Method and device for generating a Gaussian error

Abstract

Method and device for generating a Gaussian error. This description relates to a device configured to generate an approximate value by adding noise to an output of a balanced arithmetic circuit, comprising: - the balanced arithmetic circuit configured to generate a first value; - an approximation circuit configured to generate a k-bit mask based on a first distribution; and - a logic circuit configured to generate a second value based on the first value, the k least significant bits of the second value being generated by applying the mask to the k least significant bits of the first value, the most significant bits of the second values ​​being equal to the most significant bits of the first value, the first distribution being such that the second value corresponds to the first value with an added error value having a Gaussian distribution of standard deviation.Figure for the abridged version: Fig. 1.

Description

Title of the invention: Method and device for generating a Gaussian error. Technical field

[0001] The present description relates generally to the field of approximation calculation circuits. Previous technique

[0002] Approximation calculation methods and circuits sacrifice accuracy in favor of improved performance, energy or resource savings and are used in various applications, for example in machine learning, embedded systems or multimedia processing, where absolute accuracy is not essential.

[0003] Learning with errors (LWE) is a problem in computer learning theory and cryptography that serves as a basis for building secure cryptographic systems. LWE involves solving systems of linear equations by adding random noise corresponding to an error. These systems are complex and, for this reason, are used in post-quantum cryptography to ensure security against quantum computer attacks. Implementing an LWE problem involves an approximation adder with a Gaussian error distribution. Designs based on fully depleted silicon-on-insulator (FDSOI) technology have been proposed using approximation circuits that can achieve a distribution similar to a Gaussian distribution.However, errors in FDSOI (Fully Depleted Silicon On Insulator) circuits are only introduced when a delayed signal transition is sampled. This implementation is called frequency or voltage overscaling and is also compatible with non-FDSOI technologies. When the signal is stable, no errors are introduced, which poses a problem for generating continuous and coherent noise. Furthermore, due to its dependence on signal transitions, the error characteristics in FDSOI circuits exhibit a strong dependence on the order of the circuit inputs. This variability can negatively impact the uniformity of the Gaussian error distribution used for the LWE problem, since different input orders result in different errors.Furthermore, errors in FDSOI circuits are generated along a critical path of the circuit, since the critical path is usually the one with the delay closest to the clock period, the time difference typically being on the order of nanoseconds to picoseconds. For a . In an adder architecture, the critical path is the one that evaluates the most significant bits, which can only generate larger errors than those obtained from a Gaussian distribution. Errors should ideally be generated on a few of the least significant bits, but achieving this with FDSOI properties requires large buffer sizes, resulting in high area, power consumption, and cost.

[0004] There is a need in the art for a circuit and a corresponding method capable of generating error values ​​that follow a Gaussian distribution. Summary of the invention

[0005] One embodiment provides a device configured to generate an approximate value by adding noise to an output of a balanced arithmetic circuit, the device comprising: - the balanced arithmetic circuit configured to generate a first value coded by N bits, N being an integer greater than or equal to 2; - an approximation circuit configured to generate a k-bit mask, where k is an integer less than N, based on a first distribution; and - a logic circuit configured to generate a second N-bit value based on the first value, the k least significant bits of the second value being generated by applying the mask to the k least significant bits of the first value, the Nk most significant bits of the second values ​​being equal to the Nk most significant bits of the first value, the first distribution being such that the second value corresponds to the first value with the addition of an error value, the added error value having a Gaussian distribution of standard deviation °.

[0006] According to one embodiment, the logic circuit is configured to apply an XOR operation between the value of the mask and the k least significant bits of the first value.

[0007] According to one embodiment, the k-bits of the mask are automatically programmed to 0, based on a control signal.

[0008] According to one embodiment, the above-mentioned device further includes an AND gate configured to perform an AND operation between the mask and the control signal, the logic circuit being configured to generate the second value based on the output of the AND gate.

[0009] According to one embodiment, the approximation circuit is configured to generate the mask on the basis of an input coded by a number y of bits, y being an integer, generated by an entropy source.

[0010] According to one embodiment, the entropy source is a hardware random number generator.

[0011] According to one embodiment, the entropy source is further configured to provide an input value to the arithmetic circuit.

[0012] According to one embodiment, the approximation circuit comprises a number k of Boolean functions, each Boolean function being configured to generate a bit of the mask on the basis of the y-bit input.

[0013] According to one embodiment, the arithmetic circuit is an adding circuit.

[0014] According to one embodiment, the logic circuit comprises k gates XOR, the i-th XOR gate, for 0 < i < k-1, being configured to perform an XOR operation between the (i+l)-th least significant bit of the mask and the (i+l)-th least significant bit of the first value.

[0015] According to one embodiment, the second value is provided to a circuit configured to perform a post-quantum cryptography operation on the basis of the second value.

[0016] One embodiment provides a method for generating an approximate value corresponding to an arithmetic value to which is added noise having a Gaussian distribution with standard deviation 0, the method comprising: - the generation of a first value of N bits, N being an integer, by a balanced arithmetic circuit, N being an integer greater than or equal to 1; - the generation of a k-bit mask, where k is an integer less than or equal to N, by an approximation circuit, based on a first distribution; and - the generation of a second value, by a logic circuit, by applying the mask to the k least significant bits of the first value, the Nk most significant bits of the second value being equal to the first value; the first distribution being such that the second value corresponds to the first value with an added error value, the added error value having a Gaussian distribution of standard deviation °.

[0017] One embodiment provides a method for designing an architecture for the approximation circuit of the above circuit, wherein the method comprises: - the identification, by an external device, of a Gaussian distribution based on the value of the standard deviation, the identification further including the calculation, by the external device, of the value of the integers k and y; - for each k-bit mask value, the determination, by the external device, of at least one associated error value by applying the mask to each k-bit value, each added error value being associated with a frequency for the mask value; - the determination, by the external device, of the first distribution, based on the

[0018] error values ​​and their associated frequency for each mask value; and - the determination, by the device, of the architecture of the approximation circuit, the determined architecture being capable of generating k-bit mask values, based on y-bit input values, in accordance with the first distribution. According to one embodiment, the external device is configured to determine the value of the integer y by solving the equation xh(P(j) - 1 ct To determine the value of k by solving the equation 2^'1 _ 1 < 2^ _ p where P is a predetermined positive real number.

[0019] According to one embodiment, the determination, by the device, of the architecture of the approximation circuit includes the determination of a number k of Boolean functions, each Boolean function being configured to generate a bit of the mask, on the basis of the input of y bits. Brief description of the drawings

[0020] These features and advantages, as well as others, will be described in detail in the following description of particular embodiments, given by way of non-limiting example, in relation to the accompanying figures, among which:

[0021] [Fig.1] is a block diagram illustrating a precision configurable circuit, according to an embodiment of the present description;

[0022] [Fig.2] is a block diagram illustrating an approximation circuit connected to a logic circuit, according to an embodiment of the present description;

[0023] [Fig.3A] is a block diagram of a device configured to determine an architecture;

[0024] [Fig.3B] is a flowchart illustrating steps in a process for designing the approximation circuit, according to an embodiment of the present description;

[0025] [Fig.4A] and [Fig.4B] are histograms linked to a Gaussian distribution;

[0026] [Fig. 5A] is a table illustrating the relationship between the mask values ​​and the error values;

[0027] [Fig.5B] is a table showing the error values ​​covered by each mask value;

[0028] [Fig.6] represents an algorithm for extracting the distribution of masks, according to an embodiment of the present description;

[0029] [Fig. 7] is a histogram of the mask distribution; and

[0030] [Fig.8] is a Venn diagram from which the Boolean functions are, for example, extracted. Description of the implementation methods

[0031] The same elements have been designated by the same reference numerals in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same reference numerals and may have identical structural, dimensional and material properties.

[0032] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been represented and are detailed.

[0033] Unless otherwise specified, when referring to two elements connected together, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") together, this means that these two elements can be connected or linked through one or more other elements.

[0034] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "superior", "inferior", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made, unless otherwise specified, to the orientation of the figures.

[0035] Unless otherwise specified, the expressions "approximately", "roughly", and "on the order of" mean to within 10% or 10°, preferably to within 5% or 5°.

[0036] Figure 1 is a block diagram illustrating an accuracy configurable circuit (ACCURACY CONFIGURABLE CIRCUIT) according to an embodiment of this description. In particular, the accuracy configurable circuit is configured to generate values ​​corresponding to values ​​generated by an arithmetic circuit (ARITHMETIC CIRCUIT) plus random noise, following a Gaussian distribution having a given standard deviation CT.

[0037] The configurable precision circuit 100 comprises the arithmetic circuit 102, an approximator circuit 104, and a logic circuit 106. The arithmetic circuit 102 is configured to generate an output value S, and the approximator circuit 104 is configured to generate a mask M. For example, the output value S is encoded by a number N of bits, with 1 ≤ k < N. For example, the value of the integer k depends on the standard deviation °.

[0038] The arithmetic circuit 102 is a balanced circuit, meaning that all possible outputs of the arithmetic circuit 102 are equally probable. Furthermore, in some embodiments, the bit distribution of the output values ​​includes the same number of 1s and 0s. The arithmetic circuit 102 is, for example, an adding circuit. Moreover, the output value S corresponds to a precise value, free from noise. The arithmetic circuit 102 is, for example, configured to generate the output value S from input values ​​(ARITHMETIC INPUTS). By For example, the input values ​​are random inputs, for example generated by a random number generator (not shown in [Fig.1]).

[0039] The approximation circuit 104 is configured to produce a mask M which is used to corrupt the correct result of the arithmetic circuit 102. The generated mask M and the output S are, for example, provided to the logic circuit 106, which is configured to corrupt the output value S by applying the mask M to it. The logic circuit 106 produces a corrupted result (OUTPUT) corresponding to S+e, where e follows a Gaussian distribution with mean 0 and standard deviation °. The corrupted result is, for example, provided to a post-quantum cryptographic circuit (not shown in [Fig. 1]) configured to perform post-quantum cryptographic operations on the basis of the corrupted value.

[0040] In particular, the logic circuit 106 is configured to selectively invert the k least significant bits of the output value S according to the mask M. The logic circuit 106 includes, for example, k XOR gates, each configured to perform an XOR operation between one bit among the k least significant bits of the output value S and one bit among the k bits of the mask M. The Nk most significant bits of the output value S are, for example, propagated by the logic circuit 106 without modification.

[0041] The approximation circuit 104 is, for example, configured to generate the mask M based on an input value of size y, where y is an integer dependent on the value of the standard deviation °. The approximation circuit 104 receives, for example, input values ​​generated by an entropy source, such as a hardware random number generator circuit 108 (TRNG). In one example, the hardware random number generator circuit 108 is further configured to generate and supply the input values ​​for the arithmetic circuit 102. Moreover, the distribution of the values ​​generated by the hardware random number generator 108 is a uniform distribution.

[0042] In the example of [Fig. 1], the configurable precision circuit 100 further includes k AND gates 110, each configured to receive at one of its inputs a corresponding bit of the mask M and at its other input a control signal (CTRL SIGNAL). For example, the control signal is a binary signal equal to 0 or 1 depending on whether the configurable precision function is to be activated or not. In this example, the output of the approximation circuit 104 is connected to the inputs of the logic circuit 106 via the AND gates 110. The AND gates 110 are configured to perform an AND operation between each of the values ​​of the mask M and the binary value of the control signal. For example, if the control signal is equal to the binary value 0, the configurable precision circuit 100 operates in full precision mode, and the AND gates 110 provide at output a mask M' with k bits every set to 0 and supply it to the logic circuit 106. The output of the logic circuit 106 is then equal to the output value S of the arithmetic circuit 102. Otherwise, if the control signal is equal to the binary value 1, the configurable precision circuit 100 operates in approximation mode, and the AND gates provide as output a mask M' equal to the mask M and supply it to the logic circuit 106. The output of the logic circuit 106 is then equal to S+e.

[0043] Fig. 2 is a block diagram illustrating in more detail the approximation circuit 104 and the logic circuit 106 according to an embodiment of the present description.

[0044] The approximation circuit 104 comprises, for example, k Boolean function circuits B0 to B1. The hardware random number generator circuit 108 of Figure 1 is configured to provide an input value coded on a number y of bits to ay-1. The k Boolean function circuits are configured to generate the k bits M0 to the mask M. For example, for each j ∈ {0, -1}, the circuit Boolean function B^ is configured to generate the i-th bit M; of the mask M.

[0045] The logic circuit 106 includes, for example, k XOR gates 200_0 to 200_(k-1). For example, for each / g ? - 1}, the XOR gate 200_i is configured to perform an XOR operation between the i-th bit Mj of the mask M and the i-th least significant bit S of the output value generated by the arithmetic circuit 102. Each XOR gate 200_i then generates a bit. The k bits S^q are the k least significant bits of the approximate result OUTPUT, provided as output by the configurable precision circuit 100. In particular, if the output value S is encoded on a number N of bits S0, the approximate result is the bit sequence S^q. The k bits... The less significant bits of the approximate result are approximate and the N-k most significant bits are precise and come directly from the precise result.

[0046] The approximation circuit 104 is then configured to receive random inputs and creates a mask distribution. In particular, the mask distribution is not a Gaussian distribution, but allows the creation of a Gaussian error distribution when combined with the accurate random results of the arithmetic circuit 102 using the logic circuit 106.

[0047] Figure 3A is a block diagram illustrating a device 300 configured to determine an architecture for Boolean function gates Bq to B^.

[0048] Device 300 is, for example, an external device such as a computer. In particular, Device 300 is, for example, a separate device from the precision configurable circuit 100. Device 300 comprises a processing unit 302 (CPU) connected to a non-volatile memory 304 (NVMEM). The non-volatile memory For example, 304 stores instructions 306 (INSTRUCTIONS). In the example in Figure 3A, the non-volatile memory 304 is located in the device 300. In alternative embodiments, the non-volatile memory 304 is external to the device 300. The device 300, for example, further includes an interface 308 (INTERFACE) connected to the processing unit 302. The processing unit 302 is then configured to execute the instruction 306. The instructions 306 are such that their execution results in the processing unit 302 generating a circuit architecture of Boolean functions B0 to B0. Furthermore, the processing unit 302 is configured to execute the instructions 306 according to a given value of the standard deviation. This value is, for example, provided to the processing unit 302 by a user and via the interface 308.The processing unit 302 is, for example, also configured to provide the generated architecture of the circuits of the Boolean function Bo to B for example to the user and via the interface 308.

[0049] Figure 3B is a flowchart illustrating steps in a design process for the approximation circuit 102 according to an embodiment of the present description. In particular, these steps are carried out by device 300, by means of the execution of instruction 306, and result in an architecture of Boolean function circuits B0 to B1.

[0050] In a first step 310 (ERROR DISTRIBUTION IDENTIFICATION), the distribution of an error over a limited number of cases is determined. The error distribution is a discretized Gaussian distribution with a mean of zero and a standard deviation CT. For example, the value of Q is an input parameter, for example set at a level based on the desired error distribution, which will depend, for example, on the application of the configurable precision circuit.

[0051] The entire cumulative probability of the Gaussian distribution is considered to be in the interval R = [ - P(J, Pd ], where P is a positive value. For example, in the case where P is equal to 3, the entire cumulative probability is considered to be in the interval [ - 3g, 3(T ], instead of 99.73% of the cumulative distribution.

[0052] The value of the integer k is, for example, equal to the appropriate number of bits to cover up to the maximum error belonging to the interval. The implementation of step 310 also includes determining the value of k. For example, the value of k is such that the maximum error, corresponding to [Per] (the integer part of Pc), is such that 2^-1 < P <j < 2k - P

[0053] Step 310 involves evaluating the Gaussian density function h for each integer value x belonging to the interval R. In particular, The Gaussian density function h for the Gaussian distribution with mean 0 and standard deviation ° is such that:

[0054] [Math.l] A(x) = -xg [ -Pa,Pa]

[0055]

[0056]

[0057] A first histogram h corresponding to the distribution of a discretized Gaussian density is obtained by evaluating h(x) for any integer x in the interval R. The value of the integer y is determined such that the binary value of a resized histogram H is equal to one. In particular, the resized histogram is such that \ ) = 2^+1 X h ( X ) ~ 1' where X is the maximum error defined above as being equal to. Furthermore, the resized histogram is such that the sum of its integer binary values ​​is equal to 2^+1. Step 310 further includes solving 2'y+1 xh(X) - 1' of other terms, step 310 further includes calculating 1 / h(X) and finding its nearest power of 2, denoted by |h{X)|. The value of y is then obtained by calculating 70ff2(|l / h(X)|2)-1. In particular, the resizing factor is 2“v+1 ct not 2^' because 'c ^cuit Arithmetic 102 is a balanced circuit. Therefore, errors generated by inverting the outputs have the same probability of being positive or negative.

[0058] For example, if the standard deviation CT is equal to 2 and the value P is set to 3, the Gaussian distribution to be evaluated lies in the interval R = [-6,6]. Therefore, the largest error is equal to 6. The value of k is equal to 3. The power of 2 closest to the value of l / h(6) is 512. The value of y is equal to 8.

[0059] For each integer value x in the interval R, the value H(x) is determined as being the integer closest to the value xh ( x) ' to ensure that the sum of all the values ​​H(x), x GR, is equal to 2^+1, the device 300 is configured to check if the sum is indeed equal to 2y+1 and if not, to adjust the values ​​of H(x) so that the sum is equal to 2^+1.

[0060] Figure 4A represents a histogram H for a Gaussian distribution with a standard deviation of 2 and values ​​in the interval R = [-6, 6]. In particular, the histogram H comprises 13 cells, each cell being associated with an integer value in the interval R. Furthermore, the sum of all the cells is equal to 512 = 28 + 1 and H(6) = H(-6) = 1.

[0061] Step 310 further includes determining a positive histogram Hp corresponding to the positive part of the histogram H, i.e. Hp(x)=H(x), xe{L -, [PoUet with Hp(0)=H(0) / 2.

[0062] Figure 4B represents a positive histogram Hp associated with the histogram H shown in Figure 4A. In particular, the histogram Hp comprises 7 cells, each cell being associated with an integer value in the interval [0,6]. Moreover, since the Gaussian distribution is symmetric, the sum over all the cells is equal to 216 = 28 + 1 / 2. Furthermore, Hp(0) = H(0) / 2.

[0063] In step 311 (RELATION BETWEEN MASK AND ERROR VALUES), the relationship between mask values ​​and error values ​​is determined. Device 300 is configured, for example, to determine all possible k-bit values, that is, to determine 2^ values. These values ​​correspond to the set of all possible masks, as well as the set of all possible combinations S0, ■ ■ ■, for the k least significant bits of the output value S. Furthermore, the k-bit mask where all bits are equal to 0 is not considered. Thus, only 2^-1 mask values ​​are determined. For each mask, device 300 is configured to generate, for each combination S0, ■ ■ ■, S^, the result of an XOR operation between them.

[0064] The device 300 is configured to determine the error values ​​and their frequency in the 2^ combinations by performing an XOR operation between each mask value and each combination of k least significant bits of the output value S. Since the arithmetic circuit 102 is a balanced circuit, all values ​​within the sum table are equally probable. The number of positive errors that can be generated is therefore equal to the number of negative errors. Consequently, the number of errors that each mask can generate and their frequency depend solely on the number of bits equal to a binary 1 within the mask. The number of bits equal to a binary 1 in the mask value is denoted u, with 1 → u → k.

[0065] The number of different errors is equal to 2 and each error appears with the frequency of 1 / 2U1 insofar as all the outputs S have the same probability.

[0066] Figure 5A shows two tables, 500 and 501, illustrating the relationship between mask values ​​and error values. In particular, tables 500 and 502 illustrate the relationship between mask values ​​and error values ​​for the example shown in relation to step 310, with R=[-6,6], k=3 and y=8.

[0067] Table 500 contains all possible mask values. The mask values ​​are coded on k=3 bits, and the mask with value 000 is not taken into account. Therefore, there are 2³ - 1 = 7 possible mask values. Table 502 contains the set of the k least significant possible bits, S2, Sj and So of the output value S. There are therefore 23 = 8 possible combinations for the 3 least significant bits of the output value S.

[0068] When an XOR operation is performed between mask 111 and combination 000, the value obtained is 111. The error value, corresponding to the absolute value of the difference between S^S^Sq and the result of the XOR operations, is equal to | 0 - 7| = 7. When an XOR operation is performed between mask 111 and combination 001, the value obtained is 110. The error value is equal to 11 - 6| = 5. When an XOR operation is performed between mask 111 and combination 010, the value obtained is 101. The error value is equal to | 2 - 51 = 3. When an XOR operation is performed between mask 111 and combination 011, the value obtained is 100. The error value is equal to | 3 - 41 = 1. When an XOR operation is performed between mask 111 and combination 100, the value obtained is 011.The error value is equal to 14 - 31 = 1. When an XOR operation is performed between mask 111 and combination 101, the value obtained is 010. The error value is equal to | 5 - 21 = 3. When an XOR operation is performed between mask 111 and combination 110, the value obtained is 001. The error value is equal to 16 - 1| = 5. When an XOR operation is performed between mask 111 and combination 111, the value obtained is 000. The error value is equal to | 7 - 01 = 7. Thus, applying mask 111 results in 4 different errors (1, 3, 5, 7), each with a frequency of 1 / 4.

[0069] The identification of error values ​​and their frequencies for the other mask values ​​is carried out in the same way. Applying mask 110 results in 2 different errors (2, 6), each with a frequency of V2. Applying mask 101 presents 2 different errors (3, 5), each with a frequency of V2. Applying mask 100 presents only error 4, with a frequency of 1. Applying mask 011 presents 2 different errors (1, 3), each with a frequency of V2. Applying mask 010 presents only error 2, with a frequency of 1.

[0070] Figure 5B is a table showing the error values ​​covered by each mask in the particular example above with R=[-6,6], k=3 and y=8. One column S^S^Sq represents the 3 least significant bits of the output S. Seven columns illustrate the result (S) of applying the mask to each of the output values ​​and the resulting error values ​​(Err).

[0071] For example, a first column illustrates the application of mask 001 to all three least significant possible bits of output S. The values The error values ​​are all equal to 1 in all these cases. This means that applying mask 001 covers the error value 1 with a frequency of 1. Similarly, applying masks 010 and 100, each containing one bit equal to 1, each covers a unique error value. Applying mask 010 covers the error value 2, and applying mask 100 covers the error value 4.

[0072] The application of masks 011, 101 and 110, each comprising u=2 bits equal to 1, covers respectively two different error values, each with a frequency of 1 / 2. Mask 011 covers error values ​​1 and 3. Mask 101 covers error values ​​3 and 6 and mask 110 covers error values ​​2 and 6.

[0073] The application of mask 111, comprising u=3 bits equal to 1, covers the four different error values ​​1, 3, 5 and 7.

[0074] Referring again to [Fig. 3B], in step 312 (MASK DISTRIBUTION), the device 300 is configured to determine the distribution of the mask values ​​in order to produce a Gaussian distribution of the error values. In particular, the mask distribution is not necessarily a Gaussian distribution.

[0075] For example, device 300 starts with the largest mask value and checks whether any associated errors are present in the positive histogram HP. For each positive error value x, a cover value, denoted by C(x), corresponds to the number of times the error x must be covered, and a value N(M) corresponds to the number of times the mask value M must be generated in order to cover the errors. An error is covered by a mask M when it is generated by applying the mask. The algorithm implemented by instructions 306, for example, starts with C(x) = HP(x) and iterates until C(x) = 0, for each x. When all the cover values ​​are equal to 0, all the errors have been covered correctly.

[0076] If a mask M creates at least one error outside the interval R, and therefore not present in C(x), this mask value must never occur and N(M) is then set equal to 0.

[0077] If all the errors created by a mask M are present in the interval R, the device 300, under the execution of instructions 306, processes the error values ​​from largest to smallest. There are two cases: either a first case in which the error value is covered only by this mask value, or a second case in which the error value is covered by one or more smaller masks.

[0078] In the first case, for an error value xl covered only by a mask M and when the mask M covers several error values, the algorithm implemented by instructions 306 correctly covers the error value xl by dividing C(xl) by the frequency of xl, determined in step 311. The value of The coverage N(M) is thus evaluated. The value N(M) is then distributed according to the error frequencies. Furthermore, the value N(M) is subtracted from the coverage values ​​C(x) of the other error values ​​covered by the mask M. The coverage value C(xl) is then decremented to 0, while the other coverage values ​​C(x) are decreased by N(M) multiplied by the frequency of each other error value. In the second case, when the error is covered by another, smaller mask, the coverage value is decreased by C(xl), where xl is an error value covered only by the mask M. Then, by repeating the process, this type of error will be treated as a first-case error during the processing of the smallest mask that covers it.

[0079] The same process is repeated for each mask value. A lookup table, with the input mask bits and the number of times the mask values ​​should appear as output, is, for example, generated by device 300. The sum of all the N(M) is equal to 2^- At the end of step 312, the distribution of the masks is determined. Consequently, the mask values ​​and the frequency with which each mask should be generated by the approximation circuit 104 are known.

[0080] Figure 6 illustrates the algorithm for extracting the mask distribution, through the manipulation of lookup tables, according to an embodiment of the present description. In particular, the illustrated algorithm makes it possible to determine the mask distribution for the example shown in relation to step 310, with R=[-6,6], k=3 and y=8.

[0081] A first table 600 contains the error values ​​determined by the application of step 311, for example illustrated by Figure 5. The possible error values ​​x are integers from 0 to 7. A column C(x) contains the desired number of occurrences for the associated integer. Since the error distribution lies in the interval R=[-6,6], the error value x=7 must not occur. The value C(7) is therefore equal to 0. For the error value x between 1 and 6, the associated value C(x) is equal to Hp(x), that is, H(x), which is the integer closest to the value 29 xh(x). The value C(0) corresponds to the integer closest to the value 28 xh(x). Thus, C(6)=1, C(5)=5, C(4)=14, C(3)=33, C(2)=62, C(1)=90, and C(0)=5. The goal of the algorithm is to iteratively process the mask value until the entire column C(x) is filled with the value 0.

[0082] A table 602 represents the application of the algorithm to the mask values ​​111 and 110. Since the application of the mask value 111 generates the error value 7 and C(7)=0, the application of the algorithm assigns the value 0 to the occurrence N(111).

[0083] Applying mask 110 generates error values ​​2 and 6. Error value 6 is only covered by this mask, while error value 2 is also covered by mask 010. Therefore, since the frequency of the error value 6, via mask 110, is equal to U2, the occurrence N(110) is equal to C(6) / 0.5, that is, N(110)=2. The cover value C(6) is then reassigned to be equal to 0 and the cover value C(2) is revised to be equal to C(2)-N(110)*0.5= C(2)- C(6)=61.

[0084] Once mask 110 has been processed, the algorithm is applied to the value of mask 101. The application of the algorithm to mask 101 is illustrated in Tables 600a and 602a. Applying the value of mask 101 generates error values ​​3 and 5, each with a frequency of 1 / 2. The error value 5 is only covered by this mask value 101, while the error value 3 is also covered by the mask value 011. Therefore, the occurrence N(101) is determined to be equal to C(5) / 0.5, that is, 10. The coverage value C(5) is then decreased to 0 and the coverage value C(3) is revised to be equal to C(3)-C(5), that is, 28.

[0085] Once mask 101 has been processed, the algorithm is applied to the value of mask 100. The application of the algorithm to the value of mask 100 is illustrated in Tables 600b and 602b. Applying the value of mask 100 generates only the error value 4. The error value 4 is covered only by this mask. Therefore, the occurrence N(100) is determined to be equal to C(4), that is, 14. The coverage value C(4) is revised to be equal to 0.

[0086] Once mask value 100 has been processed, the algorithm is applied to mask value 011. The application to mask value 011 is illustrated in Tables 600c and 602c. Applying mask value 011 generates error values ​​1 and 3, each with a frequency of 1 / 2. Error value 3 is now covered only by mask value 011, while error value 1 is also covered by mask value 001. Therefore, the occurrence N(011) is determined to be equal to C(3) / 0.5, i.e., 56. The coverage value C(3) is then revised to be equal to 0, and the coverage value C(1) is revised to be equal to C(1)-C(3), i.e., 62.

[0087] Once mask value 011 has been processed, the algorithm is applied to mask value 010. The application to mask value 010, and then to mask values ​​001 and 000, is illustrated in Tables 600d and 602d. Applying mask value 010 generates only error value 2. Error value 2 is now only covered by this mask. Therefore, the occurrence N(010) is determined to be equal to C(2), i.e., 61. The coverage value C(2) is thus revised to be equal to 0. Applying mask value 001 generates only error value 1. Error value 1 is now only covered by this mask. Therefore, the occurrence N(001) is determined to be equal to C(l), that is, 62. The coverage value C(l) is therefore revised to 0. Applying the mask value 000, by definition, only generates the error value 0. The error value 0 is only covered by this mask. Consequently, the occurrence N(000) is determined to be equal to C(0), that is, 51. The coverage value C(0) is therefore revised to 0. The column C(x) is, at this stage, filled with 0 values. The mask distribution is then determined, which completes step 312.

[0088] [Fig.7] is a histogram of the distribution of masks determined in the example presented in relation to step 310 of [Fig.3B], with R=[-6,6], k=3 and y=8. In particular, the occurrence values ​​of each of the mask values ​​are those obtained by applying the algorithm described in relation to [Fig.6].

[0089] Referring again to Figure 3B, in step 313 (BOOLEAN FUNCTION), the Boolean functions Bq to are written, by device 300, to cover the distribution of masks.

[0090] The operation of the approximation circuit 104 can be represented by a truth table with y inputs and k outputs. The implementation of step 313 allows the position of each mask value in the truth table to be determined.

[0091] In one example, device 300, under the execution of instructions 306, is configured to complete the truth table by inserting mask values ​​to respect their occurrences.

[0092] Another example of determining Boolean functions Bj is, for example, described on the following web page: https: / / math.stackexchange.com / questions / 4935662 / given-the-output-frequencies-create-a-truth-table-with-minimal-boolean-function. In this example, Boolean variables Aj are constructed on the basis of the inputs $o,---, $yl of the approximation circuit 104, so that the sets | A (a) = 1} are increasing. In other words, the Boolean functions Aj are constructed so as to satisfy Set[0] cSet[l] c • • -cSetUn-l] , where m is the number of different mask values. In particular, since it is possible that one of the 2^ possible masks generates an error value outside the interval R, the value of m is less than or equal to 2^-. These sets have prescribed cardinalities defined by the mask distribution N(M). The sets Setj are therefore interpreted as the increasing unions of cells in a Venn diagram for M Mq and obtain the mask bits corresponding to the outputs of the approximation circuit 104. The Boolean variables Aj represent intermediate variables between the output variable M and the input variables a of the approximation circuit.

[0093] Device 300 is further configured, by the execution of instructions 306, to extract the Boolean functions of a given mask from a Venn diagram. For each mask M, each bit Mj of the mask, which is represented by the union of several intervals, consists of adjacent cells of the Venn diagram. The number of AND and / or OR gates used to generate bit M is, for example, equal to the number of inner ends of the intervals minus one. The inner ends of the intervals are those that lie inside the Venn diagram. Since two identical encodings cannot coexist, at each boundary between two cells, there is at least one inner end if we consider the set of k bits. Therefore, the minimum number of inner ends is equal to the number of internal separations of the space, i.e., m-1. The number Nb of gates is such that [Math 2]

[0094] Nb= miny.. „ = miny., ,Ej-k = m-1-k

[0095] The Venn diagram is not unique. Device 300, for example, is configured to determine the Venn diagram by applying the asymptote algorithm. This algorithm constructs the sequence by iterating through binary representations and validating specific models to minimize the number of internal intervals. One advantage of this algorithm is that it is well suited to large standard deviations.

[0096] Figure 8 is a Venn diagram from which Boolean functions are, for example, extracted. In particular, the Venn diagram is associated with the example shown in relation to step 310 of Figure 3B, with R=[-6,6], k=3 and y=8.

[0097] A line 800 cuts the masks having as its least significant bit Mo a bit equal to 1. A line 802 cuts the masks having as its bit Mj a bit equal to 1. Two lines 804 and 806 are such that their union is the intersection of the masks having as its most significant bit M2 a bit equal to 1. The length of each column, associated with a mask value M, is related to the occurrence value determined in step 312 of figure 3B. The Boolean functions Bq, B1, and B2 for expressing the bits Mq and M2 respectively involve the use of 0, 1, and 2 gates, corresponding to 1, 2, and 3 inner ends 808, 810, 812, 814, 816, and 818. In particular, line 800 includes only inner end 808. Line 802 includes inner ends 810 and 812. Line 804 includes only inner end 814, and line 806 includes inner ends 816 and 818.

[0098] Furthermore, the Venn diagram is divided into 7 sets Set[0] to Set[6], such that Set[0] cSet[l] c • - -cSet[6] The set Set[6] covers all lengths of the Venn diagram. The set Set[5] corresponds to the set Set[6], minus the column associated with the mask value 000. The set Set[4] corresponds to the set Set[5], minus the column associated with the mask value 100. The set Set[3] corresponds to the set Set[4], minus the column associated with the mask value 110. The set Set[2] corresponds to Set[3], minus the column associated with the mask value 010. The set Set[1] corresponds to Set[2], minus the column associated with the mask value 011. The set Set[0] corresponds to the set Set[1], minus the column associated with the mask value 001. The set Set[0] includes only the column associated with the mask value 101. The Mq bit is equal to A^. Boolean variables A express when the bits of the mask are equal to 1, which corresponds to boolean functions B.Bit Mest is equal to A2 & A5 and bit M2 is equal to ^4$. In particular, the cardinality of the set S[j] is . defined by the distribution of masks.

[0099] Step 313 of Figure 3B further includes the determination, by device 300, of the relationship between the boolean variables and the inputs at ^y-1 of the approximation circuit 104. This determination is carried out for example by the execution of instructions 306.

[0100] Instructions 306, when executed, produce a Boolean function with a specific number of 1s within the total 2^ case range created by the input values. Device 300 is then configured to generate a plurality of Boolean functions and weight them according to a cost function. An example of a cost function is given in the following table: [Tables 1] Door Cost NOT 1 NOT-AND N NOT-OR N AND n+1 OR n+1 Where the doors are doors with n entrances.

[0101] The NOT gate includes, for example, two transistors. The NOR and NOR gates each include, for example, two transistors per input, and their cost in terms of the number of transistors therefore depends on the number of inputs. The AND and OR gates are obtained, for example, by negating the outputs of the NOR and NOR gates. OR respectively. Their cost in terms of the number of transistors is equal to the number of inputs plus one.

[0102] The device 300 is further configured to calculate the dimensions Dilllj of each variable Aj, based on the Venn diagram and the mask distribution. For example, for a standard deviation of 2, DimQ = TV ( 101 ) = 10, Dim^ DimQ+N (001) = 72, Dim2 = Dim^ N (011) = 128, Dim3 = Dim2 + F Dim6 = Dim5+N(000) = 256 = 2 y

[0103] In another example, the device 300 is configured to perform a binary search for all processes. This search begins with a function Fj that evaluates one of the dimensions Dînij. For example, F is a function representing the Boolean variable A^. From there, knowing A^, the device 300 is configured to determine either A3 or A5 with new "temporary" functions F' that are obtained by modifying F = A^. This search is not for example used only to evaluate a single variable A when the application The above method is not satisfactory. In any case, there would be a function F for each dimension Dilllj. Therefore, there are 6 different functions Fj. each representing a Boolean variable Aj. The Boolean function Fj comprises exactly Dim 1. The Boolean function Fj can be represented by a truth table with y entries. The entry ay-l is, for example, the first contribution to the function F. If . > 27'1' 'c number Pcut can be increased using an OR gate with the successive entries, therefore pj = 3^2. If on the contrary 'c number is reduced using an AND gate with successive inputs, so Fj = ay-i & ay-2- The process is repeated until the number of cases identified by Fj in the truth table is equal to Dînij.

[0104] In another example, the determination of F(Dilllj} is carried out, by the device 300, from an F ( Dim^ ) given by a quick search by bisection. The main loop generates boolean functions, and the 300 device stores them in a Heap vector H, then selects the cheapest one to add to a vector W, representing a code of the current boolean circuit.

[0105] Bisection search is for example applied by device 300 for any Dilllj in order to create Boolean functions with exactly Dilllj ≥ 1 and to store U), U(a)] in W, where U(a) represents all the intermediate Boolean functions necessary to obtain Aj(a) from the variables input a, comprising the y bits 3q to 104 of the approximation circuit. The vector H is filled with all possible combinations that can be obtained in one step from the elements of W, except for Aj. This process stops when the capacity of the Heap vector, for example set by the user, is reached, or if all the combinations (NOT(F1),F1); (AND(F1, F2),OR(F1, F2)) and (AND(F1, F2, F3),OR(F1, F2, F3)), where F1, F2, and F3 represent functions stored in W, are taken into consideration. The device 300 is then configured to generate a Boolean function F such that the number of 1s given by AND(Aj,F) is equal to BDijj+j or the number of 1s given by OR(Aj,F) is equal to Dinij.j. The functions for the following Aj are then constructed by device 300 using the same process, i.e. using AND for i = J + 1 and OR for 1 = j - 1.The cost of this construction depends on the initial cost of F and its origin, which can be either W or H.

[0106] If no combination of functions is found, for example, if the functions generated by device 300 are not suitable for the user, device 300 is configured to perform another binary search, which can construct functions with any number of 1s. Once a function is found, the pair A1 - A2 and all intermediate functions U are stored in W. The vector H is then updated with the new combinations. Device 300 is then configured to repeat the process for the next pair, until all Boolean variables A have been evaluated. The complete loop is applied from all the Dinijs, and only the result with the minimum cost is used to generate the final circuit.

[0107] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will be apparent to those skilled in the art. In particular, the method used to obtain the Boolean functions may vary.

[0108] Finally, the practical implementation of the embodiments and variants described is within the reach of a person skilled in the art, based on the functional indications given above.

Claims

Demands

1. Device (100) configured to generate an approximate value by adding noise to an output of a balanced arithmetic circuit (102), the device comprising: - the balanced arithmetic circuit configured to generate a first value (S) coded by N bits, N being an integer greater than or equal to 2; - an approximation circuit (104) configured to generate a mask (M) of k bits, k being an integer less than N, on the basis of a first distribution;and - a logic circuit (106) configured to generate a second N-bit value (OUTPUT) based on the first value (S), the k least significant bits of the second value being generated by applying the mask to the k least significant bits of the first value, the Nk most significant bits of the second values ​​being equal to the Nk most significant bits of the first value, the first distribution being such that the second value corresponds to the first value with an added error value, the added error value having a Gaussian distribution of standard deviation °.;

2. Device according to claim 1, wherein the logic circuit is configured to apply an XOR operation between the value of the mask (M) and the k least significant bits of the first value (S).

3. Device according to claim 1 or 2, wherein the k-bits of the mask (M) are automatically programmed to 0, based on a control signal.

4. Device according to claim 3, further comprising an AND gate configured to perform an AND operation between the mask (M) and the control signal, the logic circuit (106) being configured to generate the second value based on the output of the AND gate.

5. Device according to any one of claims 1 to 4, wherein the approximation circuit (104) is configured to generate the mask (M) on the basis of an input encoded by a number y of bits, y being an integer, generated by an entropy source.

6. Device according to claim 5, wherein the entropy source is a hardware random number generator (108).

7. Device according to claim 5 or 6, wherein the entropy source is further configured to provide an input value to the arithmetic circuit (102).

8. Device according to any one of claims 5 to 7, wherein the approximation circuit (104) comprises k Boolean functions (Bq,..., B^^), each Boolean function being configured to generate one bit of the mask on the basis of the y-bit input.

9. Device according to any one of claims 1 to 8, wherein the arithmetic circuit (102) is an adding circuit.

10. Device according to any one of claims 1 to 9, wherein the logic circuit comprises k number of XOR gates (200_0, 200_(kl)), the i-th XOR gate, for 0 < i < k -1, being configured to perform an XOR operation between the (i+l)-th least significant bit (Mj) of the mask and the (i+l)-th least significant bit (Sj) of the first value.

11. Device according to any one of claims 1 to 10, wherein the second value is provided to a circuit configured to perform a post-quantum cryptography operation on the basis of the second value.

12. A method for generating an approximate value corresponding to an arithmetic value to which is added noise (e) having a Gaussian distribution of standard deviation a, the method comprising: - the generation of a first value of N bits, N being an integer, by a balanced arithmetic circuit (102), N being an integer greater than or equal to 1; - the generation of a mask (M) of k bits, k being an integer less than or equal to N, by an approximation circuit (102), on the basis of a first distribution; and - the generation of a second value, by a logic circuit (106), by applying the mask to the k least significant bits of the first value, the Nk most significant bits of the second value being equal to the first value;the first distribution being such that the second value corresponds to the first value with an added error value, the added error value having a Gaussian distribution with standard deviation °.;

13. A method for designing an approximation circuit architecture (104) according to any one of claims 1 to 11, the method comprising: - the identification, by an external device (300), of a Gaussian distribution based on the value of the standard deviation, the identification further comprising the calculation, by the external device, of the values ​​of the integers k and y; - for each k-bit mask value, the determination, by the external device, of at least one associated error value by applying the mask to each k-bit value, each added error value being associated with a frequency for the mask value; - the determination, by the external device, of the first distribution, based on the error values ​​and their associated frequency for each mask value;and - the determination, by the device (300), of the architecture of the approximation circuit, the determined architecture being capable of generating k-bit mask values, based on y-bit input values, in accordance with the first distribution.;

14. A method according to claim 13, wherein the external device (300) is configured to determine the value of the integer y by solving the equation 2^+1 xh ( P(j) - 1' ° where h is the Gaussian density function for the Gaussian distribution with mean 0 and standard deviation °, and to determine the value of k by solving the equation 1 < Per < 2^ _ where P is a predetermined positive real number.

15. A method according to claim 13 or 14, wherein the determination, by the device (300), of the architecture of the approximation circuit (104) comprises the determination of a number k of Boolean functions (Bq,..., B]^, each Boolean function being configured to generate a bit of the mask, on the basis of the y-bit input.

Images