[otbn/hw] Add HPC gadgets to prims by h-filali · Pull Request #29642 · lowRISC/opentitan

h-filali · 2026-03-31T16:08:48Z

Description

This PR adds HPC gadgets to opentitan primitives.

For details, see the following paper:
Cassiers, Gaëtan, et al. "Compress: Generate small and fast masked pipelined circuits." available here.

The first commit adds the gadget themselves.
The following commits add scripts that are needed to evaluate the gadgets for leakage.

This PR provides the scripts to analyze the design using Coco Alma and PROLEAD.

In the following instructions <gadget> can be one of the following:

hpc2o
hpc2_and
hpc3o
hpc3_and

Run Synthesis

To synthesize the design run the following commands:

cd <REPO_TOP>/hw/ip/otbn/pre_syn
./syn_yosys_sec_add.sh <gadget>

Run Leakage Analysis with Alma

Make sure you have Alma installed. A guide on how to install Alma can be found in the Prerequisites section here.

To start the leakage analysis using alma run the following commands in your nix shell:

cd <REPO_TOP>
source util/build_consts.sh
cd ~/alma
source dev/bin/activate
~/opentitan/hw/ip/otbn/pre_sca/alma/verify_sec_add.sh <gadget>

Run Leakage Analysis with PROLEAD

To start the leakage analysis using PROLEAD run the following commands:

# Clone the PROLEAD repo
git clone https://github.com/ChairImpSec/PROLEAD.git

# Start the PROLEAD dev shell
cd PROLEAD
nix-shell
make release

# Make sure package metadata is up to date
nix-channel --update

# Set up shell variables
source ../opentitan/util/build_consts.sh
cd ../opentitan/hw/ip/otbn/pre_sca/prolead

# Run analysis
./evaluate.sh <gadget>

This commit adds two new HPC gadgets which implement a secure AND gate which operate on masked bits. Both HPC2 and HPC3 modules implement two versions of the gadget. One toffoli version where the output is equal to the masked operation of Z = W ^ (X & Y) And the straightforward implementation where the output is equal to the masked implementation of Z = X & Y Signed-off-by: Hakim Filali <hfilali@lowrisc.org>

This commit adds a wrapper file per HPC gadget and mode. These wrappers are needed for leakage analysis. Signed-off-by: Hakim Filali <hfilali@lowrisc.org>

This commit adds the synthesis scripts for the HPC gadgets. These scripts are needed for leakage analysis. Signed-off-by: Hakim Filali <hfilali@lowrisc.org>

This commit adds all the necessary scripts to run leakage analysis of the HPC gadgets on Coco Alma. Signed-off-by: Hakim Filali <hfilali@lowrisc.org>

Signed-off-by: Hakim Filali <hfilali@lowrisc.org>

etterli

Would it be possible to add some ASCII diagrams showing what is computed where? I have a hard time mapping the RTL to the gadget algorithms.

etterli · 2026-04-01T08:31:12Z

hw/ip/prim/rtl/prim_hpc2.sv

+//     halt data propagation.
+//
+// For details, see the following paper:
+// Cassiers, Gaëtan, et al. "Compress: Generate small and fast masked pipelined circuits." available at


NIT: Line length

etterli · 2026-04-01T08:32:10Z

hw/ip/prim/rtl/prim_hpc2.sv

+  parameter  bit EnW = 1'b0,
+  localparam int NumShares = 2


NIT: alignment of =

etterli · 2026-04-01T08:37:01Z

hw/ip/prim/rtl/prim_hpc2.sv

+  prim_flop_en #(
+    .Width      (2),
+    .ResetValue ('0)
+  ) u_prim_flop_en_y_masked (
+    .clk_i(clk_i),
+    .rst_ni(rst_ni),
+    .en_i(en1_i),
+    .d_i('{y_masked_d[0], y_masked_d[1]}),
+    .q_o('{y_masked_q[0], y_masked_q[1]})
+  );


Shouldn't here the width be defined using NumShares to avoid a mismatch between the localparam and the actual width? Same goes for the in/output.

NIT: Alignment of (). Should be the opposite way around, parameters have no space and signals have aligned ().

There are several other flops which I think should be NumShares wide. I did not comment on all of them.

etterli · 2026-04-01T08:40:01Z

hw/ip/prim/rtl/prim_hpc2.sv

+  prim_flop_en #(
+    .Width      (1),
+    .ResetValue ('0)
+  ) u_prim_flop_en_r (
+    .clk_i(clk_i),
+    .rst_ni(rst_ni),
+    .en_i(en1_i),
+    .d_i(r_i),
+    .q_o(r_q)
+  );


NIT: alignment

Applies also to other module instantiations

etterli · 2026-04-01T08:46:21Z

hw/ip/prim/rtl/prim_hpc2.sv

+  // HPC2o (EnW=1): XOR w and x_masked into the inner term before registering.
+  // HPC2  (EnW=0): register the inner term and x_masked separately, XOR after.
+  if (EnW) begin : gen_xor_w
+    logic xyw_masked[NumShares];  // x[i] & y_q[i] ^ w[i]


Is xy_masked = x[i] & y_q[i]? If so, (x[i] & y_q[i]) ^ w[i] would be helpful

etterli · 2026-04-01T08:53:10Z

hw/ip/prim/rtl/prim_hpc2.sv

+    always_comb begin
+      unused_w = 1'b0;
+      for (int i = 0; i < NumShares; i++) unused_w ^= w_i[i];
+    end


Replace with operator which combines all bits of w_i:

assign unused_w = ^w_i;

etterli · 2026-04-01T09:14:42Z

hw/ip/prim/rtl/prim_hpc3.sv

+//   - Symmetric Latency: All inputs (x_i, y_i, w_i, r_i, rp_i) share a uniform 1-cycle latency.
+//     Unlike HPC2, no input needs to be presented early.
+//   - Stall Support: To support stallable pipelines, the `en_i` flip-flop
+//     enable signals can be safely deasserted to freeze the internal registers and


NIT: "enable signalS" -> "enable signal"

etterli · 2026-04-01T09:17:32Z

hw/ip/prim/rtl/prim_hpc3.sv

+  prim_flop_en #(
+    .Width      (2),
+    .ResetValue ('0)
+  ) u_prim_flop_en_y_masked (
+    .clk_i(clk_i),
+    .rst_ni(rst_ni),
+    .en_i(en_i),
+    .d_i('{y_masked_d[0], y_masked_d[1]}),
+    .q_o('{y_masked_q[0], y_masked_q[1]})
+  );


Here I have the same remark about using NumShares instead of 2 as in prim_hpc2.sv. Applies to all flops in HPC3

etterli · 2026-04-01T09:19:07Z

hw/ip/prim/rtl/prim_hpc3.sv

+  // HPC3o (EnW=1): XOR w into the inner term before registering.
+  // HPC3  (EnW=0): inner term is just (x&y_masked) ^ rp.
+  if (EnW) begin : gen_xor_w
+    logic xyw_masked[NumShares];  // x[i] & (y[i] ^ r) ^ w[i]


Add () to clearly state the operation order?

etterli · 2026-04-01T09:20:06Z

hw/ip/prim/rtl/prim_hpc3.sv

+    always_comb begin
+      unused_w = 1'b0;
+      for (int i = 0; i < NumShares; i++) unused_w ^= w_i[i];
+    end


use assign unused_w = ^w_i;

h-filali requested a review from a team as a code owner March 31, 2026 16:08

h-filali requested review from andrea-caforio, etterli, nasahlpa, pamaury and vogelpi and removed request for a team and pamaury March 31, 2026 16:08

h-filali added 4 commits March 31, 2026 18:17

[hw/otbn] Add wrapper files for leakage analysis

e7bec93

This commit adds a wrapper file per HPC gadget and mode. These wrappers are needed for leakage analysis. Signed-off-by: Hakim Filali <hfilali@lowrisc.org>

[hw/otbn] Add synthesis scripts for HPC gadgets

bb2ea2c

This commit adds the synthesis scripts for the HPC gadgets. These scripts are needed for leakage analysis. Signed-off-by: Hakim Filali <hfilali@lowrisc.org>

[hw/otbn] Add Alma setup for HPC gadgets

aecee2e

This commit adds all the necessary scripts to run leakage analysis of the HPC gadgets on Coco Alma. Signed-off-by: Hakim Filali <hfilali@lowrisc.org>

[hw/otbn] Add scripts for PROLEAD leakage analysis

edfade4

Signed-off-by: Hakim Filali <hfilali@lowrisc.org>

h-filali force-pushed the otbn-hpc-gadgets branch from 9e20a8b to edfade4 Compare March 31, 2026 16:17

h-filali requested a review from thommythomaso March 31, 2026 16:18

etterli reviewed Apr 1, 2026

View reviewed changes

Conversation

h-filali commented Mar 31, 2026

Description

Run Synthesis

Run Leakage Analysis with Alma

Run Leakage Analysis with PROLEAD

Uh oh!

etterli left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants