Carry-lookahead adder, secure adder, and method of performing carry-lookahead addition

Abstract

The present invention provides a carry lookahead adder, a secure adder and a method of performing a carry lookahead addition. The carry lookahead adder includes a first XOR gate receiving a first mask value and a second mask value to provide a variable. A first masking unit performs a first masking operation on first input data according to the variable to obtain first masked data. A half adder receives the first masked data and second input data to generate a propagate value and an intermediate generated value. A second masking unit performs a second masking operation on the propagate value according to a third mask value to obtain second masked data. A logic circuit provides a generated value according to the propagate value, the intermediate generated value and the second mask value. A carry lookahead generator provides a carry output and a carry value according to a carry input, the generated value and the propagate value. A second XOR gate receives the second masked data and the carry value to provide a sum output.

Description

Technical Field

[0001] This invention relates to a safe adder, and more particularly to a safe carry-lookahead adder. Background Technology

[0002] Addition is a crucial function in many operations, hence adders are widely used in signal processing, data protection, and other applications. In recent years, encryption and decryption applications have placed great emphasis on protecting confidential information to prevent the analysis and theft of computational data. Generally, a common and effective protection mechanism is XOR masking, which uses a random number and critical data (or variables) within the encryption / decryption algorithm to perform an XOR operation, thus achieving masking protection. Therefore, encryption and decryption applications require a secure adder capable of performing secure addition operations.

[0003] Secure addition refers to the ability of a secure adder to perform addition operations without removing the masking layer of the input data, without revealing the original value of the input data during the calculation, and providing an output protected by the masked value. Secure adders capable of performing secure addition operations are widely used in various integrated circuits or electronic products applied to encryption and decryption operations.

[0004] Therefore, a safe adder with low manufacturing cost is needed. Summary of the Invention

[0005] This invention provides a carry-lookahead adder. The carry-lookahead adder includes a first XOR gate, a first masking unit, a half-adder, a second masking unit, a logic circuit, a carry-lookahead generator, and a second XOR gate. The first XOR gate receives a first masking value and a second masking value to provide a variable. The first masking unit performs a first masking operation on a first input data corresponding to the first masking value based on the variable to obtain a first masked data. The half-adder receives the first masked data and a second input data corresponding to the second masking value to generate a propagation value and an intermediate generated value. The second masking unit performs a second masking operation on the propagation value based on a third masking value to obtain a second masked data. The logic circuit provides a generated value based on the propagation value, the intermediate generated value, and the second masking value. The carry-lookahead generator provides a carry output and a carry value based on a carry input, the generated value, and the propagation value. The second XOR gate receives the second masked data and the carry value to provide a sum output.

[0006] Furthermore, the present invention provides a secure adder. The secure adder includes a masking generator and a carry-lookahead adder. The masking generator includes a random number generator and a first masking unit. The random number generator randomly generates a first masking value, a second masking value, and a third masking value. The first masking unit performs a first masking operation on a first data based on the first masking value to obtain a first masked data, and performs a second masking operation on a second data based on the second masking value to obtain a second masked data. The carry-lookahead adder includes a first XOR gate, a second masking unit, a half-adder, a third masking unit, a logic circuit, a carry-lookahead generator, and a second XOR gate. The first XOR gate receives the first masking value and the second masking value to provide a variable. The second masking unit performs a third masking operation on the first masked data based on the variable to obtain a third masked data. The aforementioned half-adder receives the aforementioned third masked data and the aforementioned second masked data to generate a propagated value and an intermediate generated value. The aforementioned third masking unit performs a fourth masking operation on the propagated value based on the aforementioned third masking value to obtain a fourth masked data. The aforementioned logic circuit provides a generated value based on the aforementioned propagated value, the aforementioned intermediate generated value, and the aforementioned second masking value. The aforementioned carry-lookahead generator provides a carry output and a carry value based on a carry input, the aforementioned generated value, and the aforementioned propagated value. The aforementioned second XOR gate receives the aforementioned fourth masked data and the aforementioned carry value to provide a sum output.

[0007] Furthermore, the present invention provides a method for performing carry-lookahead addition. A variable is obtained based on a first masking value and a second masking value. A first masking operation is performed on a first input data corresponding to the first masking value using the variable to obtain a first masked data. Using a half-adder, an intermediate generated value and a propagated value are obtained based on the first masked data and a second input data corresponding to the second masking value. A second masking operation is performed on the propagated value based on a third masking value to obtain a second masked data. A generated value is provided based on the propagated value, the intermediate generated value, and the second masking value. A carry-lookahead generator obtains a carry output and a carry value based on a carry input, the generated value, and the propagated value. A sum output is obtained based on the second masked data and the carry value. The first masking operation and the second masking operation are performed by different XOR gates. Attached Figure Description

[0008] Figure 1 This illustrates a secure adder according to some embodiments of the present invention.

[0009] Figure 2This illustrates a method for performing carry-lookahead addition according to some embodiments of the present invention, applicable to... Figure 1 A safe carry-lookahead adder.

[0010] Figure 3A This diagram shows an exemplary circuit diagram of a first-type safe carry-lookahead adder according to some embodiments of the present invention.

[0011] Figure 3B This diagram shows an exemplary circuit diagram of a second type of secure carry-lookahead adder according to some embodiments of the present invention.

[0012] Figure 4 This illustrates a 4-bit carry-lookahead generator according to some embodiments of the present invention.

[0013] Explanation of reference numerals in the attached figures: 10: Busbar 100: Safe Adder 110: Busbar Interface 120: Mask Generator 122: Random Number Generator 124: Masking Unit 130: Selection Circuit 131, 133, 135, 137, 139: Multiplexers 140: Storage circuit 141, 143, 145, 147, 149: Temporary registers 150, 150A, 150B: Safety carry-lookahead adders 310, 312, 314: Masking Units 320: Half Adder 330, 410-440: Logic Circuits 340, 400: Carry-lookahead generator 351-358: XOR gates 361-362: and the door Cin: Carry Input Cout: Carry-out output C0: Input signal C1-C4: Output signals Ctrl1: Control signal D1-D2: Intermediate Data D3, x'', y'': Masked data G: Generated value G': Intermediate value G0-G3: Generate signals R, Rxy: variables rx, ry, rz: Masking values rx_int, ry_int, rz_int: Masking values rx_ext, ry_ext, rz_ext: Masking values P: Propagation value P': Intermediate propagation value P0-P3: Propagation signal S210-S260: Steps SEL: Selection signal Sout: Total output x, y: data x', y': Input data x'_int, y'_int, x'_ext, y'_ext: Masked data Detailed Implementation

[0014] To make the above and other objects, features, and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings: Figure 1 A secure adder 100 according to some embodiments of the present invention is shown. The secure adder 100 may be implemented in an integrated circuit (not shown). Furthermore, the secure adder 100 can perform addition operations without disclosing operands and provides mask protection for the output result. In some embodiments, the secure adder 100 can perform data transfer with other circuitry (not shown) within the integrated circuit via bus 10. For example, a processor (not shown) can provide multiple input data (or operands) to the secure adder 100 via bus 10 to perform addition operations. In some embodiments, the input data may be unmasked raw data. In some embodiments, the input data may be masked data. Furthermore, after completing the addition operation, the secure adder 100 provides the masked operation result to the processor via bus 10.

[0015] exist Figure 1In this embodiment, the secure adder 100 includes a bus interface 110, a mask generator 120, a selection circuit 130, a storage circuit 140, and a secure carry-lookahead adder (SCLA) 150. The bus interface 110 is coupled to bus 10 and configured to provide various input data (e.g., operands, mask values, control signals, etc.) from bus 10 to the mask generator 120, the selection circuit 130, and the secure carry-lookahead adder 150. Furthermore, after completing the addition operation, the bus interface 110 is configured to provide output data (e.g., the result of the operation) from the secure carry-lookahead adder 150 back to bus 10.

[0016] Masking generator 120 includes a random number generator (RNG) 122 and a masking unit 124. The RNG generator 122 generates multiple random numbers based on a control signal Ctrl1 from bus interface 110, which serve as masking values ​​rx_int, ry_int, and rz_int. In some embodiments, the masking value rx_int is different from the masking value ry_int. In some embodiments, the masking value rx_int is the same as the masking value ry_int. The RNG generator 122 is configured to provide masking values ​​rx_int and ry_int to the masking unit 124 and to provide masking values ​​rx_int, ry_int, and rz_int to the selection circuit 130. In some embodiments, the control signal Ctrl1 is provided by external circuitry (i.e., other circuitry within an integrated circuit) via bus 10. In some embodiments, bus interface 110 generates the control signal Ctrl1 to masking generator 120 based on input data from bus 10. Furthermore, the masking unit 124 performs masking operations on data x and data y according to the masking values ​​rx_int and ry_int, respectively, to obtain masked data x'_int and masked data y'_int. Generally, the masking operation represents performing an exclusive-OR or XOR operation on multiple bits of data and multiple bits of masking values ​​to mask a portion of the data and provide masked data, thus preventing data theft. In addition, the masking unit 124 also provides the masked data x'_int and masked data y'_int to the selection circuit 130. Furthermore, data x and data y are provided by external circuitry through bus 10.

[0017] Selection circuit 130 includes multiplexers (MUX) 131, 133, 135, 137, and 139. In this embodiment, multiplexers 131, 133, 135, 137, and 139 are controlled by the same selection signal SEL. In some embodiments, the selection signal SEL is provided by external circuitry via bus 10. In some embodiments, bus interface 110 generates the selection signal SEL to selection circuit 130 based on input data from bus 10. When the selection signal SEL has a first logic level, the selection signal SEL controls multiplexers 131, 133, 135, 137, and 139 to provide masked data x'_ext and y'_ext, as well as masking values ​​rx_ext, ry_ext, and rz_ext from bus interface 110 to storage circuit 140, where they are stored in corresponding registers (or memories). The masking values ​​rx_ext, ry_ext, and rz_ext, as well as the masked data x'_ext and y'_ext, are provided by external circuitry via bus 10. On the other hand, when the selection signal SEL has a second logic level, the selection signal SEL controls multiplexers 131, 133, 135, 137, and 139 to provide the masked data x'_int and y'_int, as well as the masking values ​​rx_int, ry_int, and rz_int from the masking generator 120 to the storage circuit 140, where they are stored in the corresponding temporary registers (or memory).

[0018] For the secure adder 100, the masked data x'_int and y'_int, as well as the masking values ​​rx_int, ry_int, and rz_int, are generated by the internal masking generator 120. As previously described, the generation of the masked data x'_int is related to the masking value rx_int, and the generation of the masked data y'_int is related to the masking value ry_int. On the other hand, for the secure adder 100, the masked data x'_ext and y'_ext, as well as the masking values ​​rx_ext, ry_ext, and rz_ext, are provided by external circuitry. Furthermore, the generation of the masked data x'_ext is related to the masking value rx_ext, and the generation of the masked data y'_ext is related to the masking value ry_ext. In some embodiments, the masking value rx_ext is different from the masking value ry_ext. In some embodiments, the masking value rx_ext is the same as the masking value ry_ext.

[0019] Storage circuit 140 includes registers 141, 143, 145, 147, and 149. Register 141 can store masked data x'_int or masked data x'_ext from multiplexer 131 and serve as input data x' of safe carry adder 150. Furthermore, register 143 can store masked data y'_int or masked data y'_ext from multiplexer 133 and serve as input data y' of safe carry adder 150. For safe carry adder 150, input data x' and input data y' are masked data. Additionally, register 145 can store masked value rx_int or masked value rx_ext from multiplexer 135 and serve as masked value rx of safe carry adder 150. Register 147 can store either the mask value ry_int or the mask value ry_ext from multiplexer 137, and use it as the mask value ry for safe carry adder 150. Register 149 can store either the mask value rz_int or the mask value rz_ext from multiplexer 139, and use it as the mask value rz for safe carry adder 150. Then, safe carry adder 150 generates carry output Cout and sum output Sout based on the input data x' and y' from storage circuit 140, the mask value rz, ry and rz, and the carry input Cin.

[0020] Figure 2 This illustrates a method for performing carry-lookahead addition according to some embodiments of the present invention, applicable to... Figure 1 A safe carry-look adder 150. In some embodiments, Figure 2 The method for performing carry-lookahead addition can be performed by other circuitry (such as a processor).

[0021] First, in step S210, masking values ​​rx, ry, and rz, as well as input data x' and y', are obtained. As previously described, input data x' is obtained by performing a masking operation (e.g., XOR operation "⊕") on data x using the masking value rx, as shown in the following formula (1): x' = x⊕rx (1).

[0022] Similarly, the input data y' is obtained by performing a masking operation (e.g., XOR operation) on the data y using the masking value ry, as shown in the following formula (2): y' = y⊕ry (2).

[0023] Furthermore, the masking value rz is used to perform a masking operation on the result of a carry-lookahead addition operation in order to provide security protection for the output result, which will be described in detail later.

[0024] In step S220, the variable Rxy can be obtained based on the masking value rx and the masking value ry, as shown in the following formula (3): Rxy = rx⊕ry (3).

[0025] Next, based on the masking value rx or masking value ry, the variable R can be obtained. The following will explain it in two types: the first type and the second type.

[0026] In the first type, the variable R is equal to the masking value rx, as shown in the following formula (4): R = rx (4).

[0027] Furthermore, based on the input data x', the masked data x'' can be obtained, and a masking operation is performed on the input data y' based on the variable Rxy to obtain the masked data y'', as shown in the following formulas (5) and (6): x'' = x' (5); and y'' = y'⊕Rxy (6).

[0028] According to formulas (1), (4), and (5), the masked data x'' is equal to the data x and variable R performing an XOR operation, as shown in the following formula (7): x'' = x' = x⊕rx= x⊕R (7).

[0029] Furthermore, if the masking value ry is different from the masking value rx (i.e., ry ≠ rx), then according to formulas (2), (3) and (6), it can be seen that the masked data y'' is equal to the data y and the variable Rxy performing an XOR operation, as shown in the following formula (8): y'' = y'⊕Rxy = (y⊕ry)⊕(rx⊕ry) = y⊕rx⊕(ry⊕ry) = y⊕R (8).

[0030] Conversely, if the masking value ry is the same as the masking value rx (i.e., ry = rx), then Rxy equals 0. Therefore, according to formulas (2) and (6), and given that the masking value ry is the same as the masking value rx and the variable R is also equal to the masking value rx, it can be seen that the masked data y'' is equal to the data y and the variable R. Performing an XOR operation, as shown in the following formula (9): y'' = y'⊕Rxy = y'⊕0 = y' = y⊕ry = y⊕rx = y⊕R (9).

[0031] As can be seen from equations (7), (8), and (9), regardless of whether the masking value ry is the same as the masking value rx, the masked data y' is equal to the XOR operation performed on the data y and the variable R. Furthermore, the original values ​​of data x and data y are not revealed during the operations of equations (3) to (6). In other words, using the secure adder 100 to perform addition does not require restrictions on the masking values ​​ry and rx, unlike in a traditional secure adder where the masking value ry must be different from the masking value rx.

[0032] In the second type, the variable R is equal to the masking value ry, as shown in the following formula (10): R = ry (10).

[0033] Furthermore, by performing a masking operation on the input data x' according to the variable Rxy, the masked data x'' can be obtained, and by performing a masking operation on the input data y', the masked data y'' can be obtained, as shown in the following formulas (11) and (12): x'' = x'⊕Rxy (11); and y'' = y' (12).

[0034] According to formulas (2), (10), and (12), the masked data y'' is equal to the data y and the variable R performing an XOR operation, as shown in the following formula (13): y'' = y' = y⊕ry= y⊕R (13).

[0035] Furthermore, if the masking value ry is different from the masking value rx (i.e., ry ≠ rx), then according to formulas (1), (3), and (11), it can be seen that the masked data x'' is equal to the data x and the variable Rxy performing an XOR operation, as shown in the following formula (14): x'' = x'⊕Rxy = (x⊕rx)⊕(rx⊕ry) = x⊕ry⊕(rx⊕rx) = x⊕R (14).

[0036] Conversely, if the masking value ry is the same as the masking value rx (i.e., ry = rx), then Rxy equals 0. Therefore, according to formulas (2) and (11), and given that the masking value ry is the same as the masking value rx and the variable R is also equal to the masking value ry, it can be seen that the masked data x'' is equal to the data x and the variable R. Performing an XOR operation, as shown in the following formula (15): x'' = x'⊕Rxy = x'⊕0= x' = x⊕rx = x⊕ry = x⊕R (15).

[0037] As can be seen from equations (13), (14), and (15), regardless of whether the masking value ry is the same as the masking value rx, the masked data y' is equal to the XOR operation performed on the data y and the variable R. Furthermore, the original values ​​of data x and data y are not revealed during the operations of equations (3) and (10)-(12). In other words, using the secure adder 100 to perform addition does not require restrictions on the masking values ​​ry and rx, unlike in a conventional secure adder where the masking value ry must be different from the masking value rx.

[0038] In step S230, based on the masked data x'' and masked data y'' obtained from the first type or the second type, the intermediate propagation value P' can be obtained, as shown in the following formula (16): P' = x''⊕y'' (16).

[0039] Next, according to the first type of formula (7)-formula (9) or the second type of formula (13)-formula (15), it can be obtained that the intermediate propagation value P' (i.e. x''⊕y'') of formula (16) is equal to the propagation value P (i.e. x⊕y), as shown in the following formula (17): P' = x''⊕y'' = (x⊕R)⊕(y⊕R) = x⊕y = P (17).

[0040] Furthermore, performing an AND operation (“&”) on the masked data x'' and the masked data y'' yields the intermediate value G', as shown in the following formula (18): G' = x''&y'' (18).

[0041] In step S240, according to the distributive property between AND and XOR operations (e.g., (a⊕b)&c=(a&c)⊕(b&c)), the AND operation in formula (18) can be assigned to the lowest level operation, as shown in the following formula (19): G'= x''&y'' = (x⊕R) & (y⊕R) = (x&(y⊕R))⊕(R&(y⊕R)) = (x&y)⊕(x&R)⊕(R&y)⊕(R&R) = (x&y)⊕(x&R)⊕(R&y)⊕R (19).

[0042] Next, for the adder, performing an AND operation on data x and data y yields the value G, i.e., G = x & y. Therefore, equation (19) can be rewritten as equation (20), as shown below: G' = (x&y)⊕(x&R)⊕(R&y)⊕R = G⊕(x&R)⊕ (y&R)⊕R (20).

[0043] Next, based on the distributive property between AND and XOR operations, equation (20) can be rewritten as equation (21), as shown below: G' = G⊕(x&R)⊕(y&R)⊕R = G⊕((x⊕y)&R)⊕R (21).

[0044] Next, substituting equation (17) into equation (21), we obtain equation (22), as shown below: G' = G⊕(P'&R)⊕R (22).

[0045] Next, according to the associative law of the XOR operation and formula (22), the generated value G can be obtained according to formula (23), as shown below: G = G'⊕(P'&R)⊕R (23).

[0046] In step S250, based on the propagation value P obtained from equation (17), the generation value G obtained from equation (23), and the carry-lookahead generator, the carry-lookahead generator can obtain the carry output Cout and the carry value C. The carry-lookahead generator will be described later. In some embodiments, the initial value of the carry input Cin is 0. In some embodiments, the carry input Cin is provided by external circuitry via bus 10.

[0047] In step S260, according to the operation principle of the adder, the data x, data y and carry value C are XORed to obtain the sum output Sout, as shown in the following formula (24): Sout = (x+y) = x⊕y⊕C = P'⊕C (24).

[0048] Next, an XOR operation is performed on the sum output Sout and the masking value rz to satisfy the condition that both the input and output values ​​are masked in the addition operation. Thus, the masked sum output Sout can be obtained, as shown in the following formula (25): Sout = (P'⊕rz)⊕C (25).

[0049] Generally, a carry-lookahead generator can obtain the carry output Cout and the carry value C based on the propagation value P, the generated value G, and the carry input Cin, as shown in the following formula (26): {Cout, C} = CLG (G, P, Cin) (26), CLG is a function representing the carry-lookahead generator. Therefore, substituting the carry value C from equation (26) into equation (25) yields equation (27), as shown below: Sout = (P'⊕rz)⊕CLG (G, P, Cin) (27).

[0050] Next, substituting the generated value G from equation (23) into equation (27) yields equation (28), as shown below: Sout = (P'⊕rz)⊕CLG (G, P, Cin) = (P'⊕rz)⊕CLG (G'⊕(P'&R)⊕R, P, Cin) (28).

[0051] Next, substituting the propagation value P and the intermediate propagation value P' of equation (17) into equation (28) yields equation (29), as shown below: Sout = (P'⊕rz)⊕CLG (G'⊕(P'&R)⊕R, P, Cin) = ((x''⊕y'')⊕rz)⊕CLG (G'⊕((x''⊕y'')&R)⊕R, (x''⊕y''), Cin)(29).

[0052] Next, substituting the intermediate value G' of equation (18) into equation (29) yields equation (30), as shown below: Sout =(x''⊕y''⊕rz)⊕CLG(((x''& y'') ⊕((x''⊕y'')&R)⊕R), (x''⊕y''), Cin) =(x''⊕y''⊕rz)⊕CLG(((x''& y'')⊕R⊕((x''⊕y'')&R)), (x''⊕y''),Cin) (30) Therefore, the logic circuit of the safe carry-lookahead adder 150 can be obtained based on formula (30), formula (3) and formula (7)-formula (9) of the first type or formula (13)-formula (15) of the second type.

[0053] Figure 3AThis diagram shows an exemplary circuit diagram of a first-type secure carry-lookahead adder 150A according to some embodiments of the present invention. The secure carry-lookahead adder 150A includes masking units 312 and 314, a half-adder 320, logic circuitry 330, a carry-lookahead generator 340, and XOR gates 351 and 352.

[0054] As shown in equation (5), the masked data x'' is equal to the input data x'. XOR gate 351 is used to perform an XOR operation on the masking value ry and the masking value rx to obtain the variable Rxy, as shown in equation (3). In addition, the masking unit 312 includes an XOR gate 354, which is configured to perform a masking operation (i.e., an XOR operation) on the input data y' according to the variable Rxy to obtain the masked data y'', as shown in equation (6).

[0055] The half-adder 320 includes an XOR gate 356 and an AND gate 361. The XOR gate 356 is configured to receive masked data x'' and masked data y'', and output an intermediate propagation value P', as shown in equation (17). As previously described, the intermediate propagation value P' (i.e., x''⊕y'') is equal to the propagation value P (i.e., x⊕y). Furthermore, the AND gate 361 is configured to receive masked data x'' and masked data y'', and output an intermediate generated value G', as shown in equation (18).

[0056] Logic circuit 330 provides the generated value G based on the variable R, the intermediate generated value G', and the intermediate propagation value P' (i.e., the propagation value P). In some embodiments, logic circuit 330 includes XOR gate 357, XOR gate 358, and AND gate 362. XOR gate 357 is configured to receive the variable R and the intermediate generated value G', and output intermediate data D1. AND gate 362 is configured to receive the variable R and the intermediate propagation value P' (i.e., the propagation value P), and output intermediate data D2. Furthermore, XOR gate 358 is configured to receive intermediate data D1 and D2 and output the generated value G to carry-lookahead generator 340. Thus, carry-lookahead generator 340 can obtain carry output Cout and carry value C based on the propagation value P (i.e., the intermediate propagation value P'), the generated value G, and the carry input Cin. The operation of carry-lookahead generator 340 will be described later.

[0057] The masking unit 314 includes an XOR gate 355, which performs a masking operation on the intermediate propagation value P' (i.e., the propagation value P) based on the masking value rz to obtain the masked data D3. It is worth noting that because the path delay of the carry-lookahead generator 340 is relatively long, the masking value rz will first undergo a masking operation on the intermediate propagation value P' through the masking unit 314. Next, the XOR gate 352 is configured to receive the masked data D3 and the carry value C, and provide a sum output Sout.

[0058] After obtaining the sum output Sout, the safe carry-lookahead adder 150A provides the sum output Sout and carry output Cout to bus interface 110 for delivery to other circuits (e.g., a processor) via bus 10 for subsequent operations. As previously described, the sum output Sout is masked data. Therefore, in addition to providing the sum output Sout and carry output Cout, the safe adder 100 also provides a mask value rz to other circuits. These other circuits can then use the mask value rz to remove the mask from the sum output Sout and obtain the original value of the sum output Sout.

[0059] Figure 3B This diagram shows an exemplary circuit diagram of a second-type secure carry-lookahead adder 150B according to some embodiments of the present invention. The secure carry-lookahead adder 150B includes masking units 310 and 314, a half-adder 320, logic circuitry 330, a carry-lookahead generator 340, and XOR gates 351 and 352.

[0060] exist Figure 3B In this context, the masked data y'' is equal to the input data y', as shown in equation (12). Furthermore, the masking unit 310 includes an XOR gate 353, which is configured to perform a masking operation (i.e., an XOR operation) on the input data x' according to the variable Rxy, in order to obtain the masked data x'', as shown in equation (11).

[0061] Similar to Figure 3A The half-adder 320 outputs an intermediate propagation value P' (propagation value P) and an intermediate generated value G' based on the masked data x'' and y''. Next, the logic circuit 330 outputs a generated value G based on the variable R, the intermediate generated value G', and the intermediate propagation value P'. Then, the carry-lookahead generator 340 obtains a carry output Cout and a carry value C based on the propagation value P (i.e., the intermediate propagation value P'), the generated value G, and the carry input Cin. As previously described, the XOR gate 352 is configured to receive the carry value C and the masked data D3 from the masking unit 314, and provide a sum output Sout.

[0062] After obtaining the sum output Sout, the safe carry-lookahead adder 150B provides the sum output Sout and carry output Cout to bus interface 110 for delivery to other circuits (e.g., a processor) via bus 10 for subsequent operations. As previously described, the sum output Sout is masked data. Therefore, in addition to providing the sum output Sout and carry output Cout, the safe adder 100 also provides a mask value rz to other circuits. These other circuits can then use the mask value rz to remove the mask from the sum output Sout and obtain the original value of the sum output Sout.

[0063] Figure 4 This illustrates a 4-bit carry-lookahead generator 400 according to some embodiments of the present invention, suitable for... Figure 3A and Figure 3B The carry-lookahead generator 340. In this embodiment, the propagation value P is a 4-bit data consisting of propagation signals (or bits) P3, P2, P1, and P0, i.e., P = [P3, P2, P1, P0], where P3 is the most significant bit (MSB) and P0 is the least significant bit (LSB). The generated value G is a 4-bit data consisting of generated signals (or bits) G3, G2, G1, and G0, i.e., G = [G3, G2, G1, G0], where G3 is the most significant bit and G0 is the least significant bit. In addition, the input signal (or bit) C0 is a 1-bit data consisting of carry input Cin, i.e., C0 = Cin. Based on the propagation value P, the generated value G, and the carry input Cin, the carry-lookahead generator 400 can perform the following operations (31) to (34) to obtain the carry output Cout and the carry value C. The carry value C is a 4-bit data composed of the output signals (or bits) C3, C2, C1, and C0, i.e., C = [C3, C2, C1, C0], where C3 is the most significant bit and C0 is the least significant bit. Furthermore, the carry output Cout is composed of the output signal (or bit) C4, i.e., Cout = C4. Equations (31) to (34) are shown below: C1 = G0|P0&C0 (31); C2 = G1|P1&G0|P1&P0&C0 (32); C3 = G2|P2&G1|P2&P1&G0|P2&P1&P0&C0 (33); and C4 = G3|P3&G2|P3&P2&G1|P3&P2&P1&G0|P3&P2&P1& P0&C0 (34).

[0064] As previously described, "|" indicates an OR operation, while "&" indicates an AND operation.

[0065] The carry-lookahead generator 400 includes logic circuits 410, 420, 430, and 440. Logic circuit 410 is configured to perform the operation of formula (31) to generate signal C1 based on signals C0, G0, and P0. Logic circuit 420 is configured to perform the operation of formula (32) to generate signal C2 based on signals C0, G0 and G1, and P0 and P1. Furthermore, logic circuit 430 is configured to perform the operation of formula (33) to generate signal C3 based on signals C0, G0-G2, and P0-P2. Logic circuit 440 is configured to perform the operation of formula (34) to generate signal C4 based on signals C0, G0-G3, and P0-P3. It is worth noting that the 4-bit carry-lookahead generator 400 is merely an example and is not intended to limit the invention. More or fewer carry-lookahead generators can be used in the safe adder of the present invention. Furthermore, the carry value C generated by the carry-lookahead generator 400 has the same number of bits as the propagation value P and the generated value G, and the carry output Cout has one bit.

[0066] According to an embodiment of the present invention, in the secure adder 100, the first type and the second type of secure carry-lookahead adder 150 can perform operations on masked input data and provide masking protection for the operation result. Compared with conventional ripple carry adders that cannot perform secure operations, the first type and the second type of secure carry-lookahead adder 150 do not need to remove the masking of the input data (i.e., the secure carry-lookahead adder 150 does not reveal the original value of the input data (or operands), thus providing secure protection for the input signal. Furthermore, compared with conventional secure carry-lookahead adders, the secure carry-lookahead adder 150 can provide masking protection for the operation result regardless of whether the masking value rx is different from the masking value ry. In addition, the secure carry-lookahead adder 150 can use fewer logic units to complete the operation of the formula (30), thus reducing the power consumption of the secure adder and reducing the area of ​​the integrated circuit, thereby reducing the manufacturing cost.

[0067] Although the present invention has been described above with reference to preferred embodiments, it is not intended to limit the invention. Any person skilled in the art can make some modifications and refinements without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention shall be defined by the scope of the claims.

Claims

1. A carry-lookahead adder, characterized in that, include: A first XOR gate is used to receive a first mask value and a second mask value to provide a variable; A first masking unit is configured to perform a first masking operation on a first input data corresponding to the first masking value based on the variable, so as to obtain a first masked data. A half-adder is used to receive the first masked data and a second input data corresponding to the second masked value to generate a propagated value and an intermediate generated value. A second masking unit is configured to perform a second masking operation on the propagation value based on a third masking value to obtain a second masked data. A logic circuit for providing a generated value based on the propagation value, the intermediate generated value, and the second masking value; A carry-lookahead generator is used to provide a carry output and a carry value based on a carry input, the generated value, and the propagated value; as well as A second XOR gate is used to receive the second masked data and the carry value to provide a sum output; The half-adder is configured to perform a first AND operation on the first masked data and the second input data to obtain the intermediate generated value, and to perform a first mutually exclusive OR operation on the first masked data and the second input data to obtain the propagated value; The logic circuit is configured to perform a second mutually exclusive OR operation on the intermediate generated value and the second masking value to obtain a first intermediate data, perform a second AND operation on the propagation value and the second masking value to obtain a second intermediate data, and perform a third mutually exclusive OR operation on the first intermediate data and the second intermediate data to provide the generated value.

2. The carry-lookahead adder as described in claim 1, characterized in that, The first masking unit includes: A third XOR gate is used to receive the variable and the first input data to provide the first masked data.

3. The carry-lookahead adder as described in claim 1, characterized in that, The second masking unit includes: A fourth XOR gate is used to receive the third masking value and the propagation value to provide the second masked data.

4. The carry-lookahead adder as described in claim 1, characterized in that, The first input data is obtained by performing a third masking operation on a first data using the first masking value, and the second input data is obtained by performing a fourth masking operation on a second data using the second masking value, wherein the first masking value is the same as the second masking value.

5. The carry-lookahead adder as described in claim 1, characterized in that, The first input data is obtained by performing a third masking operation on a first data using the first masking value, and the second input data is obtained by performing a fourth masking operation on a second data using the second masking value, wherein the first masking value is different from the second masking value.

6. A safe adder, characterized in that, include: A mask generator, comprising: A random number generator for randomly generating a first masking value, a second masking value, and a third masking value; and A first masking unit is configured to perform a first masking operation on a first data based on a first masking value to obtain a first masked data, and to perform a second masking operation on a second data based on a second masking value to obtain a second masked data; and A carry-lookahead adder includes: A first XOR gate is used to receive the first mask value and the second mask value to provide a variable; A second masking unit is configured to perform a third masking operation on the first masked data according to the variable, so as to obtain a third masked data; A half-adder is used to receive the third masked data and the second masked data to generate a propagated value and an intermediate generated value. A third masking unit is configured to perform a fourth masking operation on the propagation value based on the third masking value to obtain a fourth masked data. A logic circuit for providing a generated value based on the propagation value, the intermediate generated value, and the second masking value; A carry-lookahead generator is configured to provide a carry output and a carry value based on a carry input, the generated value, and the propagation value; and A second XOR gate is used to receive the fourth masked data and the carry value to provide a sum output; The half-adder is configured to perform a first AND operation on the third masked data and the second masked data to obtain the intermediate generated value, and to perform a first mutually exclusive OR operation on the third masked data and the second masked data to obtain the propagated value. The logic circuit is configured to perform a second mutually exclusive OR operation on the intermediate generated value and the second masking value to obtain a first intermediate data, perform a second AND operation on the propagation value and the second masking value to obtain a second intermediate data, and perform a third mutually exclusive OR operation on the first intermediate data and the second intermediate data to provide the generated value.

7. The safe adder as described in claim 6, characterized in that, The half-adder includes: A first AND gate, used to receive the third masked data and the second masked data and perform the first AND operation to provide the intermediate generated value; and A third XOR gate is used to receive the third masked data and the second masked data and perform the first mutually exclusive OR operation to provide the propagation value.

8. The safe adder as described in claim 6, characterized in that, The logic circuit includes: A fourth XOR gate is used to receive the intermediate generated value and the second masking value and perform the second mutually exclusive OR operation to provide a first intermediate data; A second AND gate, used to receive the propagation value and the second masking value, to provide a second intermediate data; and A fifth XOR gate is used to receive the first intermediate data and the second intermediate data and perform the third mutually exclusive OR operation to provide the generated value.

9. A method for performing carry-lookahead addition, characterized in that, include: A variable is obtained based on a first masking value and a second masking value; A first masking operation is performed on a first input data corresponding to the first masking value using the variable to obtain a first masked data; Perform a first AND operation on the first masked data and a second input data corresponding to the second mask value to obtain an intermediate generated value; Perform a first mutual exclusion OR operation on the first masked data and the second input data to obtain a propagation value; A second masking operation is performed on the propagation value based on a third masking value to obtain a second masked data; Perform a second mutually exclusive OR operation on the intermediate generated value and the second masking value to obtain a first intermediate data; Perform a second AND operation on the propagation value and the second masking value to obtain a second intermediate data; Perform a third mutually exclusive OR operation on the first intermediate data and the second intermediate data to provide a generated value; A carry-lookahead generator generates a carry-out and a carry-value based on a carry input, the generated value, and the propagated value; and Based on the second masked data and the carry value, a sum output is obtained; The first masking operation and the second masking operation are performed by different XOR gates.

10. The method for performing carry-lookahead addition as described in claim 9, characterized in that, Also includes: A third masking operation is performed on a first data using the first masking value to obtain the first input data; as well as A fourth masking operation is performed on a second set of second data using the second masking value to obtain the second input data.

Images