Multiplication method and electronic circuit

Abstract

The invention relates to a multiplication method and an electronic circuit. A digital multiplicand is received. An initial digital multiplier including logical 0 and 1 is also received. The processing of the initial multipliers includes, at the beginning of a string of initial multipliers each having at least one logic 1, outputting a final multiplier by applying or not applying Booth coding to the string in a selective manner. The multiplicand is then multiplied by the final multiplier to produce an output.

Description

[0001] Priority claim

[0002] This application claims priority to French patent application No. 2310518 filed on October 2, 2023, the contents of which are incorporated herein by reference in their entirety to the maximum extent permitted by law. Technical Field

[0003] Embodiments and examples relate to multiplication of operands in multiplication electronic circuits, particularly to performing cryptographic calculations, and more particularly to making side channel attacks (SCA) more difficult. Background Art

[0004] Cryptographic computations should maintain the confidentiality of the secrets processed during the multiplication operations.

[0005] At each clock cycle, the multiplicand is multiplied by the multiplicand. This produces consumption peaks and electromagnetic peaks, the shape and amplitude of which can reveal the value of the multiplier, the value of the multiplicand, and the value of the contents of the accumulator register. This can lead to the extraction of the secret value using a side channel attack (SCA) type of attack. Protecting these secrets from SCA type attacks is difficult to achieve.

[0006] It is possible to perform arithmetic masking of data using a random number R. For example, the multiplication A*B is masked by performing the following operation A*(B+R)-A*R, which gives the same result as the result of the multiplication A*B.

[0007] Arithmetic masking is currently used in many implementations and is most often managed at the software level. However, masking data increases the number of operations or hardware circuits (if these hardware circuits are integrated in hardware). In addition, new machine learning techniques can use unique traces to make attacks successful and defeat data masking countermeasures.

[0008] In U.S. Patent Application Publication No. 2013 / 0262544 (which is incorporated herein by reference), a multiplication device is proposed, which includes an encoder implementing Booth-2 type Booth coding, which is modified so as to pass an empty codeword ("generate zero Booth code") or a codeword with all bits equal to 1 ("avoid zero Booth code") at the output of the encoder, and only does so when the bits of the multiplier word are empty.

[0009] Thus, Booth coding is applied to all words of the multiplier, wherein the Booth codeword is modified to be obfuscated only when the multiplier word is empty. Hence, this leads to a potential weakness with respect to SCA attacks, since only the value 0 is protected.

[0010] There exists a need to provide another solution to make multiplication circuits more robust against SCA type attacks. Summary of the invention

[0011] According to one aspect, a multiplication method is provided, comprising: receiving a digital multiplicand; receiving a so-called "initial" digital multiplier comprising logical 0s and 1s; processing the multiplier, including at the beginning of each string of at least one logical 1 of the initial multiplier, by applying or not applying (in other words, selectively applying) Booth encoding to the string so as to output a so-called "final" multiplier; and multiplying the multiplicand by the final multiplier.

[0012] Therefore, at the beginning of each string of 1s (a string of 1s may contain one 1 or several consecutive 1s), it is decided whether to use Booth encoding.

[0013] In other words, unlike the teaching of US2013 / 0262544 of continuously applying Booth coding with modification of the coding in the specific case of a null word, the method according to this aspect provides for not systematically applying Booth coding, but rather for deciding each time a string of 1s is detected whether to apply Booth coding to the detected string of 1s, and of course also to the 0s immediately following the string of 1s.

[0014] Therefore, the multiplication is done without any additional operations, using only simple operand encoding, which is more efficient than masking the data to protect against SCA attacks.

[0015] Furthermore, this solution requires no additional computation time and only very little additional computing power (a few percentage points).

[0016] Furthermore, due to the decision to continue with Booth encoding or not, for example, an 8-bit operand can be encoded with 16 different values ​​on average, which makes it much more difficult to identify the operand during an SCA attack.

[0017] Although the decision whether to perform Booth encoding on a string of 1s may be made according to any criteria, it is particularly advantageous to make this decision randomly, making identification of the operands even more difficult.

[0018] Therefore, according to one embodiment, the method further comprises receiving a pseudo-random digital data segment. Whether to apply Booth encoding to the string depends on the logic value of a bit of the pseudo-random data segment that coincides with the beginning of the string.

[0019] For example, Booth encoding may include Booth-1 encoding or Booth-2 encoding.

[0020] According to another aspect, there is provided a multiplication electronic circuit, such as an integrated circuit, comprising: a first input for receiving a digital multiplicand; a second input for receiving an initial digital multiplier comprising logic 0s and 1s; a first stage configured to receive the initial digital multiplier and to apply or not apply (in other words, selectively apply) Booth encoding to the string at the beginning of each string of the multiplier having at least one logic 1, and output a final multiplier; and a multiplication stage configured to perform a multiplication of the multiplicand by the final multiplier.

[0021] According to one embodiment, the circuit further comprises a third input for receiving a pseudo-random digital data segment, and the first stage is configured to apply or not apply Booth encoding to the string depending on the logic value of a bit of the pseudo-random data segment coinciding with the start of the string.

[0022] Booth encoding may include Booth-1 encoding or Booth-2 encoding.

[0023] According to one embodiment, the circuit is clocked by a clock signal, the multiplicand includes a series of n-bit words, the multiplier includes a series of k-bit words, for example, k=8, the pseudo-random digital data segment includes a series of j-bit words (for example, for Booth-1 encoding, j=k; and for Booth-2 encoding, j=k / 2), at each cycle of the clock signal, the first stage is configured to receive the word of the initial multiplier, the word of the pseudo-random data segment, and output a j-sign word of the final multiplier (through the effect of Booth encoding, one symbol contains several bits), and the multiplication stage includes j multiplexers, which are controlled based on the j symbols of the word of the final multiplier respectively.

[0024] These multiplexers are configured to receive at their multiplexer inputs during the cycle an input word selected from the group formed by a null word, a multiplicand word, the negation of this word, a word of the multiplicand word shifted left and a word of the negation of the word shifted left, double the word of the multiplicand, the negation of this double, a word of the multiplicand word shifted left twice and a word of the negation of this double, and to output at their respective outputs partial products resulting from respective selected multiplexer inputs during a cycle of the clock signal.

[0025] The output of the multiplexer is connected to the input of the spare adder stage.

[0026] The use of double the word of the multiplicand, the negation of this double, and double the word of the multiplicand shifted left and this double negation shifted left word in Booth-2 encoding is particularly advantageous because the number of multiplexers is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Other advantages and features of the present invention will become apparent upon examination of the detailed description of non-limiting examples and embodiments and in light of the accompanying drawings, in which:

[0028] Figure 1 A multiplication electronic circuit is illustrated;

[0029] Figure 2 An implementation of the multiplication method is illustrated;

[0030] Figures 3 to 6 An embodiment for implementing Booth-1 type Booth encoding in a pseudo-random manner is illustrated; and

[0031] Figures 7 to 9 An embodiment for implementing Booth-2 type encoding is illustrated. DETAILED DESCRIPTION

[0032] Figure 1 A multiplication electronic circuit IC, such as an integrated circuit, is illustrated, comprising: a first input E1 for receiving a digital multiplicand A; and a second input for receiving an initial digital multiplier BI comprising logical zeros and ones.

[0033] The circuit also includes a first stage circuit ET1, which is configured to receive an initial digital multiplier BI, and apply or not apply (in other words, selectively apply) Booth encoding to the string at the beginning of each string of multipliers having at least one logical 1, and output a final multiplier BF.

[0034] The circuit further comprises a multiplication stage circuit ETM configured to perform a multiplication of the multiplicand A and the final multiplier BF and output a result of the multiplication RS.

[0035] As one can see in more detail hereinafter, the multiplication stage ETM comprises in particular a given number of multiplexers controlled by a selection word BSL obtained as a function of the final multiplier BF.

[0036] Furthermore, in practice, the circuit is clocked by a clock signal CLK output by a clock generator GNK having a conventional structure known to those skilled in the art, and the multiplicand A comprises a series of n-bit words.

[0037] The initial multiplier BI comprises a series of k-bit words, for example bytes (k=8).

[0038] The circuit herein comprises a third input E3 configured to receive a pseudo-random digital data segment R output by a random number generator GNR having a conventional structure known to those skilled in the art.

[0039] The pseudo-random digital data segment R comprises a series of j-bit words (as one will see in more detail below, j may be equal to k or k / 2, depending on the type of Booth encoding used).

[0040] And, at each cycle of the clock signal CLK, the first stage circuit ET1 is configured to receive the word of the initial multiplier BI, the word of the pseudo-random data segment, and output the j-sign word of the final multiplier BF, according to which the selection word BSL will be determined.

[0041] Figure 2 An implementation of the multiplication method is illustrated.

[0042] The method includes receiving an initial digital multiplier BI and receiving a pseudo-random digital data segment R.

[0043] Thereafter, step ST10 includes processing the initial multiplier, including by applying or not applying (in other words, selectively applying) Booth encoding to the string at the beginning of each string of the initial multiplier having at least one logic 1, so as to output a final multiplier BF.

[0044] The method further comprises receiving a digital multiplicand A and, in step ST20, multiplying the multiplicand A by a final multiplier BF so as to output a result RS.

[0045] Now more specifically refer to Figures 3 to 6 To illustrate the embodiments and implementation methods of the present invention for implementing Booth-1 type Booth coding in a pseudo-random manner.

[0046] Booth-1 encoding is well known to those skilled in the art.

[0047] Its principle is as follows Figure 3 As reviewed in .

[0048] like Figure 3 The word BI shown in the example at the top of is encoded by Booth-1 encoding to become the word BF shown below the word BI.

[0049] More specifically, a string of 1s includes 1 or several consecutive 1s. Such a string ends with a 0 and may (but not necessarily) be constrained by two 0s.

[0050] When a bit of word BI is a 1 marking the start of a string of 1s, this 1 is encoded as -1.

[0051] When a 0-valued bit of word BI marks the end of a string of 1s, it is encoded as 1.

[0052] When a 1 is in a string of 1s, it is encoded as a 0.

[0053] Finally, when a 0 is in a string of 0s, it is encoded as 0.

[0054] Reference now Figure 4 , Figure 4 More specifically, it shows the case of whether Booth-1 encoding is applied at the beginning of a string of 1s.

[0055] In this respect, a bit STR1 is used which, depending on its value, indicates whether, before processing the current bit BIi of the initial multiplier word, this is actually a string of 1s encoded with Booth-1 encoding.

[0056] Reference STR1N refers to the new value of bit STR1 after processing bit Bii.

[0057] So if bit BIi is 0 and bit STR1 is 0 (for example), this means it is not a string of 1s.

[0058] In this case, whatever the value of the bit Ri of the pseudo-random data segment, the bit BFi is equal to 0 and the new value STR1N of the bit STR1 does not change and remains equal to 0.

[0059] Conversely, if bit BIi is equal to 0 and bit STR1 has the value 1, this means that, whatever the value of bit Ri, this bit BIi marks the end of the string of 1s encoded with Booth-1 encoding.

[0060] Therefore, bit BFi takes the value 1 and the new value STR1N of bit STR1 is 0.

[0061] If bit BIi is 1 and bit STR1 is 0, this means that this is the start of a string of 1s.

[0062] In this case, the value of the bits of the pseudo-random data segment Ri will determine whether Booth encoding should be applied to the string of 1s.

[0063] For example, if Ri is equal to 0, then Booth encoding will not be applied to the string of 1s.

[0064] Therefore, bit BFi retains the same value as bit BIi, ie in this case the value of bit BFi is 1, and the new value STR1N of bit STR1 remains unchanged and equal to 0.

[0065] Conversely, if the value of the pseudo-random bit Ri is 1 as shown in the next row of the table, Booth encoding is applied to the string of 1s.

[0066] Therefore, bit BFi is encoded as -1 and the new value STR1N of bit STR1 is 1.

[0067] Finally, as shown in the last row of the table, if bit BIi is 1 and bit STR1 is 1, this means that the bit BIi is found within a string of 1s encoded using Booth-1 encoding.

[0068] In this case, regardless of the value of bit Ri, bit BFi is 0 and the new value STR1N of bit STR1 remains unchanged and equal to 1.

[0069] Bit BIi and bit STR1N are determined by the following logic equation:

[0070] ABS(BFi)=BIi XOR STR1

[0071] SIGN(BFi)=BIi AND(NOT STR1)AND Ri

[0072] STR1N=BIi AND(STR1 OR Ri)

[0073] In these equations, ABS refers to absolute value and SIGN refers to sign.

[0074] Those skilled in the art should know how to construct a hardware encoder from logic elements to implement the above logic equations.

[0075] Figure 5 Different possible combinations for encoding the byte BI comprising bits b0 to b7 are illustrated.

[0076] Reference ENC0 refers to word BF which is identical to word BI, since no Booth encoding is applied to the string of 1s of word BI.

[0077] In encoding ENC1, Booth encoding is applied to strings of all 1s in a word.

[0078] In encoding ENC2, Booth encoding is not applied to the first string of 1s (bit b1), but only to the second string of 1s starting at bit b3.

[0079] In encoding ENC3, Booth coding is applied to the first string of 1s (bit b1), Booth coding is not applied to the second string of 1s (bit b3), but is applied to the third string of 1s starting at bit b4.

[0080] In code ENC4, Booth coding is applied to the first string of 1s (bit b1), Booth coding is not applied to the second string of 1s (bit b3) nor to the third string of 1s (bit b4), but is applied to the fourth string of 1s (bit b5).

[0081] In encoding ENC5, Booth coding is applied only to the first string of 1s (bit b1), and Booth coding is not applied to other strings of 1s.

[0082] In encoding ENC6, Booth coding is applied neither to the first string of 1s (bits b1) nor to the second string of 1s (bits b3), but is applied to the third string of 1s (bits b4 and b5).

[0083] In encoding ENC7, Booth coding is applied neither to the first string of 1s (bit b1) nor to the second string of 1s (bits b3 and b4), but is applied to the third string of 1s (bit b5).

[0084] Now more specifically refer to Figure 6 An embodiment of a multiplication circuit is described which allows the method just described to be implemented using Booth-1 encoding.

[0085] The circuit IC comprises a clock generator GNK outputting a clock signal CLK and a multiple pseudo-random number generator GNR outputting a pseudo-random digital data segment R.

[0086] Each pseudo-random data segment R comprises a series of j-bit words, here bytes (j=8).

[0087] The initial multiplier BI comprises a series of k-bit words, here bytes (k=8), and the multiplicand A comprises a series of n-bit words.

[0088] The first stage ET1 comprises a Booth-1 encoder implementing the above logic equations.

[0089] The encoder RBE1 is configured to receive, at each cycle of the clock signal CLK, a word of the initial multiplier BI, a word of the pseudo-random data segment R, and output an 8-symbol word of the final multiplier BF, from which a selection word having 8 symbols BSL0-BSL7 (one symbol comprises a number of bits) will be generated, which selection word is intended to control j (here j=8) multiplexers MX0-MX7 of the multiplication stage ETM, as one can see in more detail below.

[0090] Each multiplexer MXi comprises three input terminals EM0, EM1, EM2, which can be selected by corresponding symbols BSLi.

[0091] Input terminal EM0 receives the empty word.

[0092] Input EM1 receives the word of the multiplicand or a word of this multiplicand shifted to the left.

[0093] Multiplexer MX0 thus receives the n-bit word of multiplicand A at its input EM1.

[0094] The input EM1 of the multiplexer MX1 ​​receives the word shifted left by 1 bit, and the input EM1 of the multiplexer MX7 receives the n-bit word shifted left by 7 bits.

[0095] The input EM2 of each multiplexer receives the opposite of the word received at the input EM1.

[0096] If the selection symbol BSLi is 0, the input EM0 of the corresponding multiplexer is selected.

[0097] If selection symbol BSLi is 1, input EM1 is selected.

[0098] If the symbol BSLi is selected as 2, then input EM2 is selected.

[0099] And, within the Booth encoder RBE1, the symbol BSLi is generated starting from the value of the bit BFi, for example in the following way:

[0100] If BFi=0, then BSLi=0

[0101] If BFi=1, then BSLi=1, and

[0102] If BFi=-1, then BSLi=2

[0103] During a period of the clock signal CLK, the multiplexers pass on at their respective outputs the partial products PP0-PP7 generated from respective selected inputs of the multiplexers.

[0104] The output of the multiplexer is connected to the input of a spare adder stage CSA1 (Carry Save Adder).

[0105] The structure of such alternate adder stages is well known to those skilled in the art, as described in ParhamiBehrooz, "Computer arithmetic: algorithms and hardware designs" (2nd edition), published by New York Oxford University Press in 2010 (incorporated herein by reference).

[0106] Furthermore, the multiplication stage ETM comprises two accumulation registers AR1 and AR2 looped between the output of the spare adder CSA1 and the input of this spare adder.

[0107] The adder ADD receives the low-weight bits delivered at the output of the standby adder and continuously outputs result words RS.

[0108] The flip-flop latch FF2 receives the carry rt0 delivered at the output of the adder ADD at its input and delivers the carry rtin again at the input in the next cycle.

[0109] Furthermore, another flip-flop type latch FF1 is looped over the output of encoder RBE1 and the input of the encoder.

[0110] More specifically, this latch FF1 is intended to receive the value of the bit STR1 that has been generated at the end of the current byte, in order to pass it on again when the next byte is processed.

[0111] In fact, for example, a string of 1s may span two consecutive bytes.

[0112] Now more specifically refer to Figures 7 to 9 Embodiments and implementations of the present invention using Booth-2 type encoding are described below.

[0113] The conventional Booth-2 encoding is well known to those skilled in the art, and its encoding table is as follows: Figure 7 As shown in the figure.

[0114] This consists of a coding over 2 bits. In other words, the bit BIi and the next bit BIi+1 are coded in the symbol BFi (which comprises several bits). The previous bit BIi-1 allows to determine whether a string of 1s is pending.

[0115] The meaning of the main line of Booth-2 coding is Figure 7 The right side portion opposite to the corresponding row is mentioned.

[0116] Figure 8 A modified Booth-2 encoding table is shown to contain the bits of the pseudo-random data segment Ri.

[0117] Here again, like in the previous embodiment using Booth-1 encoding, depending on the logic value of bit Ri, it is decided whether the string of 1s is encoded with Booth-2 encoding at the beginning of the string of 1s.

[0118] Thus, like the previous case, if bit Ri is 0 (for example), Booth coding is not applied to this string of 1s, whereas if bit Ri is 1, Booth coding is applied to the string of 1s that will start next.

[0119] Fig. 9 An embodiment of a circuit IC for implementing Booth-2 encoding using pseudo-random data segments R is illustrated.

[0120] The pseudo-random data segment R here comprises 4-bit words (j=4).

[0121] Here again, the words of the initial multiplier consist of bytes, and the words of the multiplicand consist of n-bit words.

[0122] Those skilled in the art should know how to use logic elements to physically implement the encoder RBE2 Figure 8 The encoding.

[0123] Like Figure 6 In an embodiment of the present invention, a latch FF1 is provided in order to store the value of the bit STR1 determined at the end of the current byte in order to reinject it into the encoder RBE2 at the beginning of the next byte.

[0124] and Figure 6 Unlike the embodiment of the present invention, the multiplication stage ETM1 here includes 4 multiplexers MX0-MX3.

[0125] Each multiplexer includes five inputs EM0-EM4.

[0126] Enter EM0 to receive a null word.

[0127] Input EM2 receives the word of the multiplicand A or this word shifted to the left.

[0128] Thus, the input EM2 of the multiplexer MX0 receives the word of the multiplicand A.

[0129] Input EM2 of multiplexer MX1 ​​receives this word shifted left by 2 bits.

[0130] Input EM2 of multiplexer MX2 receives this word shifted left by 4 bits.

[0131] The input EM2 of the multiplexer MX3 receives the word of the multiplicand shifted left by 6 bits.

[0132] The input EM1 of each multiplexer receives a double of the word of the multiplicand, possibly shifted to the left, in the same way as for the input EM1.

[0133] The input EM3 of each multiplexer receives the inversion of the word received at the input EM1.

[0134] The input EM4 of each multiplexer receives the inversion of each word received at the input EM2.

[0135] The multiplexer is controlled by a select word having 4 symbols BSL0-BSL3.

[0136] Each symbol BSLi can take the value 0, 1, 2, 3, 4 to control the input EM0, EM1, EM2, EM3, EM4 respectively.

[0137] If bit BFi is 0, then BSLi is 0.

[0138] If BFi is 2, then BSLi is 1.

[0139] If BFi is 1, then BSLi is 2.

[0140] If BFi is -2, then BSLi is 3.

[0141] If BFi is -1, then BSLi is 4.

[0142] The four partial products PP0-PP3 are delivered at the input of a spare adder stage CSA2 having a conventional structure.

[0143] The rest of the multiplication stage ETM1 is referenced Figure 6 Similar to what described.

Claims

1. A multiplication method, comprising: Receive a digital multiplicand; receiving an initial digital multiplier including a logic 0 and a logic 1; processing the initial digital multiplier by selectively applying Booth encoding to the string of at least one logical 1 at the beginning of each string of at least one logical 1 to output a final multiplier; as well as The digital multiplicand is multiplied by the final multiplier.

2. The method according to claim 1, further comprising: receiving a pseudo-random digital data segment; as well as Wherein selectively applying Booth encoding to the string includes depending on the logic value of a bit of the pseudo-random digital data segment that coincides with the beginning of the string having at least one logic 1.

3. The method of claim 1, wherein the Booth encoding is Booth-1 encoding. The method of claim 1 , wherein the Booth encoding is Booth-2 encoding.

5. A multiplication electronic circuit comprising: a first input configured to receive a digital multiplicand; a second input configured to receive an initial digital multiplier including a logic 0 and a logic 1; a first stage circuit configured to receive the initial digital multiplier, selectively apply Booth encoding to the string of at least one logical 1 at the beginning of each string of at least one logical 1 in the initial digital multiplier, and output a final multiplier; as well as A multiplication stage circuit is configured to perform a multiplication of the digital multiplicand by the final multiplier.

6. The circuit according to claim 5, further comprising: a third input configured to receive a pseudo-random digital data segment; as well as Wherein the first stage circuit is configured to apply Booth encoding to the string depending on the logic value of a bit of the pseudo-random digital data segment that coincides with the beginning of the string having at least one logical 1.

7. The circuit of claim 6, said circuit being clocked by a clock signal, wherein the digital multiplicand comprises a series of n-bit words; wherein the initial digital multiplier comprises a series of k-bit words; wherein the pseudo-random digital data segment comprises a series of j-bit words; and in, At each cycle of the clock signal, the first stage circuit is configured to receive a word of the initial digital multiplier, a word of the pseudo-random digital data segment, and output a word of the j-sign of the final multiplier; wherein the multiplication stage comprises j multiplexers, the j multiplexers being controlled based on j signs of the word of the final multiplier, respectively, and the j multiplexers being configured to receive on their multiplexer inputs during the period an input word selected from the group consisting of a null word, a multiplicand word, the negation of this word, a word of the multiplicand word shifted left and a word of the negation of the word, a double of the word of the multiplicand, the negation of this double, a double shifted left word of the multiplicand word and a double negation shifted left word, and to output on their respective outputs during the period of the clock signal partial products resulting from respective selected multiplexer inputs; and The output of the multiplexer is connected to the input of the spare adder stage.

8. The circuit of claim 5, wherein the Booth encoding is Booth-1 encoding.

9. The circuit of claim 5, wherein the Booth encoding is Booth-2 encoding.

Images