Cryptographic accelerator and differential fault analysis method of encryption and decryption operations

Abstract

The present application provides a cipher accelerator and a differential fault analysis method for encryption and decryption operations. An encryption and decryption circuit is configured to perform encryption and decryption operations according to control signals. The encryption and decryption operations include a plurality of normal rounds and a plurality of redundant rounds. A controller is configured to provide the control signals to the encryption and decryption circuit according to a first variable and a second variable, so as to control the encryption and decryption circuit to perform the normal rounds and the redundant rounds in a sequence. A first memory is configured to store a state of performing the normal rounds. A second memory is configured to store a state of performing the redundant rounds. The encryption and decryption circuit divides the normal rounds into a first normal part and a second normal part according to the first variable, and divides the redundant rounds into a first redundant part and a second redundant part according to the second variable. The encryption and decryption circuit sequentially performs the first normal part, the first redundant part, the second normal part, and the second redundant part. The present application can avoid an attacker from making the same fault in the normal rounds and the redundant rounds, and improve a time redundancy mechanism.

Description

Technical Field

[0001] This invention relates to a cryptographic accelerator, and more particularly to a cryptographic accelerator for performing differential fault analysis. Background Technology

[0002] In recent years, encryption and decryption applications have been widely used in various electronic products. These applications place great emphasis on protecting confidential information to prevent data from being analyzed and stolen.

[0003] During encryption and decryption, a voltage glitch attack involves rapidly changing the voltage input to an integrated circuit (IC). This causes some transistors in the IC to produce erroneous output values, leading to processor errors or the processing of incorrect data. Furthermore, information hidden within the IC can be leaked due to these processor errors.

[0004] Therefore, analyzing whether the data in the operation has been attacked is one of the problems that needs to be solved in encryption and decryption applications. Summary of the Invention

[0005] This invention provides a cryptographic accelerator. The cryptographic accelerator includes an encryption / decryption circuit, a controller, a first memory, and a second memory. The encryption / decryption circuit is configured to perform an encryption / decryption operation according to a control signal. The encryption / decryption operation includes multiple normal rounds and multiple redundant rounds. The controller is configured to provide the control signal to the encryption / decryption circuit according to a first variable and a second variable to control the order in which the encryption / decryption circuit executes the normal rounds and the redundant rounds. The first memory is configured to store the state of executing the normal rounds. The second memory is configured to store the state of executing the redundant rounds. The encryption / decryption circuit divides the normal rounds into a first normal portion and a second normal portion according to the first variable of the control signal, and divides the redundant rounds into a first redundant portion and a second redundant portion according to the second variable of the control signal. The encryption / decryption circuit executes the first normal portion, the first redundant portion, the second normal portion, and the second redundant portion sequentially to complete the encryption / decryption operation.

[0006] Furthermore, this invention provides a differential fault analysis method for encryption / decryption operations, wherein an encryption / decryption operation includes multiple normal rounds and multiple redundant rounds. A first variable and a second variable are obtained using a random number generator. Based on the first variable, the normal rounds are divided into a first normal portion and a second normal portion, and based on the second variable, the redundant rounds are divided into a first redundant portion and a second redundant portion. The first normal portion, the first redundant portion, the second normal portion, and the second redundant portion are executed sequentially according to a clock cycle. The success of the encryption / decryption operation is determined based on a first state from a first memory corresponding to the second normal portion and a second state from a second memory corresponding to the second redundant portion. Attached Figure Description

[0007] Figure 1 This is a schematic diagram illustrating the execution of encryption and decryption algorithms according to some embodiments of the present invention.

[0008] Figure 2 This describes a cryptographic accelerator according to some embodiments of the present invention.

[0009] Figure 3 This is to illustrate the embodiments described in the present invention. Figure 2 The controller.

[0010] Figure 4 This describes a differential fault analysis method for performing encryption and decryption operations according to some embodiments of the present invention.

[0011] Figure 5 This illustrates the use according to some embodiments of the present invention. Figure 4 The diagram illustrates the method for executing encryption and decryption algorithms.

[0012] [Symbol Explanation]

[0013] 10: Busbar

[0014] 20: Cryptographic Accelerator

[0015] 30: Bus Interface

[0016] 40: Input / Output Buffer

[0017] 50: Controller

[0018] 60: Encryption / decryption circuit

[0019] 70, 80: Memory

[0020] 110: Processor

[0021] 120: Normal Mode Finite State Machine Unit

[0022] 130: Analysis Mode Finite State Machine Unit

[0023] 140: Random Number Generator

[0024] 150: Multiplexer

[0025] 200: Method

[0026] CTRL: Control signal

[0027] Comp_State: Signal

[0028] IN: Input data

[0029] Normal_FSM, TRRSM_FSM: Finite state machine information

[0030] NR, NR1-NR10: Normal rounds

[0031] NR_SEC1: First normal part

[0032] NR_SEC2: Second Normal Part

[0033] NO1-NO10, O1-O10, RO6-RO10: Output

[0034] R1-R10: Rounds

[0035] RNG: Random Variable

[0036] RR, RR6-RR10: Redundant rounds

[0037] RR_SEC1: First Redundancy

[0038] RR_SEC2: Second Redundancy

[0039] S210-S240: Steps

[0040] t0-t4: Time

[0041] x: First variable

[0042] y: Second variable Detailed Implementation

[0043] To make the above and other objects, features, and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings:

[0044] Figure 1This is a schematic diagram illustrating the execution of encryption and decryption algorithms according to some embodiments of the present invention. In some embodiments, the encryption and decryption algorithm may be the Advanced Encryption Standard (AES) algorithm, which is currently widely analyzed and used. In some embodiments, the encryption and decryption algorithm may be the ChaCha algorithm.

[0045] exist Figure 1 In this process, the encryption / decryption algorithm executes multiple rounds. Furthermore, each round uses the same circuitry to perform the same or similar operations on the state from the previous round. Figure 1 In the algorithm, the encryption / decryption process executes 10 rounds R1-R10. First, based on the input data IN, round R1 is executed, yielding output O1. Next, the output O1 from round R1 is substituted into round R2 for calculation, yielding output O2. Then, the output O2 from round R2 is substituted into round R3 for calculation, yielding output O3, which is then substituted into round R4. This process continues, with rounds R4 through R10 executed sequentially, producing outputs O4 through O10 respectively. Thus, after completing the 10 rounds of encryption / decryption computation (R1-R10), the final output O10 is obtained.

[0046] During the encryption / decryption operation of an integrated circuit, differential fault analysis can be performed using normal rounds R1-R10 and redundant rounds R1-R10 to determine whether the encryption / decryption process has been maliciously attacked (e.g., voltage glitch attack). First, normal rounds R1-R10 (hereinafter referred to as normal rounds NR1-NR10) are executed based on the initial state of the input data, resulting in the normal round output NO10. Next, redundant rounds R1-R10 (hereinafter referred to as redundant rounds RR1-RR10) are executed based on the initial state of the input data, resulting in the redundant round output RO10. Then, it is determined whether the normal round output NO10 is the same as the redundant round output RO10. If the normal round output NO10 and the redundant round output RO10 are the same, it indicates that the encryption / decryption operation has not failed (i.e., the encryption / decryption process has not been attacked). Therefore, the normal round output NO10 can be transmitted to other circuits for subsequent operations. Conversely, if the normal round output NO10 differs from the redundant round output RO10, it indicates a failure in the encryption / decryption operation (i.e., the encryption / decryption process has been attacked). The integrated circuit will then re-execute normal rounds NR1-NR10 and redundant rounds RR1-RR10 until the normal round output NO10 and the redundant round output RO10 are consistent. In some embodiments, when the normal round output NO10 differs from the redundant round output RO10, the integrated circuit will directly terminate the encryption / decryption operation and notify other circuits (e.g., by transmitting a specific value) that the encryption / decryption process has been attacked and has failed.

[0047] Figure 2 This describes a cipher accelerator 20 according to some embodiments of the present invention. The cipher accelerator 20 is implemented in an integrated circuit to encrypt and decrypt data from other circuits via bus 10, and to transmit the encrypted / decrypted data back to the original circuit or to other circuits.

[0048] The cryptographic accelerator 20 includes a bus interface 30, an input / output buffer 40, a controller 50, encryption / decryption circuitry 60, a memory 70, and a memory 80. In some embodiments, the memories 70 and 80 may be memory or temporary storage. The bus interface 30 is coupled to the bus 10. The bus interface 30 can transmit instructions from other circuits on the bus 10 to the controller 50 and transmit responses from the controller 50 to the bus 10. Furthermore, the bus interface 30 can transmit data to be encrypted or decrypted to the input / output buffer 40 and transmit encrypted or decrypted data from the input / output buffer 40 to the bus 10.

[0049] In response to instructions from bus interface 30, controller 50 provides control signals to encryption / decryption circuit 60, and the control signal CTRL includes finite state machine (FSM) information related to encryption / decryption operations. In some embodiments, controller 50 may provide control signal CTRL to encryption / decryption circuit 60 with finite state machine information corresponding to a normal mode or finite state machine information corresponding to a differential fault analysis mode.

[0050] In normal mode, the control signal CTRL only instructs the encryption / decryption circuit 60 to perform normal encryption / decryption operations and not redundant encryption / decryption operations; that is, the encryption / decryption circuit 60 only performs the normal round NR. Therefore, after completing the normal round NR, the encryption / decryption circuit 60 obtains the encrypted / decrypted data and transmits it to the input / output buffer 40. The encrypted / decrypted data is then provided to bus 10 through bus interface 30 for other circuits to execute subsequent programs.

[0051] In differential fault analysis mode, in addition to normal encryption / decryption operations, the control signal CTRL instructs the encryption / decryption circuit 60 to perform redundant encryption / decryption operations, i.e., the encryption / decryption circuit 60 will further perform redundant rounds RR. After completing the normal encryption / decryption operation and the redundant encryption / decryption operation, the encryption / decryption circuit 60 compares the results to determine if they are consistent. If the results are inconsistent, the encryption / decryption circuit 60 provides the signal Comp_State to the controller 50 to notify the controller 50 of a fault. Conversely, if the results are consistent, the encryption / decryption circuit 60 transmits the encrypted / decrypted data to the input / output buffer 40. The encrypted / decrypted data is then provided to bus 10 via bus interface 30 for other circuits to execute subsequent programs.

[0052] In differential fault analysis mode, the results (states) generated during normal encryption / decryption operations by the cryptographic accelerator 20 are stored in memory 70, while the results (states) generated during redundant encryption / decryption operations are stored in memory 80. Furthermore, the number of redundant rounds (RR) required for redundant encryption / decryption operations is less than the number of normal rounds (NR) required for normal encryption / decryption operations. In other words, the time required for redundant encryption / decryption operations (i.e., the number of clock cycles) is less than the time required for normal encryption / decryption operations (i.e., the number of clock cycles). Therefore, using the cryptographic accelerator 20 can accelerate differential fault analysis operations and reduce the required analysis time.

[0053] Figure 3This is to illustrate the embodiments described in the present invention. Figure 2 The controller 50 includes a multiplexer (MUX) 150, a processor 110, a normal mode finite state machine unit 120, an analysis mode finite state machine unit 130, and a random number generator 140. Figure 3 In order to simplify the description, only the relevant circuits of controller 50 are described, while other circuits will be omitted.

[0054] In normal mode, processor 110 controls normal mode finite state machine unit 120 to generate finite state machine information Normal_FSM corresponding to normal encryption / decryption operations. Furthermore, in differential fault analysis mode, processor 110 controls analysis mode finite state machine unit 130 to generate finite state machine information TRRSM_FSM corresponding to normal encryption / decryption operations combined with redundant encryption / decryption operations. It is worth noting that analysis mode finite state machine unit 130 provides finite state machine information TRRSM_FSM based on random variable RNG from a random number generator. Moreover, the number of redundant rounds RR required to perform redundant encryption / decryption operations is determined by the random variable RNG. In other words, the number of redundant rounds RR required for each execution of redundant encryption / decryption operations is variable.

[0055] Also refer to Figure 2 and Figure 3 In normal mode, processor 110 controls multiplexer 150 to select finite state machine information Normal_FSM from normal mode finite state machine unit 120 as control signal CTRL. Furthermore, in differential fault analysis mode, processor 110 controls multiplexer 150 to select finite state machine information TRRSM_FSM from analysis mode finite state machine unit 130 as control signal CTRL.

[0056] As previously described, in differential fault analysis mode, the encryption / decryption circuit 60 determines whether the results of normal encryption / decryption operations and redundant encryption / decryption operations are consistent, and provides a Comp_State signal to the controller 50 to notify the controller 50 whether a fault has occurred. When the Comp_State signal indicates a fault has occurred, the processor 110 controls the analysis mode finite state machine unit 130 to generate finite state machine information TRRSM_FSM again, so as to control the encryption / decryption circuit 60 to re-execute the normal encryption / decryption operations and redundant encryption / decryption operations. In some embodiments, when the Comp_State signal indicates a fault has occurred, the processor 110 directly terminates the encryption / decryption operation and notifies other circuits (e.g., by transmitting a specific value) that the encryption / decryption process has been attacked and the operation has failed.

[0057] Figure 4This describes a differential fault analysis method 200 for performing encryption and decryption operations according to some embodiments of the present invention. According to the differential fault analysis method 200, the cryptographic accelerator 20 can provide finite state machine information TRRSM_FSM with a timing-redundancy random swapping mechanism to perform differential fault analysis. Figure 5 This illustrates the use according to some embodiments of the present invention. Figure 4 A schematic diagram illustrating the encryption / decryption algorithm executed by the differential fault analysis method 200. For ease of explanation, assume... Figure 5 The total number of normal rounds NR is 10, meaning that encryption and decryption operations require executing normal rounds NR1-NR10.

[0058] Also refer to Figure 4 and Figure 5 First, in step S210, a random variable RNG is obtained. The random variable RNG includes a first variable x and a second variable y. When the total number of normal rounds (NR) is 10, the first variable x can be a random value between the integers 1 and 7 (i.e., 1 ≤ x ≤ 7), and the second variable y can be a random value between 0 and the integer 10 minus the first variable x (i.e., 0 ≤ y ≤ (10 - x)). In this embodiment, it is assumed that the first variable x is 5 (i.e., x = 5) and the second variable y is 2 (i.e., y = 2). Furthermore, the sum of the first variable x and the second variable y is less than or equal to the total number of normal rounds (i.e., x + y ≤ 10).

[0059] In step S220, based on the first variable x, the normal rounds NR1-NR10 are divided into a first normal part NR_SEC1 and a second normal part NR_SEC2. For example... Figure 5 As shown, the first normal portion NR_SEC1 includes normal rounds NR1, NR2, NR3, NR4, and NR5, while the second normal portion NR_SEC2 includes normal rounds NR6, NR7, NR8, NR9, and NR10. Furthermore, based on the first variable x and the total number of normal rounds NR, the number of redundant rounds RR is 5 (i.e., 10 - x = 5). It is noteworthy that the operation of each redundant round RR is identical to its corresponding normal round NR. For example, the operations of redundant rounds RR6, RR7, RR8, RR9, and RR10 correspond to the operations of normal rounds NR6, NR7, NR8, NR9, and NR10, respectively. In other words, the number of redundant rounds RR6-RR10 is the same as the number of normal rounds NR6-NR10 in the second normal portion NR_SEC2, and the operations of redundant rounds RR6-RR10 are identical to those in the second normal portion NR_SEC2.

[0060] Next, based on the second variable y, the redundant rounds RR6-RR10 are divided into a first redundant part RR_SEC1 and a second redundant part RR_SEC2. For example... Figure 5 As shown, the first redundancy portion RR_SEC1 includes redundant rounds RR6 and RR7, while the second redundancy portion RR_SEC2 includes redundant rounds RR8, RR9 and RR10.

[0061] In step S230, the analysis mode finite state machine unit 130 generates finite state machine information TRRSM_FSM so as to control the encryption / decryption circuit 60 to sequentially execute the first normal part NR_SEC1, the first redundant part RR_SEC1, the second normal part NR_SEC2, and the second redundant part RR_SEC2 according to a clock cycle.

[0062] like Figure 5 As shown, in the first normal part NR_SEC1, normal round NR1 is executed first to obtain output NO1, which is then stored in memory 70. Next, the output NO1 of normal round NR1 is substituted into normal round NR2 for calculation to obtain output NO2, which is also stored in memory 70. Thus, the state generated by the normal encryption / decryption operation stored in memory 70 is updated to output NO2. This process continues, with normal rounds NR3 through NR5 executed sequentially, generating outputs NO3 through NO5 respectively. Furthermore, the state generated by the normal encryption / decryption operation stored in memory 70 is updated to outputs NO3, NO4, and NO5 sequentially. This completes the first normal part NR_SEC1.

[0063] In some embodiments, after completing a normal round NR5, in addition to storing the output NO5 in memory 70, the encryption / decryption circuit 60 also stores the output NO5 in memory 80.

[0064] After completing the first normal part NR_SEC1, the encryption / decryption circuit 60 substitutes the output NO5 into the redundant round RR6 of the first redundant part RR_SEC1 for calculation to obtain the output RO6, and stores the output RO6 in the memory 80. Thus, the state stored in the memory 80 is updated to the output RO6. Next, the output RO6 of the redundant round RR6 is substituted into the redundant round RR7 for calculation to obtain the output RO7, and the output RO7 is stored in the memory 80. Thus, the state generated by the redundant encryption / decryption operation stored in the memory 80 is updated to the output RO7. Therefore, the first redundant part RR_SEC1 is completed.

[0065] After completing the first redundant section RR_SEC1, the encryption / decryption circuit 60 substitutes the output NO5 stored in memory 70 into the normal round NR6 of the second normal section NR_SEC2 for calculation to obtain output NO6, and stores output NO6 in memory 70. Next, the output NO6 of normal round NR6 is substituted into normal round NR7 for calculation to obtain output NO7, and output NO7 is stored in memory 70. This process continues, with normal rounds NR8 to NR10 executed sequentially, generating outputs NO8 to NO10 respectively. Furthermore, the states generated by the normal encryption / decryption operations stored in memory 70 are sequentially updated to outputs NO8, NO9, and NO10. Thus, the completion of the second normal section NR_SEC2 and the states generated by the normal encryption / decryption operations stored in memory 70 are finally updated to output NO10.

[0066] After completing the second normal part NR_SEC2, the encryption / decryption circuit 60 substitutes the output RO7 stored in memory 80 into the redundant round RR8 of the second redundant part RR_SEC2 for calculation to obtain output RO8, and stores output RO8 in memory 80. Next, the output RO8 of redundant round RR8 is substituted into redundant round RR9 for calculation to obtain output RO9, and stores output RO9 in memory 80. Then, the output RO9 of redundant round RR9 is substituted into redundant round RR10 for calculation to obtain output RO10, and stores output RO10 in memory 80. Thus, the state generated by the redundant encryption / decryption operations stored in memory 80 is finally updated to output RO10. Thus, the second redundant part RR_SEC2 is completed.

[0067] Referring to the differential fault analysis method 200, in step S240, the encryption / decryption circuit 60 compares the last output NR10 of the normal round NR stored in memory 70 with the last output RR10 of the redundant round RR stored in memory 80. If the output NR10 is the same as the output RR10, the encryption / decryption circuit 60 performs the encryption / decryption operation based on the output NR10 and provides the encrypted / decrypted data to the input / output buffer 40 for transmission to the bus 10 via the bus interface 30. Conversely, if the output NR10 is different from the output RR10, the encryption / decryption circuit 60 provides the signal Comp_State to the controller 50 to notify the controller 50 that a fault has occurred.

[0068] exist Figure 5In this process, the first normal portion NR_SEC1 is executed starting at time t0 (e.g., t0 = 0). Next, the first redundant portion RR_SEC1 is executed starting at time t1 (e.g., t1 = x). Then, the second normal portion NR_SEC2 is executed starting at time t2 (e.g., t2 = x + y). Next, the second redundant portion RR_SEC2 is executed starting at time t3 (e.g., t3 = 10 + y). Finally, the second redundant portion RR_SEC2 ends at time t4 (e.g., t4 = 20 - y). In other words, the normal rounds NR and redundant rounds RR are executed alternately. Furthermore, only the latter half of the redundant rounds RR (e.g., redundant rounds RR6-RR10) needs to be executed. Compared to traditional differential fault analysis that requires executing all redundant rounds RR (e.g., redundant rounds RR1-RR10) or adding additional random / idle cycles, this embodiment only requires executing a portion of the redundant rounds RR, thus reducing analysis time.

[0069] In this embodiment of the invention, the end times of the normal round (NR) and the redundant round (RR) are each protected by a random variable (RNG). For example, a first variable (x) can be used to protect the end time of the redundant round (RR) (e.g., the end time of redundant round (RR) 10), and a second variable (y) can be used to protect the end time of the normal round (NR) (e.g., the end time of normal round (NR) 10). Since the end times of the redundant round (RR) and the normal round (NR) are determined by different variables (e.g., the first variable (x) and the second variable (y), the difficulty of attack is increased. Compared to traditional differential fault analysis where the redundant round (RR) and / or the normal round (NR) have fixed end times, this embodiment of the invention can prevent attackers from creating the same fault at critical time points in both the normal round (NR) and the redundant round (RR), thereby improving the time redundancy mechanism.

[0070] Although the present invention has been described above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art may make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the scope of the claims.

Claims

1. A cryptographic accelerator, characterized in that, include: An encryption / decryption circuit is used to perform an encryption / decryption operation according to a control signal, wherein the encryption / decryption operation includes multiple normal rounds and multiple redundant rounds; A controller is configured to provide the control signal to the encryption / decryption circuit based on a first variable and a second variable, so as to control the order in which the encryption / decryption circuit executes the normal round and the redundant round; A first memory is used to store the state of the execution of the normal round; as well as A second memory is provided for storing the state of executing the redundant rounds; The encryption / decryption circuit divides the normal round into a first normal part and a second normal part according to the first variable of the control signal, and divides the redundant round into a first redundant part and a second redundant part according to the second variable of the control signal. The encryption / decryption circuit sequentially executes the first normal part, the first redundant part, the second normal part, and the second redundant part to complete the encryption / decryption operation. The number of redundant rounds is determined by the first variable and is less than the number of normal rounds, and the sum of the first variable and the second variable is less than or equal to the number of normal rounds.

2. The cryptographic accelerator according to claim 1, characterized in that, The operation of the redundant rounds is the same as that of the second normal part.

3. The cryptographic accelerator according to claim 1, characterized in that, The end time of the normal round is determined by the second variable, and the end time of the redundant round is determined by the first variable.

4. The cryptographic accelerator according to claim 1, characterized in that, When the encryption / decryption circuit sequentially executes each of the first normal rounds to the first normal round, the encryption / decryption circuit stores a first state corresponding to the first normal round in the first memory, and executes the first redundant part according to the first state.

5. The cryptographic accelerator according to claim 4, characterized in that, When the encryption / decryption circuit sequentially executes each of the first redundant rounds to a first redundant round according to the first state, the encryption / decryption circuit stores a second state corresponding to the first redundant round in the second memory, and executes the second normal part according to the first state stored in the first memory.

6. The cryptographic accelerator according to claim 5, characterized in that, When the encryption / decryption circuit sequentially executes each normal round to a second normal round of the second normal part according to the first state, the encryption / decryption circuit stores a third state corresponding to the second normal round in the first memory, and sequentially executes the second redundant part according to the second state stored in the second memory.

7. The cryptographic accelerator according to claim 6, characterized in that, When the encryption / decryption circuit sequentially executes each of the second redundant rounds to a second redundant round according to the second state, the encryption / decryption circuit stores a fourth state corresponding to the second redundant round into the second memory.

8. The cryptographic accelerator according to claim 7, characterized in that, When the third state of the first memory is the same as the fourth state of the second memory, the encryption / decryption circuit determines that the encryption / decryption operation is successful.

9. A differential fault analysis method for encryption / decryption operations, characterized in that, An encryption / decryption operation includes multiple normal rounds and multiple redundant rounds. The differential fault analysis method includes: A first variable and a second variable are obtained by using a random number generator; According to the first variable, the normal round is divided into a first normal part and a second normal part, and according to the second variable, the redundant round is divided into a first redundant part and a second redundant part. Based on a clock cycle, the first normal portion, the first redundant portion, the second normal portion, and the second redundant portion are executed sequentially; and Based on a first state from a first memory and corresponding to the second normal portion and a second state from a second memory and corresponding to the second redundant portion, it is determined whether the encryption / decryption operation is successful. The number of redundant rounds is determined by the first variable and is less than the number of normal rounds, and the sum of the first variable and the second variable is less than or equal to the number of normal rounds.

Images