Apparatus and method for converting, and adder circuit

An apparatus and method for converting a dual-rail input. The apparatus combines two useful operand bits and two auxiliary operand bits so that, in a data mode, two output operands of three output operands have a value which is different from that of the third output operand. In a preparation mode, the three output operands of the apparatus have the same value. The apparatus and method may preferably be employed in a three-operands adder as an interface between a dual-rail three-bits half adder and a sum-carry stage of a two-bits full adder so to achieve the same level of security as a full implementation of the three-operands adder in dual-rail technology, despite the two-bits full adder being implemented in single-rail technology.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to secure adder circuits and, in particular, to an apparatus and a method for converting a dual-rail input to a one-hot output.

2. Description of the Related Art

DE 3631992 C2 discloses a cryptography processor for performing the RSA public-key crypto system. Here, a modular exponentiation having a basis, and exponent and a module is broken down into a plurality of three-operands additions. The three operands include a module operand N, a multiplicand operand C and an intermediate-result operand Z. By appropriate shifting/weighting of the three operands before the addition, a multiplication/reduction accelerated by a multiplication-lookahead algorithm and reduction-lookahead algorithm may be performed.

FIG. 8depicts part of the adder representing, as it were, the core of the cryptography processor shown in DE 3631992 C2. In particular,FIG. 8shows two successive bit slices to calculate the two aggregate bits i−1 and i, to be precise from the three input operand bits Ci, Ni, Zi; Ci−1, Ni−1, Zi−1; and Ci−2, Ni−2and Zi−2, respectively.

From the point of view of a bit plane, the three-operands addition of C, N, Z is broken down into a two-level operation. A three-bits half adder80is provided for performing the first stage of the operation, each three-bits half adder80being upstream of a two-bits full adder81. The three-bits half adder provides two output bits xi, yi, the output bits xi, yibeing fed into the downstream two-bits full adders as is depicted inFIG. 8. In particular, in each two-bits full adder of a bit slice, the less significant bit yiat the output of the three-bits half adder is combined with the highly significant bit of the three-bits half adder stage (xi−1), which is one order down, in the two-bits full adder81to calculate an aggregate bit82and a carry bit83. The three-operands addition is thus divided into two sections. In the first section, a sum of the three bits of the operands is formed at each binary digit. The sum may take on the values of 0 to 3 (in decimal notation). Thus, the sum may be represented in a binary manner with the two bits x, y. Since the sum is formed at each digit, two new figures may be combined from the two aggregate bits.

In the second section, both figures are added by the two-bits full adder81in the usual manner. The circuit connection such that a two-bits full adder always obtains, as an input, two output bits from two different three-bits half adders, leads to an extension of the calculating unit by one bit.

The three-operands adder shown inFIG. 8is problematic in that provision is made neither of a backup of the input operands C, N, Z nor of a backup of the “intermediate operands” x, y. This is problematic in so far as, in particular in the normal case where all circuits are configured in a CMOS logic, switching one bit from 0 to 1 and from 1 to 0, respectively, leads to a current pulse which starts when a bit state is switched. As is known, CMOS circuits do not consume current in the static state. In the switching state, however, they do consume current. This current consumption may be determined by a power analysis. It is therefore possible, in principle, to derive information about C, N, Z so as to draw conclusions, for example, about the secret key used in an RSA operation.

An attacker could determine, for example by capturing the current profile, whether a switchover from 0 to 1 or from 1 to 0 has occurred. In a non-secured circuit, a switchover of a bit would occur whenever a current peak may be recognized in the current profile. Therefore, an attacker may re-enact, in his/her mind, the overall switchover behavior of a calculating unit using the current profile. The attacker then would only require one single bit in a whole sequence to be able to reconstruct therefrom whether a switchover from a “1” to a “0” or vice versa has occurred.

Specific CMOS circuits additionally exhibit the property that the switchover from 0 to 1 entails a power consumption which is different from that of the switchover from 1 to 0. By comparing two different current peaks, an attacker in this case immediately sees which bits have been processed in the calculating unit.

As a countermeasure to be taken against such power analysis attacks it has been proposed to employ a so-called dual-rail technology. In principle, in the dual-rail technology, each signal path is configured in a dual manner. For example, a signal x is processed in a normal manner on a first signal path. On the second signal path integrated in the same chip, it is not the signal x that is processed, but the complementary signalx. The result is that whenever a transition occurs from, for example, 0 to 1 in the signal line, a complementary transition occurs in the other line, i.e. the second “rail”. Therefore, there are always two transitions that occur on both lines for each bit transition. This leads to the fact that for circuits wherein transitions from 0 to 1 and from 1 to 0 require a different amount of current, it is no longer possible to find out whether a transition has occurred from 0 to 1 or from 1 to 0. This is due to the fact that the current profile contains, for each circuit transition, a peak which is the superposition of the current consumption of both rails. The dual-rail technology provides a high level of security, but suffers from the disadvantage that all circuits normally have to have a double configuration and that the power consumption of the entire circuit is also double. On the other hand, the circuit is already immune, to a certain extent, to power analysis attacks.

If only dual-rail technology is employed, it is still recognizable, by means of the current profile, whether a specific bit has transitioned from 0 to 1 or from 1 to 0 or whether it has remained the same compared to the previous clock cycle. In the event of a bit transition, a power peak is actually evident. However, the power peak is not evident if a bit has remained, for example, at 1 or at 0, i.e. has not changed, from one cycle to the next. In order to fend off attacks based on this effect it has been proposed to complement the dual-rail technology by a precharge/predischarge mode. The circuit is operated alternatively in a data mode and in a preparation mode (precharge/predischarge mode). Each data cycle is preceded by a preparation cycle wherein, in the case of precharge, both rails, i.e., for example, x andx, are precharged to “1” so as to feed thereafter, in the data mode, the two rails with complimentary input signals to be processed. This leads to the fact that it is always exactly the same number of transitions that take place from a data cycle to a preparation cycle or from a preparation cycle to a data cycle. If the preparation mode is configured as a predischarge mode, in the preparation mode, all input data is not initialized to 1, as in the precharge mode, but “predischarged” to 0. Then there will be exactly the same number of transitions from a preparation cycle to a data cycle and vice versa.

As has already been explained, a three-operands adder is required for performing modular operations, e.g. addition or multiplication, for example, within the framework of cryptographic algorithms such as RSA or elliptic curves. Due to the various reasons, these operations must be performed, by the adder, in a manner which is secure against power attacks. Since cryptographic calculations require a very high amount of calculating expenditure, the adder must have a large amount of power available to it. Since, in particular in cryptography, long operands must be processed, the length of the operands in elliptic curves ranging from 100 to 200 bits and, in the field of RSA, ranging from 1024 to 2048 bits, the adder itself has a long bit length to achieve the speed requirements placed upon the calculating unit. Due to this long bit length, however, it is essential, from an economic point of view, to design the adder with as little area as possible—the bulk cost is usually accounted for by the chip area. Therefore, a calculating unit is required which has high speed, is secure and also requires a small amount of area all at once.

As has already been discussed, the three-operands adder disclosed in DE 3631992 C2 provides no security against hardware attacks. If both the three-bits half adder and the two-bits full adder were fully configured in dual-rail with precharge, this would provide a high level of security but will also mean an immense space requirement.

SUMMARY OF THE INVENTION

It is an object of the present invention to provide a secure and efficient concept for performing an addition with at least three operands.

In accordance with a first aspect, the present invention provides an apparatus for converting a dual-rail input, having two useful operand bits and two auxiliary operand bits, to an output having three output operands, the two auxiliary operand bits being, in a data mode, complementary to the two useful operand bits, the apparatus having: control means for alternately operating the apparatus in a data mode and in a preparation mode following the data mode and again a data mode following the preparation mode; and a logic circuit for combining the two useful operand bits and the two auxiliary operand bits such that, in the data mode, two output operands of the three output operands have a value which is different from that of a third output operand of the three output operands, and wherein the logic circuit is further configured to ensure, in the preparation mode, that the three output operands have the same value.

In accordance with a second aspect, the present invention provides an adder for adding three operands, having: a three-bits half adder in dual-rail technology which is operable in a preparation mode and in a data mode so as to calculate two dual-rail output operands from three dual-rail input operands; a two-bits full adder, having: an apparatus for converting a dual-rail input, comprising two useful operand bits and two auxiliary operand bits, to an output having three output operands, the two auxiliary operand bits being, in a data mode, complementary to the two useful operand bits, the apparatus having: control means for alternately operating the apparatus in a data mode and in a preparation mode following the data mode and again a data mode following the preparation mode; and a logic circuit for combining the two useful operand bits and the two auxiliary operand bits such that, in the data mode, two output operands of the three output operands have a value which is different from that of a third output operand of the three output operands, and wherein the logic circuit is further configured to ensure, in the preparation mode, that the three output operands have the same value, for generating single-rail lookahead parameters from two dual-rail output bits; and a sum-carry stage for calculating an aggregate bit and a carry bit from the single-rail lookahead parameters.

In accordance with a third aspect, the present invention provides a method for converting a dual-rail input, having two useful operand bits and two auxiliary operand bits, to an output having three output operands, the two auxiliary operand bits being, in a data mode, complementary to the two useful operand bits, the method having the steps of: operating the apparatus alternately in a data mode, in a preparation mode following the data mode and again in a data mode; and combining the two useful operand bits and the two auxiliary operand bits such that, in the data mode, two output operands of the three output operands have a value which is different from that of a third output operand of the three output operands, and ensuring that, in the preparation mode, the three output operands have the same value.

In accordance with a fourth aspect, the present invention provides a computer program having a program code for performing the method for converting a dual-rail input, having two useful operand bits and two auxiliary operand bits, to an output having three output operands, the two auxiliary operand bits being, in a data mode, complementary to the two useful operand bits, the method having the steps of: operating the apparatus alternately in a data mode, in a preparation mode following the data mode and again in a data mode; and combining the two useful operand bits and the two auxiliary operand bits such that, in the data mode, two output operands of the three output operands have a value which is different from that of a third output operand of the three output operands, and ensuring that, in the preparation mode, the three output operands have the same value, if the program runs on a computer.

The present invention is based on the findings that a more or less high level of security may be achieved if only the three-bits half adder is configured in dual-rail with precharge/predischarge, and if the subsequent two-bits full adder, which consists of a series connection of a carry-lookahead element and a sum-carry element, is still configured in single rail, which leads to the fact that even though the three-bits half adder consumes double the chip area due to its full dual-rail configuration, the two-bits full adder, however, is only configured in single rail, so that the latter consumes only half of the chip area compared to full dual-rail configuration.

In accordance with the invention, the fact that the carry-lookahead element provides, for calculating a propagate value P, a kill value K and a generate value G, an output representing a one-hot coding is benefited from. In the one-hot coding of an output consisting of several output lines there is only ever one output line that differs from all other output lines. By operating the one-hot coded output in a data mode wherein the state of an output line is different from all other output lines, and in a subsequent preparation mode, which may be a precharge mode or a predischarge mode, it is ensured that it is always the same number of transitions that take place from one cycle to the next at the output of the carry-lookahead element, to be precise that it is always, for example, one single transition or, for example, two transitions.

The inventive three-operands adder which is fast, on the one hand, and secure, on the other hand, and also space-efficient, is therefore achieved by a dual-rail to one-hot converter which translates a dual-rail input into a one-hot coded output with at least three operands.

In accordance with the invention, use is made of the fact that a one-hot coding, if operated in a data mode and a preparation mode, fulfils the same security requirements as does a dual-rail system, this requirement being that it is always the same number of state alterations that occur from one clock cycle to the next, i.e. from a preparation cycle to a data cycle or vice versa, so that it may not be recognizable, by means of a power analysis, which bits are actually being processed in the data cycle.

The inventive apparatus for converting a dual-rail input to a one-hot coded output is advantageous in that it enables a dual-rail three-bits half adder and a single-rail two-bits full adder to be combined to provide a fast, secure and space-efficient adder for, preferably, a cryptoprocessor or cryptoco-processor.

A further advantage of the inventive conversion circuit from dual-rail to one-hot is that the circuit fulfils, as it were, two functions at the same time; specifically, it combines, on the one hand, the dual-rail input signals in a logically correct manner to obtain correct one-hot coded output signals, and it provides, on the other hand, the conversion of dual-rail to single-rail “for free”, as it were.

A one-hot coding, which is used particularly frequently in adders, is the propagate, kill and generate codings. These three signals, which are typical of adders, are defined such that it is only ever one signal that can be active at any one time. A pair of bits may only have either propagate=1 or kill=1 or generate=1. On the output side, the dual-rail to one-hot converter in accordance with the present invention is coupled to common single-rail sum-carry element which calculates, from the three lookahead parameters P, K, G and from a carry of the next adder stage down, both the aggregate bit of the current bit slice, and determines and outputs the carry bit from the current bit slice to the next slice up.

A further advantage of the inventive conversion apparatus is that the redundancy of the dual-rail half adder, which is tolerated for security reasons, may be advantageously used by the logic circuit of the inventive apparatus to calculate the one-hot coded output with a minimum number of transistors, since logical links, or combinations, may be performed not only due to the usual output signals of the half adder but also due to the present complementary output signals, so that the inventive converter, which, at the same time, calculates lookahead parameters and provides a dual-rail to one-hot conversion, may also be implemented in a manner which is economical in terms of transistors.

In the embodiment of the present invention, the logic part of the conversion apparatus additionally is not constructed in a normal complementary CMOS logic, but merely with NMOS transistors which, on the one hand, operate faster and, on the other hand, are easier to drive and/or are easier to be handled, on the whole, in terms of circuit design, than the PMOS transistors. The converter in accordance with this preferred embodiment of the present invention therefore has an NMOS-only-logic in contrast to a common CMOS logic wherein the transistor types always come up in pairs, i.e. an NMOS transistor co-operates with a PMOS transistor, etc.

FIG. 1shows an apparatus for converting a dual-rail input comprising at least two useful operand bits x, y, z, and a corresponding number of auxiliary operand bitsx,y,z, to an output having at least three output operands a, b, c, the two auxiliary operand bits being, in a data mode, complementary to the two useful operand bits, and, depending on the embodiment, the two auxiliary operand bits having, in a preparation mode, the same values as the two useful operand bits. If the preparation mode is a precharge mode, both the useful operand bits and the auxiliary operand bits all have the same high voltage level. On the other hand, if the preparation mode is implemented by means of a predischarge, both the useful operand bits and the auxiliary operands bits have a same low voltage value. Typically, the high voltage value is referred to as Vdd, whereas the low voltage value is referred to as Vss and is typically O V.

The conversion apparatus in accordance with the invention shown inFIG. 1includes control means10for operating the apparatus in a data mode and for operating the circuit in a preparation mode, the preparation mode following the data mode. Depending on the practical implementation, the preparation mode is one preparation cycle long, and the data mode is one data cycle long, a cycle being derived from a clock generator.

The inventive conversion apparatus depicted inFIG. 1further includes a logic circuit12for combining at least two useful operand bits x, y, z and at least two auxiliary operand bitsx,y,zsuch that, in the data mode, two output operands a, b of the, e.g., three output operands a, b, c have a value different from that of the third output operand, and wherein the apparatus ofFIG. 1is further configured to provide, in the preparation clock cycle, identical output operands a, b, c. In other words, the output shown inFIG. 1representing, in the data mode, a one-hot coding, may be referred to as a “single-rail output” with precharge and/or with predischarge. In the preparation mode, the output values a, b, c have a low voltage state, such as 0 V, or Vss, in the event of predischarge. In the precharge operation as the preparation mode, the output operands a, b, c all have a logically high state (Vdd).

It shall be pointed out at this point that the inventive conversion apparatus may be used not only for calculating the lookahead parameters P, K, G, from dual-rail input bits x, y, andx,y, respectively, but that generally each dual-rail input, i.e. even an input with more than two useful operand bits, may be converted to a one-hot coding comprising more than two output lines. The inventive apparatus ofFIG. 1is thus suitable for any dual-rail to one-hot conversion as long as a logic circuit may be constructed which enables a conversion of the useful operand bits x, y, z, . . . to a one-hot coding in accordance with a mapping specification.

Even though mention has always been made above and will always be made below of “one-hot” encoding, it shall be pointed out here that a one-hot coding may evidently consist, e.g., in one of three lines having a high voltage state (Vdd), whereas the other two lines have a low voltage state (Vss). A one-hot coding is also an inverse mapping, as it were, wherein one line has a low voltage state (Vss), whereas the other two lines have a high voltage state (Vdd). In the case of inverse mapping, a data-state alteration will always take place, at the output of the apparatus depicted inFIG. 1, at the transition from a precharge mode to a data mode. In the precharge mode, all output lines are on Vdd, whereas in the data mode, at least one output line is on Vss. If the precharge mode is operated with a non-inverted one-hot coding, there will always be precisely two alterations of state that take place at a transition from the data mode to the preparation mode.

If, however, the predischarge mode is combined with the inverted data mode, there will also be two state alterations if a switch is made from a preparation cycle to a data cycle and vice versa. If, on the other hand, predischarge is combined with the non-inverted mapping of the one-hot coding, there will only be a state transition from a data cycle to the preparation cycle, and vice versa.

FIG. 2shows a truth table of the functionality of the logic circuit12ofFIG. 1using the example of the generation of lookahead parameters P, K, G of a two-bits full adder. As is known, the lookahead parameter P, also referred to as propagate, designates the case where exactly one bit of two bits to be added equals 1. In this case, a carry coming from the next bit slice down is simply passed on and propagates. If, however, both input bits in one bit slice are equal to 1, this bit slice generates a new carry (generate). If, on the other hand, both input bits are equal to 0, a carry which may possibly enter into this bit slice will be absorbed by the next stage down by the currently considered bit slice, i.e. the carry is “killed”.

It may be seen from the right-hand half of the table depicted inFIG. 2that only ever either P, K or G have a logical state “1”, i.e. that P, K, G together represent a one-hot coding.

The parameter P is calculated by XORing x and y. The parameter K is created by NORing x and y. The parameter G is created by performing an AND operation on x and y, as is described, for example, in “Computer Architecture a Quantitative Approach”, Hennessy and Patterson, Morgan Kaufmann Publishers, Inc., 1996, annex A.

Considering the fact that the input into the inventive converter is a dual-rail input, i.e. that there are not only x and y, but alsox, andy, a plurality of different logical operations may be employed to calculate the parameters P, K, and G in an efficient manner. A preferred implementation is represented inFIG. 3. The logic circuit depicted inFIG. 3could be implemented in the logic circuit12shown inFIG. 1. It includes a first AND gate30, a second AND gate31, a third AND gate32, a fourth AND gate33and an OR gate34.x, on the one hand, and y, on the other hand, are fed to the first AND gate30. x, on the one hand, andy, on the other hand, are fed into the second AND gate31. The outputs of the two AND gates30and31are fed into an OR gate34to obtain the P output signal. The K output signal is obtained by performing an AND operation onxandyby means of the third AND gate32. The output parameter G is obtained by performing an AND operation on x and y by means of the AND gate33ofFIG. 3.

The logic circuit represented inFIG. 3further has the advantage that in the event that the input parameters x, y,x,y, in the preparation mode, are all at the low state, results which are at the low state are provided at the output side in the preparation mode as well. The circuit depicted inFIG. 3could therefore be employed as a conversion apparatus without any further modifications, in which conversion apparatus the input variables x,x, y,yare subject to a predischarge operation in the preparation mode. If the input side of the logic circuit depicted inFIG. 3was operated in the precharge mode, the AND gate33would provide, on the output side, as well as the AND gate32and the OR gate34, a logically high signal in the event of a precharge. In the preparation mode, P, K and G would then be equal to 1. The circuit shown inFIG. 3could therefore also be employed immediately for precharge-operated input data and would provide, in the precharge mode, on the output side, three identical parameters which now, however, comprise the logically high state (Vdd). If, on the other hand, the input data is operated in the precharge mode, and if low one-hot parameters are desired, on the output side, in the preparation mode, an inverter could be connected downstream of the gates34,33, and32. Alternatively, the gates themselves could also be modified to provide inverted output signals. This goes to show that the inventive circuit may be configured for most varied applications which are determined by whether precharge or predischarge data is provided on the input side and whether or not precharge or predischarge parameters are needed on the output side.

FIG. 4shows an overview block diagram of an inventive conversion apparatus in accordance with a preferred embodiment. The circuit shown inFIG. 4is made up of an input stage40, a logic stage41, a precharge stage42, a hold-“1” stage43, a hold-“0” stage44, an output stage45(the elements40,41,42,43,44and45correspond to means12ofFIG. 1), and control means10, which means are identical with the control means10shown inFIG. 1. The control means10are configured to provide a respective signal via lines46,47to the precharge stage and to the hold-“0” stage, and to control, in a preferred embodiment of the present invention, the input stage via an input control line48, and the output stage via an output control line49so as to provide a clear-cut situation for data coming from a preceding circuit, and data going to a subsequent circuit, i.e. so as to signalize whether the preparation mode or the data mode is present.

In the circuit shown inFIG. 4, it is in particular the hold-“1” stage43and the hold-“0” stage44that are of particular interest. The hold-“1” stage ensures that in the data mode, a “1” is securely held on lines P, K or G, whereas the hold-“0” stage44ensures that a “0” is also securely held on a line P, K or G. These two stages are of particular importance in the case where the data clock rates are such that charge drifts already occur in the circuit from one data cycle to the next, which charge drifts might lead to a reduced reliability of the circuit if the drift becomes too long. In particular, circuits43and44also enable the logic stage41to be implemented in the NMOS-only logic or, evidently “PMOS-only logic”. Even though generally NMOS transistors are preferred in logic circuits, PMOS-only circuits may also be implemented by those skilled in the art on the basis of the present description. In contrast to normal CMOS modules, wherein logic gates are always constructed by paired complementary transistors, the inventive conversion circuit is advantageous in that no complementary implementation of the logic gates is required, so that the number of transistors may be reduced, and thus expensive chip area may be saved. So as not to introduce disadvantages due to transient drifts, it is preferred to provide the circuits43and44. However, they are not used for holding the dual-rail input data, but for holding the one-hot coded output data which typically have a smaller number than the input data, so that, even if circuits43and44are provided, a gain in the chip area may be achieved in comparison with a common complementary gate implementation.

FIG. 5shows a preferred embodiment of the inventive conversion apparatus at a transistor level. The first useful operand bit x is applied via an input500. The second useful operand y is input via an input502. The first auxiliary operand bitxis applied via an input504, the auxiliary operand bitxbeing, in the data mode, complementary to the first auxiliary operand bit x input via the input500. The second auxiliary operand bityis input via an input506, the auxiliary operand bitybeing complementary to the second auxiliary operand bit y input via the input502if the circuit is operating in the data mode. The conversion apparatus shown inFIG. 5includes the logic stage41which has already been mentioned with regard toFIG. 4and which, in the embodiment shown inFIG. 5, merely consists of NMOS transistors. The first output signal of the one-hot coded output is the propagate signal P output via an output508. The kill signal K is output via an output510. The generate signal G is output via an output512.

In the preferred embodiment shown inFIG. 5, it is not directly the propagate signal P that is produced at the output of the logic stage, but the inverted propagate signalPas is represented by a node514. At a node516, the inverted kill signalKis produced at the output of logic stage41. Finally, the inverted generate signalGis produced at a node518. A first NMOS transistor520and a second NMOS transistor522are provided for generating the generate signalG. On the one side of the first NMOS transistor520, the low reference voltage Vss is applied, which results in the node518being low only if both y (input502) and x (input500) have a logically high state. I this case, both transistors520and522are gated, and Vss is applied directly at node518. If, on the other hand, either x or y or both are in a logically low state, the potential at node518is initially undetermined, i.e. floating, and is, as will be described below, held securely at a logically high state by the hold-“1” stage43.

A third NMOS transistor524and a fourth NMOS transistor526are provided for producing the inverted kill signalK. If bothxandyare in a logically high state, both transistors524and526are gated, so that Vss is immediately applied at node516.Kis then in a low state. If, however, eitherxory, or both of them are in a logically low state (on Vss), the node516Kis initially floating, i.e. not connected to Vss, and is driven to the logically high state (Vdd) by the hold-“1” stage43, as will be described below.

The third NMOS transistor524forms, along with a fifth NMOS transistor528, the second AND gate31ofFIG. 3. The first AND gate30ofFIG. 3, however, is implemented by the first NMOS transistor520and a sixth NMOS transistor530. The outputs of both transistors528and530are connected to node514and thus imitate the OR gate34ofFIG. 3. The inverted propagate signalPand/or node514is/are defined at the low voltage state Vss (due to transistor524and/or transistor520) whenever an AND gate (30or31) provides a low voltage state (Vss) on the output side. In all other cases, the state of node514is initially floating and will be put into the defined logically high state (Vdd) by the hold-“1” stage43.

In the embodiment depicted inFIG. 5, the logic stage41itself is therefore initially operative to calculate defined “0” states forP,KorG, whereas logically high states are not actively established by the logic stage41, which is evident, in particular, from the fact that the logic stage is established only with Vss, i.e. the low voltage state, but does not comprise a node that is or may be connected to the high voltage, i.e. Vdd.

The secure establishment of the logically high states is effected by the hold-“1” stage43. The hold-“1” stage43includes three circuits which are similar to each other and are each comprised of PMOS transistors. A first circuit of stage43is formed by a first PMOS transistor531and a second PMOS transistor532. Both transistors531and532are configured to switch the high voltage potential Vdd present thereon to the node516(K) and the node518(G). The switching of the high potential Vdd to nodes516and518, however, only occurs if a low potential, i.e. Vss, is present at node514. Thus, if the propagate signal P is low, as is determined by logic stage41, both nodes516and518are connected to Vdd, as it were, and are placed into the high state (Vdd) from the actually floating state in a defined manner.

The analog circuit arrangement for placing nodes514and518is comprised of a third PMOS transistor533and a fourth PMOS transistor534. Both transistors533and534generally serve to place both nodes514and518to the defined logically high state in the case where node516, i.e.K, is placed on Vss in a defined manner.

The third analog circuit, which consists of a fifth PMOS transistor535and a sixth PMOS transistor536, operates by analogy therewith. If it is determined, by the logic circuit, that the inverted generate signalGis low, the inverted kill signalKand the inverted propagate signalPare placed to the logically high state automatically, as it were, i.e. they are connected to Vdd by transistors535and536. The inventive circuit is therefore configured to place “high” the two or several other output lines “regardlessly”, as it were, whenever the signal on an output line has a data state calculated by the logic circuit. This is possible since it is a principal property of the one-hot coding that all output lines minus one output line have the same state which is complementary to the state of the one output line.

The hold-“0” stage44performs two functions. Initially each hold-“0” stage44includes an inverter541,542,543for each node to invert the inverted output signalsP,K, andG, respectively, such that the non-inverted output signals P, K, G are present at the outputs508,510and512. The inverters are not necessary in the event that the next circuit stage, e.g. a sum-carry stage, which is to be connected to the output stage45, e.g. in accordance withFIG. 8, operates with inverted lookahead parameters. In the preferred embodiment shown inFIG. 5, the downstream sum-carry stage, however, is configured to operate with the non-inverted lookahead parameters. However, stage44performs another advantageous function. Specifically, it is provided to keep the “0”, i.e. the logically low state, at nodes514,516,518irrespective of what is present at the input stage40. To this end, feedback lines544,545,546, respectively, are provided for each node514,516,518, the feedback lines being connected to the gate of an NMOS transistor547,548and549, respectively. The transistors547,548,549are operative to place a signal present on a lockQ line550and provided by the controller10, to a node518,516or514which is gated accordingly. If lockQ=0 V, i.e. set to Vss, nothing will happen in the case where a nodeP,K,Gis at +Vdd. In addition, nothing will happen if a nodeP,K,Gis at 0 V. The signal lockQ550will not cause a switchover even in this case. However, an important advantage is that in the case where a “0”, i.e. Vss, is at a node514,516or518, this “0” state, or Vss state, is maintained even if a manipulation takes place at logic stage41, i.e. if, for example, transistors520,524of logic stage41are switched for any reason, so that Vss is no longer present at the corresponding node515,516and518, respectively.

As will be explained below in more detail with reference toFIG. 6, the application of Vdd to the lockQ signal input550leads to the fact that in the case where a “0” state, i.e. Vss, is present at nodes514,516and518, respectively, this “0” state is converted to a “1” state, since by means of a 0, for example, on node518, the inverted signal at the output of inverter543is a “1” which, when applied to the gate of the NMOS transistor549, causes Vdd, which is present at the lockQ line550, to be gated to node518. The position lockQ is therefore not selected to be in the data mode, but in the preparation mode, as a preparation for pre-charging. A lockQ signal=Vdd has no effect on high states at nodes514,516and518, i.e. if these nodes are at Vdd, since in this case, transistors547,548and/or549are never disabled, so that the lockQ potential is not transferred to nodes514,516,518.

The precharge stage42includes, as is depicted inFIG. 5, a precharge transistor551,552,553for each node514,516,518. The transistors551,552,553are configured as PMOS transistors. If Vss, i.e., for example, 0 V, is applied at a precharge input554, also referred to as PrchQ, by controller10, the three transistors551,552,553are switched to be conductive, so that the high potential Vdd is applied immediately to nodes514,516,518. If the signal at the precharge input554is a high signal (Vdd), on the other hand, all three precharge transistors551,552,553are disabled such that these transistors and the precharge input554do not have any effect on the behavior of the circuit. The precharge input is therefore set to Vdd, i.e. to the high voltage state, in the data mode.

A preferred sequence of signal states and data input/output controllers for the preparation mode and the data mode will be represented below with reference toFIG. 6. In a step61picked at random, signal550(lockQ) is initially set to 0, i.e. to Vss. Since step61takes place in the preparation mode, PQ, KQ and GQ (i.e.P,KandG) are all at Vdd, and the outputs508,510,512are all at Vss. LockQ=0 has the consequence that the zeros are kept in the output stages, i.e. the “ones” are kept on nodes514,516,518. Then, signal554(PrchQ) is set to 0 to perform the precharge clock. This leads to the fact that nodes514,516,518are all charged to a defined Vdd state, which leads to the consequence, as in61, that outputs508,510,512are at Vss, as is desired for the preparation mode, i.e. the precharge and/or predischarge mode.

As is shown at63inFIG. 6, at the end of the precharge clock, the precharge line554is deactivated by applying Vdd, which has no effect, however, on nodes514,516,518or on outputs508,510,512due to the fact that lockQ=0 still applies. As is represented at64inFIG. 6, valid data may be fed to inputs500,502,504,506essentially at the same time as or subsequent to the deactivation of the precharge state. In this case, the signals at inputs500and504are complementary to each other. In addition, the signals at the inputs502and506are complementary to each other. Logic stage41will cause one node, such as node518, to change over from state Vdd, i.e. from a high state, to state Vss. In response to this, stage43will cause both nodes514,516, which are not established in a defined manner by logic stage41, to be placed to, or kept in, the defined Vdd state. Due to the data fed, node518is connected to Vss via transistors522and520in the example described, as has been set forth.

This causes a “0” to be present at the input of inverter543. This “0” is inverted to a “1”, i.e. to Vdd, by inverter543, Vdd at the output of inverter543causing the transistor549to become conductive. Since Vss is still present at lockQ550, the feedback via the feedback line546and the gating of the transistor549will cause the low state of node518to be kept. Once node518is at a low potential in a stable manner, and therefore the output512is at high potential in a stable manner, “evaluate” may be performed (step65), i.e. valid output data may be output from output stage45. The data output may be controlled either via an output control line or it may be timed in that the subsequent sum-carry stage does not receive data from the inventive converter until secure states are present at outputs508,510,512.

Then, one returns to the preparation mode from the data mode, as is represented at66inFIG. 6. In the preparation mode, the input data at the inputs500-506is all equal, and in the preferred embodiment shown inFIG. 5it is all equal to 0. This means that the previous stage, i.e. the three-bits half adder having a dual-rail output performs a predischarge in its preparation mode. The imposition on inputs500-506directly leads to the fact that all three nodes514,516,518are floating, i.e. that none of the three nodes has the low potential Vss imposed on it. However, the initial state resulting from the data mode is maintained at the output by stage43and stage44, irrespective of the fact that the input stage already has obtained preparation mode data. Therefore, data readout could also take place in step66, even though step66is already considered part of the preparation mode in the terminology shown inFIG. 6. If the terminology “data mode” and “preparation mode” is made to refer to the input, i.e. to the situation at the input stage40, step66is already part of the preparation mode. However, if the terminology is made to refer to the output, i.e. the output stage45, step66still is part of the data mode. The output does not switch to the preparation mode until the lockQ signal is switched to “1”.

In this case, node518, which is actually floating and held by stage44, is separated from Vss, which leads to the fact that feedback546, inverter543and transistor549are in a transient state and that stage43, which keeps the other two lines at “1” on the basis of the “0” on node518, also get into a transient state, as it were. In this state, node518is no longer securely connected to Vss. Due to the fact that at the switch-on time of Vdd on line550, transistor549is still open due to the previous conditions, at least some part of a charge is injected into node518via transistor549until node518comprises so much charge that the inverter543flips and thereby disables the transistor549.

Next, lockQ is again placed to 0, which typically has no effect on nodes514,516and518. Thereafter, in the subsequent precharge clock in which precharge is activated (step62), the lack of security of potential that may have arisen on the three nodes514,516,518due to steps66and67, is rectified by securely connecting each node514,516,518to Vdd, i.e. by placing each node into the precharge state, which will transition to a data mode after having been deactivated.

The use of the step sequence lockQ=1 (step67), lockQ=0 (step61) and then PrchQ=0 (step62) ensures that the respective inverters541,542,543are not “overdriven” against their state, which is possible, in principle, but may lead to a considerable shunt current through the inverter, which in turn would be accessible for current profile analyses. Instead, inverter543is still kept at its current state, for example by applying lockQ in step66, since Vss is applied via lockQ550on the input side, and Vdd is applied on the output side. Thereafter, lockQ is switched to Vdd. This leads to the transient behavior described in that a charge is injected into node518until inverter543flips voluntarily, as it were, so as to stop, immediately after the flipping, the injection of charge into node518by disabling the transistor549. Therefore, at no time inverter543has the same state imposed on it on the input side and on the output side, so as to forcibly overdrive, as it were, e.g. a “1” at the output of the inverter to a “0”.

FIG. 7depicts a block diagram of an inventive three-operands adder. In accordance with the invention, the three-bits half adder is implemented, in each bit slice, as a dual-rail circuit such that on the input side, the three operands are fed in as useful operand bits, and the three inverted operands are fed in as auxiliary operand bits in the data mode, whereas on the output side, the two bits x, y are output as useful operand bits, and bitsxandyare output as auxiliary operand bits, in dual-rail as well. In the preparation mode, the three-bits half adder may be operated such that all input operands are equal to “0”, which would correspond to the predischarge operation, or that all input operands have a high voltage stage, which would correspond to the precharge state. On the output side it is preferred for the signals xi,xi, yi,yito be predischarge signals, i.e. to be present at Vss in the preparation mode. A dual-rail three-bits half adder designated by70inFIG. 7has a two-bits full adder71connected downstream of it for the respective bit slice, the two-bits full adder71having, as a first stage, the dual-rail to one-hot converter71adepicted inFIGS. 1 and 5, and, as a second stage, a conventionally constructed sum-carry stage71bto calculate the aggregate bit for the respective bit slice, and the carry bit of the respective bit slice for the next bit slice up. It shall be pointed out that due to the dual-rail converter71a, common sum-carry stages71bmay be used, since stage71bevidently does not know that the one-hot coded lookahead parameters P, K, G have been generated from dual-rail input values.

The three-operands adder represented inFIG. 7has the following advantages as compared to the known three-operands adder depicted inFIG. 8:

The half-adder stage is secured against hardware attacks due to its implementation in dual-rail technology with precharge/predischarge. Even though the two-bits full adder stage inFIG. 7is implemented merely in single rail, it is still secured against hardware attacks due to the inherent properties of one-hot coding, but consumes only half the chip area in comparison with a full dual-rail implementation of the two-bits full adder stage. The three-operands adder shown inFIG. 7may therefore be implemented in a space-efficient manner.

Due to the fact that the calculating unit shown inFIG. 7and the calculating unit shown inFIG. 8enable fast addition of three operands, the circuit depicted inFIG. 7does not exhibit any losses in speed in comparison with the circuit shown inFIG. 8if it is taken into account that the preparation mode of the circuit ofFIG. 7, i.e. the precharge/predischarge operation, may be executed fast and, at the time, may be used for performing input/output operations or storage operations, so that, on the whole, the preparation mode is not important.

The adder concept depicted inFIG. 7, in particular, is not limited to three-operands adders but may be extended to N-operands adders, N being >3, since N-operands adders may be constructed of several three-operands adders in accordance withFIG. 7.

A further advantage of the concept shown inFIG. 7is that three-bits adders implemented in dual-rail technology already exist, in particular as three-bits carry-save adders, so that already existing concepts may be employed for the inventive three-operands adder, these existing concepts having the advantage that they do no longer have to be developed and, in particular, tested.

The inventive dual-rail to one-hot converter may readily be combined with a sum-carry stage, which is also already known and has already been implemented and tested, so as to construct a carry-propagate adder, in the embodiment described, in the precharge mode, all circuit nodesP,K,G, being 1, and in the data mode, wherein the one-hot coding is present, exactly one line going to 0. IfFIG. 5is considered, in particular, the reverse case could be realized by reversing the transistors, i.e. from NMOS to PMOS and from PMOS to NMOS, the said reverse case being that all nodes514,516,518ofFIG. 5are, in the preparation mode, at Vss, i.e. at a lower voltage, and that only one node, in the data operation, switches to a high voltage state in accordance with the one-hot coding. As has been explained, it is preferred to provide the inventive converter with a circuit ensuring that, in response to a valid data state on one node, the other nodes are set in a complementary manner/to be complementary, an additional circuit preferably being provided which keeps and/or “secures” the valid data state.

Another advantage of the inventive converter is that it may be implemented in a transistor-efficient, i.e. chip area-efficient manner if the complementary signals of the dual-rail input, i.e. the auxiliary operand bits, each finally lead to the fact that a logic may be constructed merely with transistors of a single transistor type, i.e. either NMOS or PMOS. To this end, NMOS transistors are preferred due to their easy handling for the circuit developer and due to their advantages in terms of speed.

Depending on the circumstances, the inventive method for converting may be implemented in hardware or software. The implementation may be effected on a digital storage medium, in particular a disk or CD with electronically readable control signals which may co-operate with a programmable computer system such that the respective method is performed. Generally, the invention therefore also consists in a computer program product with a program code, stored onto a machine-readable carrier, for performing the inventive method if the computer program product is executed on a computer. In other words, the present invention is therefore also a computer program having a program code for performing the method for converting if the computer program is executed on a computer.