Carry-save adder, secure adder, and method of performing secure carry-save addition

Abstract

This invention provides a carry-saving adder, a safe adder, and a method for performing safe carry-saving addition. The carry-saving adder includes: a first masking unit performing a first masking operation on first input data corresponding to the first masking value based on a first masking value and an input variable to obtain a first variable; a second masking unit performing a second masking operation on second input data corresponding to the second masking value based on the first masking value and a second masking value to obtain first masked data; and a third masking unit performing a third masking operation on third data corresponding to the third masking value based on the first masking value and a third masking value to obtain second masked data; and an XOR gate receiving the first masked data, the second masked data, and the first variable to provide a sum output of the first input data, the second input data, and the third input data.

Description

Technical Field

[0001] This invention relates to a safe adder, and more particularly to a carry-saving adder, a safe adder, and a method for performing safe carry-saving addition. Background Technology

[0002] Addition is a crucial function in many operations, hence adders are widely used in signal processing, data protection, and other applications. In recent years, encryption and decryption applications have placed great emphasis on protecting confidential information to prevent the analysis and theft of computational data. Generally, a common and effective protection mechanism is the XOR masking technique, which uses random numbers and critical data (or variables) within the encryption / decryption algorithm to perform an XOR operation, thus creating a mask protection mechanism. Therefore, encryption and decryption applications require a secure adder capable of performing secure addition operations.

[0003] Secure addition refers to the ability of a secure adder to perform addition operations without removing the mask of the input data, without revealing the original value of the input data during the calculation, and providing an output protected by the masked value. Secure adders capable of performing secure addition operations are widely used in various integrated circuits or electronic products applied to encryption and decryption operations.

[0004] Therefore, a safe adder with low manufacturing cost is needed. Summary of the Invention

[0005] This invention provides a carry-saving adder. The carry-saving adder includes a first mask unit, a second mask unit, a third mask unit, and a first XOR gate. The first mask unit performs a first mask operation on a first input data corresponding to the first mask value based on a first mask value and an input variable to obtain a first variable. The second mask unit performs a second mask operation on a second input data corresponding to the second mask value based on the first mask value and a second mask value to obtain first masked data. The third mask unit performs a third mask operation on a third input data corresponding to the third mask value based on the first mask value and a third mask value to obtain second masked data. The first XOR gate receives the first masked data, the second masked data, and the first variable to provide a sum output of the first input data, the second input data, and the third input data.

[0006] Furthermore, the present invention provides a secure adder. The secure adder includes a mask generator and a carry-saving adder. The mask generator includes a random number generator for randomly generating a first mask value, a second mask value, a third mask value, and an input variable. The carry-saving adder includes a first mask unit, a second mask unit, a third mask unit, and a first XOR gate. The first mask unit performs a first mask operation on a first input data corresponding to the first mask value based on the first mask value and the input variable to obtain a first variable. The second mask unit performs a second mask operation on a second input data corresponding to the second mask value based on the first mask value and the second mask value to obtain first masked data. The third mask unit performs a third mask operation on a third input data corresponding to the third mask value based on the first mask value and the third mask value to obtain second masked data. The first XOR gate receives the first masked data, the second masked data, and the first variable to provide a sum of the first input data, the second input data, and the third input data as an output.

[0007] Furthermore, the present invention provides a method for performing safe and economical carry addition. A first masking operation is performed on a first input data corresponding to the first masking value based on a first masking value and an input variable to obtain a first variable. A second masking operation is performed on a second input data corresponding to the second masking value based on the first masking value and a second masking value to obtain first masked data. A third masking operation is performed on a third input data corresponding to the third masking value based on the first masking value and a third masking value to obtain second masked data. An XOR gate is used to perform an XOR operation on the first masked data, the second masked data, and the first variable to provide a sum output of the first input data, the second input data, and the third input data. Attached Figure Description

[0008] Figure 1 This illustrates a secure adder according to some embodiments of the present invention.

[0009] Figure 2 The method for performing safe and economical carry addition according to some embodiments of the present invention is applicable to... Figure 1 A carry-saving adder.

[0010] Figure 3 Displays a truth table of the variable Exy according to some embodiments of the present invention.

[0011] Figure 4This displays a truth table of the original output value carry according to some embodiments of the present invention.

[0012] Figure 5 Displays a truth table for "masked data carry" as described in some embodiments of the present invention.

[0013] Figure 6A This diagram shows an exemplary circuit diagram of a carry-saving adder according to some embodiments of the present invention.

[0014] Figure 6B This diagram shows an exemplary circuit diagram of a carry-saving adder according to some embodiments of the present invention.

[0015] Figure 6C This diagram shows an exemplary circuit diagram of a carry-saving adder according to some embodiments of the present invention.

[0016] Icon labels:

[0017] 10: Busbar

[0018] 100: Safe Adder

[0019] 110: Bus Interface

[0020] 120: Mask generator

[0021] 122: Random Number Generator

[0022] 124: Mask Unit

[0023] 130: Selection Circuit

[0024] 131-137: Multiplexer

[0025] 140: Storage circuit

[0026] 141-147: Temporary Registers

[0027] 150, 150A-150C: Carry-saving adder

[0028] 160: Safety Preview Carry Adder

[0029] 310a-310c, 320a-320c, 330a-330c: Mask unit

[0030] 340: Logic Circuits

[0031] 352-356: AND gates

[0032] 360: or (OR) door

[0033] 410, 412-414, 422-424, 432-434: XOR gates

[0034] Cout: Carry-out output

[0035] Ctrl1: Control signal

[0036] carry: Original output value

[0037] "carry": Masked data

[0038] D1-D3: Intermediate Data

[0039] Exy, Eyz, Exz: variables

[0040] rx,ry,rz,rs: Mask values

[0041] rx_int, ry_int, rz_int, rx_ext, ry_ext, rz_ext: Mask values

[0042] Sout: Total output

[0043] Rsum_int, Rsum_ext: Mask values

[0044] R, Rsum, Rsum', Rsum”: variables

[0045] Rxy, Rxz, Ryz: variables

[0046] S210-S250: Steps

[0047] SEL: Selection signal

[0048] s': Sum of results

[0049] x, y, z: data

[0050] x',y',z': Input data

[0051] x'_int, y'_int, z'_int, x'_ext, y'_ext, z'_ext: Masked data

[0052] x”,y”,z”: Masked data Detailed Implementation

[0053] To make the above and other objects, features, and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings:

[0054] Figure 1A secure adder 100 according to some embodiments of the present invention is shown. The secure adder 100 may be implemented in an integrated circuit (not shown). Furthermore, the secure adder 100 can perform addition operations without disclosing operands and provides mask protection for the output result. In some embodiments, the secure adder 100 can perform data transfer with other circuitry (not shown) within the integrated circuit via bus 10. For example, a processor (not shown) can provide multiple input data (or operands) to the secure adder 100 via bus 10 to perform addition operations. In some embodiments, the input data may be unmasked raw data. In some embodiments, the input data may be masked data. Furthermore, after completing the addition operation, the secure adder 100 provides the masked operation result to the processor via bus 10.

[0055] exist Figure 1 In this circuit, the secure adder 100 includes a bus interface 110, a mask generator 120, a selection circuit 130, a storage circuit 140, a secure carry-save adder (CSA) 150, and a secure carry-lookahead adder (SCLA) 160. The bus interface 110 is coupled to the bus 10 and configured to provide various input data (e.g., operands, mask values, control signals, etc.) from the bus 10 to the mask generator 120, the selection circuit 130, and the secure carry-lookahead adder 160. Furthermore, after completing the addition operation, the bus interface 110 is configured to provide output data (e.g., the result of the operation) from the secure carry-lookahead adder 160 back to the bus 10.

[0056] Mask generator 120 includes a random number generator (RNG) 122 and a mask unit 124. The RNG generator 122 generates multiple random numbers based on a control signal Ctrl1 from bus interface 110, which serve as mask values ​​rx_int, ry_int, rz_int, and Rsum_int. In some embodiments, the mask value rx_int is different from the mask values ​​ry_int and rz_int. In some embodiments, the mask value rx_int is the same as either ry_int or rz_int. The RNG generator 122 is configured to provide mask values ​​rx_int, ry_int, and rz_int to mask unit 124 and to provide mask values ​​rx_int, ry_int, rz_int, and Rsum_int to selection circuitry 130. In some embodiments, the control signal Ctrl1 is provided by external circuitry (i.e., other circuitry within an integrated circuit) via bus 10. In some embodiments, bus interface 110 generates a control signal Ctrl1 to mask generator 120 based on input data from bus 10.

[0057] Masking unit 124 performs masking operations on data x, data y, and data z from bus interface 110 based on mask values ​​rx_int, ry_int, and rz_int, respectively, to obtain masked data x'_int, masked data y'_int, and masked data z'_int. Generally, masking operation involves performing an exclusive-OR or XOR operation on multi-bit data and multi-bit mask values ​​to mask a portion of the data and provide masked data, thus preventing data theft. Furthermore, masking unit 124 also provides masked data x'_int, masked data y'_int, and masked data z'_int to selection circuit 130. Moreover, data x, data y, and data z are provided by external circuitry through bus 10.

[0058] Selection circuit 130 includes multiplexers (MUX) 131 to 137. In this embodiment, multiplexers 131 to 137 are controlled by the same selection signal SEL. In some embodiments, the selection signal SEL is provided by external circuitry via bus 10. In some embodiments, bus interface 110 generates the selection signal SEL to selection circuit 130 based on input data from bus 10. When the selection signal SEL has a first logic level, the selection signal SEL controls multiplexers 131 to 137 to provide the masked data x'_ext, y'_ext, and z'_ext, mask values ​​rx_ext, ry_ext, rz_ext, and mask value Rsum_ext from bus interface 110 to storage circuit 140, and store them in the corresponding temporary registers (or memories). The mask values ​​rx_ext, ry_ext, rz_ext, mask value Rsum_ext, and masked data x'_ext, y'_ext, and z'_ext are provided by external circuitry via bus 10. On the other hand, when the selection signal SEL has a second logic level, the selection signal SEL controls multiplexers 131-137 to provide the masked data x'_int, y'_int, and z'_int, mask values ​​rx_int, ry_int, rz_int, and mask value Rsum_int from the mask generator 120 to the storage circuit 140 and store them in the corresponding temporary registers (or memories).

[0059] For the secure adder 100, the masked data x'_int, y'_int, and z'_int, the mask values ​​rx_int, ry_int, rz_int, and Rsum_int are generated by the internal mask generator 120. As previously described, the generation of the masked data x'_int is related to the mask value rx_int, the generation of the masked data y'_int is related to the mask value ry_int, and the generation of the masked data z'_int is related to the mask value rz_int. On the other hand, for the secure adder 100, the masked data x'_ext, y'_ext, and z'_ext, the mask values ​​rx_ext, ry_ext, rz_ext, and Rsum_ext are provided by external circuitry. Furthermore, the generation of masked data x'_ext is related to the mask value rx_ext, the generation of masked data y'_ext is related to the mask value ry_ext, and the generation of masked data z'_ext is related to the mask value rz_ext. In some embodiments, the mask value rx_ext is different from the mask values ​​ry_ext and rz_ext. In some embodiments, the mask value rx_ext is the same as the mask values ​​ry_ext or rz_ext.

[0060] Storage circuit 140 includes registers 141-147. Register 141 can store masked data x'_int or masked data x'_ext from multiplexer 131 and serve as input data x' of safe carry-saving adder 150. Register 142 can store masked data y'_int or masked data y'_ext from multiplexer 132 and serve as input data y' of safe carry-saving adder 150. Register 143 can store masked data z'_int or masked data z'_ext from multiplexer 133 and serve as input data z' of safe carry-saving adder 150. For safe carry-saving adder 150, input data x', input data y', and input data z' are masked data. Furthermore, register 144 can store the mask value rx_int or rx_ext from multiplexer 134, and use it as the mask value rx of safe carry-saving adder 150. Register 145 can store the mask value ry_int or ry_ext from multiplexer 135, and use it as the mask value ry of safe carry-saving adder 150. Register 146 can store the mask value rz_int or rz_ext from multiplexer 136, and use it as the mask value rz of safe carry-saving adder 150. Furthermore, register 147 can store the mask value Rsum_int or Rsum_ext from multiplexer 137, and use it as the variable Rsum of safe carry-saving adder 150. Next, the safe-save carry adder 150 generates a carry output Cout and a sum output Sout based on the input data x', y' and z', mask values ​​rz, ry and rz and variable Rsum from the storage circuit 140.

[0061] Without removing the mask values ​​rz, ry, and rz, the safe carry-saving adder 150 can perform addition on three input data x', y', and z' to obtain a carry output Cout and a sum output Sout. Then, the safe carry-saving adder 150 provides the carry output Cout and the sum output Sout, along with a mask value R and a variable Rsum, to the safe look-ahead carry adder 160, where the mask value R and the variable Rsum are the mask values ​​for the carry output Cout and the sum output Sout, respectively. In some embodiments, the carry output Cout can be obtained by performing a mask operation on the carry value obtained from adding the three input data x', y', and z' using the mask value R, and the sum output Sout can be obtained by performing a mask operation on the sum value obtained from adding the three input data x', y', and z' using the variable Rsum. Next, the safety carry-lookahead adder 160 performs an addition operation on the carry output Cout and the sum output Sout based on the mask value R and the variable Rsum, and performs a masking operation on the result of the addition operation using the mask value rs to obtain the sum result s'. In some embodiments, the mask value rs may be provided by external circuitry (i.e., other circuitry within the integrated circuit) via bus 10. In some embodiments, the mask value rs may be provided by the mask generator 120. Specifically, the mask value rs is used to perform a masking operation on the result of the carry-lookahead addition operation to provide safety protection for the output result.

[0062] Figure 2 The method for performing safe and economical carry addition according to some embodiments of the present invention is applicable to... Figure 1 A safe and energy-saving carry adder 150. In some embodiments, Figure 2 The method for performing safe and economical carry addition can be executed by other circuitry (such as a processor).

[0063] First, in step S210, mask values ​​rx, ry, and rz, as well as input data x', y', and z', are obtained. As previously described, input data x' is obtained by performing a masking operation (e.g., XOR operation "⊕") on data x using the mask values ​​rx, as shown in the following formula (1):

[0064]

[0065] Similarly, the input data y' is obtained by performing a masking operation on the data y using the mask value ry, as shown in the following formula (2):

[0066]

[0067] Furthermore, the input data z' is obtained by performing a masking operation on the data z using the mask value rz, as shown in the following formula (3):

[0068]

[0069] In step S220, the variable R is obtained based on the mask value rx, mask value ry, or mask value rz. For example, the variable R can be equal to the mask value rx, mask value ry, or mask value rz. In this embodiment, the variable R is equal to the mask value rx, as shown in the following formula (4):

[0070] R = rx (4)

[0071] Furthermore, based on the mask values ​​rx, ry, and rz, the variables Rxy and Rxz can be obtained, as shown in the following formulas (5) and (6):

[0072]

[0073]

[0074] In some embodiments, when variable R is equal to mask value ry, then variables Rxy and Ryz can be obtained based on mask values ​​rx, ry, and rz, where... In some embodiments, when variable R is equal to mask value rz, then variables Rxz and Ryz can be obtained based on mask values ​​rx, ry, and rz, where

[0075] When the variable R equals the mask value rx, the masked data x” can be obtained based on the input data x’, as shown in the following formula (7).

[0076] x”=x' (7)

[0077] Furthermore, masking operations are performed on the input data y' and input data z' according to the variables Rxy and Rxz respectively, so as to obtain the masked data y” and masked data z” as shown in the following formulas (8) and (9):

[0078]

[0079]

[0080] According to formulas (1) and (7), the masked data x” is equal to the data x and the variable R performing an XOR operation, as shown in the following formula (10):

[0081]

[0082] Furthermore, if the mask value ry is different from the mask value rx (i.e., ry ≠ rx), then according to formulas (2), (4) and (5), it can be seen that the masked data y” is equal to the data y and the variable R performing an XOR operation, as shown in the following formula (11):

[0083]

[0084] Conversely, if the mask value ry is the same as the mask value rx (i.e., ry = rx), then Rxy equals 0. Therefore, according to formulas (2) and (5), and given that the mask value ry is the same as the mask value rx and the variable R is also equal to the mask value rx, it can be seen that the masked data y” is equal to the data y and the variable R performing an XOR operation, as shown in the following formula (12):

[0085]

[0086] As can be seen from equations (11) and (12), regardless of whether the mask value ry is the same as the mask value rx, the masked data y” is equal to the XOR operation performed on the data y and the variable R. Furthermore, the original values ​​of the data x and data y are not revealed during the operation of equations (10)-(12). In other words, it is not necessary to restrict the mask value ry and the mask value rx when using the safe adder 100 to perform the addition operation. For example, in a traditional safe adder, it is necessary to restrict the use of different mask values.

[0087] Similarly, if the mask value rz is different from the mask value rx (i.e., rz ≠ rx), then according to formulas (3), (4) and (6), it can be seen that the masked data z” is equal to the data z and the variable R performing an XOR operation, as shown in the following formula (13):

[0088]

[0089] Conversely, if the mask value rz is the same as the mask value rx (i.e., rz = rx), then Rxz equals 0. Therefore, according to formulas (3) and (6), and given that the mask value rz is the same as the mask value rx and the variable R is also equal to the mask value rx, it can be seen that the masked data z” is equal to the data z and the variable R performing an XOR operation, as shown in the following formula (14):

[0090]

[0091] As can be seen from equations (13) and (14), regardless of whether the mask value rz is the same as the mask value rx, the masked data z” is equal to the data z and the variable R performing an XOR operation. Furthermore, the original values ​​of data x and data z are not revealed during the operation of equations (10), (13), and (14). In other words, using the secure adder 100 to perform addition does not require restrictions on the mask value rz and the mask value rx. For example, in a conventional secure adder, it is necessary to restrict the mask value rz from being different from the mask value rx.

[0092] The carry-saving adder mainly compresses the three data x, y, and z into two raw output values, sum and carry (i.e., the raw values ​​without masking), as shown in the following equations (15) and (16):

[0093]

[0094] carry=(x&y)|(x&z)|(y&z) (16)

[0095] The "|" symbol represents the OR operation, while the "&" symbol represents the AND operation.

[0096] Suppose that performing an XOR operation on the masked data x”, masked data y”, and masked data z” yields the masked data sum”, as shown in the following formula (17):

[0097]

[0098] Next, substituting equations (10)-(15) into equation (17) yields equation (18), which can then be rewritten as equation (19), as shown below:

[0099]

[0100]

[0101] Similarly, suppose that performing an OR operation on the masked data x”, masked data y”, and masked data z” yields the masked data carry”, as shown in the following formula (20):

[0102] carry”=(x”&y”)|(x”&z”)|(y”&z”) (20)

[0103] Next, substituting equations (10)-(15) into equation 20, we obtain equation (21), as shown below:

[0104]

[0105] Next, based on the distributive property between the AND and XOR operations, equation (21) is rewritten as equation (22), as shown below:

[0106]

[0107] To simplify the equations, new variables Exy, Eyz, and Exz are defined, as shown in the following equations (23)-(25):

[0108]

[0109]

[0110]

[0111] Next, substituting the variables Exy, Eyz, and Exz into equation (22), we obtain equation (26), as shown below:

[0112]

[0113] refer to Figure 3 , Figure 3 Display a truth table for the variable Exy according to some embodiments of the present invention. For example... Figure 3 The results show that if data x and data y are equal, the variable Exy will equal the value of R. Conversely, if data x is different from data y, the variable Exy will equal 0. Similarly, if data x and data z are equal, the variable Exz will equal the value of R. Conversely, if data x is different from data z, the variable Exz will equal 0. Furthermore, if data y and data z are equal, the variable Eyz will equal the value of R. Conversely, if data y is different from data z, the variable Eyz will equal 0.

[0114] Figure 4 A truth table showing the original output value carry of the formula (16) according to some embodiments of the present invention, and Figure 5 Displays a truth table of the masked data "carry" of the formula (26) according to some embodiments of the present invention. Also refer to... Figure 4 and Figure 5 When variable R equals 0, regardless of the values ​​of data x, y, and z, the value of the masked data "carry" will be the same as the original output value "carry". Conversely, when variable R equals 1, regardless of the values ​​of data x, y, and z, the value of the masked data "carry" is opposite to (or complementary to) the original output value "carry". Therefore, it can be deduced from... Figure 4 and Figure 5 The following formula (27) is derived:

[0115]

[0116] Next, the mask values ​​for the original output values ​​sum and carry are set to Rsum and Rcarry, respectively. Furthermore, to optimize the safety and save carry adder, the mask value Rcarry is set to the variable R. In addition, the mask values ​​Rcarry and Rsum can be used to perform masking operations on the original output values ​​carry and sum to obtain the carry output Cout and the sum output Sout, as shown in the following equations (28)-(29):

[0117]

[0118]

[0119] Since the mask value Rcarry is equal to the variable R, equation (29) can be optimized to Cout = carry". Furthermore, performing an XOR operation between the variable R and the variable Rsum yields the variable Rsum', as shown in the following equation (30):

[0120]

[0121] Next, performing an XOR operation between the masked data x” and the variable Rsum’ yields the variable Rsum”, as shown in the following formula (31):

[0122]

[0123] Therefore, by substituting equations (30) and (31) into equation (28), we can obtain equation (32), as shown below:

[0124]

[0125] Reference Figure 2 In step S230, based on one of the masked data x”, y”, and z” (e.g., masked data x’), the variable R, and the input variable Rsum, the variable Rsum” is obtained, as shown in equations (30) and (31). Next, in step S240, based on the other two of the masked data x”, y”, and z” (e.g., masked data y” and masked data z”) and the variable Rsum”, the sum output Sout and the carry output Cout are obtained, as shown in equations (29) and (32).

[0126] Next, in step S250, a safe carry-lookahead adder is performed on the sum output Sout, the carry output Cout, the variables R, Rsum, and the mask value rs to obtain the masked data s'. As previously described, the mask values ​​for the original output value sum and the original output value carry are the input variables Rsum and R, respectively. This is achieved by using a safe carry-lookahead adder, for example... Figure 1 The safe carry-lookup adder 160 can perform addition operations on the sum output Sout and carry output Cout, which are masked by the input variables Rsum and R, and use the mask value rs to provide mask protection for the operation result to obtain the masked data s'.

[0127] It is worth noting that in this embodiment, the variable R is equal to the mask value rx, so the sum output Sout can be obtained based on the masked data y” and z” and the variable Rsum”, as shown in equation (32). In addition, the variable Rsum” is obtained based on the masked data x”, as shown in equation (31). Thus, the logic circuit of the safe carry adder 150 can be obtained based on equations (10)-(14), equation (18), equation (20), equation (29), equation (30), equation (31), and equation (32).

[0128] In some embodiments, the variable R is equal to the mask value ry, and the sum output Sout can be obtained from the masked data x” and z” and the variable Rsum”, as shown in the following formula (33):

[0129]

[0130] Furthermore, the variable Rsum” is obtained based on the masked data y”, as shown in the following formula (34):

[0131]

[0132] In some embodiments, the variable R is equal to the mask value rz, and the sum output Sout can be obtained from the masked data x” and y” and the variable Rsum”, as shown in the following formula (35):

[0133]

[0134] Furthermore, the variable Rsum” is obtained based on the masked data z”, as shown in the following formula (36):

[0135]

[0136] Figure 6AThis diagram shows an exemplary circuit diagram of a safe carry-saving adder 150A according to some embodiments of the present invention. The safe carry-saving adder 150A includes mask units 310a, 320a, and 330a, logic circuitry 340, and an XOR gate 410. In this embodiment, the variable R is equal to the mask value rx.

[0137] Masking unit 310a is configured to perform a masking operation on input data y' based on mask values ​​rx and ry to obtain masked data y'". In some embodiments, masking unit 310a includes XOR gates 412 and 414. XOR gate 412 is used to perform an XOR operation on mask values ​​ry and rx to obtain variable Rxy, as shown in equation (5). Then, XOR gate 414 is configured to perform a masking operation (i.e., an XOR operation) on input data y' based on variable Rxy to obtain masked data y'", as shown in equation (8).

[0138] Masking unit 320a is configured to perform a masking operation on input data x' based on mask value rx (i.e., variable R) and variable (or mask value) Rsum to obtain variable Rsum", where variable Rsum" can also be considered as masked data. In some embodiments, masking unit 320a includes XOR gates 422 and 424. XOR gate 422 is used to perform an XOR operation on variable R (i.e., mask value rx) and variable Rsum to obtain variable Rsum', as shown in equation (30). Then, XOR gate 424 is configured to perform a masking operation on the masked data x" (i.e., input data x') based on variable Rsum' to obtain variable Rsum", as shown in equation (31).

[0139] Masking unit 330a is configured to perform a masking operation on input data z' based on mask values ​​rx and rz to obtain masked data z'". In some embodiments, masking unit 330a includes XOR gates 432 and 434. XOR gate 432 is used to perform an XOR operation on mask values ​​rx and rz to obtain variable Rxz, as shown in equation (6). Then, XOR gate 434 is configured to perform a masking operation on input data z' based on variable Rxz to obtain masked data z'", as shown in equation (9).

[0140] Logic circuit 340 provides a carry output Cout based on the masked data x”, y”, and z”. In some embodiments, logic circuit 340 includes AND gates 352, 354, and 356 and an OR gate 360. AND gate 352 is configured to receive the masked data y” and z” and output intermediate data D1. Furthermore, AND gate 354 is configured to receive the masked data y” and x” and output intermediate data D2. Moreover, AND gate 356 is configured to receive the masked data z” and x” and output intermediate data D3. OR gate 360 ​​is configured to receive intermediate data D1, D2, and D3 and output a carry output Cout, as shown in equations (20) and (29).

[0141] XOR gate 410 is configured to receive masked data y” and z” and variable Rsum”, and output sum output Sout, as shown in equation (32). Thus, the safe carry-saving adder 150 performs addition on the three input data x’, y’ and z’ without removing the masked values ​​rz, ry and rz, and provides sum output Sout and carry output Cout.

[0142] After obtaining the sum output Sout and the carry output Cout, the safe-to-save carry adder 150 will provide the sum output Sout, the carry output Cout, and the variables Rsum and Rto. Figure 1 A secure carry-preview adder 160 is provided. As previously described, variables Rsum and R are mask values ​​for the sum output Sout and the carry output Cout. The secure carry-preview adder 160 then performs addition on the sum output Sout and the carry output Cout without removing the mask values ​​Rsum and R, and performs a masking operation on the result of the addition using the mask value rs to obtain the sum s'. The secure carry-preview adder 160 then provides the masked sum s' to bus interface 110 for provision to other circuitry (e.g., a processor) via bus 10 for subsequent operations. In addition to providing the sum s', Figure 1 The safe adder 100 also provides a mask value rs to other circuits. These other circuits can then use the mask value rs to remove the mask from the summation result s' and perform subsequent calculations.

[0143] Figure 6B This diagram shows an exemplary circuit diagram of a safe carry-saving adder 150B according to some embodiments of the present invention. The safe carry-saving adder 150B includes mask units 310b, 320b, and 330b, logic circuitry 340, and an XOR gate 410. In this embodiment, the variable R is equal to the mask value ry.

[0144] exist Figure 6BIn this process, masking unit 310b is configured to perform a masking operation on input data x' based on mask values ​​rx and ry to obtain masked data x". Furthermore, masking unit 320b is configured to perform a masking operation on input data y' based on mask values ​​ry (i.e., variable R) and variable Rsum to obtain variable Rsum". Moreover, masking unit 330b is configured to perform a masking operation on input data z' based on mask values ​​ry and rz to obtain masked data z.

[0145] Similar to Figure 6A The logic circuit 340 of the safe carry-saving adder 150B provides a carry output Cout based on the masked data x”, y”, and z”. In addition, the XOR gate 410 of the safe carry-saving adder 150B is configured to receive the masked data x” and z” and the variable Rsum”, and output a sum output Sout, as shown in equation (33).

[0146] Figure 6C This diagram shows an exemplary circuit diagram of a safe carry-saving adder 150C according to some embodiments of the present invention. The safe carry-saving adder 150C includes mask units 310c, 320c, and 330c, logic circuitry 340, and an XOR gate 410. In this embodiment, the variable R is equal to the mask value rz.

[0147] exist Figure 6C In this process, masking unit 310c is configured to perform a masking operation on input data y' based on mask values ​​rz and ry to obtain masked data y'. Furthermore, masking unit 320b is configured to perform a masking operation on input data z' based on mask values ​​rz (i.e., variable R) and variable Rsum to obtain variable Rsum'. Moreover, masking unit 330c is configured to perform a masking operation on input data x' based on mask values ​​rx and rz to obtain masked data x'.

[0148] Similar to Figure 6A The logic circuit 340 of the safe carry-saving adder 150C provides a carry output Cout based on the masked data x”, y”, and z”. In addition, the XOR gate 410 of the safe carry-saving adder 150C is configured to receive the masked data y” and z” and the variable Rsum”, and output a sum output Sout, as shown in equation (35).

[0149] According to an embodiment of the present invention, in the secure adder 100, a secure carry-saving adder 150 and a look-ahead carry adder 160 are used to perform addition operations on three masked input data and provide mask protection for the operation result. Compared to a conventional carry-saving adder, the secure carry-saving adder 150 does not require removing the mask of the three input data (i.e., the secure carry-saving adder 150 does not reveal the original value of the input data (or operands), thus providing secure protection for the input signal. Furthermore, the secure carry-saving adder 150 can correctly perform addition operations regardless of whether the mask values ​​rx, ry, and rz are the same. In addition, when performing encryption and decryption operations using the secure carry-saving adder 150, since a look-ahead carry generator is not required, the complexity of the hardware circuitry (e.g., using fewer logic units) and latency can be effectively reduced. Thus, the power consumption of the secure adder can be reduced and the area of ​​the integrated circuit can be reduced, thereby reducing manufacturing costs.

[0150] Although the present invention has been described above with reference to preferred embodiments, it is not intended to limit the present invention. Those skilled in the art can make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the scope defined in the claims of this application.

Claims

1. A carry-saving adder, characterized in that, include: A first mask unit is configured to perform a first mask operation on a first input data corresponding to the first mask value based on a first mask value and an input variable, so as to obtain a first variable; A second masking unit is configured to perform a second masking operation on a second input data corresponding to the second masking value based on the first masking value and a second masking value, so as to obtain a first masked data; A third mask unit is configured to perform a third mask operation on a third input data corresponding to the third mask value based on the first mask value and a third mask value, so as to obtain a second masked data; as well as A first XOR gate is used to receive the first masked data, the second masked data, and the first variable to provide a sum output of the first input data, the second input data, and the third input data.

2. The carry-saving adder according to claim 1, characterized in that, Also includes: A logic circuit is used to receive the first masked data, the second masked data, and the first input data to provide a carry-out of the first input data, the second input data, and the third input data.

3. The carry-saving adder according to claim 2, characterized in that, The logic circuit includes: A first AND gate is used to receive the first masked data and the second masked data to provide a first intermediate data; A second AND gate is used to receive the first masked data and the first input data to provide a second intermediate data; A third AND gate is used to receive the second masked data and the first input data to provide a third intermediate data; and An OR gate is used to receive the first intermediate data, the second intermediate data, and the third intermediate data to provide the carry output.

4. The carry-saving adder according to claim 1, characterized in that, The first mask unit includes: A second XOR gate, used to receive the first mask value and the input variable, to provide a second variable; and A third XOR gate is used to receive the second variable and the first input data to provide the first variable; The first input data is obtained by performing a mask operation on a first data using the first mask value.

5. A safe adder, characterized in that, include: A mask generator, comprising: A random number generator for randomly generating a first mask value, a second mask value, a third mask value, and an input variable; and A carry-saving adder includes: A first mask unit is configured to perform a first mask operation on a first input data corresponding to the first mask value based on the first mask value and the input variable, so as to obtain a first variable; A second masking unit is configured to perform a second masking operation on a second input data corresponding to the second masking value based on the first masking value and the second masking value, so as to obtain a first masked data; A third masking unit is configured to perform a third masking operation on a third input data corresponding to the third masking value based on the first masking value and the third masking value, to obtain a second masked data; and A first XOR gate is used to receive the first masked data, the second masked data, and the first variable to provide a sum output of the first input data, the second input data, and the third input data.

6. The safe adder according to claim 5, characterized in that, Also includes: A carry-preview adder is provided to provide a summation result of the first input data, the second input data, and the third input data based on the summation output, a carry output, the input variable, and the first mask value; The carry-saving adder further includes: A logic circuit is used to receive the first masked data, the second masked data, and the first input data to provide the carry output of the first input data, the second input data, and the third input data; The input variable is the mask value of the sum output, and the first mask value is the mask value of the carry output.

7. The safe adder according to claim 6, characterized in that, The look-ahead adder also performs a fourth mask operation on the summation result based on a fourth mask value.

8. The safe adder according to claim 5, characterized in that, The first mask unit includes: A second XOR gate, used to receive the first mask value and the input variable, to provide a second variable; and A third XOR gate is used to receive the second variable and the first input data to provide the first variable; The first input data is obtained by performing a mask operation on a first data using the first mask value.

9. A method for performing safe and economical carry addition, characterized in that, include: Based on a first mask value and an input variable, perform a first mask operation on a first input data corresponding to the first mask value to obtain a first variable; Based on the first mask value and a second mask value, a second mask operation is performed on a second input data corresponding to the second mask value to obtain a first masked data; Based on the first mask value and a third mask value, a third mask operation is performed on a third input data corresponding to the third mask value to obtain a second masked data; as well as An XOR gate is used to perform an XOR operation on the first masked data, the second masked data, and the first variable to provide a sum output of the first input data, the second input data, and the third input data.

10. The method for performing safe and economical carry addition according to claim 9, characterized in that, Also includes: A look-ahead carry adder is used to provide a summation of the first input data, the second input data, and the third input data based on the summation output, a carry output, the input variables, and the first mask value; The input variable is the mask value of the sum output, and the first mask value is the mask value of the carry output.

Images