WO2012127135A1

WO2012127135A1 - Secure memory element

Info

Publication number: WO2012127135A1
Application number: PCT/FR2012/000103
Authority: WO
Inventors: Philippe Maurine; Bruno VAQUIE
Original assignee: Université Montpellier 2 Sciences Et Techniques; Centre National De La Recherche Scientifique
Priority date: 2011-03-24
Filing date: 2012-03-23
Publication date: 2012-09-27
Also published as: FR2973138B1; FR2973138A1

Abstract

The memory element comprises a clock, a first flip-flop (8a) of master-slave D type regulated by the clock and a second flip-flop (8b) of master-slave D type, structurally identical to the first flip-flop, regulated by the clock and connected to the first flip-flop (8a) in such a way that the second flip-flop (8b) switches upon each active edge of the clock where the first flip-flop does not switch.

Description

SECURE MEMORY ELEMENT

Technical field of the invention

The invention relates to secure integrated circuits, and more particularly to a master-slave type D flip-flop resistant to hidden channel attacks.

State of the art

Secure electronic circuits are intended to process secret or confidential data. They are, for example, used in smart cards to carry out banking transactions. In general, this type of circuit is built around a microprocessor associated with a memory. The microprocessor implements cryptographic algorithms to encrypt or decrypt messages, or uses a certificate to authenticate a user.

Secret data, such as a cryptographic key, may pass between the microprocessor and the memory by a register. A register is a buffer formed of flip-flops, generally of master-slave type D (flip-flop D). Each flip-flop corresponds to a bit of the register.

Figure 1 shows the symbol of a conventional master slave D flip-flop. The flip-flop comprises a data input D, a clock input H and a Q output. An RST signal makes it possible to initialize the state of the flip-flop at power-up, ie the value of the flip-flop. bit memorized in the flip-flop.

At each rising edge of the clock signal H, the output Q copies the input value D. The flip-flop then maintains this value until the next rising edge. Thus, when the data presented at the input D is identical to the value stored in the flip-flop, the state of the output Q does not vary. On the other hand, when the input D differs from the stored value, the output Q changes state. This is called switching or switching.

Figure 2 shows the current consumption of such a rocker. The curve in dotted lines corresponds to the current consumed by the rocker when switching, while the curve in solid line represents the consumption of the rocker in the absence of switching.

There are therefore two consumption profiles depending on whether the data stored in the flip-flop changes or does not change. Thus, the consumption of the flip-flop depends on the state of the input data and the current state in the flip-flop.

Side Channel Attacks ("Side Channel Attacks"), and more particularly the differential analysis ("Differential Power Analysis" (DPA) and correlation ("Correlation Power Analysis", CPA) type of power or emissions electromagnetic, exploit this difference in consumption to find the cryptographic key stored in the secure circuit.

Secure circuit manufacturers provide countermeasure systems to protect registers against DPA attacks. In particular, the patent application FR2802733 aims to mask the consumption difference of a master-slave D flip-flop.

Figure 3 schematically shows the flip-flop D described in this application. The flip-flop conventionally comprises a master stage 2M and a slave stage 2S, of identical structure and connected in series. The flip-flop further includes a consumption masking circuit. The masking circuit consists of a 4M control stage connected in parallel with the master stage 2M and a control stage 4S connected in parallel with the slave stage 2S.

The operation of this rocker is in short the following. When the input data D is identical to the data in memory, the master and slave stages do not switch. On the other hand, the two control stages switch. When the input data differs from that in memory, one of the master and slave stages switches, as well as one of the control stages. In other words, there are always two of the four stages that switch at each clock edge. However, it is observed that the difference in consumption is not sufficiently reduced and it is still possible to distinguish the state in which the flip-flop is located. This is due to the fact that the control stage is not strictly identical to the corresponding stage of the flip-flop (master or slave). Indeed, a node of the control stages is disconnected, as can be seen in FIG. 3. The consumption due to the tilting of a control stage is then different from that of the master or slave stage. In addition, the power consumption of this rocker is greatly increased, due to the systematic switching of two floors.

Summary of the invention

It is noted that there is a need to provide a memory element robust attacks, while having a controlled power consumption. This need is satisfied by providing a clock, a first master-slave D-type flip-flop clocked by the clock and a second master-slave D-type flip-flop, structurally identical to the first flip-flop, clocked and connected. to the first flip-flop so that the second flip-flop switches to each active edge of the clock where the first flip-flop does not switch.

In one embodiment, the memory element comprises a logic circuit configured to detect switching of the first flip-flop and to control switching of the second flip-flop when the first flip-flop does not switch. According to a development, the logic circuit receives as input an input signal of the first flip-flop, an output signal of the first flip-flop and an output signal of the second flip-flop, the logic circuit being configured to switch the second flip-flop when none of the three signals is in an active state or when two of the three signals are in an active state. In another embodiment, the memory element comprises a clock generating circuit from an external signal, configured to introduce a random delay between each active edge of the clock and an associated active edge of the external signal.

According to a development, the clock is generated using a plurality of inverters from the external signal and the generator circuit comprises a modulation circuit of the number of inverters. Brief description of the drawings

Other advantages and features will emerge more clearly from the following description of particular embodiments given as non-limiting examples and illustrated with the aid of the accompanying drawings, in which: FIG. 1, previously described, is a symbolic representation of a master-slave D flip-flop; FIG. 2, previously described, represents the current consumption of a flip-flop according to FIG. 1, with and without switching; FIG. 3, previously described, is a block diagram of a secure master-slave D flip-flop according to the prior art; FIG. 4 represents an embodiment of a secure memory element provided with two master-slave D flip-flops interconnected by a logic circuit; FIGS. 5 to 9 are timing diagrams illustrating an overall operation of the memory element of FIG. 4; FIG. 10 represents power consumption profiles of the memory element according to FIG. 4; Fig. 11 is a block diagram of a memory element provided with an internal clock tree; Figures 12 to 18 are timing diagrams of internal signals of the memory element of Figure 11; FIG. 19 represents current consumption profiles of the memory element according to FIG. 11; and FIG. 20 represents an embodiment of the logic circuit of FIG. 4. Description of a preferred embodiment of the invention

It is proposed here to duplicate a conventional master-slave D-type flip-flop to form a secure memory element. The two flip-flops are interconnected so as to obtain the switching of only one of these flip-flops to each active edge of a clock signal. Thus, the power consumption of the memory element is substantially constant. This effectively counter attacks using power analysis.

An active edge is defined as the edge, or transition, of a signal that triggers the switching of one of the flip-flops. In the following description, the rising edge has been arbitrarily chosen as the active edge of the clock signal. Similarly, the active state of a signal will correspond to the logic high or logic level. The operation of the memory element would, however, be similar to that described below, considering the falling edge as the active edge and the low state as the active state. Figure 4 shows an embodiment of a memory element 6 having a balanced consumption. The memory element 6 comprises a data input D, a clock input H and an output Q respectively connected to the inputs-outputs D1, H1 and Q1 of a first master-slave type D flip-flop 8a. The element further comprises a second latch 8b, structurally identical to the latch 8a and clocked by the same clock H. The inputs H1 and H2 of the latches 8a and 8b are connected to the input H of the memory element. The initialization inputs RST1 and RST2 of the flip-flops 8a and 8b are connected to an input RST of the element 6. For reasons of convenience, the signals of the flip-flops have hereinafter the same name as the input-outputs to which they are connected. affected.

The flip-flop 8b is connected to the flip-flop 8a via a logic circuit 10. The circuit 10 receives as input the input signal D1 of the flip-flop 8a, the output signal Q1 of the flip-flop 8a and the signal of Q2 output of the flip-flop 8b. The output of the circuit 10 is connected to the input D2 of the flip-flop 8b. Thus, the signal D2 is a logical function of the signals D1, Q1 and Q2, the calculation of which is carried out offset from the active edge of the clock. In this configuration, the inputs D and D1 receive the same signal. The flip-flop 8a performs the memory function of the element 6 and the flip-flop 8b makes it possible to balance the power consumption. In fact, the memory element has the same function as that of a master-slave D flip-flop. The circuit 10 is configured to detect a switching of the flip-flop 8a and cause switching of the flip-flop 8b when the flip-flop 8a does not switch.

The logic function of circuit 10 corresponds to that of an exclusive three-input NOR gate. Considering D1, Q1 and Q2 as the inputs of the circuit 10 and D2 its output, we obtain: D2 = D10Q1 ®Q2

The truth table of logic circuit 0 is given below:

It can be seen that the output D2 of the circuit 10 goes high when none of the inputs D1, Q1 and Q2 are in the high state or when two of these three inputs are in the high state. Figures 5 to 9 show, in a simplified manner, signal timing of the memory element of Figure 4. The plot of Figure 5 corresponds to the clock signal H which rates flip-flops 8a and 8b. The plots of FIGS. 6 to 9 represent the input and output signals of flip-flops 8a and 8b, respectively D1, Q1, O2 and Q2.

The flip-flops are initially initialized using the RST signal. The signals Q1 and Q2, which correspond to the data stored in the latches, are initially in the low state (or logic level Ό ').

During a first rising edge of clock, at time ti, the input D1 is in the low state (Fig.6: D1 = '0'). Thus, in accordance with the operation of a master-slave D flip-flop described in connection with FIG. 1, the output Q1 remains in the low state (FIG. 7: Q1-0 '). There is therefore no switching in the flip-flop 8a.

Since the signals D1, Q1, and Q2 are initially all Ό ', the signal D2 is equal to Ί' (FIG. 8) according to the truth table of the logic circuit 10. At the rising edge, the output Q2 copies the input D2 of the flip-flop 8b. The signal Q2 thus goes from '0' to (FIG. 9), which means that the flip-flop 8b switches. At time t2, the input D1 being kept low, the flip-flop 8a still does not switch. The signal D2 is' 0 'at the instant t2 because only one of the inputs of the circuit 10 is in the high state (D1 =' 0 \ Q1 = '0', Q2 =). As a result, flip-flop 8b switches and signal Q2 drops back to Ό '.

At time t.3, the input signal D1 of flip-flop 8a is' 1 'while the value previously stored in flip-flop 8a is Ό'(Fig.7; Q1 (t2) = '0'). We observe the switching of the flip-flop 8a (Q1 (t.3) = T). At this time, the signal D2 is '0' because only the input D1 is in the high state. Accordingly, the latch does not switch 8b (Fig.9: Q2 (t ₃₎ = Q2 (t ₂₎ = '0').

At the fourth rising edge (t4), the signal D1 is maintained at '1' so the flip-flop 8a does not switch. On the other hand, the signal D2 is switched on, which causes switching of the flip-flop 8b.

Thus, it can be shown that there is systematically only one flip-flop on the rising edge of the clock, regardless of the state of the input D and the current state of the flip-flops 8a and 8b. Indeed, it can be seen in FIGS. 7 and 9 that only one of the signals Q1 and Q2 changes level at each rising edge. The signal D2 takes into account the signal D1 (or D) and the output state of the flip-flop 8a (Q1) to know whether there will be a switching of the flip-flop 8a. It also takes into account the state of the output of the flip-flop 8b (Q2) to generate, if necessary, the switching of the flip-flop 8b. The updating of the signal D2 is performed at a different time from that of the flip-flops 8a and 8b, for example on the falling edges of the clock H (FIG. 8). This avoids hazards in the latch 8b which would cause overconsumption.

FIG. 10 shows the envelope of the current consumption defined from all the operating modes of the memory element 6. The solid line represents the lower limit of the consumption envelope, that is, say the minimum consumption regardless of the operating mode of element 6. The dotted line curve corresponds to the upper limit of the consumption envelope, ie the maximum consumption regardless of the mode of operation. operation.

The difference between the two curves corresponds to the maximum consumption difference (in the worst case) depending on whether the data stored in the element 6 changes state or not. This difference in consumption, inevitable, is attributable to the polarization of the internal nodes of the flip-flops. It can be seen that, compared with FIG. 2, this difference is considerably reduced, which makes the DPA attacks more difficult.

Figure 11 is a detailed view of some components of the memory element 6: the latches 8a and 8b, and an internal clock shaft 20. The logic circuit 10 is not shown in this figure. Each flip-flop 8a, 8b comprises a master stage 2M and a slave stage 2S. The master and slave stages are identical in structure and connected in series.

In the embodiment of FIG. 11, each master stage 2M (respectively slave 2S) comprises an inverter 12 followed by a first transfer gate TM (respectively TS), and a storage loop 14. The storage loop 14 includes two other inverters 16, 18 and a second transfer gate TM '(respectively TS') in series. The transfer gates are formed, for example, of two MOS transistors connected in parallel, one of the N type and the other of the P type.

The transfer gate TM connects the output of the inverter 12 to a storage node of the storage loop 14 located between the transfer gate TM 'and the inverter 16. The storage node is noted NM1 in the master stage of the flip-flop 8a, NS1 in the slave stage of the flip-flop 8a, NM2 in the master stage of the flip-flop 8b and NS2 in its slave stage. The output of the inverter 16 of the master stage is connected to the input of the inverter 12 of the slave stage.

It will be noted that the signals at the nodes NM1 and NM2 of the master stages respectively correspond to the complements of the input signals D1 and D2. In addition, the signals at the nodes NS1 and NS2 of the slave stages respectively correspond to the signals Q1 and Q2. An inverter 19 is then added in each flip-flop 8a, 8b in parallel with the slave stage 2S to obtain the outputs Q1 and Q2 of FIG.

The latches 8a and 8b, and more particularly the transfer gates TM, TM ', TS and TS', are controlled by internal clock signals CPI and CPN. These signals are assigned to the gates of the NMOS and PMOS transistors of each transfer gate. The CPI, CPN signals are complementary. Thus, the two transistors of a door are simultaneously blocked or passersby.

The CPI, CPN signals come from the clock tree 20 integrated in each memory element. They are generated using a plurality of inverters from the external clock H.

The clock shaft 20 usually consists of two inverters 22 and 24 connected in series. The external clock signal H propagates through the two inverters. The signal CPN is recovered at the output of the first inverter 22 and the signal CPI is recovered at the output of the second inverter 24. Thus, the signal CPN corresponds to the complement of the external signal H and the signal CPI corresponds to the signal H. The transfer doors TM and TM 'are controlled in phase opposition: when the TM gate is busy, the gate TM' is blocked, and vice versa. For this purpose, the assignment of the CPI and CPN signals between the transfer gates TM and TM 'is reversed. Similarly, the TS and TS 'gates are controlled in phase opposition. On the other hand, the doors TM and TS 'are controlled simultaneously, as well as the doors TM' and TS.

Figures 12 to 18 show, in a simplified manner, timing of internal signals flip-flops 8a and 8b. The plots of FIGS. 12 to 14 respectively represent the internal clock signals CPI and CPN and the input D1 of the flip-flop 8a (equivalent to the input D of the memory element). The plots of FIGS. 15 to 18 represent the signals at the storage nodes NM1, NS1, NM2 and NS2 of the flip-flops 8a and 8b.

The operation of the flip-flops 8a and 8b is described in detail below, in connection with the block diagram of FIG. 11 and the timing diagrams of FIGS. 12 to 18.

Between instants t ₁ and t ₂ , the input data D 1 (or D) already corresponds to that stored in flip-flop 8a, at node NM 1 (NM 1 = 1 = D 1). It therefore has no switching of the flip-flop 8a, neither in the master stage (NM1: Fig.15), nor in the slave stage (NS1: Fig.16) during this period.

On the other hand, we observe the switching of the flip-flop 8b. At the falling edge of the signal CPI (or rising edge of the signal CPN), the transfer gate TM of the flip-flop 8b becomes conducting and the node NM2 changes state (FIG. 17). At the next edge, that is to say at the rising edge of the signal CPI, the gate TS becomes busy. The slave stage then copies the value of the node NM2 in the node NS2 (FIG. 18).

At time t ₂ , the input D1 of the flip-flop 8a changes state (D1 =). This first causes the tilting of the master stage 2M of the flip-flop 8a. Indeed, by activating the TM gate at the falling edge of the signal CPI, the signal at the node NM1 goes to '0' (Fig.15). Then, the slave stage 2S switches to the next rising edge of the signal CPI (at time t.3). The TS gate is activated and the node NS1 copies the value of the node NM1 (FIG. Since the switching of the flip-flop 8a has taken place, the circuit 10 does not cause any change of the signal D2 (not shown) of the flip-flop 8b between the instants t2 and t.3. There is therefore no tilting in the associated master and slave stages. Between instants t3 and t _t , the input D1 remains at. When the TM and TS gates are activated, there is therefore no change in the state of the nodes NM1 and NS1 of the flip-flop 8a.

The circuit 10 then controls the switching of the flip-flop 8b, with a new value of the input D2. The node NM2 goes to '0' at the falling edge of the signal CPI, following the activation of the gate TM, then the node NS2 copies this value during the activation of the gate TS, at the rising edge of the signal CPI (instant t ₄ ).

Thus, it can be shown that at each falling edge of the signal H (or falling edge of the signal CPI), only one of the master stages switches. At the rising edge of the signal H (or rising edge of the signal CPI), only one of the slave stages switches. To summarize, only one of the four stages of the memory element switches at each edge of the clock signal H, unlike the master-slave D flip-flop secure of the prior art.

There is therefore no increase in the instantaneous consumption relative to the systematic switching of two floors. The memory element consumes less power than a conventional secure flip-flop.

The slave master D flip-flop described in this application is more robust to hidden channel attacks than the prior art circuits.

In WO00 / 26746 for example, each data processing circuit whose power consumption is to be masked is provided with a complementary masking circuit, controlled in parallel with the processing circuit. When a transition (rising or falling) takes place in the data processing circuit, the opposite transition occurs in the masking circuit (downstream or rising respectively).

However, it is still possible to distinguish the activity or inactivity of this processing circuit, by analyzing the current consumption according to whether the circuit switches or does not switch. The difference in consumption is even doubled, since we observe two transitions (instead of only one) when the circuit is active and no transition when it is inactive. It is therefore even easier to conduct attacks that exploit this difference in consumption.

Here, the power consumption of the master slave D flip-flop is balanced in time because there is systematically (i.e. at each clock edge) only one of the two flip-flops that switches.

In a preferred embodiment represented by dotted lines in FIG. 11, the clock tree 20 is modified to form a random delay generator between the external clock signal H and the internal clock signals CPI and CPN which control flip-flops 8a, 8b.

The random delay generator 20 comprises, in addition to the inverters 22 and 24 of the clock shaft, two inverters 26 and 28 connected in series and arranged between the inverters 22 and 24. The generator also comprises two transfer gates 30 and 32. The gate 30 connects the output of the inverter 22 to the input of the inverter 24 and the gate 32 connects the output of the inverter 28 to the input of the inverter 24. Each inverter is characterized by a propagation time of the external clock signal H through the inverter. There are two operating states of the generator 20, according to the state of the gates 30 and 32. These are controlled in phase opposition by a DJIT signal.

When the signal DJIT is low (DJIT-0 '), the gate 30 is on and the clock signal H passes through the inverters 22 and 24. The signal CPN is then inverted and offset by the propagation time of the inverter 22 relative to the signal H. In the same way, the signal CPI is inverted and offset from the propagation time of the inverter 24 with respect to the signal CPN. The signal CPI therefore corresponds to the signal H shifted by two propagation times. This operating state corresponds in fact to that of a conventional clock tree.

On the other hand, when the gate 36 is busy (DJIT =), the signal H passes through two further inverters, 26 and 28. The delays applied to the CPN and CPI signals are then increased by the propagation time of the inverter 26 and by the propagation time of the inverter 28.

It is therefore possible, using the DJIT signal, to modulate the time delay between each rising edge of the control signal CPI and an associated rising edge of the external signal H. This delay can take two distinct values, depending on the number of inverters used. to generate the signal CPI, two or four in the example of Figure 11. The delay is much less than the duration of a period of the signal H. It is of the order of half the delay of propagation of the signal between the input H and the Q output of the flip-flop of FIG. 1, that is to say between 50 ps and 100 ps in 130 nm technology.

The generator 20 may also comprise additional inverters and transfer gates, arranged to form other propagation loops of the signal H. The number of possible delay values is thus increased. The DJIT signal is then encoded on several bits. The DJIT signal preferably corresponds to the output of a random number generator (not shown). The delay generator 20 is then stochastically controlled.

The propagation time of the signal H in an inverter varies as a function of the size of the transistors constituting the inverter, typically an N-type MOS transistor and a P-type MOS transistor connected in series. By varying the size of the transistors, for example those of the inverters 26 and 28, it is possible to vary the delays applied to the CPI and CPN signals from one memory element to the other.

In a preferred embodiment, a register comprises a plurality of memory elements and at least one of the two delay values differs from one memory element to another.

FIG. 19 represents the envelope of the electric current consumed by a memory element 6 equipped with the random delay generator 20. It can be seen that the difference between the upper limit and the lower limit of the envelope is smaller than in FIG. 10 but also that this envelope spreads over a longer period. In fact, the random delay introduced on the CPI and CPN signals delays the updating of the signal Q1 (or the signal Q2) with respect to the front of the external clock H. The average electrical consumption of the flip-flop is therefore spread. over a longer period of time. In other words, the current consumption of the memory element is averaged over several cycles or cryptographic calculations. This has the effect of further reducing the average consumption difference between all modes of operation of the memory element. It thus becomes difficult to distinguish the state of the memory element from the consumption records.

To carry out hidden channel attacks on a register, the switching of the flip-flops and their associated consumption must be synchronized with respect to the external clock signal H. When this is not the case, the attacker performs a so-called resynchronization operation. . However, in the case of memory elements according to FIG. 11, each element is slightly out of synchronization with the clock H thanks to the generator 20 integrated in each flip-flop. This desynchronization is on the one hand variable within the same rocker, between two successive failovers, thanks to the signal DJIT. On the other hand, it may differ from one memory element to another by adapting the generator 20, for example by changing the size of the transistors of the inverters. Resynchronization of all memory elements is therefore impossible, which further improves the robustness to hidden channel attacks.

In addition, the random delay generator 20 has the effect of limiting information leaks logic circuits located downstream of the memory element. Indeed, the calculations of these circuits are delayed, which also reduces their average difference in consumption. The memory element is not only secure, but the logic circuits at the output are also more robust to attacks. In a single rail logic circuit, a binary value is encoded on a wire, which corresponds to two distinct states: '0' and. In double rail logic, the binary value is coded on two wires. It is then possible to code up to four states: ΌΟ ', Ό1', '10' and Ί l '. Double rail coding is intrinsically more robust to attacks because it allows a first balancing of consumption.

The secure memory element described above can be used in a single rail logic circuit, using only the signal D1 at the output of the memory element. However, it is noted that the memory element is also suitable for double-rail coding with invalid state feedback. It suffices for this to use the output Q2 of the second flip-flop 8b. It is thus possible to combine, in a simple and secure manner, single rail registers and double rail registers in the same circuit, using a single type of memory element. As previously described, the signal D2 of the flip-flop 8b is updated before the update of the flip-flops 8a and 8b, that is to say before each rising edge of the signal CPI, for example on each falling edge .

FIG. 20 represents a preferred embodiment of logic circuit 10 in which the signal D2 is synchronized on the falling edges of the signal CPI.

In the first place, it is desired to synchronize the signal D1 on the falling edges of the signal CPI. For this, we reproduced a portion of the block diagram of the flip-flop 8a (Fig.11). This input portion of the flip-flop 8a successively comprises the inverter 12, the transfer gate TM and the inverter 16. The signal D1 \ at the output of the inverter 16 corresponds to the signal D1 synchronized on the falling edges of the signal CPI . Indeed, the gate TM is busy during a low state of the CPI signal.

In the example of FIGS. 12 to 18, the signal D1 is synchronized on the rising edges of the signal CPI. The signal D1 'will then be offset by one half of a clock cycle with respect to the signal D1. The signal D1 'corresponds in fact to the complement of the signal at the node NM1 (FIG.

In FIG. 20, two transfer gates TG and TG 'make it possible to obtain the signals Q1' and Q2 'from the signals Q1 and Q2. The signals Q1 'and Q2' respectively correspond to the signals Q1 and Q2 synchronized on the rising edges of the signal CPI and whose values are maintained on the low state of the signal CPI. The exclusive NOR function of the circuit 10 is performed by a plurality of inverters and transfer gates arranged to define different propagation paths of the signal D1 '.

The circuit 10 comprises a first inverter 34 receiving as input the signal D1 'and connected in series with a first branch 36a provided with a transfer gate 38a. A second branch 36b, in parallel with the branch 36a, comprises a transfer gate 38b and an inverter 34b. The doors 38a and 38b are controlled in phase opposition by the signals Q1 'and Q1 \

A third branch 36c is connected in series with the branches 36a and 36b. It includes a transfer gate 38c. Connected in parallel with the branch 36c, a branch 36d comprises a transfer gate 38d and an inverter 34d. The doors 38c and 38d are controlled in phase opposition by the signals Q2 'and Q2'.

The signal D1 'propagates systematically through two of the four branches, one of the branches 36a and 36b, then one of the branches 36c and 36d, depending on the state of the doors 38a-d. Thus, the signal D passes through one, two or three inverters depending on the state of the signals Q1 ', Q2', Qf and Q2 '. By way of example, when the signals Q1 'and Q2' are in the low state (Ό '), the signal D1' propagates through the branches 36a and 36c and passes through only one inverter (34). The signal D2 is then '1' if the signal D1 'is at' 0 'and' 0 'if the signal D1' is at Ί '.

With this configuration, it is possible to associate a value of the signal D2 with each combination of values of the signals D1, Q1 and Q2, according to the truth table of the logic circuit 10. The signal D2 evolves at the same time as the signal D1 ', c i.e. in synchronism with the rising edges of the clock signal CPI.

Many variations and modifications of the memory element will occur to those skilled in the art. In particular, other implementations of master-slave D-flip-flop, exclusive NOR gate, and inverter than those described herein can be employed.

Claims

claims

1. Memory element comprising a clock (CPI), a first flip-flop (8a) of master-slave type D clocked by the clock, characterized in that it comprises a second flip-flop (8b) of master-slave type D, structurally identical to the first flip-flop, clocked by the clock (CPI) and connected to the first flip-flop so that the second flip-flop (8b) switches to each active edge of the clock where the first flip-flop (8a) does not switch.

Memory element according to claim 1, comprising a logic circuit (10) configured to detect a switching of the first flip-flop

(8a) and to control switching of the second flip-flop (8b) when the first flip-flop (8a) does not switch.

3. The memory element according to claim 2, wherein the logic circuit (10) receives as input an input signal (D1) of the first flip-flop (8a), an output signal (Q1) of the first flip-flop (8a). , and an output signal (Q2) of the second flip-flop (8b), the logic circuit (10) being configured to switch the second flip-flop (8b) when none of the three signals (D1, Q1, Q2) are in a state active or when two of the three signals are in an active state.

4. The memory element of claim 3, wherein the logic circuit (10) is an exclusive NOR gate arranged to operate in offset with the active edge of the clock.

5. A memory element according to claim 1, comprising a generator circuit (20) of the clock (CPI) from an external signal (H), configured to introduce a random delay between each active edge of the clock (CPI). ) and an associated active edge of the external signal (H).

The memory element of claim 5, wherein the clock (CPI) is generated using a plurality of inverters (22, 24, 26, 28) from the external signal (H), and which the generator circuit (20) comprises a modulation circuit (30, 32) of the number of inverters.

The memory element of claim 6, wherein the delay varies between a first value and a second value as a function of the number of inverters (22, 24, 26, 28) used to generate the clock (CPI).

An integrated circuit comprising first and second memory elements according to claim 7, characterized in that the first delay value of the first element differs from the first delay value of the second element.