Upload
douglas-dixon
View
212
Download
0
Embed Size (px)
Citation preview
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
Data Dependent Power Use in Multipliers
Colin D. [email protected]
David [email protected]
Work partly done at DICE, UCL, Louvain-la-Neuve, Belgium
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
2/17Overview
• Background & Aims
• History
• Cryptographic Context
• Multiplier Models
• Gate Switching Activity
• Hamming & Booth Weight Multipliers
• Lab Results
• Conclusions
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
3/17Background
• Power used by a multiplier is data dependent.
• Similarly, EMR from a multiplier depends on current state & new inputs.
• Inexpensive equipment can measure the variations.
• So secret data may leak during cryptographic use.
• The main leakage in smart cards is from buses. First order leakage depends on Hamming weight, which can be made constant.
• The multiplier is the next most leaky HW component of a crypto co-processor.
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
4/17Aims
• There are HW counter-measures, such as Faraday cages, and SW blinding counter-measures.
• It is unclear if these are totally effective.
• So investigate which multiplier designs & arithmetic representations might reduce power/EMR variations.
1. Build model to simulate power consumption.
2. Apply to standard designs and compare them.
3. Develop “better” multipliers...
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
5/17History
• Occasional (public) refs in old patents: To ensure that the data carrier consumes the same amount of
current whether the requested operation is authorized or unauthorized, a bit is stored in the memory in either event. [Abstract, US Patent 4211919, filed Aug 1978]
• Kocher et al (CRYPTO 1996, 1999): Timing and Power Attacks – the concepts made public.
• Walter (CHES 2001): How to extract private RSA key from power variation of single decryption in presence of standard SW counter-measures.
• Flynn & Oberman (Wiley, 2001) “Advanced Computer Arithmetic Design”
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
6/17Cryptographic Context
Smartcard : 8- or 16-bit multipliers for RSA.
Long integers A, B in modular products have ~27 digits.
Each digit x digit multn ai x bj has ~27 cases with same ai (or bj).
Take average power trace as bj (resp. ai) varies. (Generally, some average must be taken to eliminate noise)
Does result characterise ai or mask its value?
Any revealed characteristics can be used to distinguish multipliers in the expn algm, and hence determine the secret exponent.
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
7/17Multiplier Model
Standard Add-and-Shift Multiplier:
3-to-2 full adders (counters) & 2 bit half adders.
Wallace tree arrangement for adders/ HAs.
Build model with input word length k as parameter.
For convenience, assume all gate switching (AND, XOR, etc) consumes same power. (Easy to drop this assumption.)
Count gates switched for all initial states and all inputs.
Draw graphs and look for distinguishing characteristics.
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
8/17Gate Switching Activity
Clearly, Hamming weight is leaked by knowledge of switch counts.(Hamming Weight = #1 bits in binary string.)
No. of Gate Switchings averaged over
initial states for 3-bit multiplier
2nd
Arg
um
ent D
igit
20
15
10
5
0 1 2 4 5 3 6 71st Argument Digit
Digitwt 3
Digits wt 2
Digitswt 1
Digitwt 0
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
9/17Hamming Weight Multiplier
Similar results hold for exhaustive simulations as word size increases.
Complexity too great for 16-bit words or larger: O(24kk2) for k-bit words.
Need to build a Hamming weight multiplier where inputs are Hamg Wts and output is average gate switching activity– and with polynomial complexity, if possible.
Solution: For k-bit multiplier & input a with HW(a) = h,send probability h/k of a bit 1 along the wire, and compute probabilities of gates switching.
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
10/17Results
Gate Switching in 8-bit Multiplier as function of input Ham Wts.
Comparison of gate counts
gives excellent match
between HWt multiplier
and binary multiplier, all k.
So model can be used
to predict gate activity
in larger cases.
HW(a)
0 2 4 6 8 HW
(b)
86
42
0
75
100
125
150
175
200
Gates
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
11/17Evaluation
The model also accurately predicts the Ham Wt of the output.
The 3-D graphs (actual vs model results) have the same features.
Hamming Wt of Output (k = 16):
0 2 4 6 8
10
12
14
16
0
4
8
12
16
0
2
4
6
8
10
12
14
16
HW
(a*b
)
HW(a )
HW(b )HW(a)
HW
(b)
HW
(a×
b)
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
12/17Booth 2 Multiplier
A 2-bit Booth Multiplier was built:One input is given a base 4 re-coding of one
argument using digits –2, –1, – 0, +0, +1, +2.
These multiples of the other input (the multiplicand)feed into a tree of compressors.
Graphs show that gate switching (& leakage) depends on:i) The Hamming Wt of the multiplicand
ii) The “Booth” Weight of the multiplier:
Booth Wt is defined by summing:0 for recoded digit +0 (000...00 is added)2 for recoded digit –0 (111...11 is added, with correction)1 for all other digits d (dM is added for multiplicand M)
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
13/17Booth Weight Multiplier
Can a HWt / BWt multiplier be built for the Booth multiplier like the Ham Wt add-and-shift multiplier?
This would predict gate switching from HWt and BWt inputs without combinatorial explosion.
The Add-and-Shift case assumed compressor input bits were independent. This was reasonably accurate.
Addends 111...11 and 000...00 make this unreasonable for a Booth weight multiplier.
Alignment of bits in 2M & shifted 1M also reduces independence.
Solution not yet worked out.
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
14/17Multiplier Comparison
• Overall gate switching was less in the Booth multiplier than the Add-and-Shift multiplier.
• Area is larger for Booth multiplier with expected digit sizes.
• So leakage is less, but there is a silicon cost.
• More complex multipliers are unlikely in most smartcards.
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
15/17Lab Results
• The DICE lab at UCL was used to measure power variation and EMR in several multipliers. Only add-and-shift designs were available.
• EMR at a variety of frequencies yields much more discriminating leakage than a simple gate count, which approximated the power leakage data.
• So the models agreed with lab results, but the lab results might be used to extract further information.
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
16/17Conclusions
• Power use in standard multipliers is closely related to input Hamming (or re-coded) weights;
• Simplified poly time models can enable good accuracy for power use, so designs can be tested easily in the search for less leaky hardware;
• Some multiplier designs (such as one with 2-bit Booth re-coding) leak less information about Hamming wts than others (such as the standard Add-and-Shift multiplier).
IEEE ARITH 17 Cape Cod, 27th – 29th June 2005
17/17IACR CHES 2005
28 Aug – 1 Sept
Edinburgh
Scotland