Uniformly-switching Logic for Cryptographic Hardware D. Maslov - University of Victoria, Canada I. L. Markov - University of Michigan, USA
Outline - Motivation - Uniformly-switching logic and doubling construction - Circuit synthesis - Results and limitations page 1/7 DATE, Munich, Germany March 7-11, 2005
Motivation page 2/7 DATE, Munich, Germany March 7-11, 2005 Differential Power Attacks: When used, hardware requires power. Amount of energy used depends on the switching activity. Processing different keys results in different switching patterns. Problem 1: measuring power consumption may reveal vulnerable information (DPA).
Motivation page 2/7 DATE, Munich, Germany March 7-11, 2005 Heat dissipation monitoring: Monitoring circuit temperature distribution over the computation allows to locate areas of intensive computation. Problem 1: measuring power consumption may reveal vulnerable information (DPA). Problem 2: heat density dissipation monitoring may uncover secure information. Our solution: - uniformly-switching logic and doubling construction; - clever placement.
Uniformly-switching Logic page 3/7 DATE, Munich, Germany March 7-11, 2005 Definition. A gate f(x 1, x 2, …, x n ) = (y 1, y 2, …, y k ) with n inputs and k outputs is uniformly-switching iff there is a constant 0 < M such that for any input combination (x1, x2, …, xn), changing the value of any single bit in it will lead to changing exactly M output bits. AND u-s OR u-s XOR u-s
primary input input for C C2C2 Doubling construction page 4/7 DATE, Munich, Germany March 7-11, Take two copies of the circuit. - Switch input of one part every time other input does not switch. C C2C2 V SS clk T Q
Our solution page 5/7 DATE, Munich, Germany March 7-11, Take any circuit. - Substitute its gates with uniformly-switching. Results in constant amount of switching for any single input transition. - Build doubling construction on top of it. Equalizes amount of switching for any input transition. - Place each gate in C by its copy in C2. Prevents hot spots from building up.
Our solution: example page 6/7 DATE, Munich, Germany March 7-11, 2005
Results and Limitations page 7/7 DATE, Munich, Germany March 7-11, 2005 Our technique adapts existing circuits. The cumulative area overhead can be less than two times, but our best upper bound is ten times. Our uniformization and doubling constructions equalize energy dissipation for all inputs, states, as well as input and state transitions. Signal delay overhead is modest because we leave the structure of signal paths intact, but the area increase implies that wires may be times longer on average.
END Thank you for your attention! Uniformly-switching Logic for Cryptographic Hardware