Multiplier protected against power analysis attacks
AssigneeNuvoton Technology Corporation
InventorMoshe Alon
Life of this patent
Estimating the term…
Abstract
A multi-word multiplier circuit includes an interface and circuitry. The interface is configured to receive a first parameter X including one or more first words, and a second parameter Y′ including multiple second words. The second parameter includes a blinded version of a non-blinded parameter Y that is blinded using a blinding parameter AY so that Y′=Y+AY. The circuitry is configured to calculate a product Z=X·Y by summing multiple sub-products, each of the sub-products is calculated by multiplying a first word of X by a second word of Y′, and subtracting from intermediate temporary sums of the sub-products respective third words of a partial product P=X·BY, BY is a blinding word included in AY.
Claims15
A multi-word multiplier circuit, comprising:
- an interface configured to receive:
- a first parameter X comprising one or more first words;
- and
- a second parameter Y′ comprising multiple second words, wherein the second parameter comprises a blinded version of a non-blinded parameter Y that is blinded using a blinding parameter AY which is a concatenation of multiple instances of an m-bit blinding word BY, so Y′=Y+AY;
- and
- circuitry, including:
- a word-based multiplier configured to calculate sub-products in a plurality of iterations, wherein each of the sub-products is calculated by multiplying a first word of X by a second word of Y′,
- an adder configured to sum the sub-products calculated by the word-based multiplier into intermediate temporary sums;
- and
- control circuits configured to control the word-based multiplier to calculate all the sub-products forming the product of the first parameter X and the second parameter Y′, and to control the adder to sum all the sub-products, while subtracting from the intermediate temporary sums, in some of the iterations a partial product of the m-bit blinding word BY and the first parameter X, so as to calculate the product of the first parameter X and the second parameter Y.
A method of multiplying a first parameter X, including one or more first words, by a second parameter Y including multiple second words, comprising:
- blinding the second parameter Y, using a first blinding parameter AY, which is a concatenation of multiple instances of an m-bit blinding word BY, by forming a modified second parameter Y′ calculated as Y′=Y+AY;
- in a multi-word multiplier circuit, receiving the first parameter X, and the modified second parameter Y′;
- calculating by a word-based multiplier of the multi-word multiplier circuit multiple sub-products in a plurality of iterations, wherein each of the sub-products is calculated by multiplying a first word of X by a second word of Y′;
- calculating a partial product as a product of the m-bit blinding word BY and the first parameter X;
- and
- summing the sub-products, by an adder of the multi-word multiplier circuit, into intermediate temporary sums, while subtracting from the intermediate temporary sums in some of the iterations, the partial product, so as to generate the product of the first parameter X and the second parameter Y.
Dependencies are inferred from the claim text.