Planeamiento de la ruta

According to the motivation behind the research, the secure design flow necessitates estimation of physical characteristics in order to compare the efficiency of the synthes- ised expansions. Precise physical simulation is available only after the placement and routing has been done, which is a complex task. At the logic synthesis stage a tool should use statistical evaluation based on numeric values from the library specification. In our RTL-based implementations we used the Faraday 90nm library (FSD0A_A for UMC’s 90nm 1P9M Logic/Mixed Mode Low-K SP process). Energy and area estimations of the proposed components are shown in Table 5.2. In order to show the difference between technologies, we have included the out-dated AMS C35 0.35µm library results as well. For RTL implementations, the total switching energy is computed as the sum of the switching energies for each layer of a component circuit. The total area of a component is a sum of area values for all gates in its circuit. Higher radix components grow too large and difficult to implement, so the possible error in estimating their parameters can be significantly increased. Therefore we limit ourselves to radices 2, 3 and 4.

The dynamic logic library uses a 90nm technology, and its switching energy estimates have been normalised in order to enable cross-technology comparison with 90nm RTL components. GF(2) addition, identical at the transistor level to an RTL im- plementation, has been simulated in SPICE to find the scaling factor. The component’s power consumption has been measured and multiplied by this factor. Although the estimation method is fairly rough, it satisfies the required level of approximation. Area is measured by transistor count using relative measures.

Table 5.2: Physical characteristics of GF components

physical characteristics

radix, operation RTL: AMS 0.35µm RTL: Faraday 90nm Dynamic logic 90nm encoding energy, area, energy, area, energy, area,

pJ µm2 10−3pJ cell units 10−3pJ cell units

GF(2), + 0.36 330 3.348 24 2.450 13

dual-rail ×relaxed balancing 0.39 182 2.783 14 – –

×fully balanced 0.39 366 4.110 28 2.430 13

GF(3), + – – 4.110 54 2.640 18

1-of-3 ×relaxed balancing – – 3.348 31 – –

×fully balanced – – 6.893 81 2.410 24

GF(4), + 0.42 1244 7.419 108 2.520 27

1-of-4 ×relaxed balancing 0.39 805 4.110 61 – –

×fully balanced 0.81 1699 10.202 147 2.950 39

The parameters of 0.35µm-implemented components cannot be compared to other libraries as absolute values, since they are obtained using different estimations rules. However, it is still possible to observe how different radices impact on the component and circuit parameters for this technology.

As can be seen from Table 5.2, RTL operations over GF(4) show a considerable area overhead compared to their GF(2) counterparts. A possible explanation is the fact that binary operations use the same radix as their gate level implementations, so the radix mapping problem is encountered at the sub-component level. Dynamic logic however has reduced overheads in higher radices, especially for switching energy, as it is less dependent on the binary computation according to the features listed in Section 5.1.2. Interestingly, the AMS library has acceptably cheap energy costs for quaternary components, while in Faraday both area and power go up with the radix.

Another interesting point concerning 1-of-n encoded component implementations is so-called “wire crossing” operations. Certain arithmetic functions in these encodings degenerate into trivial re-assignment of signals. For example, dual-rail inversion (x +1) has the following structure: q0 = x1, q1= x0. The truth table for “wire crossing”

operations over GF(4) is shown in Figure 5.6. In the one-hot ternary case such trivial operations are: (x + 1), (x + 2) and 2x. Consequently, these pseudo-components have

x 0 1 A B x +1 1 0 B A x + A A B 0 1 x + B B A 1 0 Ax 0 A B 1 Bx 0 B 1 A x2 0 1 B A

Figure 5.6: “Wire crossing” operations in 1-of-4: their implementations do not involve any logic

Table 5.3: Estimated physical characteristics of the examples using Faraday 90nm library (relaxed balancing)

radix circuit switching sw. en., area,

wires 10−3pJ c. units

2 → 2 Figure 2.11 on page 38 6 18.393 114

2 → 3 Figure 4.6 on page 96 4 13.786 136

2 → 4 Figure 4.4 on page 85 3 12.985 136

{2, 4} → 4, r = 1 Figure 4.5(a) on page on page 90 5 23.187 286

{2, 4} → 4, r = 2 Figure 4.5(b) on page on page 90 5 28.638 347

4 → 4 Figure 2.12 on page 40 8 52.734 942

4 → 2 Figure 4.3 on page 78 8 49.120 587

no area or switching costs, and this also should be considered when estimating physical circuit parameters.

From the discussion presented in this subsection one can conclude that simple efficiency analysis, such as the number of terms or the number of operations, is not sufficient for the correct search for the optimal RM expansion. All components have specific characteristics that depend on the choice of the library, encoding and power balancing strength. The next subsection presents and compares benchmark results for different radix combinations.

Example 5.1. Assuming that Examples 2.1—4.5 are required to be secure (power bal- anced), the components have been mapped into RTL implementations from Table 5.2. Table 5.3 gives the estimates for the physical parameters of the circuits. Although the mixed radix examples show fewer components and reduced switching activity, the area for binary is smaller, as expected from the background discussion.

The next section presents and compares benchmark results for real security al- gorithms, and also gives a detailed discussion on how we estimate the circuit para- meters.