Device and method for binary flag determination

Abstract

Embodiments of the present disclosure relate to apparatuses and methods for binary flag determination. An exemplary method for determining a carry digit indicator bit of first binary data includes steps for processing the first binary data to be masked by a masking operation and does not include any processing steps of the first binary data.

Description

[0001] Cross - Reference to Related Applications

[0002] This application claims the benefit of French Provisional Application No. 1911347, filed on October 11, 2019, which is incorporated herein by reference. Technical Field

[0003] The present disclosure generally relates to electronic systems and circuits, and more particularly to processors and associated methods. The present disclosure more particularly relates to processors configured to process masked data and methods of operating the same. Background Art

[0004] A processor is an electronic component present in many electronic systems and circuits, and is configured to process data by executing commands and instructions from a computer program.

[0005] In some cases, a processor may have to process confidential data. Such confidential data is typically encrypted, for example, by masking.

[0006] There is a desire to be able to at least partially improve certain aspects of known processors. Summary of the Invention

[0007] There is a need in the art for more reliable processors.

[0008] There is a need in the art for processors configured to process masked data.

[0009] There is a need in the art for processors configured to process masked data without performing any revealing operations on such data.

[0010] One embodiment addresses all or some of the disadvantages of known processors.

[0011] One embodiment provides a method for determining a carry digit indicator bit of first binary data, including steps for processing binary data masked by a masking operation and not including any processing steps of the first data.

[0012] According to one embodiment, the first data is not revealed during the determination.

[0013] According to one embodiment, the first data is obtained by performing an addition of a second masked data and a third masked data.

[0014] According to one embodiment, the masked data is masked by adding a mask to the data to be masked.

[0015] According to one embodiment, the carry digit indicator bit is provided by the following equivalent formula:

[0016] Flag_C = CD1_M xor CD2_M xor CADD_D_M xor CADD_M xor CD_MD

[0017] Flag_C = CD1_M + CD2_M + CADD_D_M - CADD_M - CD_M

[0018] Where:

[0019] xor represents the exclusive - or logical operation;

[0020] “+” represents the addition operation;

[0021] “-” represents the subtraction operation;

[0022] CD1_M represents the carry digit that can occur during the masking operation for obtaining the second masked data;

[0023] CD2_M represents the carry digit that can occur during the masking operation for obtaining the third masked data;

[0024] CADD_D_M represents the carry digit that can occur during the addition operation of the second masked data and the third masked data;

[0025] CADD_MD represents the carry digit that can occur during the addition operation of the second mask and the third mask; and

[0026] CD_M represents the carry digit that can occur during the masking operation for obtaining the first masked data.

[0027] Another embodiment provides a circuit configured to perform the foregoing method.

[0028] According to one embodiment, the circuit includes three comparators.

[0029] According to one embodiment, the circuit further includes a circuit implementing a logic gate of the exclusive - or type.

[0030] According to one embodiment, the circuit implementing the logic gate of the exclusive - or type includes five inputs. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In the following description of specific embodiments given by way of example and not limitation, reference will be made to the accompanying drawings in which the above - mentioned and other features and advantages will be described in detail, where:

[0032] Figure 1 Schematically and in the form of a block diagram, a part of the architecture of the processor is shown;

[0033] Figure 2 Schematically and in the form of a block diagram, it is shown thatFigure 1 An embodiment of the circuit of a processor;

[0034] Figure 3 is schematically and in the form of a block diagram Figure 1 Another embodiment of the circuit of a processor; and

[0035] Figure 4 is schematically and in the form of a block diagram Figure 1 A detailed example of an embodiment of a processor. Detailed Description

[0036] In the various figures, like features have been designated by like reference numerals. In particular, structural and / or functional features common between the various embodiments may have the same reference numerals and may be arranged with the same structural, dimensional, and material characteristics.

[0037] For clarity, only the operations and elements useful for understanding the embodiments described herein are illustrated and described in detail. The complete operation of the processor will not be disclosed herein, and the embodiments disclosed below are compatible with most of the operation methods in the usual operation method of the processor.

[0038] Unless otherwise indicated, when referring to two elements connected together, this means a direct connection without any intermediate element other than a conductor; and when referring to two elements coupled together, this means that the two elements may be connected or they may be coupled via one or more other elements.

[0039] In the following disclosure, unless otherwise indicated, when referring to absolute position modifiers (such as the terms "front", "rear", "top", "bottom", "left", "right", etc.) or relative position modifiers (such as, the terms "above", "below", "upper", "lower", etc.), or when referring to orientation modifiers (such as, "horizontal", "vertical", etc.), it refers to the orientation shown in the figure.

[0040] Unless otherwise specified, the expressions "about", "approximate", "substantially", and "approximately" mean within 10%, preferably within 5%.

[0041] In the remainder of this disclosure, the data is binary data, that is, each data corresponds to a binary word including at least one bit (preferably including more than one bit).

[0042] Figure 1 is schematically and in the form of a block diagram a part of the architecture of an embodiment of a processor 10 (CPU).

[0043] Processor 10 is a processor configured to process masked data and its mask. Processor 10 includes an Arithmetic and Logic Unit 100 (ALU), which is also configured to process masked data and its mask. More specifically, processor 100 receives masked input data Data_In and its mask Mask_In as inputs, and provides masked output data Data_Out and its mask Mask_Out as outputs.

[0044] By implementing arithmetic type masking, the input data Data_In and the output data Data_Out are respectively masked using the masks Mask_In and Mask_Out. In the case described here, arithmetic masking is an additional masking that adds the mask to the data to be masked. The mask and the data to be masked are binary words of equal size. More specifically, the masked data A_M is given by the following formula:

[0045] A_M = (A + MA) mod 2 n

[0046] Where:

[0047] A represents the data to be masked;

[0048] MA represents the mask;

[0049] “+” represents an addition operation;

[0050] “mod” represents a modulo operation; and

[0051] n is the number of bits that make up the data A to be masked, the mask MA, and the masked data A_M.

[0052] Unit 100 is configured to further receive an operation code Opcode, which interprets the processing to be applied to pairs that each include the masked input data Data_In and its mask Mask_In. The operation code Opcode indicates different operations or a set of different operations to be applied to the masked input data Data_In and its mask Mask_In in order to obtain the masked output data Data_Out and its mask Mask_Out. More specifically, the operation code is a set of instructions that define arithmetic and / or logical operations or a set of arithmetic and / or logical operations to be applied to the input data Data_In and its mask Mask_In.

[0053] To implement these operation codes, unit 100 includes one or more (preferably multiple) circuits 101(OP) configured to implement various arithmetic or logical operations. Circuit 101 is configured to be selected and used according to a set of instructions defined by the operation code Opcode, which is received by unit 100. As an example, circuit 101 is configured to implement arithmetic operations (such as addition, multiplication, complementary calculation, etc.) and / or logical operations (such as AND operation, OR operation, exclusive OR operation (XOR), etc.). Multiple circuits 101 can be implemented in parallel or in series to execute the operation code Opcode. Therefore, each circuit 101 is configured to receive masked input data Data_In and its mask Mask_In and / or intermediate masked output data Data_Int and its mask Mask_Int corresponding to the output data of other circuits 101 and their masks.

[0054] Unit 100 also includes a circuit 103(FL) for generating indicator bits or flag bits. Each circuit 103 is coupled to one of the circuits 101 in circuit 101. Circuit 103 is configured to receive masked data (received by circuit 101 as input) and its mask, and receive the data provided by circuit 101 as output and its mask as input. Therefore, in the example disclosed herein, circuit 103 is configured to receive masked data Data_In and its mask Mask_In (not shown in Figure 1 ), and receive intermediate output data Data_Int and its mask Mask_Int. Circuit 103 provides an indicator bit as output. More specifically, circuit 103 is configured to provide: Figure 1

[0055] Symbol indicator bit Flag_N;

[0056] Carry digit indicator bit Flag_C;

[0057] Indicator bit Flag_Z for null value; and

[0058] Overflow indicator bit Flag_V.

[0059] According to a variant, some parts of circuit 103 of unit 100 can be shared by multiple circuits 101.

[0060] When the data calculated from it is negative, the symbol indicator bit Flag_N is a bit equal to "1", and otherwise equal to "0". Incorporated Figure 2 discloses an exemplary circuit configured to calculate the indicator bit Flag_N.

[0061] ​When the data from which it is calculated includes a carry digit, the carry digit indicator bit Flag_C is the bit equal to "1", and otherwise equal to "0". In combination with Figure 3 An exemplary circuit configured to calculate the carry digit indicator bit Flag_C is disclosed.

[0062] When the data from which it is calculated is equal to zero, the null value indicator bit Flag_Z is the bit equal to "1", and otherwise equal to "0".

[0063] When the data from which it is calculated is a number that is too large to be represented by the number of bits of the data from which it is calculated, the overflow indicator bit Flag_V is the bit equal to "1", otherwise equal to "0".

[0064] According to one embodiment, the indicator bits Flag_N, Flag_C, Flag_Z, and Flag_V are generated each time the circuit 101 is used. According to a variant, for several uses of the circuit 101 or another type of circuit 101, only some of the indicator bits Flag_N, Flag_C, Flag_Z, and Flag_V are generated.

[0065] Figure 2 Schematically and in the form of a block diagram, an embodiment of the circuit 20(Flag_N) is shown, which is configured to calculate the Figure 1 symbol indicator bit Flag_N as disclosed.

[0066] The circuit 20 receives the masked data B_M and its mask MB as inputs, and the data B_M is obtained from the data B. The data B_M and the mask MB are binary words including n bits, where n is a natural integer. The following notations will be used hereinafter:

[0067] P[m;k] specifies a set of bits from the order k to the order m of the binary word P, where m and k are natural integers less than or equal to n; and

[0068] P[m] specifies the bit of the order m of the binary word P.

[0069] As disclosed with respect to Figure 1 when the data from which it is calculated (i.e., the data B here) represents a negative number, the symbol indicator bit Flag_N is the bit equal to "1", and otherwise equal to "0". By convention, the most significant bit of the binary word representing a negative number is equal to "1". According to one embodiment, when the following conditions are met, the masked data B_M is negative:

[0070] (B_M[n - 1;0]+CB_M*2 n )≥(MB[n - 1;0]+2 n-1 )

[0071] Among them, CB_M represents the carry digit that can occur during the masking operation to obtain the masked data B_M.

[0072] When the following conditions are met, the carry digit CB_M is equal to "1", and otherwise equal to "0":

[0073] B_M[n - 1;0] < MB[n - 1;0]

[0074] Combined with Figure 2 One advantage of the disclosed circuit is that it enables the provision of the sign indicator bit Flag_N of the masked data without disclosing the data.

[0075] Figure 3 Schematically and in the form of a block diagram, an embodiment of the circuit 30 (Flag_C) is shown. The circuit 30 (Flag_C) is configured to calculate regarding Figure 1 the disclosed carry digit indicator bit Flag_C.

[0076] The circuit 30 more specifically belongs to the circuit combined with Figure 1 the disclosed circuit 103. This circuit 30 is associated with the circuit 101 that performs an addition operation between two masked data. More specifically, the output data D_M of the circuit 101 and its mask MD are given by the following formula:

[0077]

[0078] Where:

[0079] D1_M and D2_M represent the two data D1 and D2 after the masking operation; and MD1 and MD2 represent the masks of the masked data D1_M and D2_M.

[0080] As disclosed regarding Figure 1 When the calculated data includes a carry digit, the carry digit indicator bit Flag_C is the bit equal to "1", and otherwise equal to "0". The carry digit indicator bit Flag_C is more specifically given by the following equivalent formula:

[0081] Flag_C = CD1_M xor CD2_M xor CADD_D_M xor CADD_MD xor CD_M

[0082] Flag_C = CD1_M + CD2_M + CADD_D_M - CADD_MD - CD_M

[0083] Where:

[0084] xor represents the exclusive OR logical operation;

[0085] CD1_M represents the carry digit that can occur during an addition masking operation that uses mask MD1 to obtain masked data D1_M;

[0086] CD2_M represents the carry digit that can occur during an addition masking operation that uses mask MD2 to obtain masked data D2_M;

[0087] CADD_D_M represents the carry digit that can occur during an addition operation between two masked data D1_M and D2_M;

[0088] CADD_MD represents the carry digit that can occur during an addition operation between two masks MD1 and MD2; and

[0089] CD_M represents the carry digit that can occur during an addition masking operation that uses mask MD to obtain masked data D_M.

[0090] The carry digits CD1_M, CD2_M, and CD_M are obtained by comparing their respective associated masked data with their masks in the same way as the carry digit CB_M is obtained as disclosed in conjunction with Figure 2 The carry digit CADD_D_M is equal to "1" when the following condition is satisfied:

[0091] D_M[n - 1;0] < (D1_M[n - 1;0] + D2_M[n - 1;0]) mod 2

[0092] Otherwise, the carry digit CADD_D_M is equal to "0". The carry digit CADD_D_M is also the bit of order n obtained by the addition of the binary words D1_M[n - 1;0] and D2_M[n - 1;0]. n

[0093] The carry digit CADD_MD is equal to "1" when the following condition is satisfied:

[0094] MD[n - 1;0] < (MD1[n - 1;0] + MD2[n - 1;0]) mod 2

[0095] Otherwise, the carry digit CADD_MD is equal to "0". The carry digit CADD_MD is also the bit of order n obtained by the addition of the binary words MD1[n - 1;0] and MD2[n - 1;0]. n

[0096] The carry digit CADD_MD is equal to "0". The carry digit CADD_MD is also the bit of order n obtained by the addition of the binary words MD1[n - 1;0] and MD2[n - 1;0].

[0097] In conjunction with Figure 3One advantage of the disclosed circuit 30 is that it calculates the carry digit indicator bit Flag_C without using any disclosure operations on the masked data D_M, D1_M, and D2_M.

[0098] Figure 4 A more detailed example of an embodiment of circuit 103 associated with circuit 101 is schematically shown in block diagram form.

[0099] Circuit 101 is a circuit configured to perform an addition or subtraction operation between two masked data E_M and F_M and their masks ME and MF to provide masked data G_M and its mask MG as outputs. The masked data E_M, F_M, G_M are the results of additive masking of data E, F, G with masks ME, MF, MG, respectively. In the case of addition, the masked data G_M and its mask MG are given by the following formula (A):

[0100] (A)

[0101] In the case of subtraction, the masked data G_M and its mask MG are given by the following formula (B):

[0102] (B)

[0103] where!X specifies the one's complement of the binary word X.

[0104] Circuit 101 includes two adder circuits 1011 and 1012, and includes two inverter circuits 1013 and 1014. As an example, inverter circuits 1013 and 1014 are exclusive OR logic circuits that are used as inverters in the case of a subtraction operation or as followers in the case of an addition operation.

[0105] The bit-by-bit adder circuit 1011 is a circuit that includes at least three inputs and at least two outputs. Circuit 1011 receives mask ME, a modified mask MF' from mask M, and operation information ADD_SUB as inputs. As an example, the operation information ADD_SUB is equal to "0" in the case of addition and equal to "1" in the case of subtraction. Circuit 1011 provides mask MG and carry digit C1011 as outputs.

[0106] The adder circuit 1012 is a circuit that includes at least three inputs and at least two outputs. Circuit 1012 receives masked data E_M, a modified masked data F_M' from masked data F_M, and operation information ADD_SUB as inputs. Circuit 1012 provides mask MG and carry digit C1012 as outputs.

[0107] The inverter circuit 1013 enables the mask MF to be modified to the mask MF' according to the operation information ADD_SUB.

[0108] The inverter circuit 1014 enables the masked data F_M to be modified to the masked data F_M' according to the operation information ADD_SUB.

[0109] The operation of the circuit 101 is as follows. When an addition operation is requested, the operation information ADD_SUB is equal to "0", and when a subtraction operation is requested, the operation information ADD_SUB is equal to "1".

[0110] When an addition operation is requested, the inverter circuits 1013 and 1014 see that the operation information ADD_SUB is equal to "0", which indicates to them that they are not required to invert the data they receive as input. Then, the circuits 1013 and 1014 provide the mask MF' equal to the mask MF and the masked data F_M' equal to the masked data F_M as outputs. The adder circuits 1011 and 1012 take the data they receive as input and then provide the mask MG and the masked data G_M as outputs according to the formula (A) given above.

[0111] When a subtraction operation is requested, the inverter circuits 1013 and 1014 see that the operation information ADD_SUB is equal to "1", which indicates to them that the calculation of the complement of the data they receive as input is requested. Then, the circuits 1013 and 1014 provide the mask MF' equal to the mask MF and the masked data F_M' equal to the masked data F_M as outputs. The adder circuits 1011 and 1012 and the data they receive as input, and then provide the mask MG and the masked data G_M as outputs according to the formula (B) given above.

[0112] The circuit 103 is adapted to provide the indicator bits Flag_V, Flag_C, Flag_N, and Flag_Z in combination Figure 1 disclosed. The circuit 103 receives as input:

[0113] the mask ME;

[0114] the masked data E_M;

[0115] the mask MF;

[0116] the masked data F_M;

[0117] the operation information ADD_SUB;

[0118] the carry digit C1011 from the adder circuit 1011;

[0119] the carry digit C1012 from the adder circuit 1012;

[0120] a mask MG; and

[0121] masked data G_M.

[0122] The circuit 103 includes:

[0123] three comparator circuits 1031 (COMP1), 1032 (COMP2), and 1033 (COMP3);

[0124] two circuits 1034 and 1035 that implement an AND-type logic gate;

[0125] a circuit 1036 that implements an OR-type logic gate; and

[0126] a circuit 1037 that implements an exclusive-OR type logic gate.

[0127] The comparator circuit 1031 receives the mask ME and the masked data E_M as inputs and provides a binary word CE_M as an output, where the binary word CE_M represents a carry digit that can occur during the masking operation that results in the masked data E_M. Additionally, the comparator circuit 1031 provides a sign indicator bit FlagE_N as an output, and the sign indicator bit FlagE_N indicates the sign of the data E corresponding to the masked data E_M revealed using the mask.

[0128] The comparator circuit 1032 receives the mask MF, the masked data F_M, and the operation information ADD_SUB as inputs and provides a binary word CF_M as an output. In the case of addition, the binary word CF_M represents a carry digit that can occur during the masking operation that results in the masked data F_M, and in the case of subtraction, it represents the inversion of the carry digit that can occur during the masking operation that results in the masked data F_M. Additionally, the comparator circuit 1032 provides a sign indicator bit FlagF_N as an output. In the case of addition, the sign indicator bit FlagF_N indicates the sign of the data F corresponding to the masked data F_M revealed using the mask MF, or in the case of subtraction, it represents the inversion of the sign of F.

[0129] Comparator circuit 1033 receives mask MG and masked data G_M as inputs and provides binary word CG_M as output, where binary word CG_M represents the carry digits that can occur during the masking operation of the masked data G_M. Additionally, comparator circuit 1033 provides sign indicator bit FlagG_N as output, where sign indicator bit FlagG_N indicates the sign of data G corresponding to the masked data G_M revealed by [sic] using mask MG, and provides null indicator bit FlagG_Z as output, where null indicator bit FlagG_Z indicates whether data G is equal to zero. Sign indicator bit Flag_N is equal to indicator bit FlagG_N. Null indicator bit Flag_Z is equal to indicator bit FlagG_Z.

[0130] Circuit 1034 is a circuit implementing a logic gate of the "AND" type, which includes one non-inverting input and two inverting inputs. Circuit 1034 receives sign indicator bit FlagG_N as input on its non-inverting input and receives sign indicator bits FlagE_N and FlagG_N as inputs on its two inverting inputs. Circuit 1034 provides data Flag_V4 as output.

[0131] Circuit 1035 is a circuit implementing a logic gate of the "AND" type. Circuit 1035 includes two non-inverting inputs and one inverting input. Circuit 1035 receives sign indicator bits FlagE_N and FlagF_N as inputs on its non-inverting inputs and receives sign indicator bit FlagG_N as input on its inverting input. Circuit 1035 provides data Flag_V5 as output.

[0132] Circuit 1036 is a circuit implementing an "OR" logic gate with two inputs. Circuit 1036 receives the outputs of circuits 1035 and 1036 as inputs, namely data Flag_V4 and Flag_V5. Circuit 1036 provides overflow indicator bit Flag_V as output.

[0133] Circuit 1037 is a circuit implementing an exclusive-OR type logic gate with five non-inverting inputs. Circuit 1037 receives carry digits CE_M, CG_M, C1011, and C1012 as inputs. Circuit 1037 provides carry digit indicator bit Flag_C as output.

[0134] Combined Figure 4 One advantage of the disclosed circuit 103 is that it does not use a revealing operation to calculate indicator bits Flag_V, Flag_C, Flag_N, and Flag_Z.

[0135] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these embodiments can be combined, and other variations will be readily apparent to those skilled in the art.

[0136] Finally, based on the functional descriptions provided above, the actual implementation of the embodiments and variations described herein is within the capabilities of those skilled in the art.

Claims

1. A method of operating an Arithmetic and Logic Unit (ALU) circuit in a Central Processing Unit (CPU), the method comprising: Adding second masked data and third masked data by an arithmetic operation circuit in the ALU circuit to obtain first masked binary data; Adding a second mask corresponding to the second masked data and a third mask corresponding to the third masked data by the arithmetic operation circuit to obtain a first mask corresponding to the first masked binary data; Providing the first masked binary data and the first mask by the arithmetic operation circuit to a flag generator circuit in the ALU; Comparing the first masked binary data and the first mask by a first comparator circuit in the flag generator circuit; And Determining a carry digit indicator bit of the first masked binary data by an Exclusive - OR (XOR) logic gate in the flag generator circuit without disclosing the first masked binary data, according to one of the following formulas: Flag_C = CD1_M xor CD2_M xor CADD_D_M xor CADD_MD xor CD_M; or Flag_C = CD1_M + CD2_M + CADD_D_M - CADD_MD - CD_M where: Flag_C represents the carry digit indicator bit; "xor” represents an Exclusive - OR logic operation; "+” represents an addition operation; "-” represents a subtraction operation; CD1_M represents a first carry digit that can occur during a masking operation for obtaining the second masked data; CD2_M represents a second carry digit that can occur during a masking operation for obtaining the third masked data; CADD_D_M represents a third carry digit that can occur during the addition of the second masked data and the third masked data; CADD_MD represents a fourth carry digit that can occur during the addition of the second mask and the third mask; and CD_M represents a fifth carry digit that can occur during a masking operation for obtaining the first masked binary data.

2. The method according to claim 1 further comprises: Keeping the first masked binary data masked by the arithmetic operation circuit.

3. The method according to claim 1, wherein the first masked binary data represents the sum of a first unmasked binary data and the first mask.

4. The method according to claim 1 further comprises: Setting the carry digit indicator bit to "1” by the ALU circuit to indicate the presence of a carry digit.

5. The method according to claim 1, further comprising receiving an operation code by the arithmetic operation circuit and the flag generator circuit, the operation code indicating one or more operations to be performed.

6. The method according to claim 1, further comprising: Providing the first masked binary data, the first mask, and the determined carry digit indicator bit by the ALU circuit as an output.

7. The method according to claim 1, further comprising: The second masked data and the second mask corresponding to the second masked data are compared by a second comparator circuit in the flag generator circuit to provide one input to the XOR logic gate.

8. The method according to claim 1 further comprises: The third masked data, the third mask corresponding to the third masked data, and an add / subtract select bit are compared by a third comparator circuit in the flag generator circuit to provide one input to the XOR logic gate.

9. A first circuit, comprising: an arithmetic and logic unit (ALU) circuit, the ALU circuit comprising: an arithmetic operation circuit configured to: add the second masked data and the third masked data to obtain first masked binary data; process the first masked binary data; and provide the first masked binary data to a flag generator circuit; and the flag generator circuit, the flag generator circuit comprising: three comparator circuits configured to receive the second masked data and the third masked data, the second mask corresponding to the second masked data and the third mask corresponding to the third masked data, an add / subtract select bit, the first masked binary data, and a corresponding first mask for the first masked binary data; and an XOR logic gate coupled to the three comparator circuits and the arithmetic operation circuit and configured to determine a carry digit indicator bit of the first masked binary data by one of the following formulas without disclosing the first masked binary data: Flag_C = CD1_M xor CD2_M xor CADD_D_M xor CADD_MD xor CD_M; or Flag_C = CD1_M + CD2_M + CADD_D_M - CADD_MD - CD_M where: Flag_C represents the carry digit indicator bit; "xor” represents an exclusive OR logic operation; "+” represents an addition operation; "-” represents a subtraction operation; CD1_M represents a first carry digit that can occur during a masking operation to obtain the second masked data; CD2_M represents a second carry digit that can occur during a masking operation to obtain the third masked data; CADD_D_M represents a third carry digit that can occur during the addition of the second masked data and the third masked data; CADD_MD represents a fourth carry digit that can occur during the addition of the second mask and the third mask; and CD_M represents a fifth carry digit that can occur during a masking operation to obtain the first masked binary data.

10. The first circuit according to claim 9, wherein the ALU circuit is further configured to: keep the first masked binary data masked when determining the carry digit indicator bit.

11. The first circuit according to claim 9, wherein the ALU circuit is further configured to: obtain the first mask for the first masked binary data by performing an addition of the second mask for the second masked data and the third mask for the third masked data.

12. The first circuit according to claim 9, wherein the ALU circuit is further configured to: set the carry digit indicator bit to "1" to indicate the presence of a carry digit, or set the carry digit indicator bit to "0" to indicate the absence of the carry digit.

13. The first circuit according to claim 9, wherein the ALU circuit is further configured to receive an operation code that indicates one or more operations to be performed on the first masked binary data.

14. The first circuit according to claim 9, wherein the ALU circuit is further configured to: provide the first masked binary data, the first mask, and the determined carry digit indicator bit as an output.

15. An arithmetic and logic unit (ALU) circuit in a central processing unit (CPU), the ALU circuit comprising: five inputs of the ALU circuit in the CPU, configured to receive two masked data, the associated masks of the two masked data, and an add / subtract selection bit; an arithmetic operation circuit, coupled to the five inputs and configured to: add or subtract the two masked data according to the add / subtract selection bit, and add or subtract the associated masks of the two masked data, and generate a first masked data and the associated mask of the first masked data; three comparator circuits, coupled to the five inputs, the first masked data, and the associated mask of the first masked data; and an exclusive-OR logic gate, coupled to the outputs of the three comparator circuits and the output of the arithmetic operation circuit, and configured to: generate a carry digit indicator bit without revealing the two masked data or the first masked data.

Images