27 MHz JH-256 320 S-boxes, one round of R 8 per cycle 58.83 kGates 4219 Mbit/s 380.22 MHz Keccak(-256) One instance of Keccak-f round 56.32 kGates 21229 Mbit/s 487.80 MHz Skein-256-256 8 Threefish rounds unrolled 58.61 kGates 1882 Mbit/s 73.52 MHz Skein-512-512 8 Threefish rounds unrolled 102.04 kGates 2502 Mbit/s 48.87 MHz







6.4 BLAKE, Grøstl, Skein





Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 One G function in 11 cycles 25.57 kGates 11 Mbit/s 31.25 MHz Grøstl-224/256 64-bit datapath, P & Q permutation shared 14.62 kGates 145.9 Mbit/s 55.87 MHz Skein-256-256 64-bit datapath 12.89 kGates 19.8 Mbit/s 80 MHz







Reported results of this study are post-P&R performances of designs targeting high throughput.









Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 Four parallel G functions modules 47.5 kGates 6966 Mbit/s 400 MHz Grøstl-256 P and Q permutation interleaved with one pipeline stage, S-box as LUT 135 kGates 16254 Mbit/s 667 MHz JH-256 S-boxes as LUTs, stored constants 80 kGates 9134 Mbit/s 760 MHz Keccak(-256) One round per cycle 50 kGates 43011 Mbit/s 949 MHz Skein-256-256 Four unrolled Threefish rounds 50 kGates 3558 Mbit/s 264 MHz







Designs optimized towards throughput to area ratio. The cited results are those for the Xilinx Virtex 5 and Altera Stratix III platforms (both for the 256-bit and the 512-bit version of the candidates). Results marked with N/A did not fit into the largest device of the device family. For a full listing of all ATHENa results refer to the ATHENa webpage.









Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 4 G function units per iteration 1523 slices 2245 Mbit/s 128.9 MHz BLAKE-512 4 G function units per iteration 3064 slices 3080 Mbit/s 99.7 MHz Grøstl-256 P & Q permutations interleaved 1597 slices 7885 Mbit/s 323.4 MHz Grøstl-512 P & Q permutations interleaved 3138 slices 10314 Mbit/s 292.1 MHz JH-256 1018 slices 4578 Mbit/s 380.8 MHz JH-512 1104 slices 4742 Mbit/s 394.5 MHz Keccak(-256) 1272 slices 12817 Mbit/s 282.7 MHz Keccak(-512) 1257 slices 6845 Mbit/s 285.2 MHz Skein-512-256 4 Threefish rounds unrolled 1621 slices 3178 Mbit/s 118.0 MHz Skein-512-512 4 Threefish rounds unrolled 1716 slices 3209 Mbit/s 119.1 MHz













Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 4 G function units per iteration 3635 ALUTs 2072 Mbit/s 119.0 MHz BLAKE-512 4 G function units per iteration 7086 ALUTs 2766 Mbit/s 89.5 MHz Grøstl-256 P & Q permutations interleaved 6350 ALUTs 5380 Mbit/s 220.7 MHz Grøstl-512 P & Q permutations interleaved 12355 ALUTs 7142 Mbit/s 202.3 MHz JH-256 3525 ALUTs 4661 Mbit/s 387.8 MHz JH-512 3709 ALUTs 4696 Mbit/s 390.6 MHz Keccak(-256) 4213 ALUTs 12393 Mbit/s 273.4 MHz Keccak(-512) 3979 ALUTs 7310 Mbit/s 304.6 MHz Skein-512-256 4 Threefish rounds unrolled 4645 ALUTs 2503 Mbit/s 92.9 MHz Skein-512-512 4 Threefish rounds unrolled 4794 ALUTs 2434 Mbit/s 90.3 MHz







Results are without wrapper for long messages.









Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 1118 slices 835 Mbit/s 118.06 MHz BLAKE-512 1718 slices 1137 Mbit/s 90.91 MHz Grøstl-256 2391 slices 3242 Mbit/s 101.32 MHz Grøstl-512 4845 slices 3619 Mbit/s 123.4 MHz JH 1291 slices 1641 Mbit/s 250.13 MHz Keccak(-224) 1117 slices 5915 Mbit/s 189 MHz Keccak(-256) 1117 slices 6263 Mbit/s 189 MHz Keccak(-384) 1117 slices 8190 Mbit/s 189 MHz Keccak(-512) 1117 slices 8518 Mbit/s 189 MHz Skein-512 1786 slices 1945 Mbit/s 83.65 MHz







Results include throughputs without interface overhead.









Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 1660 slices 1911 Mbit/s 115 MHz Grøstl-256 2616 slices 7885 Mbit/s 154 MHz JH-256 2661 slices 2231 Mbit/s 201 MHz Keccak(-256) 1433 slices 8397 Mbit/s 205 MHz Skein-256-256 854 slices 1402 Mbit/s 115 MHz







Same implementations as in Matsuo et al. [33] implemented on STM 90 nm technology.









Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 37 kGates 4763 Mbit/s 286.5 MHz Grøstl-256 139.1 kGates 17297 Mbit/s 337.8 MHz JH-256 54.6 kGates 8471 Mbit/s 763.4 MHz Keccak(-256) 50.7 kGates 33333 Mbit/s 781.3 MHz Skein-256-256 43.1 kGates 3295 Mbit/s 270.3 MHz







Results are post-P&R and include throughputs without interface overhead.









Hash Function Name Impl. Details Size Throughput Clock Frequency BLAKE-256 43.52 kGates 3318 Mbit/s 200 MHz Grøstl-256 110.11 kGates 9606 Mbit/s 188 MHz JH-256 62.42 kGates 4334 Mbit/s 391 MHz Keccak(-256) 47.43 kGates 15457 Mbit/s 377 MHz Skein-256-256 40.9 kGates 1941 Mbit/s 159 MHz







7 References

[1] Jean-Philippe Aumasson, Luca Henzen, Willi Meier, and Raphael C.-W. Phan. SHA-3 proposal BLAKE (version 1.3). Available online at http://131002.net/blake/blake.pdf.

[2] A. H. Namin and M. A. Hasan. Hardware Implementation of the Compression Function for Selected SHA-3 Candidates. Available online at http://www.vlsi.uwaterloo.ca/~ahasan/hasan_report.html.

[3] Kazuyuki Kobayashi, Jun Ikegami, Shin'ichiro Matsuo, Kazuo Sakiyama, and Kazuo Ohta. Evaluation of Hardware Performance for the SHA-3 Candidates Using SASEBO-GII. IACR Eprint report 2010/010. Available online at http://eprint.iacr.org/2010/010.pdf.

[4] Brian Baldwin, Andrew Byrne, Mark Hamilton, Neil Hanley, Robert P. McEvoy, Weibo Pan, and William P. Marnane. FPGA Implementations of SHA-3 Candidates: CubeHash, Grøstl, LANE, Shabal and Spectral Hash. IACR Eprint report 2009/342. Available online at http://eprint.iacr.org/2009/342.pdf.

[5] Liang Lu, Maire O'Neil, and Earl Swartzlander. Hardware Evaluation of SHA-3 Hash Function Candidate ECHO. Presentation at the Clauce Shannon Institute Workshop on Coding and Cryptography 2009. Slides available online at http://www.ucc.ie/en/crypto/CodingandCryptographyWorkshop/TheClaudeShannonWorkshoponCodingCryptography2009/DocumentFile,75649,en.pdf.

[6] Bernhard Jungk, Steffen Reith, and Jürgen Apfelbeck. On Optimized FPGA Implementations of the SHA-3 Candidate Grøstl. IACR Eprint report 2009/206. Available online at http://eprint.iacr.org/2009/206.pdf.

[7] Praveen Gauravaram, Lars R. Knudsen, Krystian Matusievicz, Florian Mendel, Christian Rechberger, Martin Schläffer, and Søren S. Thomsen. Grøstl - a SHA-3 candidate (October 31, 2008). Available online at http://www.groestl.info/Groestl.pdf.

[8] Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles van Assche. KECCAK sponge function family main document (Version 1.2, April 23, 2009). Available online at http://keccak.noekeon.org/Keccak-main-1.2.pdf.

[9] Joachim Strömbergson. Implementation of the Keccak Hash Function in FPGA Devices. Available online at http://www.strombergson.com/files/Keccak_in_FPGAs.pdf.

[10] Romain Feron and Julien Francq. FPGA Implementation of Shabal: Our First Results (Version 2.0, February 19, 2010). Available online at http://www.shabal.com/wp-content/uploads/2010/03/FPGA-Implementation-of-Shabal-First-ResultsV2.0.pdf.

[11] Men Long. Implementing Skein Hash Function on Xilinx Virtex-5 FPGA Platform (Version 0.7, February 2, 2009). Available online at http://www.skein-hash.info/sites/default/files/skein_fpga.pdf.

[12] Stefan Tillich. Hardware Implementation of the SHA-3 Candidate Skein. IACR Eprint report 2009/159. Available online at http://eprint.iacr.org/2009/159.pdf.

[13] Jean-Luc Beuchat, Eiji Okamoto, and Teppei Yamazaki. Compact Implementations of BLAKE-32 and BLAKE-64 on FPGA. IACR Eprint report 2010/173. Available online at http://eprint.iacr.org/2010/173.pdf.

[14] Stefan Tillich, Martin Feldhofer, Mario Kirschbaum, Thomas Plos, Jörn-Marc Schmidt, and Alexander Szekely. High-Speed Hardware Implementations of BLAKE, Blue Midnight Wish, CubeHash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein. IACR Eprint report 2009/510. Available online at http://eprint.iacr.org/2009/510.pdf.

[15] Shai Halevi, William E. Hall, and Charanjit S. Jutla. The Hash Function Fugue (October 30, 2008). Available online at http://domino.research.ibm.com/comm/research_projects.nsf/pages/fugue.index.html/$FILE/NIST-submission-Oct08-fugue.pdf.

[16] Junfeng Fan. Hardware Evaluation of The Hash Function Hamsi. Available online at http://homes.esat.kuleuven.be/~okucuk/hamsi/implementations.html.

[17] Miroslav Knezevic and Ingrid Verbeiwhede. Hardware Evaluation of the Luffa Hash Family. 4th Workshop on Embedded Systems Security 2009. Available online at http://www.cosic.esat.kuleuven.be/publications/article-1282.pdf.

[18] Stefan Tillich, Martin Feldhofer, Wolfgang Issovits, Thomas Kern, Hermann Kureck, Michael Mühlberghuber, Georg Neubauer, Andreas Reiter, Armin Köfler, and Mathias Mayrhofer. Compact Hardware Implementations of the SHA-3 Candidates ARIRANG, BLAKE, Grøstl, and Skein. IACR Eprint report 2009/349. Available online at http://eprint.iacr.org/2009/349.pdf.

[20] Markus Bernet, Luca Henzen, Hubert Kaeslin, Norbert Felber, and Wolfgang Fichtner. Hardware Implementations of the SHA-3 Candidates Shabal and CubeHash. 52nd IEEE International Midwest Symposium on Circuits and Systems, 2009. Available online at http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5236043.

[21] Michel Kinsy and Richard Uhler. SHA-3: FPGA Implementation of ESSENCE and ECHO Hash Algorithm Candidates Using Bluespec. Available online at http://csg.csail.mit.edu/6.375/6_375_2009_www/projects/group1_report.pdf.

[22] Bernhard Jungk and Steffen Reith. On FPGA-based implementations of Grøstl. IACR Eprint report 2010/260. Available online at http://eprint.iacr.org/2010/260.pdf.

[23] Jérémie Detrey, Pierre Gaudry, and Karim Khalfallah. A Low-Area yet Performant FPGA Implementation of Shabal. IACR Eprint report 2010/292. Available online at http://eprint.iacr.org/2010/292.pdf.

[24] Jean-Luc Beuchat, Eiji Okamoto, and Teppei Yamazaki. A Compact FPGA Implementation of the SHA-3 Candidate ECHO. IACR Eprint report 2010/364. Available online at http://eprint.iacr.org/2010/364.pdf.

[25] Wim Ramakers and Hans Narinx. Implementation and evaluation of SHA-3 candidates on FPGA. Extended abstract of Master Thesis "Implementatie en Evaluatie van SHA-3-Kandidaten op FPGA" (Dutch). Extended abstract available online at http://ehash.iaik.tugraz.at/uploads/1/12/Ramakers_Narinx2010ECHO-Hamsi-Luffa_ExtendedAbstract_ENGLISH.pdf. Full thesis available online at http://ehash.iaik.tugraz.at/uploads/6/62/Ramakers_Narinx2010ECHO-Hamsi-Luffa_Thesis_DUTCH.pdf.

[26] Julien Francq and Céline Thuillet. Unfolding Method for Shabal on Virtex-5 FPGAs: Concrete Results. IACR Eprint report 2010/406. Available online at http://eprint.iacr.org/2010/406.pdf.

[27] Shugo Mikami, Nagamasa Mizushima, Setsuko Nakamura, and Dai Watanabe. A Compact Hardware Implementation of SHA-3 Candidate Luffa (version 20101105). Available online at http://www.sdl.hitachi.co.jp/crypto/luffa/ACompactHardwareImplementationOfSHA-3CandidateLuffa_20101105.pdf.

[28] Imed Mabrouk and Ryad Benadjila. ECHO webpage (hardware subpage). http://crypto.rd.francetelecom.com/ECHO/hard/.

[29] Luca Henzen, Pietro Gendotti, Patrice Guillet, Enrico Pargaetzi, Martin Zoller, and Frank K. Gürkaynak. Developing a Hardware Evaluation Method for SHA-3 Candidates. 12th International Workshop on Cryptographic Hardware and Embedded Systems (CHES), 2010. Available online at http://www.springerlink.com/content/g0115v3272156r06/.

[30] Ekawat Homsirikamol, Marcin Rogawski, and Kris Gaj. Comparing Hardware Performance of Fourteen Round Two SHA-3 Candidates Using FPGAs. IACR Eprint report 2010/445. Available online at http://eprint.iacr.org/2010/445.pdf.

[31] Brian Baldwin, Neil Hanley, Mark Hamilton, Liang Lu, Andrew Byrne, Maire O'Neill, and William P. Marnane. FPGA Implementations of the Round Two SHA-3 Candidates. Second SHA-3 Candidate Conference, 2010. Available online at http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/BALDWIN_FPGA_SHA3.pdf.

[32] Mohamed El Hadedy, Martin Margala, Danilo Gligoroski, and Svein J. Knapskog. Resource-Efficient Implementation of Blue Midnight Wish-256 Hash Function on Xilinx FPGA Platform. Second SHA-3 Candidate Conference, 2010. Available online at http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/El-Hadedy_SmallSizeFPGA-BMW256.pdf.

[33] Shin'ichiro Matsuo, Miroslav Knezevic, Patrick Schaumont, Ingrid Verbauwhede, Akashi Satoh, Kazuo Sakiyama, and Kazuo Ota. How Can We Conduct "Fair and Consistent" Hardware Evaluation for SHA-3 Candidate? Second SHA-3 Candidate Conference, 2010. Available online at http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/MATSUO_SHA-3_Criteria_Hardware_revised.pdf.

[34] Abdulkadir Akin, Aydin Aysu, Onur Can Ulusel, and Erkay Savas. Efficient Hardware Implementations of High Throughput SHA-3 Candidates Keccak, Luffa and Blue Midnight Wish for Single- and Multi-Message Hashing. Second SHA-3 Candidate Conference, 2010. Available online at http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SAVAS_SHA3_NIST_final.pdf.

[35] Xu Guo, Sinan Huang, Leyla Nazhandali, and Patrick Schaumont. Fair and Comprehensive Performance Evaluation of 14 Second Round SHA-3 ASIC Implementations. Second SHA-3 Candidate Conference, 2010. Available online at http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SCHAUMONT_SHA3.pdf.

[36] Jesse Walker, Farhana Sheikh, Sanu K. Mathew, and Ram Krishnamurthy. A Skein-512 Hardware Implementation. Available online at http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/WALKER_skein-intel-hwd.pdf.

[38] Akashi Satoh, Toshihiro Katashita, Takeshi Sugawara, Naofumi Homma, and Takafumi Aoki. Hardware Implementations of Hash Function Luffa. IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), 2010. Available online at http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=5513102&tag=1.

[39] RCIS webpage (Other ASIC Implementations). http://staff.aist.go.jp/akashi.satoh/SASEBO/en/sha3/others.html.

[40] Luca Henzen, Jean-Philippe Aumasson, Willi Meier, and Raphael C.-W. Phan. VLSI Characterization of the Cryptographic Hash Function BLAKE. IEEE T VLSI, 2010. Available online at http://131002.net/data/papers/HAMP10.pdf.

[41] Mohamed El Hadedy, Danilo Gligoroski, and Svein J. Knapskog. Single Core Implementation of Blue Midnight Wish Hash Function on VIRTEX 5 Platform. Available online at http://people.item.ntnu.no/~danilog/Hash/BMW-SecondRound/SmallSizeFPGA-BMWOct2010.pdf.