Electronic multiplication process and circuit
The dynamic application of Booth encoding based on pseudo-random data in electronic multiplication circuits addresses SCA vulnerabilities by complicating operand identification, maintaining resistance without increased complexity or power consumption.
Patent Information
- Application Number
- FR2023010518
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2023-10-02
- Publication Date
- 2025-10-17
- Estimated Expiration
- 2043-10-02
AI Technical Summary
Existing electronic multiplication circuits are vulnerable to side channel attacks (SCA) due to consumption and electromagnetic peaks revealing secret values, and current masking methods increase hardware complexity or are susceptible to machine learning attacks.
A method and circuit that dynamically applies Booth encoding based on pseudo-random data to decide whether to encode strings of ones in multipliers, using multiplexers and adders to perform multiplications without additional operations, making it harder to identify operands during SCA.
The solution enhances resistance to SCA without additional computing time or power consumption, significantly complicating operand identification by varying encoding patterns.
Smart Images
Figure 00000013_0000 
Figure 00000013_0001 
Figure 00000013_0002
Abstract
Description
Title of the invention: Electronic multiplication method and circuit
[0001] Implementation and embodiment modes relate to the multiplication of operands in an electronic multiplication circuit, in particular to carry out cryptographic calculations, and more particularly to make side channel attacks (known to those skilled in the art by the English acronym SCA: "Side Channel Attacks") more difficult.
[0002] Cryptographic calculations must maintain the confidentiality of the secret manipulated during multiplication operations.
[0003] At each clock cycle the multiplier is multiplied with the multiplicand. This generates consumption peaks and electromagnetic peaks whose shape and amplitude can betray the values of the multiplier, the multiplicand and the contents of the accumulation registers.
[0004] This can lead to extraction of the secret value using SCA type attacks.
[0005] Protection of these secrets against SCA type attacks is difficult to achieve.
[0006] Arithmetic masking of data can be performed using a number random R.
[0007] For example, the multiplication A*B is masked by performing the following operations A*(B+R) - A*R, which give the same result as that of the multiplication A*B.
[0008] Arithmetic masking is currently used in many implementations, and is most often handled at the software level.
[0009] However, data masking increases the number of operations or hardware circuits if they are integrated into the hardware.
[0010] Furthermore, new machine learning techniques could successfully attack using a single trace and defeat data masking countermeasures.
[0011] Document US 2013 / 0262544 has proposed a multiplication device comprising an encoder implementing a Booth encoding of the Booth-2 type modified to deliver at the output of the encoder either a zero code word (“zero-generation Booth code”) or a code word in which all the bits are at 1 (“zero-avoidance Booth code”), and this only when the bits of the multiplier word are zero.
[0012] Consequently, Booth encoding is applied to all multiplier words with scrambling by a modified Booth code word only when the multiplier word multiplier is zero.
[0013] This therefore results in a potential weakness against SCA attacks because only the value 0 is protected.
[0014] There is therefore a need to propose another solution to make a multiplication circuit more robust against SCA type attacks.
[0015] According to one aspect, there is provided a multiplication method, comprising - reception of a digital multiplicand, - reception of a so-called “initial” digital multiplier comprising logical 0s and 1s, - a processing of the multiplier comprising at the start of each chain at least one logical 1 of the initial multiplier, an application or not of a Booth encoding on said chain, so as to deliver a so-called “final” multiplier, and -a multiplication of the multiplicand by the final multiplier.
[0016] Thus at the start of each string of 1s (a string of 1s can contain a single 1 or several consecutive 1s), it is decided whether or not to use Booth encoding.
[0017] In other words, unlike document US 2013 / 0262544 which constantly applies Booth encoding with a modification of the encoding in the particular case of a null word, the method according to this aspect, provides for not systematically applying Booth encoding but each time a string of 1 is detected, to decide whether or not to apply it to this string of 1 detected and of course to the 0 located just after this string of 1.
[0018] The multiplication is therefore done without additional operation using only a simple operand encoding, which is more effective than hiding the data from SCA attacks.
[0019] Furthermore, this solution does not require additional computing time, and very little additional power (a few %).
[0020] Furthermore, thanks to this decision of Booth encoding or not, an 8-bit operand for example can be encoded on average with 16 different values, which makes the identification of an operand much more difficult during an SCA attack.
[0021] Although the decision whether or not to perform Booth encoding on a string of 1s can be made based on any criteria, it is particularly advantageous if this decision is made randomly, which makes it even more difficult to identify the operands.
[0022] Thus, according to one embodiment, the method further comprises receiving a pseudo-random digital data item. Whether or not Booth encoding is applied to said string depends on the logical value of the bit of said pseudo-random data item coinciding with the start of said string.
[0023] Booth encoding can be for example Booth-1 encoding or Booth-1 encoding Booth-2.
[0024] According to another aspect there is provided an electronic multiplication circuit, for example an integrated circuit, comprising - a first input to receive a digital multiplicand, - a second input to receive an initial digital multiplier comprising logical 0s and 1s, - a first stage configured to receive the initial digital multiplier, and to apply or not Booth encoding to said chain at the start of each chain of at least one logical 1 of the multiplier and deliver a final multiplier, and -a multiplication stage configured to perform the multiplication of the multiplicand by the final multiplier.
[0025] According to one embodiment, the circuit further comprises a third input for receiving pseudo-random digital data and the first stage is configured to apply or not Booth encoding on said string depending on the logical value of the bit of said pseudo-random data coinciding with the start of said string.
[0026] Booth encoding can be Booth-1 encoding or Booth-2 encoding.
[0027] According to one embodiment, -the circuit is clocked by a clock signal, -the multiplicand comprises a succession of n-bit words, the multiplier comprises a succession of k-bit words, for example k=8, the pseudo-random digital data comprises a succession of j-bit words (j=k for a Booth-1 encoding and j=k / 2 for a Booth-2 encoding, for example), -at each cycle of the clock signal, the first stage is configured to receive a word from the initial multiplier, a word of the pseudo-random data, and deliver a word of j symbols (a symbol contains, due to Booth encoding, several bits) from the final multiplier, -the multiplication stage includes] multiplexers respectively controlled from the j symbols of the final multiplier word.
[0028] These multiplexers are configured to -receive, during said cycle, on their multiplexer inputs, input words taken from the group formed by a zero word, a word of the multiplicand, the opposite of this word and words shifted to the left of the word of the multiplicand and of said opposite word, the double of the word of the multiplicand, the opposite of this double and words shifted to the left of the double of the word of the multiplicand and of the opposite of this double, and -deliver on their respective output, during the clock signal cycle, the partial products resulting from the respectively selected multiplexer inputs.
[0029] The outputs of the multiplexers are connected to the inputs of an adder stage of backup.
[0030] The double of the multiplicand word, the opposite of this double and the words shifted to the left of the double of the multiplicand word and the opposite of this double are used in Booth-2 encoding which is particularly advantageous because the number of multiplexers is reduced.
[0031] Other advantages and characteristics of the invention will appear on examining the detailed description of embodiments and implementations, which are in no way limiting, and the appended drawings in which:
[0032] [Fig.l],
[0033] [Fig.2],
[0034] [Fig.3],
[0035] [Fig.4],
[0036] [Fig.5],
[0037] [Fig.6],
[0038] [Fig.7],
[0039] [Fig.8], and
[0040] [Fig.9],
[0041] schematically illustrate embodiments of the invention.
[0042] [Fig.l] illustrates an electronic multiplication circuit IC, for example an integrated circuit, comprising - a first input El to receive a digital multiplicand A, - a second input to receive an initial digital multiplier BI comprising logical 0s and 1s.
[0043] The circuit also comprises a first stage ET1 configured to receive the initial digital multiplier BI and, at the start of each chain of at least one logic 1 of the multiplier, to apply or not a Booth encoding on said chain and to deliver a final multiplier BF.
[0044] The circuit further comprises a multiplication stage ETM configured to perform the multiplication of the multiplicand A by the multiplicand BF and deliver the result RS of the multiplication.
[0045] As will be seen in more detail below, the multiplication stage ETM comprises in particular a certain number of multiplexers controlled by a selection word B SL obtained from the final multiplier BF.
[0046] Furthermore, in practice, the circuit is clocked by a clock signal CLK delivered by a clock generator, of conventional structure and known to those skilled in the art, and the multiplicand A comprises a succession of n-bit words.
[0047] The initial multiplier BI comprises a succession of k-bit words, for example bytes (k = 8).
[0048] The circuit here comprises a third input E3 intended to receive pseudo-random digital data R delivered by a GNR generator of conventional structure and known to those skilled in the art.
[0049] The pseudo-random digital data R comprises a succession of words of j bits (we will see in more detail below that j can be equal to k or k / 2 depending on the type of Booth encoding used).
[0050] And, at each cycle of the clock signal CLK, the first stage ET1 is configured to receive a word from the initial multiplier BI, a word from the pseudo-random data and to deliver a word of j symbols from the final multiplier BF from which selection words BSL will be determined.
[0051] [Fig.2] illustrates a mode of implementation of the multiplication method.
[0052] This comprises a reception of the initial digital multiplier BI and a reception of the pseudo-random digital data R.
[0053] A step ST 10 then comprises a processing of the initial multiplier comprising at the start of each chain of at least 1 logic of the initial multiplier, an application or not of a Booth encoding on said chain so as to deliver the final multiplier BF.
[0054] The method also comprises a reception of the digital multiplicand A, and in a step ST20, a multiplication of the multiplicand A by the final multiplier BF so as to deliver the result RS.
[0055] Reference is now made more particularly to Figures 3 to 6 to illustrate embodiments and implementations of the invention implementing, in a pseudo-random manner, a Booth encoding of the Booth-1 type.
[0056] Booth-1 encoding is well known to those skilled in the art.
[0057] The principles are recalled in [Fig.3].
[0058] The word BI illustrated as an example at the top of [Fig.3] is encoded by Booth-1 encoding to become the word BF illustrated below the word BI.
[0059] More particularly, a string of 1s comprises 1 or more consecutive 1s. Such a string ends with a 0 and is optionally but not necessarily framed by two 0s.
[0060] When a bit of the word BI is a 1 which marks the start of a string of 1s, this 1 is coded as -1.
[0061] When a 0 in the word BI marks the end of a string of 1s, it is coded as 1.
[0062] When a 1 is in a string of 1s, it is coded as 0.
[0063] Finally, when a 0 is in a string of 0s, it is coded as 0.
[0064] We now refer to [Fig.4] which illustrates more particularly the cases where we apply or do not apply Booth-1 encoding to the start of a string of 1s.
[0065] In this regard, a bit STR1 is used which indicates, according to its value, before the processing of a current bit Bli of the initial multiplier word, whether or not there is already a string of 1s encoded with Booth-1 encoding.
[0066] The reference STR1N designates the new value of the bit STR1 after processing the bit Bli.
[0067] Thus, if the Bli bit is 0 and the STR1 bit is 0 (for example) then this means that we are not in the presence of a string of 1s.
[0068] In this case, whatever the value of the bit Ri of the pseudo-random data, the bit BFi is equal to 0 and the new value STR1N of the bit STR1 is unchanged and remains equal to 0.
[0069] If, on the other hand, the Bli bit is equal to 0 and the STR1 bit has the value 1 then this means, whatever the value of the Ri bit, that this Bli bit marks the end of a string of 1s encoded with Booth-1 encoding.
[0070] Consequently, the bit BFi takes the value 1 and the new value STR1N of the bit STR1 is 0.
[0071] If the Bli bit is 1 and the STR1 bit is 0, then this means that we are at the beginning of a string of 1s.
[0072] In this case, the value of the bit of the pseudo-random data Ri will determine whether or not Booth encoding is applied to the string of 1s.
[0073] If for example Ri is equal to 0, then we do not apply Booth encoding to the string of 1.
[0074] Consequently, the bit BFi retains the same value as the value of the bit Bli, i.e. in this case the value 1 and the new value STR1N of the bit STR1 remains unchanged at 0.
[0075] If, on the other hand, as illustrated in the following line of the table, the value of the pseudo-random bit Ri is 1, then we will apply Booth encoding to the string of 1s.
[0076] Therefore the BFi bit is encoded at -1 and the new STR1N value of the STR1 bit is 1.
[0077] Finally, as illustrated in the last line of the table, if the Bli bit is 1 and the Strl bit is 1, this means that this Bli bit is located within a string of 1s encoded with Booth-1 encoding.
[0078] In this case, whatever the value of the Ri bit, the BFi bit is equal to 0 and the new STR1N value of the STR1 bit remains unchanged and is equal to 1.
[0079] The bits Bli, as well as the bit STR1N are determined by the following logic equations:
[0080] - ABS(BFi)=BIi or exclusive STR1
[0081] - SIGN(BFi)=BIi and (not STR1) and Ri
[0082] - STR1N = Bli and (STR1 or Ri)
[0083] In these equations, ABS denotes the absolute value and SIGN the sign
[0084] Those skilled in the art will know how to produce a hardware encoder from logic elements to implement the above logic equations.
[0085] [Fig.5] illustrates different possible combinations of encoding a BI byte comprising bits b0 to b7.
[0086] The reference ENC0 designates a word BF identical to the word BI because no Booth encoding is applied to the strings of 1 of the word BI.
[0087] In the ENC1 encoding, Booth's encoding is applied to all strings of 1 in the word.
[0088] In ENC2 encoding, Booth encoding is not applied to the first string of 1s (bit bl) but only to a second string of 1s which begins at bit b3.
[0089] In the ENC3 encoding, Booth encoding is applied to the first string of 1s (bit bl), Booth encoding is not applied to a second string of 1s (bit b3) but it is applied to a third string of 1s which starts at bit b4.
[0090] In ENC4 encoding, Booth encoding is applied to the first string of 1s (bit bl), Booth encoding is not applied to a second string of 1s (bit b3) nor to a third string of 1s (bit b4) but it is applied to a fourth string of 1s (bit b4).
[0091] In ENC5 encoding, Booth encoding is applied only to the first string of 1s (the bl bit), and Booth encoding is not applied to the other strings of 1s.
[0092] In ENC6 encoding, Booth encoding is not applied to the first string of 1s (bit bl) nor to a second string of 1s (bit b3) but is applied to a third string of 1s (bits b4 and b5).
[0093] In ENC7 encoding, Booth encoding is not applied to the first string of 1s (bit bl) nor to a second string of 1s (bits b3 and b4) but is applied to a third string of 1s (bit b5).
[0094] We now refer more particularly to [Fig.6] to describe an embodiment of a multiplication circuit according to the invention making it possible to implement the method which has just been described using Booth-1 encoding.
[0095] The circuit IC comprises the clock generator GNK delivering the clock signal CLK as well as the pseudo-random number generator GNR delivering the pseudo-random digital data R.
[0096] This pseudo-random data comprises a succession of words of j bits, here bytes (j=8).
[0097] The initial multiplier BI comprises a succession of k-bit words, here bytes (k=8) and the multiplicand A comprises a succession of n-bit words.
[0098] The first stage ET1 comprises a Booth-1 encoder implementing the equations logics mentioned above.
[0099] The encoder RBE1 is configured to, at each cycle of the clock signal CLK, receive a word from the initial multiplier BI, a word from the pseudo-random data R and deliver a word of 8 symbols from the final multiplier BF from which a selection word of 8 symbols BSL0-BSL7 will be produced (a symbol comprises several bis) intended to control, as will be seen in more detail below, j (j= 8 here) multiplexers MX0-MX7 of the multiplication stage ETM.
[0100] Each MXi multiplexer has three inputs EM0, EM1, EM2, selectable by the corresponding symbol BSLi.
[0101] Input EM0 receives a null word.
[0102] Input EM1 receives a word from the multiplicand or a word shifted to the left of this multiplicand.
[0103] Thus, the multiplexer MX0 receives on its input EM1 the n-bit word of the multiplicand A.
[0104] The EM1 input of the MXI multiplexer receives this word shifted to the left by 1 bit and the EM1 input of the MX7 multiplexer receives this n-bit word shifted to the left by 7 bits.
[0105] The EM2 input of each multiplexer receives the opposite of the word received on the EM1 input.
[0106] If the selection symbol BSLi is 0, the input EM0 of the corresponding multiplexer is selected.
[0107] If the selection symbol BSLi is 1, the input EM1 is selected.
[0108] If the selection symbol BSLi is 2, the input EM2 is selected.
[0109] And, within the Booth encoder RBE1, the symbol BSLi is produced for example in the following way from the value of the bit BFi: BSLi = 0 if BFi = 0 BSLi =1 if BFi = 1 and BSLi = 2 if BFi =-1
[0110] The multiplexers deliver on their respective output, during the cycle of the clock signal CLK, the partial products PP0-PP7 resulting from the inputs of the respectively selected multiplexers.
[0111] The outputs of the multiplexers are connected to the inputs of a CSA1 (Carry Save Adder) backup adder stage.
[0112] The structure of such a backup adder stage is well known to those skilled in the art and they may, for example, refer to the work of Parhami Behrooz, entitled “Computer arithmetic: algorithms and hardware designs” (2nd edition), 2010, New York Oxford University Press.
[0113] The multiplication stage ETM also comprises two accumulation registers AR1 and AR2 looped between the outputs of the backup adder CSA1 and the inputs of this backup adder.
[0114] An adder ADD receives the low-order bits delivered on the outputs of the backup adder and successively delivers the result words RS.
[0115] A flip-flop FF2 receives on its input the carry rtO delivered at the output of the adder ADD and redelivers this carry rtin at the input in the following cycle.
[0116] Furthermore, another flip-flop of the Flip-Flop type, FF1, is looped back to an output of the encoder RBE1 and an input of this encoder.
[0117] More precisely, this flip-flop FF1 is intended to receive the value of the bit STR1 which was produced at the end of the current byte to redeliver it during the processing of the next byte.
[0118] Indeed, for example a string of 1s can be located between two consecutive bytes.
[0119] Reference is now made more particularly to Figures 7 to 9 to describe an embodiment and implementation of the invention using Booth-2 type encoding.
[0120] The classic Booth-2 encoding is well known to those skilled in the art and its encoding table is illustrated in [Fig.7].
[0121] This is a 2-bit encoding. In other words, the bit Bli and the following bit BIi+1 are encoded into a symbol BFi (which has several bits). The preceding bit Bli-l is used to determine whether a string of 1s is in progress.
[0122] The meanings of the main lines of the Booth-2 encoding are mentioned on the right part of [Fig.7] opposite the corresponding lines.
[0123] [Fig.8] illustrates the Booth-2 encoding table modified to include the bit of the pseudo-random data Ri.
[0124] Here again, as in the previous embodiment using Booth-1 encoding, it is decided, depending on the logical value of the bit Ri, whether, at the start of a string of 1s, this string of 1s is encoded or not with Booth-2 encoding.
[0125] Thus, as in the previous case, if the Ri bit is 0 (for example), then the Booth encoding is not applied to this string of 1s while if the Ri bit is 1, then the Booth encoding is applied to the string of 1s which will begin.
[0126] [Fig.9] illustrates an embodiment of an IC circuit implementing Booth-2 encoding with use of pseudo-random data R.
[0127] The pseudo-random data R here comprises 4-bit words (j = 4).
[0128] The words of the initial multiplier are again bytes and the words of the multiplicand are n-bit words.
[0129] A person skilled in the art will know how to materially implement the RBE2 encoder implementing the encoding table of [Fig.8], using logic elements.
[0130] As for the embodiment of [Fig.6], a flip-flop FF1 is provided so as to store the value of the bit STR1 determined at the end of the current byte for the re- inject into the RBE2 encoder at the start of the next byte.
[0131] Unlike the embodiment of [Fig.6], the multiplication stage ETM1 here comprises 4 multiplexers MX0-MX3.
[0132] Each multiplexer has 5 inputs EM0-EM4.
[0133] The EMO input receives a null word.
[0134] Input EM2 receives the word of multiplicand A or this word shifted to the left.
[0135] Thus, the input EM2 of the multiplexer MX0 receives the word of the multiplicand A.
[0136] The EM2 input of the MX1 multiplexer receives this word shifted 2 bits to the left.
[0137] The EM2 input of the MX2 multiplexer receives this word shifted 4 bits to the left.
[0138] Input EM2 of multiplexer MX3 receives the word of the multiplicand shifted by 6 bits on the left.
[0139] The EM1 input of each multiplexer receives double the word of the multiplicand possibly shifted to the left in the same way as for the EM1 inputs.
[0140] The EM3 input of each multiplexer receives the opposite of the word received on the EM1 input.
[0141] The EM4 input of each multiplexer receives the opposite of each word received on the EM2 entrance.
[0142] The multiplexers are controlled by a selection word of 4 symbols BSL0-BSL3.
[0143] Each BSLi symbol can take the values 0, 1, 2, 3, 4 so as to control the inputs EMO, EM1, EM2, EM3, EM4 respectively.
[0144] If the BFi bit is 0, then BSLi is 0.
[0145] If BFi is 2, then BSLi is 1.
[0146] If BFi is 1, then BSLi is 2.
[0147] If BFi is -2, then BSLi is 3.
[0148] And if BFi is -1 then BSLi is 4.
[0149] The 4 partial products PP0-PP3 are delivered at the input of a CSA2 backup adder stage of conventional structure.
[0150] The rest of the multiplication stage ETM1 is analogous to what was described with reference to [Fig.6].
Claims
Claims
1. Multiplication method implemented by an electronic multiplication circuit, comprising a reception of a digital multiplicand (A), a reception of an initial digital multiplier comprising logical 0s and 1s, a processing of the initial multiplier (BI) comprising at the start of each chain at least one logical 1 of the initial multiplier, an application or not of a Booth encoding on said chain so as to deliver a final multiplier (BF), and a multiplication of the multiplicand (A) by the final multiplier (BF).
2. Method according to claim 1, further comprising receiving a pseudo-random digital data (R) and whether or not Booth encoding is applied to said string depends on the logical value of the bit (Ri) of said pseudo-random data coinciding with the start of said string.
3. A method according to any preceding claim, wherein the Booth encoding is Booth-1 encoding.
4. A method according to either of claims 1 or 2, wherein the Booth encoding is Booth-2 encoding.
5. Electronic multiplication circuit, comprising a first input for receiving a digital multiplicand (A), a second input for receiving an initial digital multiplier (BI) comprising logic 0s and 1s, a first stage (ET1) configured to receive the initial digital multiplier, and to apply or not Booth encoding to said chain at the start of each chain of at least one logic 1 of the multiplier and deliver a final multiplier, and a multiplication stage (ETM) configured to perform the multiplication of the multiplicand by the final multiplier.
6. Circuit according to claim 5, further comprising a third input for receiving a pseudo-random digital data (R) and the first stage is configured to apply or not Booth encoding on said string depending on the logical value of the bit of said pseudo-random data coinciding with the start of said string.
7. A circuit according to claim 5 or 6, wherein the Booth encoding is Booth-1 encoding.
8. A circuit according to claim 5 or 6, wherein the Booth encoding is Booth-2 encoding.
9. A circuit according to claim 7 or 8 taken in combination with the re- claim 6, clocked by a clock signal (CLK) and in which - the multiplicand (A) comprises a succession of words of n bits, the initial multiplier (BI) comprises a succession of words of k bits, the pseudo-random digital data (R) comprises a succession of words of j bits, and at each cycle of the clock signal, the first stage is configured to receive a word of the initial multiplier, a word of the pseudo-random data, and deliver a word of j symbols of the final multiplier, -the multiplication stage comprises j multiplexers respectively controlled from the j symbols of the final multiplier word and configured to receive, during said cycle, on their multiplexer inputs, input words taken from the group formed by a zero word, a multiplicand word, the opposite of this word, words shifted to the left of the multiplicand word and said opposite word, the double of the multiplicand word, the opposite of this double, words shifted to the left of the double of the multiplicand word and the opposite of this double and to deliver on their respective output, during the clock signal cycle, the partial products resulting from the respectively selected multiplexer inputs, - the outputs of the multiplexers being connected to the inputs of a backup adder stage.