Data-gating based masking
A bundled-data protocol can be used to synchronize the data flow in the mask shares. A random synchronization token is input and “bundled” with the combinatorial logic of a share. An additional output from the combinatorial logic is also provided such that when the original combinational output is exclusive OR'd (XOR'd) with the additional output yields the random synchronization token. When the XOR of the original and additional outputs, and the input synchronization token are equal, it indicates that the computation of the combinatorial logic is complete. Thus, the result of the comparison of the XOR of the original and additional outputs, and the input synchronization token may be used as a “done” or “enable” handshake signal to allow asynchronous gating elements (e.g., AND gates, asynchronous set-reset latches, and/or state-holding elements like the Muller C-element, etc.) to start and stop the flow of data in a mask share.
1 . An integrated circuit, comprising:
first masked circuitry to compute a first masked output value from at least a first share value and a second share value;
second masked circuitry to compute a second masked output value from at least a randomized first token value, the first share value, and the second share value;
first regeneration circuitry to compute a first regenerated token value; and,
first enable signal circuitry to output a first enable signal based on the randomized first token value and the first regenerated token value.
2 . The integrated circuit of claim 1 , further comprising:
third masked circuitry to, in response to the first enable signal, compute a third masked output value from at least the first masked output value.
3 . The integrated circuit of claim 2 , further comprising:
fourth masked circuitry to, in response to the first enable signal, compute a fourth masked output value from at least the randomized first token value and the first masked output value.
4 . The integrated circuit of claim 3 , further comprising:
second regeneration circuitry to compute a second regenerated token value.
5 . The integrated circuit of claim 4 , further comprising:
second enable signal circuitry to output a second enable signal based on the randomized first token value and the second regenerated token value.
6 . The integrated circuit of claim 1 , wherein the first regeneration circuitry comprises an exclusive-OR function.
7 . The integrated circuit of claim 1 , wherein the first masked circuitry is included in a cryptographic operation.
8 . The integrated circuit of claim 1 , wherein the first masked circuitry implements a masked AND gate.
9 . A method, comprising:
generating a first output share of data gate based masking (DGM) circuitry based on a first input share value and a second input share value;
generating a second output share of the DGM circuitry based on a randomized first token value, the first input share value, and the second input share value;
generating a linearly processed first regenerated token value based on the first output share of the DGM circuitry and the second output share of the DGM circuitry; and,
outputting a first enable signal based on a linearly processed first token value and the linearly processed first regenerated token value.
10 . The method of claim 9 , further comprising:
in response to the first enable signal, generating a third output share of the DGM circuitry based on at least the first output share.
11 . The method of claim 10 , further comprising:
in response to the first enable signal, generating a fourth output share of the DGM circuitry base on at least the randomized first token value and the first output share.
12 . The method of claim 11 , further comprising:
generating a linearly processed second regenerated token value based on the third output share and the fourth output share.
13 . The method of claim 12 , further comprising:
outputting a second enable signal based on the linearly processed first token value and a linearly processed second regenerated token value.