Processing system and method for rapid evaluation of Boolean function

Abstract

A processing system (1) is provided that is configured to perform one or more processing operations involving an evaluation of at least one Boolean function. The processing system includes an evaluation device (20) configured to evaluate each Boolean function of a variable x of length n on # imgabs0 # defined by # imgabs2 # on # imgabs1 #. The evaluation device (20) comprises:-a difference calculation unit (203) configured to calculate, for each integer intermediate variable y ranging from 1 to 2n-1, a difference # imgabs3 #-an accumulation unit (201) configured to summing, for each value of y ranging from 1 to 2n-1, a product of the difference [Delta] f (y) and # imgabs5 # using an XOR operator according to the following XOR accumulation term # imgabs4 #, in which the sum of the products of the difference [Delta] f (y) and # imgabs5 # is greater than the sum of the products of the difference [Delta] f (y) and # imgabs5 # for each value of y ranging from 1 to 2n-1; # imgabs6 # is a function associating x with an outward carry of an arithmetic summation x + z; -an XOR adder (204) configured to add f (0) to the result of the accumulation unit (201), where the output of the XOR adder provides the evaluation result of the Boolean function f.

Description

Technical Field

[0001] The present invention generally relates to processing systems, and in particular, to a processing system configured to perform processing operations involving at least one Boolean function. Background Art

[0002] Many processing systems are based on performing one or more processing operations involving Boolean functions. Boolean functions are particularly prevalent in computing systems and cryptographic systems.

[0003] However, the execution of Boolean functions involves complex evaluations that can affect the performance and computational complexity of the processing system.

[0004] Existing processing systems can use two techniques to evaluate Boolean functions:

[0005] - The first technique is the "table look-up" technique. It involves looking up values in a potentially large truth table of the function;

[0006] - The second technique is a transformation technique in some standard notations, such as algebraic normal form (ANF), conjunctive normal form (CNF), or disjunctive normal form (DNF). Although this technique is systematic, it involves unnatural and complex basis vector evaluations.

[0007] Although table look-up is memory-intensive, transformation techniques such as ANF / CNF / DNF require evaluations on certain vector bases, which are computationally intensive. In particular, ANF requires evaluating monomial functions, CNF requires evaluating maxterms, and DNF requires evaluating minterms.

[0008] Therefore, there is a need for improved systems, methods, and computer program products that can perform fast evaluations of Boolean functions and thereby improve the performance of the processing system. Summary of the Invention

[0009] To address these and other problems, a processing system is provided that is configured to: perform one or more processing operations, the execution of the one or more processing operations involving the evaluation of at least one Boolean function. The processing system includes an evaluation device configured to evaluate each Boolean function f of variable x, the Boolean function being defined over an n-dimensional vector space over a prime field vector space and x is a vector of length n over the vector space . The evaluation device includes:

[0010] - A difference calculation unit configured to calculate a difference for each integer intermediate variable y ranging from 1 to 2 n - 1

[0011] - An accumulation unit, the accumulation unit being configured to: according to the following XOR accumulation terms, use the XOR operator to sum the product of the differential Δf(y) and n for each value of y ranging from 1 to 2 :

[0012]

[0013] wherein, is a function that associates x with the outgoing carry of the arithmetic sum x + z;

[0014] - An XOR adder, the XOR adder being configured to add f(0) to the result of the accumulation unit, and the output of the XOR adder provides the evaluation result of the Boolean function f.

[0015] In some aspects, the evaluation device can be implemented in the form of a hardware circuit, and the evaluation device includes a sequential value generator, the sequential value generator being configured to generate sequential values of the intermediate variable y ranging from 1 to 2 n - 1.

[0016] The evaluation device includes a carry generator, the carry generator being configured to: determine the arithmetic carry for each value of the intermediate variable y using an AND gate to condition the arithmetic carry on the fact that the differential Δf(y) is true, the input x is submitted to the carry generator, and the output of the evaluation device is provided in the accumulation unit after 2 n - 1 clock cycles.

[0017] In some embodiments, the accumulation unit may include two multiplexers and a DFF memory, and the DFF memory receives the output of the second multiplexer and a system clock signal as inputs.

[0018] The sequential value generator can be implemented as a counter and includes an adder without carry, followed by a DFF memory, which receives the output of the adder and a system clock signal as inputs, the DFF memory returns the current value of the intermediate variable, and the adder receives the output of the DFF memory and the value 1 as inputs.

[0019] In some embodiments, the carry generator may include an adder with carry, followed by an AND component, the AND component receiving the output of the adder and the difference value for the current value of the intermediate variable y as inputs, the adder receiving the input x and the input 2 n - y as inputs, and providing an n-bit x - y mod 2n and the output of a 1-bit carry flag corresponding to the carry The AND component is configured to perform an AND operation between the difference value Δf(y) and the carry therebetween.

[0020] In some embodiments, the evaluation device may be configured to: use a parallel single instruction multiple data implementation that is parallelized only on the value x k to evaluate the Boolean function f of K input values x k where 1 ≤ k ≤ K.

[0021] In some embodiments, the evaluation device may be configured to: use a single instruction multiple data architecture that is parallelized on the value x k to perform a parallel evaluation of the Boolean function f of K input values x k where 1 ≤ k ≤ K.

[0022] In some embodiments, the evaluation device may be configured to: when the difference △f of the Boolean function f is sparse, use a look-up table (LUT) V f to evaluate the function f of x.

[0023] The evaluation device may be configured to determine the look-up table according to a truth table associated with the Boolean function.

[0024] In one embodiment, the processing system may be a cryptographic system, and the processing operation may be a cryptographic operation.

[0025] In some aspects, the carry may be defined by an intermediate bit that adds x and y.

[0026] There is also provided a processing method for performing one or more processing operations, the execution of the one or more processing operations involving the evaluation of at least one Boolean function. The processing method includes the step of evaluating each Boolean function f of a variable x, the Boolean function being defined by an n-dimensional vector space over a prime field vector space x is a vector of length n over the vector space where the evaluation step includes: - calculating the difference for each integer intermediate variable y in the range from 1 to 2

[0027] - 1 n - calculating the difference for each integer intermediate variable y in the range from 1 to 2 - 1 n - using the XOR operator, summing the product of the difference Δf(y) and for each value of y in the range from 1 to 2

[0028]

[0029] wherein, is a function associated with the outgoing carry of x and the arithmetic sum x + z;

[0030] - Add f(0) to the result of the summation step, thereby providing the evaluation result of the Boolean function f. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings incorporated in and forming a part of this specification illustrate various embodiments of the invention and, together with the general description of the invention given above and the detailed description of the embodiments given below, serve to explain the embodiments of the invention.

[0032] - Figure 1 Describes a processing system according to an embodiment of the invention.

[0033] - Figure 2 Describes the structure of a Boolean function evaluation device according to some embodiments.

[0034] - Figure 3 Is a flowchart describing a method for evaluating a Boolean function f according to some embodiments.

[0035] - Figure 4 Describes the hardware implementation of an accumulation unit according to a first embodiment.

[0036] - Figure 5 Describes the hardware implementation of a sequence value generator according to a first embodiment.

[0037] - Figure 6 Describes the hardware implementation of a carry generator according to a first embodiment.

[0038] - Figure 7 Describes the SIMD hardware implementation of an accumulation unit according to a second embodiment.

[0039] - Figure 8 Describes the SIMD hardware implementation of a sequence value generator according to a second embodiment.

[0040] - Figure 9 Describes the SIMD hardware implementation of a carry generator according to a second embodiment.

[0041] - Figure 10 Describes the SIMD hardware implementation of an accumulation unit according to a third embodiment, wherein K fast Boolean functions f k are evaluated with K input values x k for evaluation.

[0042] -Figure 11 Describes a SIMD hardware implementation of a sequence value generator according to a third embodiment.

[0043] - Figure 12 Describes a SIMD hardware implementation of a carry generator according to a third embodiment.

[0044] - Figure 13 Describes a hardware implementation of an accumulation unit according to a fourth embodiment, where △f is sparse and a look-up table is used.

[0045] - Figure 14 Describes a hardware implementation of a sequence value generator according to a fourth embodiment.

[0046] - Figure 15 Describes a hardware implementation of a carry generator according to a fourth embodiment.

[0047] - Figure 16 Is a flowchart for determining a look-up table of a Boolean function f according to a fourth embodiment.

[0048] - Figure 17 Illustrates an example calculation of a look-up table of a Boolean function f. Detailed implementation

[0049] Refer to Figure 1 , which shows an operating environment according to an embodiment of the present invention. This operating environment includes a processing system 1 according to an embodiment of the present invention.

[0050] The processing system 1 is configured to: execute at least one processing operation including one or more Boolean functions.

[0051] For example, this processing operation can be a cryptographic function or a cryptographic algorithm.

[0052] The processing system 1 can be any processing system, device, chip, or circuit that executes a processing operation, such as but not limited to a cryptographic system, a computing device (e.g., a compiler or a SAT solver), a digital processing system for real-time data filtering, etc.

[0053] The processing system 1 includes: a processing device 2 configured to execute a processing operation. The processing device can be configured to: execute a processing operation by evaluating one or more basic operations related to the processing operation, and the basic operation includes one or more Boolean functions.

[0054] The basic operation can include other types of operations, such as but not limited to basic arithmetic operations (addition, multiplication, etc.), proportional operations (e.g., multiplying by a constant), exponential operations (e.g., performing a self-multiplication operation a given number of times), etc.

[0055] It should be noted that in some embodiments, the processing operation itself can be a Boolean function.

[0056] According to an embodiment of the present disclosure, the processing device includes a Boolean function evaluation device 20 (also simply referred to as the "evaluation device"), which is configured to quickly evaluate each Boolean function.

[0057] Advantageously, the Boolean function evaluation device 20 utilizes a novel transformation of any n-bit Boolean function f evaluated on x, hereinafter referred to as the "Guilley transformation", which can limit the complexity of the evaluation and speed up its evaluation. The Boolean function evaluation device 20 utilizes the arithmetic operations (additions) built into the computer system to generate complex expressions for carry to accelerate the evaluation of the basis vectors. The evaluation device 20 according to an embodiment of the present invention allows for the average evaluation of any n-bit Boolean function f in a 2 n -1 carry evaluation.

[0058] To facilitate the understanding of some embodiments of the present disclosure, the following notations will be used:

[0059] - Denotes a set of two elements

[0060] - Considering n > 1, which is a strictly positive integer, the Cartesian product is a vector space.

[0061] - 0 n Denotes the all-zero vector existing in .

[0062] - 1 n Denotes the all-one vector existing in .

[0063] - If a vector is equal to 0 n in a context where it is clear, it is said to be equal to zero.

[0064] A Boolean function refers to a function whose arguments and results are assumed to take values from a two-element set (such as {true, false}, {0, 1}, or {-1, 1}).

[0065] The set of all Boolean functions is given the structure of a vector space. That is, Denotes all n-variable Boolean functions f: of the vector space. The dimension of is 2 n . The total number of Boolean functions is

[0066] Boolean functions can include different types of Boolean functions, such as:

[0067] -a∨b, which represents an OR operation between bits a and b.

[0068] -a∧b, or simply ab when there is no sign ambiguity, represents the AND between bits a and b.

[0069] - It represents the exclusive OR operation (or XOR) of bits a and b.

[0070] The same notation applies to component-wise representation of bit vectors.

[0071] To further facilitate understanding of the following description of some embodiments of the present disclosure, the following definitions are given.

[0072] The normative basis It is defined by equation (1):

[0073]

[0074] The monomial basis is further defined by equation (2):

[0075]

[0076] In equation (2), the sign of the power is such that x i 0 =1 and x i 1 =1.

[0077] Degree of a monomial refers to the number of coordinates involved in the product, that is, the Hamming weight of u

[0078] Furthermore, any Boolean function f: The degrees deg(f) of the monomial basis are all maxima in the degree decomposition. The zero-degree function is just a constant (0 or 1), and the unity-degree function is just a linear combination of the bit values.

[0079] symbol will be used to represent the vector space of Boolean functions that are equal to zero at zero. Therefore, Can be limited to:

[0080]

[0081] The algebraic normal form (ANF) of a Boolean function f represents its decomposition on a monomial basis. That is, it is the only representation of f, which is:

[0082]

[0083] In formula (5), the coefficient defines the Boolean function f.

[0084] By convention, the vector representation is such that the vectors are represented in the following order: (11...1)2, (11...0)2,..., (00...0)2. This vector order corresponds to an order compatible with representing the Boolean vectors as integers.

[0085] The ANF can be calculated using the Möbius transform, which consists of applying the following matrix to the vector (f(11...1), f(11...0),..., f(00...0)). The Möbius matrix can be recursively defined as:

[0086] and

[0087] Assume that for n = 2, f(x) = x1 ∨ x0. The ANF obtained by applying the matrix to the vector (f(11...1), f(11...0),..., f(00...0)) is defined by (a 11 , a 10 , a 01 , a 00 ) as:

[0088]

[0089] The following is the addition definition in , which will be mentioned in connection with some embodiments of the present disclosure. Considering x ∈ {0, 1} n , x can be associated with an integer belonging to the interval {0,..., 2 n - 1}. There is a bijection between the n-dimensional vectors in and the integers in {0,..., 2 n - 1}. will be associated with {0,..., 2 n - 1} hereinafter.

[0090] Given two integers x, y ∈ {0,..., 2 n - 1}, their arithmetic sum z = x + y (belonging to ) is defined in vector form as:

[0091]

[0092] In equation (8):

[0093]

[0094] The MAJ ternary function is called "majority" and is denoted as:

[0095]

[0096] The MAJ ternary function has the following properties:

[0097] -MAJ(a, b0) = ab (11)

[0098]

[0099] The (n + 1)-th component of z (i.e., the component at index n, i.e., c n ) is called the "carry" of the sum of x and y. For x, y ∈ {0,..., 2 n-1}, it is represented as bit vectors x = (x n-1 ,..., x0) and y = (y n-1 ,..., y0).

[0100] As used herein, considering that y belongs to The carry function for addition with y is denoted as c y . This carry function from to is defined as:

[0101]

[0102] In Equation (13), c n is iteratively defined on index n through Equation (9).

[0103] As defined herein, the carry is not limited to summation. For example, in an extreme case, is defined such that it only produces a word consisting of 1s, but no carry occurs (even in the middle, at positions 0 ≤ i ≤ n - 1). It should be noted that the subtraction of x and d can be represented as the sum of x and -y = 2 n -y mod 2 n where, for all

[0104] To achieve the Guilley transformation, the inventors have established a first theorem, according to which, for 2 n-1 non-zero values y ∈ {0,..., 2 n-1}, for x ∈ {0,..., 2 n-1} → the addition carry family of x + y constitutes If we choose y to be zero, then the first theorem also holds, since in this case c n is a constant zero function, then:

[0105]

[0106] The first theorem can be proved by induction on n. In fact, for n = 1, the family of carries considered is composed of a single function Composition, this function is equal to Therefore, the carry is because, Therefore, we get

[0107] Assuming that the first theorem is correct up to n, the function family considered is:

[0108]

[0109] It can be noted that:

[0110]

[0111] The last term of formula (14) Using properties (11) and (12), we thus:

[0112]

[0113] The first term of formula (15) Contains: except x n All except x n The monomial, and the second term of formula (15) Contains only x n (For f = 0, it belongs to the vector space ) and the form The vector (for ). These vectors can be combined with x n and x n f(x) is added (i.e. Thus, all vectors φ of (n+1) variables except 1 can be generated. u .

[0114] For example, when n=3, the expression x, y→x+y can be expressed as:

[0115]

[0116] In equation (16):

[0117]

[0118] The expression of can be derived as:

[0119]

[0120] It can be noted that the order of the monomials should not be randomly selected. Therefore, they can be sorted according to the word order of y→x I , where I ∈ {0, 1} n as an example of the word order.

[0121] In the case of n = 1, x, y → x + y = (x1y1, x0y0), so

[0122] (1)2: x0 (0)2: 0

[0124] The expression of can be derived as:

[0125]

[0126] In the case of n = 2, So:

[0127]

[0128] Then, The expression of can be derived as:

[0129]

[0130] In the case of n = 3, The expression of can be given by the following:

[0131]

[0132] In the case of n = 4, It is defined by the following:

[0133]

[0134] Two cases can be considered:

[0135] - If y n-1 = 0 (lower 2 n-1 rows), then If x n-1 = 0 then it is empty, otherwise it is equal to the monomial multiplied by x n-1 . Therefore, the copy and paste of the n - 1 quadrant and the empty quadrant (i.e., of size 2 n-1 ×2 n-1Horizontal connection of the zero matrix).

[0136] - If y n-1 = 1 (upper 2 n-1 rows), then:

[0137]

[0138] Therefore, the expression 18(B) can be decomposed according to ANF as:

[0139] 1. The first term which is a copy and paste of the upper right n - 1 quadrant, except for the monomial at the position (10...0)2 that has been added;

[0140] 2. The second term x n-1 ;

[0141] 3. The third term which is a monomial that does not contain x n-1 and the copy and paste of the upper right n - 1 quadrant.

[0142] In this case, the expression of is given by the following matrix:

[0143]

[0144] It can be noted that in the above matrix, if the first row and the last column are removed, the resulting (2 n-1 × 2 n-1 ) matrix is symmetric.

[0145] The ANF of the carry generated by can be defined. The ANF coefficients of the carry generated by the addition function are denoted as a , that is: I When

[0146]

[0147] The ANF coefficient a I is defined as follows:

[0148] When and a I (y) = y(y) = y dec(I)

[0149] The decreasing function is defined as:

[0150]

[0151] Ⅰ → ψ - 1 (ψ(I) - 1)

[0152] The function ψ is a bijective function defined as follows:

[0153] ψ:P({0,...,n-1})→P({0,...,n-1})

[0154] l→Σ i∈I 2 i

[0155] The inverse matrix of the above matrix is:

[0156]

[0157] This inverse matrix uses the monomial φ u , and returns y. For this, the CARRY of should be used to implement the value of the function represented by ANF.

[0158] Now, the matrix can be extended by one row (for the constant 1) and one column (for XOR multiplied by 1). This results in:

[0159]

[0160] The Möbius transform is given by Def.1 in Anubhab Baksi, Sylvain Guilley, Ritu Ranjan Shrivastwa, and Sofiane Takarabt (from Substitution Box To Threshold. IACR Cryptol. ePrint Arch., page 633, 2023).

[0161] For example, the complete matrix for the Möbius transform (M×C i ) is:

[0162] - For n = 0, M×C i =(1)

[0163] - For n = 1,

[0164] - For n = 2,

[0165] - For n = 3,

[0166] - For n = 4,

[0167] Considering an example of the complete transform, for n = 3, for f:· Boolean function, then:

[0168]

[0169] Therefore,

[0170]

[0171] Therefore, the "Guilley transform" of the Boolean function for any input is defined according to Equation (19): of the Boolean function:

[0172]

[0173] Equation (19) represents the Guilley transform discovered by the inventors to accelerate the evaluation of any Boolean function f of variable x, where f is defined by a vector space of dimension n over a prime field vector space of dimension n i.e., x is a vector of length n in the vector space

[0174] According to an embodiment of the present invention, the evaluation device 20 is configured to: use the Guilley transform of any (n - 1) Boolean function f (i.e., an element of the set of bit functions). Then, the evaluation device 20 can evaluate the Boolean function on a computer that manipulates at least n-bit words.

[0175] Expression (19) involves differences (differences in values):

[0176]

[0177] Therefore, Equation (19) can be rewritten as:

[0178]

[0179] Figure 2 Describes the structure of the Boolean function evaluation device 20 according to some embodiments. Advantageously, the evaluation device 20 uses the Guilley transform defined by Equation (19).

[0180] The evaluation device 20 may include an accumulation unit 201 configured to perform accumulation by XORing the sum of Equation (19).

[0181] The evaluation device 20 may further include a sequential value generator 202 configured to generate sequential values of a dummy variable y (also referred to as an "intermediate" variable) from y = 1 to y = 2 n - 1. The sequential value generator 202 may be implemented as a counter.

[0182] ​The evaluation device 20 may further include a carry generator 204 configured to calculate an arithmetic carry The condition for this arithmetic carry is the fact that the difference Δf(y) is true. The carry generator 204 uses pre-computed values of Δf(y) for each value of y, which may be pre-computed by the difference calculation unit 203.

[0183] Input is submitted to the carry generator 204, and the output is ready after 2 n - 1 clock cycles in the accumulation unit 201. The sequential value generator 202 acts as a control engine.

[0184] Figure 3 A method for evaluating a Boolean function f of x implemented by an evaluation device according to some embodiments is described.

[0185] The method includes: evaluating the Boolean function f of x using the Guilley transform defined by Equation 19.

[0186] In step 300, in order to evaluate the Boolean function f of x, according to Equation (20), for y ranging from 1 to 2 n-1 the XOR ( symbol) between the difference of the values f(y) and f(y - 1) is pre-computed, which provides the difference y is a dummy variable (or "intermediate variable") different from 0 (y ≠ 0).

[0187] For each x for which the Boolean function f is to be evaluated (block 301), do:

[0188] - In step 302, initialize the accumulator variable represented as "α" with the value f(0);

[0189] - In step 304, for each value of y, by means of an XOR operation, add the pre-computed value Δf(y) for y and the carry n obtained by adding from x to 2 - y and accumulate in the variable α; step 304 corresponds to the evaluation of the term of Equation (19),

[0190] - In step 306, return the value of the accumulator variable α, which corresponds to the evaluation result of the Boolean function f.

[0191] Figures 4 to 6 The hardware implementation of different blocks of the evaluation device 20 according to some embodiments is described.

[0192] In particular, Figure 4Describes a hardware implementation of the accumulator unit 201 according to some embodiments, the accumulator unit being configured to perform an accumulation by the XOR of the summation in equation (19).

[0193] Figure 5 Describes a hardware implementation of the sequential value generator 202 according to some embodiments, the sequential value generator being configured to generate sequential values of a virtual loop index y (referred to as a "virtual" variable or an "intermediate" variable).

[0194] Figure 6 Describes a hardware implementation of the carry generator 204 according to some embodiments, the carry generator being configured to calculate an arithmetic carry, the condition of which (by an AND gate) is the fact that the difference Δf(y) is true.

[0195] In Figures 4 to 6 the global signals include:

[0196] – a "reset" signal that initializes the memory content to zero.

[0197] – a clock signal "clk" that is used to control the operation rhythm.

[0198] The signal c represents the carry signal.

[0199] In addition, Figures 4 to 6 the wires shown in

[0200] - when represented as thin lines, carry multiple bits;

[0201] - when represented as thick lines, carry an n-bit bus.

[0202] The following symbols are also used:

[0203] – a DFF memory (D flip-flop) 403, as shown in Figure 4 which is square, where the input arrow with the system clock ('clk' signal), D is the data input, and Q is the stored output;

[0204] – components with a "+" sign inside (such as the component 501 in Figure 5 and the component 601 in Figure 6 ), which represent arithmetic adders and, unless otherwise stated, the carry is removed. In particular, in the component 501 in Figure 5 since the range of the virtual value y (also referred to as the "intermediate value") is from 1 to 2 n - 1, no carry is required, thus fitting for n bits. However, in the component 601 in Figure 6 a carry is required because it is a working factor in equation (19).

[0205] – Boxes containing 0 and 1 inside (such as Figure 4 components 401 and 402), which represent multiplexers and are configured to: if the following signals (signal c of block 401 and signal y of block 402) are equal to 0 (1 respectively), then select input 0 (1 respectively);

[0206] – The small circle 400 following the triangle is Figure 4 an inverter (logical NOT function) in

[0207] – An AND gate such as Figure 6 component 604 in

[0208] Figure 4 is represented as a rectangle ending with a circle. The function of the accumulator unit 201 of n is to switch the output each time the input c is equal to "1" (when the accumulator is active, that is, when y≠1). The output shows the valid result f(x) after 2

[0209] During these clock cycles, Figure 5 the sequential value generator 202 of n is configured to generate consecutive values y of the counter, which start from "1" to 2

[0210] Figure 6 The carry generator 204 of is configured to: determine the term of equation (19) In this regard, the carry is calculated based on the sum of x and 2 n -y. The value 2 n -y is equal to n This sum is suitable for n + 1 bits. The n first bits (lowest weight) encode the value of x+(2 n -y)=2 n +(x - y) (i.e., x - y mod 2 ) in binary format. The last bit, that is, the carry of the addition, is exactly the expected value The carry flag associated with this carry is stored in the "flag" register. The carry flag is a single bit stored in the flag register to indicate that the arithmetic carry is generated from the most significant arithmetic logic unit (ALU) bit position. The content of this "flag" register can be obtained according to Δf(y) and ANDed (i.e., perform an AND operation between ) to determine Figure 4The selection signal on the accumulation unit 201, which determines whether partial accumulation is inverted (or switched) (remains unchanged).

[0211] The processing system 100 may be implemented in a computing system that includes one or more processors for executing computer program instructions and an arithmetic logic unit (ALU) that forms a combinational digital circuit, the arithmetic logic unit being configured to perform arithmetic and bitwise operations on integer binary numbers.

[0212] Advantageously, Figure 4 The hardware blocks represented in may use the resources of one or more processors. For example, in some embodiments, Figure 5 The sequential value generator 202 of may consist of the auto - increment of a register containing a "For" loop index.

[0213] In addition, in Figure 6 In the hardware implementation of the arithmetic carry generator 204 represented, the sum of x and y may be performed by arithmetic addition in the arithmetic and logic unit (ALU) block of the processor, while the bitwise product operation may be performed by a logical AND operation of the same ALU. Figure 4 The hardware implementation of the accumulation unit 204 of may be executed in the processor user registers.

[0214] The AND gate is typically a Boolean condition that can be executed in constant time using the CMOVE instruction family (the CMOVE instruction uses the previously computed flags to determine whether the move instruction should be executed). By using the accumulation variable α, then, in Conditionally add a carry or not add a carry in.

[0215] The computing system operates on n - bit vectors, which are referred to as:

[0216] - When n = 8, it is a byte

[0217] - When n = 16, it is a word

[0218] - When n = 32, it is a double - word

[0219] - When n = 64, it is a quad - word

[0220] - When n = 128, it is a double - quad - word, and so on.

[0221] According to the problem to be solved, in an embodiment of using the ALU of a computing system according to the present invention, an (n-1) Boolean function with any of these bit widths can be calculated quickly. For example, the computing system can implement an instruction set architecture (ISA) that includes addition with carry (commonly abbreviated as "ADC"). According to the arithmetic meaning, any one of the bit vectors can be added with an optional input carry. For example, when performing basic or more complex addition on base 2n, this allows chaining operations. In fact, the addition of long integers may be cut into smaller segments (n-bit widths for each segment), and nevertheless, attention should be paid to carry propagation. That is, operations on low weights generate output carries, and these output carries are fed as input carries in subsequent operations of higher weights. This means that the arithmetic and logic unit (ALU) of a computer system is adapted to manage the generation of overflow carries when performing addition.

[0222] If two n-bit operands x and y fit within n bits, i.e., 0 ≤ x and y ≤ 2 n -1, then their sum fits within n+1 bits (even if it is regarded as an input carry ); in fact, 0 ≤ x + y + c in ≤ 2×(2 n -1)+1 = 2 n+1 -1. Since computer registers are limited to n bits, the ADC result consists of the main result x + y + c in mod 2 n that fits within n bits and the output carry and . In some embodiments, if c out = 1, then this output carry c out (along with other status bits) can be stored in a register called the "flag" register by setting the CARRY bit. Advantageously, using the CARRY operation to evaluate a Boolean function does not add additional computational cost to the computer system implementing the processing system, because most computer systems are already configured to: locally calculate the CARRY operation. In addition, the CARRY operation is silicon-optimized because it can be executed in only one clock cycle.

[0223] In some embodiments, the evaluation device 20 can utilize single instruction multiple data (SIMD) evaluation.

[0224] In fact, it can be noted that Figures 4 to 6 the control flow in the hardware implementation of k is independent of the data (i.e., the input x). This expansion allows: while decomposing the control logic, evaluating f for multiple K values of x (denoted as x

[0225] In Figures 4 to 15 the figures, like reference numerals are used to indicate equivalent components.

[0226] Figure 7 、 Figure 8 and Figure 9 illustrate different blocks of a SIMD implementation of the evaluation device 20 according to some embodiments. This implementation is particularly suitable for computer system architectures in which multiple ADCs can be executed in parallel. Figure 7 、 Figure 8 and Figure 9 represent different parts of the parallel implementation of the fast Boolean function f evaluation for K input values x k (where 1 ≤ k ≤ K). Figure 4 、 Figure 6 and Figure 7 correspond to an implementation of the SIMD implementation of Figures 7 to 9 with a K = 1 structure.

[0227] "Single instruction" is part 202 of the SIMD implementation of the evaluation device 20, while "multiple data" includes the vectorized parts 201 and 204 of the SIMD implementation of the evaluation device 20.

[0228] As Figure 10 、 Figure 11 and Figure 12 shown, the SIMD architecture can be extended from the function f input to the parallel computation of several functions f k (1 ≤ k ≤ K).

[0229] Figure 10 、 Figure 11 and Figure 12 correspond to different parts of the parallel SIMD hardware implementation of the evaluation device 20. In one embodiment, based on the function f SIMD architecture parallelized only for the data x represented by the hardware parts of Figure 7 、 Figure 8 and Figure 9 the K fast Boolean functions f evaluate K input values x k . k for k (1 ≤ k ≤ K).

[0230] In Figure 10 and Figure 12 the hardware related to the function f is dedicated. In particular, in Figure 10 for each function f k the input f k (0) value is input, while this is not the case in the corresponding implementation of the accumulation unit 201 in Figure 7 which only operates on multiple input values x kA shared single function f is effective. In Figure 12 , each function f k The difference Δf k (y) is also pre-computed.

[0231] In some embodiments, when the difference △f of the function f is a piecewise constant equal to zero, the speed of evaluating the Boolean function can also be increased. In fact, in this case, the counter y (intermediate variable) can be accelerated within the zero interval of △f, as shown by Figure 13 , Figure 14 and Figure 15 The hardware implementation of the evaluation device 20 shown. This technique will be referred to as "compressed truth table difference". For example, this may occur in a system that needs to operate on sparse data.

[0232] Figure 13 , Figure 14 and Figure 15 More specifically, it represents a faster implementation of the fast evaluation device 20, which is configured to: when △f is sparse, evaluate the Boolean function f of x (using Equation 19). When △f is sparse, it can be effectively (in terms of space) tabulated in the lookup table (LUT) V Figure 14 designated by the reference numeral 503 in f (i.e., the computer change table of f). In this case, only the number of branches of △f (which represents the value of y for which △f is equal to 1) (which will be less than 2 n ) can be stored in the lookup table (LUT), and the accumulation is limited to that number of branches. In particular, the lookup table (LUT) V f can be instantiated, which will convert the address i (0 ≤ i ≤ ≠V f ) in the hardware part corresponding to the sequential value generator 202. Then, no "△f(.)" protection is required in the hardware part corresponding to the carry generator 204. Only The values of Δf(y) = 1 are transmitted to the accumulation unit 201. Therefore, Figure 13 , Figure 14 and Figure 15 The described implementation in is lighter in terms of silicon resources and faster in terms of evaluation time (which is equal to ≠V f clock cycles instead of 2 n -1).

[0233] Figure 16 is a flowchart describing the determination of the lookup table V of the Boolean function f from the truth table associated with the function f f .

[0234] In step 700, the truth table associated with the Boolean function f is received.

[0235] In step 701, the prev variable is initialized to f(0).

[0236] In step 704, for each value of the variable y between 1 and n -1 (block 702), if f(y) is different from the current value of prev (block 705), then:

[0237] - The variable V is set to V ∪ {y} (V ← V ∪ {y}), and

[0238] - The prev variable is set to f(y) (prev ← f(y)).

[0239] Then, using the current values of V and prebv, steps 704 and 705 are iterated to obtain the next value of y (y is incremented in the step).

[0240] In step 706, when all values of y have been processed, the current value of V is returned as the lookup table V of the Boolean function f f .

[0241] In step 704, optionally, the variable prev can be set to

[0242] Figure 17 Illustrates the lookup table V of the Boolean function f f of the exemplary calculation. On the Figure 17 left side, for different values of x, the function f is given, while on the Figure 17 right side, for different values of i, the lookup table V determined according to the Figure 17 method is given f (value V f (i)).

[0243] Finally, it can be noted that the SIMD-based embodiments of the evaluation device 20 (as illustrated by Figure 7 , Figure 8 and Figure 9 ), and the embodiments of the Δf branches for the evaluation device 20 based on pre-computed LUTs (as illustrated by Figure 13 , Figure 14 and Figure 15 ) can also be combined together.

[0244] In the prior art, solutions for performing Boolean function evaluation using ANF, CNF, or DNF are not computationally friendly. In fact, they involve the evaluation of monomials, maxterms, or minterms. Specifically, in the case of ANF, the evaluation of the monomial x y requires w H(y) - 1 logical AND (where w H is the Hamming weight function, i.e., the function that counts the number of 1s in a word). Thus, on average, assuming y is uniformly distributed in , the complexity C of the ANF prior art method is equal to:

[0245]

[0246] In contrast, the evaluation device 20 and the evaluation method according to the embodiments of the present disclosure provide a complexity limited to only one operation (CARRY).

[0247] Advantageously, the middle bit of the addition of x and y (the word at the nth bit), which is usually the bit of the index i (0 ≤ i ≤ n), can be used as the CARRY. This allows the generation of the function f for the operation on the ith bit.

[0248] In Equation (18), the basic element (by design) is the natural carry of the arithmetic addition. In fact, on any processor, the overflow in the arithmetic addition is stored in the flag register, and the flag register can be read to retrieve whether a carry has been generated. The generation of this CARRY is usually performed by the ADC (addition with carry) instruction.

[0249] Considering Figure 17 the Boolean function f given in , according to the prior art methods (ANF, CNF, DNF) and the Guilley transform according to the embodiments of the present disclosure, the function f can be represented as follows:

[0250] According to the traditional ANF form, f is represented as follows:

[0251]

[0252] According to the traditional CNF form, f is represented as follows:

[0253]

[0254] According to the DNF form, f is represented as follows:

[0255]

[0256] According to the Guilley transform defined by Equation (19):

[0257]

[0258] where CARRY(x, y) is defined as:

[0259]

[0260] ANF is obtained by Möbius transformation. CNF and DNF are obtained manually by Karnaugh map. It should be noted that the constants 11, 4, and 1 in expression (20) correspond to 16 - y in the allowable values of lookup table V f , i.e., Im(V f ) = {5, 12, 15}. Additionally, another advantage of the Boolean function evaluation apparatus and method according to embodiments of the present disclosure is that the value of x can be placed in a word (or double - word, quadruple - word, etc.), which allows for faster calculations compared to ANF, CNF, and DNF expressions, where the word x should be dispatched in n registers. It should also be noted that CARRY(x, y) can be determined in various ways. In one embodiment, CARRY(x, y) can be determined from the carry flag, for example, by looking at the generated carry flag and using the ADC computer instruction. This is equivalent to testing the condition x + y ≥ 2n, which can be calculated using the compare opcode (CMP), assuming the register size is strictly greater than n

[0261] Thus, embodiments of the present disclosure utilize a property discovered by the inventors, according to which both the XOR operation and the CARRY operation (the output carry of addition with a non - zero constant) are balanced operations, and any Boolean function is reformulated according to equation (19) to provide a system and method for evaluating any Boolean function that allows for the efficient reconstruction of the Boolean function in constant time (assuming the least - significant - bit toggle function is also available). Such XOR and CARRY operations exist on all computers and allow for a significant acceleration of the calculation of Boolean functions while keeping them secret in the case of side - channel attacks. In some embodiments, a constant - time implementation independent of the processor can be used

[0262] In addition to accelerating the evaluation of Boolean functions, embodiments of the present disclosure also ensure constant - time performance (optimizing timing by removing the values of Δf(y) that are empty), the time - memory trade - off of the complete lookup table as the objective function would be unknown, and the SIMD architecture of the computer can be utilized because when using the single - instruction multiple - data (SIMD) instruction set, a carry can be generated in the middle of a word

[0263] The present invention can be used in cryptography (especially in symmetric cryptography for substitution boxes in block ciphers, round functions in hash functions, and feedback logic in stream ciphers), computer science (e.g., compilers - for representing switch / case statements, SAT solvers - for accelerating the calculation of formulas to be satisfied).

[0264] Can be extended to: primitives other than i.e., (Arithmetic product, with constant y).

[0265] The processing system 1 according to an embodiment of the present invention can be used for various applications. For example, the processing system can be a cryptographic system, such as a symmetric cipher for implementing a substitution box in a block cipher, a round function in a hash function, or a feedback logic in a stream cipher. The processing system can be a computing system, such as a compiler (e.g., for representing switch / case statements), a solver for accelerating the evaluation of Boolean formulas to be satisfied (e.g., a SAT solver), a computing system for obfuscating programs that are configured to hide functions in an abnormal encoding of a Boolean function. According to another example, the processing system 1 can be a digital signal processing (DSP) for real-time data filtering. In this case, the evaluation device can use a filter with a long-distance constant value, in which case the difference △f is zero over a large continuous interval, resulting in an XOR accumulation of equation 19 to be simplified (invalid over the interval of "0"), as Figure 13 , Figure 14 and Figure 15 illustrated by the embodiments of.

[0266] The value of the input x to which the Boolean function f is applied can represent specific data related to the application field of the processing system 1.

[0267] For example, when applying the present disclosure to the field of cryptography, the input x to which the Boolean function f is applied can be data represented as a binary information string, which aims to prevent illegal read access and / or illegal write access ("manipulation") through encryption and / or through a MAC (Message Authentication Code) algorithm. In this case, the processing device 2 can be implemented as an encryption and / or MAC algorithm (forming one or more processing operations), which are configured to utilize the Boolean function as part of its internal transformation. For example, the substitution boxes associated with the encryption algorithm or even the diffusion layer may be complex in terms of the Boolean function expression. In addition, some MAC algorithms may use hash functions. Although the combinational logic of the inner rounds of the hash function is usually not very complex, it requires fast evaluation because they are the limiting factor for the overall speed. Another example is the specific case of stream ciphers used in encryption algorithms, where some state registers are "filtered" by the Boolean function, such as in GRAIN or TRIVIUM. In particular, these algorithms themselves can prevent the implementation of hierarchical attacks (referred to as side-channel attacks, or SCA), so the ability to efficiently evaluate Boolean functions is crucial. In fact, preventing SCA (e.g., timing attacks) requires the execution time to remain constant regardless of the actual value carried by x, and can occur on a shared version of x (i.e., at the end of the calculation, before final coordination with the demapping, the sharing of multiple parallel calculations is randomly split). The encryption algorithm can be, for example, AES, and the MAC algorithm can be, for example, AES-CMAC (AES in cipher MAC mode) or HMAC (hash-based MAC). The masking protection implemented by the processing device 2 (acting as a protection device in this case) can be Boolean masking (e.g., as described in Instance I, J., Guajardo, J., Krummel, V. (2004) "AES Provably Secure Masking" (from: Lecture Notes in Computer Science, Vol. 3357, Selected Areas in Cryptography - SAC 2004, edited by Handschuh, H., Hasan, M.A. Springer, Berlin, Heidelberg. https: / / doi.org / 10.1007 / 978-3-540-30564-4_5).

[0268] In another application of the present disclosure, where the processing system is a computing system configured to execute a computer program (e.g., a compiler), the input x to which the Boolean function f is applied can be a control signal in the computer program, the value of which allows selection of a subsequent execution path. The decision regarding continuing the execution of the computer program depends on the evaluation of the conditions of the control signal x. These conditions are represented as the Boolean function f, which "decodes" the value of the control signal x. Thus, control flow forks may occur in time-critical parts of the code. To trigger cache prediction failures, it is important that they are executed efficiently. Evaluating the Boolean function that defines the above conditions using the Boolean function evaluation apparatus and method according to an embodiment of the present disclosure enables fast and constant time, thus not affecting the instruction cache. Alternatively, the present invention can be used to "artificially" complicate a computer program because the way the conditions are written in assembly language (using the ADC operation, where Boolean operators such as XOR, AND, OR are expected) is difficult to interpret and thus difficult to reverse engineer. This provides a degree of protection for the exact nature of the conditions being executed.

[0269] In still other applications of the present disclosure where the processing system 1 is a solver, the input x to which the Boolean function f is applied can be an instance of a satisfiability problem, that is, an efficient algorithm for solving a binary complex combinatorial problem ("binary" means in the sense of having an answer of "yes" or "no"). Solvers applicable to solving such problems are called SAT solvers (SAT solver stands for "SAT satisfiability solver"). SAT solvers include: exhaustively evaluating solutions, which is a method that allows pruning inconsistent solutions. The efficiency of a SAT solver still depends on the speed of evaluating the conditions. The conditions of a SAT solver are Boolean functions, which can be evaluated using the Boolean function evaluation apparatus and method according to an embodiment of the present disclosure. It should be noted that the satisfiability of instances of 64 bits and above is difficult to solve by exhaustive search. The case of 128 bits or more is especially impossible to solve in this way. A size of 128 bits corresponds to the key size of modern cryptographic algorithms, and even if all available computers were to parallelize this single problem instance, they could not withstand exhaustive search. However, problems represented as 64 bits or 128 bits can be effectively solved by a SAT solver, and the present invention speeds up the SAT solver. In addition, the SIMD version of the present invention allows evaluating the Boolean function corresponding to the conditions of a SAT solver by using the Boolean function evaluation apparatus and method according to an embodiment of the present disclosure, thereby allowing an additional speed boost.

[0270] In another application of the present disclosure, where processing system 1 is a digital processing system and processing device 20 is a signal processing processor of a digital processing device, the input x to which the Boolean function f is applied can be a digitized signal input in the signal processing processor. This digitized signal x can arrive at a very high rate and thus must be processed quickly at a determined speed. Otherwise, some data congestion may occur, so it is not processed as planned and is unfortunately dropped (resulting in an error). The processing can include finite impulse response (FIR) or infinite impulse response (IIR) filters, which have equivalent Boolean expressions that form the Boolean function. Using the Boolean function evaluation apparatus and method according to an embodiment of the present disclosure, the Boolean expression can be advantageously evaluated quickly and in constant time. Another operation on streaming digital data is to apply a "distortion correction" table using a look-up table (LUT). The evaluation of the LUT can also use the evaluation apparatus and method according to an embodiment of the present disclosure.

[0271] Embodiments of the present disclosure may take the form of embodiments that include only software, only hardware, or both hardware and software elements.

[0272] Furthermore, the methods described herein may be implemented by computer program instructions supplied to a processor of any type of computer to produce a machine having a processor that executes the instructions to implement the functions / actions described herein. These computer program instructions may also be stored in a computer-readable medium, which may direct the computer to operate in a particular manner. To this end, the computer program instructions may be loaded onto the computer so that a series of operational steps are executed, thereby producing a computer-implemented process such that the executed instructions provide a process for implementing the functions specified herein. In particular, the methods described herein may be implemented in a computer system.

[0273] It should be noted that according to embodiments of the present disclosure, the functions, actions, and / or operations specified in the flowcharts, sequence diagrams, and / or block diagrams may be reordered, processed serially, and / or processed concurrently. In addition, any one of the flowcharts, sequence diagrams, and / or block diagrams may include: more or fewer blocks than those illustrated according to embodiments of the present disclosure.

[0274] Although embodiments of the present disclosure have been illustrated by the description of various examples and have been described in considerable detail, the applicant does not intend to limit or in any way restrict the scope of the appended claims to these details. In particular, as will be readily understood by those skilled in the art, the present invention is not limited to the exemplary applications of the present disclosure and the exemplary processing systems mentioned in the specification.

[0275] Those skilled in the art will readily see other advantages and modifications. Therefore, the present disclosure is not limited to the specific details, representative methods, and illustrative examples shown and described in a broader aspect.

Claims

1. A processing system (1), the processing system being configured to perform one or more processing operations, the execution of the one or more processing operations involving the evaluation of at least one Boolean function, wherein, The processing system includes an evaluation device (20) configured to evaluate each Boolean function f of a variable x, the Boolean function f being defined by a vector space of dimension n over a prime field vector space and x is a vector of length n over a vector space wherein the evaluation device (20) includes: ​ A difference calculation unit (203), the difference calculation unit being configured to calculate a difference for each integer intermediate variable y ranging from 1 to 2 n - 1 An accumulation unit (201), the accumulation unit being configured to: according to the following XOR accumulation terms, use the XOR operator to sum, for each value of y ranging from 1 to 2 n -1, the difference Δf(y) and the product of: wherein, is a function that associates x with the outgoing carry of the arithmetic sum x + z; An XOR adder (204) configured to add f(0) to the result of the accumulator unit (201), wherein the output of the XOR adder provides the evaluation result of the Boolean function f.

2. The processing system according to claim 1, wherein, The evaluation device is implemented in the form of a hardware circuit, and wherein, the evaluation device (20) includes a sequential value generator (202), the sequential value generator being configured to generate sequential values of the intermediate variable y from 1 to 2 n - 1.

3. The processing system according to claim 2, wherein, The evaluation device includes a carry generator (204), which is configured to determine the arithmetic carry for each value of the intermediate variable y The AND gate is used to condition the arithmetic carry on the fact that the difference Δf(y) is true. The input x is submitted to the carry generator (204), and the output of the evaluation device is provided in the accumulation unit (201) after 2 n - 1 clock cycles 4. The processing system according to claims 2 and 3, wherein, The accumulator unit (201) includes two multiplexers (401, 402) and a DFF memory (403), and the DFF memory (403) receives the output of the second multiplexer and the system clock signal as inputs.

5. The processing system according to any one of claims 2 to 4, wherein, The sequential value generator (202) is implemented as a counter and includes an adder without carry (501), followed by a DFF memory (502), the DFF memory receiving the output of the adder (501) and the system clock signal as inputs, the DFF memory returning the current value of the intermediate variable, and the adder (501) receiving the output of the DFF memory and the value 1 as inputs.

6. The processing system according to any one of claims 2 to 5, wherein, The carry generator (204) includes an adder (601) with a carry, followed by an AND component (604). The AND component receives the output of the adder (601) and the difference value for the current value of the intermediate variable y as inputs. The adder (601) receives the input x and the input 2 n -y as inputs, and provides an output including n bits of x - y mod 2 n and a 1-bit carry flag corresponding to the carry The AND component (604) is configured to perform an AND operation between the difference value Δf(y) and the carry ​ 7. The processing system according to any one of the preceding claims, wherein, The evaluation device (20) is configured to: evaluate the Boolean function f of K input values x using a parallel single instruction multiple data implementation that is parallelized only on the value x k where 1 ≤ k ≤ K. k ​ 8. The processing system according to any one of the preceding claims 1 to 6, wherein, The evaluation device (20) is configured to: use a single instruction multiple data architecture parallelized on the value x k to perform parallel evaluation of the Boolean function f k on K input values x k where 1 ≤ k ≤ K.

9. The processing system according to any one of the preceding claims 1 to 6, wherein, The evaluation device (20) is configured to evaluate the Boolean function f of x using a look-up table (LUT) V when the difference △f of the Boolean function f is sparse. f to evaluate the Boolean function f of x.

10. The processing system according to claim 9, wherein, The evaluation device (20) is configured to determine the look-up table according to the truth table associated with the Boolean function.

11. The processing system according to any one of the preceding claims, wherein, The processing system is a cryptographic system, and the processing operation is a cryptographic operation.

12. The processing system according to any one of the preceding claims, wherein, The carry is defined according to the intermediate bit obtained by adding x and y.

13. A processing method for performing one or more processing operations, the execution of the one or more processing operations involving the evaluation of at least one Boolean function, wherein, The processing method includes: a step of evaluating each Boolean function f of a variable x, where the Boolean function is defined by an n-dimensional vector space over a prime field vector space x is a vector of length n over the vector space wherein the evaluating step includes: For each integer intermediate variable y ranging from 1 to 2 n a difference is calculated Using the XOR operator, for each value of y ranging from 1 to 2 n - 1, sum the product of the differential Δf(y) and : Among them, is a function associated with the outgoing carry of x and the arithmetic sum x + z; f(0) is added to the result of the summation step to provide the evaluation result of the Boolean function f.

Images