1. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 Data Dependent Power Use in Multipliers Colin D. Walter Colin.Walter@comodo.com David Samyde David.Samyde@FemtoNano.com Work partly done at DICE, UCL, Louvain-la-Neuve, Belgium

2. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 2/17 Overview Background & Aims History Cryptographic Context Multiplier Models Gate Switching Activity Hamming & Booth Weight Multipliers Lab Results Conclusions

3. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 3/17 Background Power used by a multiplier is data dependent. Similarly, EMR from a multiplier depends on current state & new inputs. Inexpensive equipment can measure the variations. So secret data may leak during cryptographic use. The main leakage in smart cards is from buses. First order leakage depends on Hamming weight, which can be made constant. The multiplier is the next most leaky HW component of a crypto co-processor.

4. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 4/17 Aims There are HW counter-measures, such as Faraday cages, and SW blinding counter-measures. It is unclear if these are totally effective. So investigate which multiplier designs & arithmetic representations might reduce power/EMR variations. 1.Build model to simulate power consumption. 2.Apply to standard designs and compare them. 3.Develop “better” multipliers...

5. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 5/17 History Occasional (public) refs in old patents: To ensure that the data carrier consumes the same amount of current whether the requested operation is authorized or unauthorized, a bit is stored in the memory in either event. [Abstract, US Patent 4211919, filed Aug 1978] Kocher et al (C RYPTO 1996, 1999): Timing and Power Attacks – the concepts made public. Walter (CHES 2001): How to extract private RSA key from power variation of single decryption in presence of standard SW counter-measures. Flynn & Oberman (Wiley, 2001) “Advanced Computer Arithmetic Design”

6. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 6/17 Cryptographic Context Smartcard : 8- or 16-bit multipliers for RSA. Long integers A, B in modular products have ~2 7 digits. Each digit x digit mult n a i x b j has ~2 7 cases with same a i (or b j ). Take average power trace as b j (resp. a i ) varies. (Generally, some average must be taken to eliminate noise) Does result characterise a i or mask its value? Any revealed characteristics can be used to distinguish multipliers in the exp n alg m, and hence determine the secret exponent.

7. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 7/17 Multiplier Model Standard Add-and-Shift Multiplier: 3-to-2 full adders (counters) & 2 bit half adders. Wallace tree arrangement for adders/ HAs. Build model with input word length k as parameter. For convenience, assume all gate switching (A ND, X OR, etc) consumes same power. (Easy to drop this assumption.) Count gates switched for all initial states and all inputs. Draw graphs and look for distinguishing characteristics.

8. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 8/17 Gate Switching Activity Clearly, Hamming weight is leaked by knowledge of switch counts. (Hamming Weight = #1 bits in binary string.) No. of Gate Switchings averaged over initial states for 3-bit multiplier 2nd Argument Digit 20 15 10 5 01245367 1st Argument Digit Digit wt 3 Digits wt 2 Digits wt 1 Digit wt 0

9. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 9/17 Hamming Weight Multiplier Similar results hold for exhaustive simulations as word size increases. Complexity too great for 16-bit words or larger: O(2 4k k 2 ) for k-bit words. Need to build a Hamming weight multiplier where inputs are Ham g Wt s and output is average gate switching activity – and with polynomial complexity, if possible. Solution: For k-bit multiplier & input a with HW(a) = h, send probability h/k of a bit 1 along the wire, and compute probabilities of gates switching.

10. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 10/17 Results Gate Switching in 8-bit Multiplier as function of input Ham Wts. Comparison of gate counts gives excellent match between HWt multiplier and binary multiplier, all k. So model can be used to predict gate activity in larger cases. HW(a) 0 2 4 6 8 HW(b) 8 6 4 2 0 75 100 125 150 175 200 Gates

11. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 11/17 Evaluation The model also accurately predicts the Ham Wt of the output. The 3-D graphs (actual vs model results) have the same features. Hamming Wt of Output (k = 16): HW(a) HW(b) HW(a×b)

12. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 12/17 Booth 2 Multiplier A 2-bit Booth Multiplier was built: One input is given a base 4 re-coding of one argument using digits –2, –1, – 0, +0, +1, +2. These multiples of the other input (the multiplicand) feed into a tree of compressors. Graphs show that gate switching (& leakage) depends on: i)The Hamming Wt of the multiplicand ii)The “Booth” Weight of the multiplier: Booth Wt is defined by summing: 0 for recoded digit +0(000...00 is added) 2 for recoded digit –0(111...11 is added, with correction) 1 for all other digits d(dM is added for multiplicand M)

13. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 13/17 Booth Weight Multiplier Can a HWt / BWt multiplier be built for the Booth multiplier like the Ham Wt add-and-shift multiplier? This would predict gate switching from HWt and BWt inputs without combinatorial explosion. The Add-and-Shift case assumed compressor input bits were independent. This was reasonably accurate. Addends 111...11 and 000...00 make this unreasonable for a Booth weight multiplier. Alignment of bits in 2M & shifted 1M also reduces independence. Solution not yet worked out.

14. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 14/17 Multiplier Comparison Overall gate switching was less in the Booth multiplier than the Add-and-Shift multiplier. Area is larger for Booth multiplier with expected digit sizes. So leakage is less, but there is a silicon cost. More complex multipliers are unlikely in most smartcards.

15. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 15/17 Lab Results The DICE lab at UCL was used to measure power variation and EMR in several multipliers. Only add-and-shift designs were available. EMR at a variety of frequencies yields much more discriminating leakage than a simple gate count, which approximated the power leakage data. So the models agreed with lab results, but the lab results might be used to extract further information.

16. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 16/17 Conclusions Power use in standard multipliers is closely related to input Hamming (or re-coded) weights; Simplified poly time models can enable good accuracy for power use, so designs can be tested easily in the search for less leaky hardware; Some multiplier designs (such as one with 2-bit Booth re-coding) leak less information about Hamming wts than others (such as the standard Add-and-Shift multiplier).

17. IEEE ARITH 17 Cape Cod, 27th – 29th June 2005 17/17 IACR CHES 2005 28 Aug – 1 Sept Edinburgh Scotland