Digital ircuits: why they leak, how to counter Ingrid Verbauwhede Ingrid.verbauwhede-at-esat.kuleuven.be KU Leuven, OSI cknowledgements: urrent and former Ph.D. students Fundamental understanding of MOS circuits So as to build models nd understand short comings of models To understand Special logic styles and hardware countermeasures, the official title of this lecture. Goal KU Leuven - OSI Digital MOS - 1 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 2 Šibenik, roatia, June 2014 Design methodology: consider all design abstraction levels line: bottom-up pplication: e-commerce, smart energy Security analysis: TPM, light weight? rypto lgorithm/protocol: crypto, entity authentication rchitecture: o-design, HW/SW, SO Micro-rchitecture: co-processor design ircuit: ircuit techniques to combat side channel analysis attacks Transistor Invertor Gate omposition of gates MOS circuits: operation Power consumption sources of information leakage ircuit styles and link to Power models Side effects of gates Side channel attack resistance onclusions and reflections WHY: 1. To get low power/ low energy 2. To be secure KU Leuven - OSI Digital MOS - 3 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 4 Šibenik, roatia, June 2014 Page 1
The image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your computer, and then open the file again. If the red x still appears, you may have to delete the image and then insert it again. Šibenik, roatia, June 2014 line Transistor Invertor MOS circuits: operation Power consumption sources of information leakage urrent Dynamic power Static power power and energy fundamentals MOS invertor KU Leuven - OSI Digital MOS - 5 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 6 Šibenik, roatia, June 2014 The MOS Inverter: First Glance MOS Inverter N Well PMOS 2 PMOS ontacts V in V out In In Metal 1 L NMOS Polysilicon NMOS GND Slide courtesy: J. Rabaey KU Leuven - OSI Digital MOS - 7 Šibenik, roatia, June 2014 Slide courtesy: J. Rabaey KU Leuven - OSI Digital MOS - 8 Šibenik, roatia, June 2014 Page 2
Two Inverters /D of MOS Inverter: D Share power and ground = STTI behavior LEGO style: but cells R p onnect in Metal V out V out V OL = 0 V OH = R n V in = V in = 0 Why we like MOS!! Full swing NO D current!!* Slide courtesy: J. Rabaey Slide courtesy: J. Rabaey *to first order, see further KU Leuven - OSI Digital MOS - 9 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 10 Šibenik, roatia, June 2014 /D of MOS Inverter: Where Does Power Go in MOS? R p = DYNMI behavior t phl = f(r on. L ) Dynamic Power onsumption = harging and discharging capacitors L V out V out L = 0.69 R on L [Short ircuit urrents = ] Short circuit path between supply rails during switching No longer an issue in deep submicron V in = 0 R n V in = SP, DP attack!! Leakage = D Leaking diodes and transistors (a) Low-to-high (b) High-to-low Slide courtesy: J. Rabaey KU Leuven - OSI Digital MOS - 11 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 12 Šibenik, roatia, June 2014 Page 3
Dynamic Power consumption SP, DP Vin Vdd L Vout Energy/transition = L * V dd 2 * α Power = Energy/transition * f = L * V 2 dd * α * f Energy = independent of clock frequency! Energy = depends on activity α! Energy, power = independent of transistor sizes Need to reduce L, V dd, α and f to reduce power KU Leuven - OSI Digital MOS - 13 Šibenik, roatia, June 2014 SP and DP monitor power Which values depend on data? Monitor α, the activity of circuit Monitor L, the capacitance Hamming weight: Measures activity between current and (past) known value Typically for pre-charged values Hamming Distance: Measures activity between current and previous value Typical for standard cell based design lso for FPG KU Leuven - OSI Digital MOS - 14 Šibenik, roatia, June 2014 Example: power model bus P Hamming Weight model 8 bit bus on a smart card, pre-charged (relatively) large capacitance Hamming weight model = numbers of bits set to 1 Side-note: on a pre-charged bus which is pre-set to 1, maximum power consumption is for data all zero. KU Leuven - OSI Digital MOS - 15 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 16 Šibenik, roatia, June 2014 Page 4
- orrelation Power nalysis R := reference state Which bit pattern was previously present? E.g. pre-charged value n opcode on the bus previously stored value in a register D Power model: a HW ( Sox( xi k ) R) b a,b are constant, linear model HW is defined as Hamming Weight = counts number of 1 s. leakage currents as Side-channel information leakage KU Leuven - OSI Digital MOS - 17 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 18 Šibenik, roatia, June 2014 D - Leakage current Vt and Vdd effect on leakage Vt, Vdd combination for low power, given a target clock frequency V in V out Drain Junction leakage Power [arb. Unit] Leakage Dynamic Total Subthreshold current Problem in deep submicron (below 45 nm) Depends strongly on threshold voltage Vt Vt is set by processing High Vt low Vt Standard cell library Low power FPGs vs High performance FPGs KU Leuven - OSI Digital MOS - 19 Šibenik, roatia, June 2014 V [V] [V] DD Memory Leakage dominance 10x more switching High performance microprocessor dynamic power dominance [slide credit: Wim Dehaene] KU Leuven - OSI Digital MOS - 20 Šibenik, roatia, June 2014 Page 5
=0 =Vdd D leakage of NND gate Vdd Vdd Vdd =Vdd =0 I1 I2 I3 =0 =0 Nand gate: out = 1, but I1 I2 I3 New source of information, If you are looking for a nice research topic. vailable even when device is at rest Time window to attack larger Less a problem for memory because differential structure Transistor Invertor Gate MOS circuits: operation Power consumption sources of leakage ircuit styles and link to Power models Static MOS Dynamic, pre-charged MOS Differential MOS Dynamic differential MOS Link to Hamming Weight Hamming Distance Side effects of gates Side channel attack resistance onclusions and reflections line KU Leuven - OSI Digital MOS - 21 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 22 Šibenik, roatia, June 2014 Standard cell automated design flow Design apture ehavioral asics and construction rules Static MOS Design Iteration Pre-Layout Simulation Post-Layout Simulation HDL Logic Synthesis Floorplanning Placement Structural Physical ircuit Extraction Routing Timing closure! Tape-out Technology/library/manufacturer input KU Leuven - OSI Digital MOS - 23 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 24 Šibenik, roatia, June 2014 Page 6
Standard ell oom In vdd vss layout More levels of metal: top levels not shown KU Leuven - OSI Digital MOS - 25 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 26 Šibenik, roatia, June 2014 Glitches in static MOS networks Most famous example: Ripplearry dder X 101 000 [MJI] in dd0 dd1 dd2 dd14 dd15 S0 S1 S2 S14 S15 X Unit Delay X Glitch Glitch = Useless transition = Waste of energy [Low Power community has addressed this] Voltage, Volts Sum put 4.0 2.0 in S1 0.0 0 5 10 Time, ns 3 2 4 6 5 S10 S15 From Rabaey, 1995 Design for low power KU Leuven - OSI Digital MOS - 27 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 28 Šibenik, roatia, June 2014 Page 7
Glitch Reduction: Path balancing voids glitching: general design practice for low power technique Principle: transform algorithm into tree like structure Then balance delay paths in all paths to output Examples: Log adder replaces Ripple dder Wallace tree replaces arry-save multiplier Synthesis tools will transform for you automatically. Dynamic MOS asics and construction rules KU Leuven - OSI Digital MOS - 29 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 30 Šibenik, roatia, June 2014 Dynamic MOS In static circuits at every point in time (except when switching) the output is connected to either GND or via a low resistance path. fan-in of n requires 2n (n N-type + n P-type) devices Dynamic circuits rely on the temporary storage of signal values on the capacitance of high impedance nodes. requires on n + 2 (n+1 N-type + 1 P-type) transistors Dynamic Gate lk M lk p M p pon 1 In 1 In 2 In 3 lk PDN M e L Two phase operation Precharge (lk = 0) Evaluate (lk = 1) lk M e off off on (()+) KU Leuven - OSI Digital MOS - 31 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 32 Šibenik, roatia, June 2014 Page 8
onditions on put Once the output of a dynamic gate is discharged, it cannot be charged again until the next precharge operation. Inputs to the gate can make at most one transition during evaluation. put can be in the high impedance state during and after evaluation (PDN off), state is stored on L Thus by construction, dynamic gates cannot glitch! ircuits against side channel attacks How they leak How to solve it KU Leuven - OSI Digital MOS - 33 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 34 Šibenik, roatia, June 2014 Remember SP, DP Transition independent power consumption Energy/transition = L * V 2 dd * α Power = Energy/transition * f = L * V 2 dd * α * f SP and DP monitor power ddress α, L Monitor α, the activity of circuit Monitor L, the capacitance doesn t create any side channel information No Hamming distance, No Hamming weight When logic values are measured by charging and discharging capacitances, we need to use a fixed amount of energy for every transition switch a constant load capacitance switch once every cycle L = constant α = 1 KU Leuven - OSI Digital MOS - 35 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 36 Šibenik, roatia, June 2014 Page 9
Dynamic and differential logic Solution based on Standard cells Dynamic & differential α = 1 No glitches Differential (with design effort): L is constant lso includes differential routing Static Leakage current is data independent 1 De-Morgan s Law false output 2 ND-ing with precharge signal precharge 1: outputs t are 0 prch with false inputs precharge 0 - evaluation: 1 output is 1 KU Leuven - OSI Digital MOS - 37 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 38 Šibenik, roatia, June 2014 Wave Dynamic Differential Logic 0-wave travels from input to output during pre-charge input 0 output 0 no pre-charge operator Differential data travels during evaluation clk precharge inputs prch prch. eval. ND gate OR gate register clk Encryption Module ll functions of and2, or2 operator In addition: inverted input, output signals XOR2X4: OI221X2: Our WDDL library: 128 cells OI22X1 OI22X1 INVX4 INVX4 Y Y 0 1 0 1 0 0 1 0 1 0 WDDL library OI221X1 OI221X1 INVX2 INVX2 Y Y [Tiri,DTE2004] KU Leuven - OSI Digital MOS - 39 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 40 Šibenik, roatia, June 2014 Page 10
For constant power consumption: constant load capacitance. Match loads at differential outputs. Unbalanced capacitive loads gate R w, w, o, o, w, R w, Load capacitance breakdown i,i2 gate 2 i,i1 gate 1 i,i1 Intrinsic caps.: matched Interconnect: dominant (Moore s law) alancing interconnect: crucial o : intrinsic output capacitance w : interconnect capacitance i,i2 i: input capacitance = o, + w, + i,i1 + i,ik = o, + w, + i,i1 + i,ik w, = w, KU Leuven - OSI Digital MOS - 41 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 42 Šibenik, roatia, June 2014 Design example Same circuit; two implementations. Insecure reference design Secure design WDDL Example WDDL differential route single ended regular route Two normal wires replace each fat wire. KU Leuven - OSI Digital MOS - 43 lbena, 43 July 2013 KU Leuven - OSI Digital MOS - 44 Šibenik, roatia, June 2014 Page 11
Early propagation effect Static MOS, dynamic MOS, differential MOS, Timing of transition is data dependent D D D O T1 T2 Pre 0 0 0 0 0 Eval 1 0 X X X @T1 0 @T1 2 0 Eval 2 1 0 0 0 @T1 0 @T2 1 1 Eval 3 1 0 1 1 @T1 1 @T2 1 1 Early propagation effect: balance D O T1 T2 Pre 0 0 0 0 0 Eval 1 0 X X X @T1 0 @T2 1 1 Eval 2 1 0 0 0 @T1 0 @T2 1 1 Eval 3 1 0 1 1 @T1 1 @T2 1 1 an prove that it is always possible to balance in WDDL logic. KU Leuven - OSI Digital MOS - 45 Šibenik, roatia, June 2014 KU Leuven - OSI Digital MOS - 46 Šibenik, roatia, June 2014 Integration in standard cell design flow: Secure digital design design specs layout logic design diff_lib.lef stream out diff.def behavior.v script lib.v logic synthesis interconnect decomposition fat.def rtl.v fat_lib.lef place & route Few key modifications with minimal influence in backend of regular synchronous static MOS standard cell design flow cell substitution [Tiri,TD2006] KU Leuven - OSI Digital MOS - 47 Šibenik, roatia, June 2014 fat.v Transistor Invertor Gate omposition of gates onclusions and reflections Fundamental understanding MOS circuits D behavior Static MOS: low power, but shows Hamming distance Dynamic MOS: high speed, no glitches, but shows Hamming weight Dynamic, differential: hides data dependencies Full custom style: SL Standard cell compatible: WDDL (with construction rules) Side effect of MOS gates: Glitch: only problem of static MOS Memory effect: static MOS Early propagation: can be addressed in WDDL Future: address D leakage current Leakage even when there is no operation KU Leuven - OSI Digital MOS - 48 Šibenik, roatia, June 2014 Page 12