Device and method for multiplication for impeding side-channel attacks

A device for multiplying two bit sequences, comprising:

• a hardware selector unit which is designed to select segments of the bit sequences to be multiplied, in accordance with a selection plan, to form operands from one or more segments and to output said operands to the partial multiplier unit,
• a partial multiplier unit, which is designed to receive the operands formed and to multiply them with each other in one step,
• an hardware accumulation unit which is designed to receive partial products outputted by the partial multiplier unit, to accumulate said partial products in accordance with an accumulation plan matching the selection plan, and to output the calculated product of the bit sequences after accumulation has been completed, wherein
• the hardware selector unit and the hardware accumulation unit are designed to randomly permute a sequence of selection steps and accumulation steps predefined in the respective selection plan and in the respective accumulation plan;
• wherein
• the partial multiplier unit has a plurality of partial multipliers and is designed to form partial operands having a predetermined number of bits from the operands which are supplied in one step and to distribute said partial operands to a predetermined number of active partial multipliers from the plurality of partial multipliers and to calculate a respective partial product using the outputs from said partial multipliers, wherein
• a) either
• the partial multiplier unit has a total number of partial multipliers which is greater than the predetermined number of partial multipliers necessary to calculate the partial product, and the total number of partial multipliers includes at least two groups of partial multipliers which implement different multiplication methods in groups,
• the partial multiplier unit is designed to randomly select the predetermined number of activated partial multipliers from the total number of partial multipliers, subject to the condition that at least one of the partial multipliers belongs to a different group of partial multipliers than the other selected partial multipliers, and to distribute the partial operands only to the randomly selected partial multipliers,
• b) or
• the partial multiplier unit has an input unit which is designed to form in one step partial operands having a predetermined number of bits from the operands supplied to it and to allocate and output the partial operands in a random manner to a predetermined number of partial multipliers, and to output control information which indicates how the partial operands have been allocated to the partial multipliers, wherein
• the partial multiplier unit does not have more partial multipliers than a predetermined number of partial multipliers necessary for the partial multiplication,
• a total number of partial multipliers is distributed among at least two groups each having at least one partial multiplier and the partial multipliers of each group implement a different multiplication method than the partial multipliers of the other groups, and wherein
• the partial multiplier unit has an output unit which receives the control information and which is designed to receive outputs from the respective partial multipliers and to calculate and output the respective partial product, in accordance with said control information.

A device for multiplying two bit sequences, comprising:

• a hardware selector unit which is designed to select, step by step in accordance with a selection plan, segments of the bit sequences to be multiplied, to form the inputs for the partial multiplier units from said selected segments and to output said inputs to the partial multiplier unit,
• a partial multiplier unit, which is designed to receive the operands supplied and to multiply them with each other in one step,
• an hardware accumulation unit which is designed to receive step by step partial products outputted by the partial multiplier unit, to accumulate said partial products in accordance with an accumulation plan matching the selection plan, and to output the calculated product of the bit sequences after accumulation has been completed, wherein
• the partial multiplier unit has a plurality of partial multipliers and is designed to form partial operands having a predetermined number of bits from the operands which are supplied in one step and to distribute said partial operands to a predetermined number of active partial multipliers from the plurality of partial multipliers and to calculate a respective partial product using the outputs from said partial multipliers, wherein
• a) either
• the partial multiplier unit has a total number of partial multipliers which is greater than the predetermined number of partial multipliers necessary to calculate the respective partial product, and the total number of partial multipliers includes at least two groups of partial multipliers which implement different multiplication methods in groups, and
• the partial multiplier unit is designed to randomly select the predetermined number of activated partial multipliers from the total number of partial multipliers, subject to the condition that at least one of the partial multipliers belongs to a different group of partial multipliers than the other selected partial multipliers, and to distribute the partial operands only to the randomly selected partial multipliers,
• b) or
• the partial multiplier unit has an input unit which is designed to form in one step partial operands having a predetermined number of bits from the operands supplied to it and to randomly allocate the partial operands to a predetermined number of partial multipliers, and to output control information which indicates how the partial operands have been allocated to the partial multipliers, wherein
• the partial multiplier unit does not have more partial multipliers than a predetermined number of partial multipliers necessary for the partial multiplication,
• a total number of partial multipliers is distributed among at least two groups each having at least one partial multiplier and the partial multipliers of each group implement a different multiplication method than the partial multipliers of the other groups, and wherein
• the partial multiplier unit has an output unit which receives the control information and which is designed to receive outputs from the respective partial multipliers and to calculate and output the respective partial product using said outputs, in accordance with said control information.

A hardware-implemented method for multiplying two bit sequences, said method comprising the steps of:

• randomly selecting and activating exactly one multiplier unit for performing multiplication from a plurality of parallel multiplier units, wherein
• each multiplier unit implements a different multiplication method to perform multiplication and for that purpose has a respective hardware selector unit and a respective hardware accumulation unit which are designed respectively for the multiplication method being implemented, wherein
• the hardware selector unit of the respectively activated multiplier unit selects segments of the bit sequences to be multiplied, step by step in accordance with a selection plan adapted to the respective multiplication method, forms operands for a partial multiplication from the selected segments and outputs said operands to a partial multiplier unit,
• all multiplier units share exactly one partial multiplier unit which receives operands formed from one or more segments by the respectively activated multiplier unit and multiplies said operands with each other, wherein
• the hardware accumulation unit of the activated multiplier unit receives step by step the partial products outputted by the partial multiplier unit, accumulates said partial products in accordance with an accumulation plan adapted to the implemented multiplication method and matching the selection plan, and outputs the calculated product of the bit sequences after accumulation has been completed.

A hardware-implemented method for multiplying two bit sequences, said method comprising the steps of:

• selecting segments of the bit sequences to be multiplied and forming the operands for partial multiplication step by step in accordance with a selection plan,
• receiving and multiplying the formed operands in one step in a partial multiplier unit for forming partial products,
• receiving and accumulating said partial products in accordance with an accumulation plan matching the selection plan and outputting the calculated product of the bit sequences after accumulation has been completed, wherein
• a) either
• partial operands having a predetermined number of bits are formed in a partial multiplier unit from the operands for the purpose of multiplying the received operands and are distributed to a predetermined number of partial multipliers of the partial multiplier unit, and a respective partial product is calculated using outputs from the partial multipliers, wherein
• the partial multiplier unit has a total number of partial multipliers which is greater than the predetermined number of partial multipliers necessary to calculate the respective partial product, and the total number of partial multipliers includes at least two groups of partial multipliers which implement different multiplication methods in groups, wherein
• the partial multiplier unit randomly selects the predetermined number of activated partial multipliers from the total number of partial multipliers, subject to the condition that at least one of the partial multipliers belongs to a different group of partial multipliers than the other selected partial multipliers, and distributes the partial operands only to the randomly selected partial multipliers,
• b) or
• the partial multiplier unit forms in one step partial operands having a predetermined number of bits from the operands supplied to it and allocates and outputs the partial operands in a random manner to a predetermined number of partial multipliers, and outputs control information which indicates how the partial operands have been allocated to the partial multipliers, wherein
• the partial multiplier unit does not have more partial multipliers than a predetermined number of partial multipliers necessary for the partial multiplication,
• a total number of partial multipliers in the partial multiplier unit is distributed among at least two groups each having at least one partial multiplier and the partial multipliers of each group implement a different multiplication method than the partial multipliers of the other groups, and wherein
• the partial multiplier unit receives outputs in accordance with the control information from the respective partial multipliers indicated therein, and calculates and outputs the respective partial product.