IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

Data Dependent Power Use in Multipliers

Colin D. WalterColin.Walter@comodo.com

David SamydeDavid.Samyde@FemtoNano.com

Work partly done at DICE, UCL, Louvain-la-Neuve, Belgium

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

2/17Overview

• Background & Aims

• History

• Cryptographic Context

• Multiplier Models

• Gate Switching Activity

• Hamming & Booth Weight Multipliers

• Lab Results

• Conclusions

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

3/17Background

• Power used by a multiplier is data dependent.

• Similarly, EMR from a multiplier depends on current state & new inputs.

• Inexpensive equipment can measure the variations.

• So secret data may leak during cryptographic use.

• The main leakage in smart cards is from buses. First order leakage depends on Hamming weight, which can be made constant.

• The multiplier is the next most leaky HW component of a crypto co-processor.

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

4/17Aims

• There are HW counter-measures, such as Faraday cages, and SW blinding counter-measures.

• It is unclear if these are totally effective.

• So investigate which multiplier designs & arithmetic representations might reduce power/EMR variations.

1. Build model to simulate power consumption.

2. Apply to standard designs and compare them.

3. Develop “better” multipliers...

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

5/17History

• Occasional (public) refs in old patents: To ensure that the data carrier consumes the same amount of

current whether the requested operation is authorized or unauthorized, a bit is stored in the memory in either event. [Abstract, US Patent 4211919, filed Aug 1978]

• Kocher et al (CRYPTO 1996, 1999): Timing and Power Attacks – the concepts made public.

• Walter (CHES 2001): How to extract private RSA key from power variation of single decryption in presence of standard SW counter-measures.

• Flynn & Oberman (Wiley, 2001) “Advanced Computer Arithmetic Design”

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

6/17Cryptographic Context

Smartcard : 8- or 16-bit multipliers for RSA.

Long integers A, B in modular products have ~27 digits.

Each digit x digit multn ai x bj has ~27 cases with same ai (or bj).

Take average power trace as bj (resp. ai) varies. (Generally, some average must be taken to eliminate noise)

Does result characterise ai or mask its value?

Any revealed characteristics can be used to distinguish multipliers in the expn algm, and hence determine the secret exponent.

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

7/17Multiplier Model

Standard Add-and-Shift Multiplier:

3-to-2 full adders (counters) & 2 bit half adders.

Wallace tree arrangement for adders/ HAs.

Build model with input word length k as parameter.

For convenience, assume all gate switching (AND, XOR, etc) consumes same power. (Easy to drop this assumption.)

Count gates switched for all initial states and all inputs.

Draw graphs and look for distinguishing characteristics.

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

8/17Gate Switching Activity

Clearly, Hamming weight is leaked by knowledge of switch counts.(Hamming Weight = #1 bits in binary string.)

No. of Gate Switchings averaged over

initial states for 3-bit multiplier

2nd

Arg

um

ent D

igit

20

15

10

5

0 1 2 4 5 3 6 71st Argument Digit

Digitwt 3

Digits wt 2

Digitswt 1

Digitwt 0

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

9/17Hamming Weight Multiplier

Similar results hold for exhaustive simulations as word size increases.

Complexity too great for 16-bit words or larger: O(24kk2) for k-bit words.

Need to build a Hamming weight multiplier where inputs are Hamg Wts and output is average gate switching activity– and with polynomial complexity, if possible.

Solution: For k-bit multiplier & input a with HW(a) = h,send probability h/k of a bit 1 along the wire, and compute probabilities of gates switching.

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

10/17Results

Gate Switching in 8-bit Multiplier as function of input Ham Wts.

Comparison of gate counts

gives excellent match

between HWt multiplier

and binary multiplier, all k.

So model can be used

to predict gate activity

in larger cases.

HW(a)

0 2 4 6 8 HW

(b)

86

42

0

75

100

125

150

175

200

Gates

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

11/17Evaluation

The model also accurately predicts the Ham Wt of the output.

The 3-D graphs (actual vs model results) have the same features.

Hamming Wt of Output (k = 16):

0 2 4 6 8

10

12

14

16

0

4

8

12

16

0

2

4

6

8

10

12

14

16

HW

(a*b

)

HW(a )

HW(b )HW(a)

HW

(b)

HW

(a×

b)

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

12/17Booth 2 Multiplier

A 2-bit Booth Multiplier was built:One input is given a base 4 re-coding of one

argument using digits –2, –1, – 0, +0, +1, +2.

These multiples of the other input (the multiplicand)feed into a tree of compressors.

Graphs show that gate switching (& leakage) depends on:i) The Hamming Wt of the multiplicand

ii) The “Booth” Weight of the multiplier:

Booth Wt is defined by summing:0 for recoded digit +0 (000...00 is added)2 for recoded digit –0 (111...11 is added, with correction)1 for all other digits d (dM is added for multiplicand M)

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

13/17Booth Weight Multiplier

Can a HWt / BWt multiplier be built for the Booth multiplier like the Ham Wt add-and-shift multiplier?

This would predict gate switching from HWt and BWt inputs without combinatorial explosion.

The Add-and-Shift case assumed compressor input bits were independent. This was reasonably accurate.

Addends 111...11 and 000...00 make this unreasonable for a Booth weight multiplier.

Alignment of bits in 2M & shifted 1M also reduces independence.

Solution not yet worked out.

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

14/17Multiplier Comparison

• Overall gate switching was less in the Booth multiplier than the Add-and-Shift multiplier.

• Area is larger for Booth multiplier with expected digit sizes.

• So leakage is less, but there is a silicon cost.

• More complex multipliers are unlikely in most smartcards.

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

15/17Lab Results

• The DICE lab at UCL was used to measure power variation and EMR in several multipliers. Only add-and-shift designs were available.

• EMR at a variety of frequencies yields much more discriminating leakage than a simple gate count, which approximated the power leakage data.

• So the models agreed with lab results, but the lab results might be used to extract further information.

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

16/17Conclusions

• Power use in standard multipliers is closely related to input Hamming (or re-coded) weights;

• Simplified poly time models can enable good accuracy for power use, so designs can be tested easily in the search for less leaky hardware;

• Some multiplier designs (such as one with 2-bit Booth re-coding) leak less information about Hamming wts than others (such as the standard Add-and-Shift multiplier).

IEEE ARITH 17 Cape Cod, 27th – 29th June 2005

17/17IACR CHES 2005

28 Aug – 1 Sept

Edinburgh

Scotland