CN107689863A

CN107689863A - A kind of arithmetic addition mask turns the protection circuit of Boolean XOR mask

Info

Publication number: CN107689863A
Application number: CN201710788468.5A
Authority: CN
Inventors: 李军; 饶金涛; 何卫国
Original assignee: CHENGDU SANLINGJIA MICROELECTRONIC Co Ltd
Current assignee: CHENGDU SANLINGJIA MICROELECTRONIC Co Ltd
Priority date: 2017-09-05
Filing date: 2017-09-05
Publication date: 2018-02-13

Abstract

The invention discloses the protection circuit that a kind of arithmetic addition mask turns Boolean XOR mask, if A is the sensitive data for needing to be blanked, M is random number mask, and input signal is T and M, and circuit forms as follows：T is respectively connected to the first NOT gate and the input of Parallel Prefix Adder；Another input of access Parallel Prefix Adder after M the second NOT gates of access；Every grade of carry-out of Parallel Prefix Adder and the output of the first NOT gate are respectively connected to XOR gate, XOR gate output final resultThe protection circuit of the present invention only includes simple combinational logic circuit, the Parallel Implementation conversion of logic, on the other hand reduces the complexity of circuit, effectively reduces circuit area and cost.The circuit applies the principle of Parallel Prefix Adder in the change-over circuit, the execution efficiency of circuit can be effectively improved, the conversion of the security logic of no median leakage is realized in the protection circuit, can the effectively power analysis to preventing side-channel, EMP attack N analysis.

Description

A kind of arithmetic addition mask turns the protection circuit of Boolean XOR mask

Technical field

The present invention relates to energy, EMP attack N guard technology, circuit design technique, and in particular to a kind of arithmetic addition mask Turn the protection circuit of Boolean XOR mask, in the case where noenergy is revealed, arithmetic mask is converted into boolean's mask so that number According to the energy expenditure and sensitive median of transfer process leakage without dependence, the energy for being effectively protected sensitive information is let out Dew, electromagnetic leakage etc., logical construction is simple, area occupied is small, while the circuit can be applicable to safety protection of chip field.

Background technology

Side-channel attack technology is the by-passing signal that make use of encryption device to reveal in the process of running, such as time, electricity Magnetic, power consumption etc., these signals are all the information that encryption device leaks in the process of running, and attack method is simply hidden, no Easily it is found.Statistical basic skills and leakage information are combined by this technology, so as to extract the sensitivity of encryption device Information, such as key of encryption device encryption etc..The species of the bypass message used according to attacker can be by side-channel attack It is divided into timing attack, Attacks, EMP attack N, fault analysis etc..In recent years, Attacks and EMP attack N obtain Swift and violent development.In research field, it is most that successful attack example occur in Attacks and EMP attack N.This two class is mainly The energy or the electromagnetic signal of radiation consumed in the process of running using crypto chip, and combine data dependence and operation phase Close the technology of breaking cryptographic keys.Its corresponding attack method have simple energy attack, differential power attack, correlation Attacks, High-order Attacks etc..

These attack technologies propose stern challenge for the design and manufacture of encryption device, and the core of encryption device is just Crypto chip, thus realize security protection crypto chip be ensure encryption device safe premise.For the core of safety Piece design, many security protections are that designing technique is also proposed one after another, safety protection technique mainly include hide defense technique and Mask defense technique, at present mask defense technique use more universal, the technical characterstic of mask defence is need not to change password The circuit characteristic of chip, defence is realized in algorithm rank, even if dependence be present in the energy expenditure of crypto chip and data, But mask technology can cover the dependence of energy expenditure and sensitive median, so as to serve the effect of security protection.

Two kinds of common mask modes are boolean's mask and arithmetic mask.In boolean's mask, median and mask are carried out XOR, i.e.,And in arithmetic mask, median and mask use add operation or multiplication to transport Calculate, add computing usually using mould.For example,N selection is according to different cryptographic algorithms. And some algorithms are based on the two kinds of computings of Boolean calculation and arithmetical operation, it is therefore desirable to using two kinds of different mask technology, Patent of the present invention is converted into Boolean XOR mask just for arithmetic addition mask.

It is the referenced patent CN using boolean's arithmetic as basic basis that traditional arithmetic addition mask, which is converted to boolean's mask, In 104852795, using the method for background mathematics, arithmetic addition mask is converted into Boolean XOR mask, it is known that A+r, r, calculateCorresponding specific algorithm is as follows： For arbitrary γ, Wherein K=32, have to arbitrary K

Complexity is high in realization for the method, while have also been introduced extra random number γ, adds complexity, increases simultaneously Memory space is added.

The content of the invention

In order to overcome the disadvantages mentioned above of prior art, the present invention proposes one kind and is easily achieved, the small combination of area occupied Logical transition circuit, arithmetic addition mask is effectively converted into Boolean XOR mask, solves arithmetic addition in the prior art Change into the problem of boolean's mask complexity is high, area occupied is big.

The technical solution adopted for the present invention to solve the technical problems is：A kind of arithmetic addition mask turns Boolean XOR mask Protection circuit, if A is to need the sensitive data that is blanked, M is mask, by input signal A+M be respectively connected to the first NOT gate and Parallel Prefix Adder, input signal M access Parallel Prefix Adder, the output of Parallel Prefix Adder after accessing the second NOT gate Output with the first NOT gate accesses XOR gate.

Compared with prior art, the positive effect of the present invention is：

The protection circuit of the present invention only includes simple combinational logic circuit, the Parallel Implementation conversion of logic, the opposing party Face reduces the complexity of circuit, effectively reduces circuit area and cost.The circuit is by the principle application of Parallel Prefix Adder In the change-over circuit, the execution efficiency of circuit can be effectively improved, the safety of no median leakage is realized in the protection circuit The conversion of logic, it can effectively support the power analysis of preventing side-channel.

Brief description of the drawings

Examples of the present invention will be described by way of reference to the accompanying drawings, wherein：

The electrical block diagram of Fig. 1 present invention.

Embodiment

Angle of the present invention from Design of Digital Circuit, it is proposed that a kind of arithmetic addition is converted to the circuit of boolean's mask.Profit Converting circuit structure is built with simple gate circuit, specific circuit structure is as shown in Figure 1.Specific thinking is as follows：Assuming that A To need the sensitive data being blanked, M is mask.When implementing boolean's mask, orderWhen implementing addition mask, Q is made =A+M mod 2ⁿ- 1, C_outFor carry, there is Q=(A+M) mod 2ⁿ-1

=(C_out*2ⁿ)+(A+M)mod 2ⁿ))mod 2ⁿ-1

=(C_out+(A+M)mod 2ⁿ))mod 2ⁿ-1

=(A+M)+C_outmod 2ⁿ

A, M, T, Q are n-bit data, are expressed as

A=(a_n-1a_n-2....a₁a₀)

M=(m_n-1m_n-2....m₁m₀)

T=(t_n-1t_n-2....t₁t₀)

Q=(q_n-1q_n-2....q₁q₀)

Wherein a_i,m_i,t_i,q_i∈ GF (2), i=0,1 ... .n-1, C_outFor carry

Formula more than can be seen that Q and first subtract M, and sensitive data A will be revealed, and further derive, by formula weight on this Bit-level circuit is turned to, is madeFurther hadWherein c_i-1For I level carries, willThe expression formula that addition mask turns boolean's mask is substituted into, is obtained

Come the carry of parallel computation i-stage, c below with the principle of Parallel Prefix Adder_i=g_i|(p_i&c_i-1), c_-1= C_out,g_i, p_iTo implementWhen ith bit final carry and carry propagation position, I=0,1,2 ... n-1. are can be found that on bit-level circuit is transformed into, due to eliminating XOR m_iComputing, to original plus Method operating structure is destroyed, i.e., algorithm is not carried out (Q-M) mod 2 in itselfⁿ- 1 operation, and the data being now blanked A, it there will not be, so as to realize the conversion logic of safe mask from circuit.Detailed design procedure is as follows：

Input：A+M,M

Output：

(1) calculate

(2) the carry c per one-level is calculated using Parallel Prefix Adder principle_i；

(3) for (i=0；i<32；i++)

In transfer process more than, the computing of each step is all without the sensitive median A of leakage.

Circuit diagram as shown in figure 1, there is two NOT gates in the circuit, an XOR gate, and Parallel Prefix The cellular construction of carry operations, the first step allow two input T and M to enter NOT gate computing, and second step is by M results of the inverted and T It is input in Parallel Prefix Adder carry computation unit, calculates carry signal, the 3rd step, carry signal and T are negated As a result it is i.e. available to carry out XOR

Claims

1. a kind of arithmetic addition mask turns the protection circuit of Boolean XOR mask, it is characterised in that：If A is quick to need to be blanked Feel data, M is random number mask, and input signal is T and M, and input signal T is respectively connected to the first NOT gate and Parallel Prefix Adder Input, input signal M access the second NOT gate after access Parallel Prefix Adder another input, Parallel Prefix addition Each grade of carry-out of device and the output access XOR gate of the first NOT gate, and export final result.

2. a kind of arithmetic addition mask according to claim 1 turns the protection circuit of Boolean XOR mask, it is characterised in that： First NOT gate carries out inverse to input signal A+M and obtained

3. a kind of arithmetic addition mask according to claim 2 turns the protection circuit of Boolean XOR mask, it is characterised in that： Second NOT gate carries out inverse to input signal M and obtained

4. a kind of arithmetic addition mask according to claim 3 turns the protection circuit of Boolean XOR mask, it is characterised in that： The Parallel Prefix Adder to input signal A+M andCarry out carry computation and obtain each grade of carry signal.

5. a kind of arithmetic addition mask according to claim 4 turns the protection circuit of Boolean XOR mask, it is characterised in that： The XOR gate to carry signal andXOR is carried out to be exported