This paper presents a high-speed SHA-1 implementation. Unlike the conventional unfolding transformation, the proposed unfolding transformation technique makes the combined hash operation blocks to have almost the same delay overhead regardless of the unfolding factor. It can achieve high throughput of SHA-1 implementation by avoiding the performance degradation caused by the first hash computation. We demonstrate the proposed SHA-1 architecture on a FPGA chip. From the experimental results, the SHA-1 architecture with unfolding factor 5 shows 1.17 Gbps. The proposed SHA-1 architecture can achieve about 31% performance improvements compared to its counterparts. Thus, the proposed SHA-1 can be applicable for the security of the high-speed but compact mobile appliances.

This paper proposes a new algorithm for evaluating the number of chaining variable conditions (CVCs) in the selecting step of a disturbance vector (DV) for the analysis of SHA-1 collision search. The algorithm is constructed by combining four strategies, that can evaluate the number of CVCs more strictly compared with the previous approach. By using our method, we found some DVs that have 57 (or 59) essential CVCs for 1st (or 2nd) block in the case if we assume that we can modify messages up to step 25, which we have not confirmed the practicability of the assumption.

SFLASH was chosen as one of the final selection of the NESSIE project in 2003. It is one of the most efficient digital signature scheme and is suitable for implementation on memory-constrained devices such as smartcards. Side channel attacks (SCA) are a serious threat to memory-constrained devices. If the implementation on them is careless, the secret key may be revealed. In this paper, we experimentally analyze the effectiveness of a side channel attack on SFLASH. There are two different secret keys for SFLASH, namely the proper secret key (s,t) and the random seed Δ used for the hash function SHA-1. Whereas many papers discussed the security of (s,t), little is known about that of Δ. Steinwandt et al. proposed a theoretical DPA for finding Δ by observing the XOR operations. We propose another DPA on Δ using the addition operation modulo 232, and present an experimental result of the DPA. After obtaining the secret key Δ, the underlying problem of SFLASH can be reduced to the C* problem broken by Patarin. From our simulation, about 1408 pairs of messages and signatures are needed to break SFLASH. Consequently, SHA-1 must be carefully implemented in order to resist SCA on SFLASH.