Flexible hardware accelerators for masking conversions with a power of two modulus

Patent metadata

Field	Value
Publication number	US-12499277-B2
Application number	US-202318298100-A
Country	US
Kind code	B2
Filing date	Apr 10, 2023
Priority date	Apr 10, 2023
Publication date	Dec 16, 2025
Grant date	Dec 16, 2025

Abstract

A hardware converter configured to convert d arithmetic shares of x to d Boolean shares of x. The hardware converter has a plurality of addition layers in a tree structure. Each layer has a plurality of secure bit adders.

First claim

The invention claimed is:

1 . A hardware converter configured to convert d arithmetic shares of x to d Boolean shares of x using a modulus of 2 k , where x has k bits, the hardware converter comprising:
a first plurality of hardware addition layers, each layer comprising: a second plurality of secure bit adders, wherein each of the secure bit adders are configured to add a first input and a second input and produce an output having N shares, wherein the number of the N shares is based upon a hierarchical position of an addition layer of the respective secure bit adder in the first plurality of hardware addition layers, wherein N is an integer greater than one, the first input of each secure bit adder is N shares, wherein the first N/2 of the shares of the first input are zero shares, the second input of each secure bit adder is N shares, wherein the last N/2 of the shares of the second input are zero shares, the inputs to each of the secure bit adders of the second plurality of secure bit adders of a first layer include a kth bit of the d arithmetic shares of x, and the inputs to each of the secure bit adders of the second plurality of secure bit adders of remaining layers include the output of a previous layer.

2 . The hardware converter of claim 1 , wherein the first plurality of hardware addition layers produces outputs in a single processing cycle.

3 . The hardware converter of claim 1 , wherein the inputs of the remaining layers are directly connected to the output of the previous layer.

4 . The hardware converter of claim 1 , wherein the secure adders for a first to k−1th bits produce a carry bit that is input into the secure adder for the next bit.

5 . The hardware converter of claim 1 , wherein the secure bit adders further include a secure full adder including a first bit input, a second bit input, a carry bit input, an output bit output, and carry bit output, the secure full adder comprising:
a first XOR circuit configured to XOR the first bit input, the second bit input, and the carry bit input to produce the output bit output; a second XOR circuit configured to XOR the second bit input with the carry bit input; a secure AND circuit configured to AND an output of the first XOR circuit with an output of the second XOR circuit; and a third XOR circuit configured to XOR the second input bit with an output of the secure AND circuit to produce the carry bit output.

6 . A hardware converter configured to convert d arithmetic shares of x to d Boolean shares of x using a modulus of 2 k , where x has k bits, the hardware converter comprising:
a first plurality of hardware addition layers, each layer comprising: a second plurality of secure bit adders and a second plurality of multiplexers, wherein each of the secure bit adders are configured to add a first input and a second input and produce an output having N shares, wherein N is an integer greater than one, the first input of each secure bit adder is N shares, wherein the first N/2 of the shares of the first input are zero shares, the second input of each secure bit adder is N shares, wherein the last N/2 of the shares of the second input are zero shares, the inputs to each of the secure bit adders of the second plurality of secure bit adders of a first layer include a kth bit of the d arithmetic shares of x, the inputs to each of the secure bit adders of the second plurality of secure bit adders of remaining layers include the output of a previous layer, each of the secure adders includes a carry bit input and a carry bit output, the multiplexers receive the carry bit output from a respective associated secure bit adder and a fixed bit value, a respective output of each of the multiplexers is connected to the carry bit input of the respective associated secure bit adder, and a first multiplexer of the second plurality of multiplexers outputs the fixed bit value for the first bit of the d shares of x and the remaining multiplexers of the second plurality of multiplexers output the carry output from a prior bit for a second to kth bits.

7 . The hardware converter of claim 6 , wherein the secure bit adders further include a secure full adder including a first bit input, a second bit input, the carry bit input, an output bit output, and the carry bit output, the secure full adder comprising:
a first XOR circuit configured to XOR the first bit input, the second bit input, and the carry bit input to produce the output bit output; a second XOR circuit configured to XOR the second bit input with the carry bit input; a secure AND circuit configured to AND an output of the first XOR circuit with an output of the second XOR circuit; and a third XOR circuit configured XOR the second input bit with an output of the secure AND circuit to produce the carry bit output.

8 . A hardware converter configured to convert d Boolean shares of x to d arithmetic shares of x using a modulus of 2 k , where x has k bits, comprising:
a random number generator configured to generate d−1 random arithmetic shares of x; a secure hardware arithmetic shares to Boolean shares converter (SecA2B) configured to receive the generated d−1 random arithmetic shares and a dth share that is zero and to produce SecA2B Boolean output shares using a modulus of 2 k , a secure hardware subtractor configured to receive the SecA2B Boolean output shares from the SecA2B and to securely subtract the SecA2B Boolean output shares of the SecA2B from the d Boolean shares of x producing subtracted output shares; a refresh circuit configured to receive the subtracted output shares from the secure hardware subtractor, and to refresh the subtracted output shares from the secure hardware subtractor producing refreshed output shares; and an unmask circuit configured to receive the refreshed output shares from the refresh circuit and to combine the refreshed output shares of the refresh circuit to produce the dth arithmetic share of x.

9 . The hardware converter of claim 8 , wherein the SecA2B comprises:
a first plurality of hardware addition layers, each layer comprising: a second plurality of secure bit adders, wherein each of the secure bit adders are configured to add a first input and a second and produce an output having N shares, wherein N is an integer greater than one, the first input of each secure bit adder is N shares, wherein the first N/2 of the shares of the first input are zero shares, the second input of each secure bit adder is N shares, wherein the last N/2 of the shares of the second input are zero shares, the inputs to each of the secure bit adders of the second plurality of secure bit adders of a first layer include a kth bit of the d arithmetic shares of x, and the inputs to each of the secure bit adders of the second plurality of secure bit adders of remaining layers include the output of a previous layer.

10 . The hardware converter of claim 9 , wherein the first plurality of hardware addition layers produces outputs in a single processing cycle.

11 . The hardware converter of claim 9 , wherein the inputs of the remaining layers are directly connected to the output of the previous layer.

12 . The hardware converter of claim 9 , wherein the secure adders for a first to k−1th bits produce a carry bit that is input into the secure adder for the next bit.

13 . The hardware converter of claim 9 , wherein the secure adders for kth bits do not produce a carry bit.

14 . The hardware converter of claim 9 , the secure bit adders further include a secure full adder including a first bit input, a second bit input, a carry bit input, an output bit output, and c

Assignees

• Nxp Bv

Inventors

• Bronchain Olivier
• Schneider Tobias

Classifications

• H04L9/0852

  Quantum cryptography (transmission systems employing electromagnetic waves other than radio waves, e.g. light, infrared H04B10/00; wavelength-division multiplex systems H04J14/02; WDM arrangements H04J14/03) · CPC title

• G06F7/504

  in bit-serial fashion, i.e. having a single digit-handling circuit treating all denominations after each other · CPC title

• G06F21/72 Primary

  in cryptographic circuits · CPC title