Protection of a cipher algorithm
A cryptographic device includes hardware data processing circuitry and software data processing circuitry coupled to the hardware data processing circuitry. The device, in operation, executes a plurality of rounds of a symmetrical data cipher algorithm and protects the execution of the plurality of rounds of the symmetrical data cipher algorithm. The protecting includes executing data masking and unmasking operations using the hardware data processing circuitry, executing linear operations applied to data using the software data processing circuitry, executing linear operations applied to masks using the hardware data processing circuitry, and executing non-linear operations applied to data using one of the hardware data processing circuitry or the software data processing circuitry.
1. A method, comprising:
executing a plurality of rounds of a symmetrical data cipher algorithm using an electronic device, the electronic device including hardware data processing circuitry and software data processing circuitry; and
protecting the execution of the plurality of rounds of the symmetrical data cipher algorithm against attacks during the execution of the plurality of rounds, the protecting including:
executing data masking and unmasking operations using the hardware data processing circuitry;
executing linear operations applied to data using the software data processing circuitry;
executing linear operations applied to masks using the hardware data processing circuitry; and
executing non-linear operations applied to data during rounds of the plurality of rounds using one of the hardware data processing circuitry or the software data processing circuitry, wherein each non-linear operation of the non-linear operations applied to data during a current round of the plurality of rounds is preceded in the current round by a mask refreshment operation implemented using one or more lookup tables.
2. The method of claim 1 , comprising:
applying a linear operation to a mask in parallel with application of a same linear operation to data.
3. The method according to claim 1 , wherein the symmetrical data cipher algorithm employs a data path and a key path, said data masking and unmasking operations, said linear operations applied to data, and said non-linear operations applied to data being operations of the data path.
4. The method according to claim 1 , wherein said data masking and unmasking operations comprise masking operations, unmasking operations, and mask refreshment operations.
5. The method of claim 4 , wherein each non-linear operation is followed by a mask refreshment operation.
6. The method according to claim 4 , wherein each non-linear operation is followed by a masking operation.
7. The method according to claim 4 , wherein each non-linear operation is preceded by an unmasking operation.
8. The method according to claim 1 , wherein each non-linear operation is followed by a masking or unmasking operation.
9. The method according to claim 1 , wherein each non-linear operation is preceded by a masking and unmasking operation.
10. The method according to claim 1 , comprising executing lookup table refreshment operations.
11. The method according to claim 1 , wherein non-linear operations executed by the hardware processing circuitry are executed using one or more lookup tables.
12. The method according to claim 1 , wherein the cipher algorithm is a block cypher algorithm or a stream cypher algorithm.
13. The method according to claim 1 , wherein data masking operations are executed using a logical addition function.
14. The method according to claim 1 , comprising:
in a first round of the plurality of rounds, initializing a lookup table of one or more lookup tables; and
in a second round of the plurality of rounds, refreshing the lookup table prior to performing a mask refreshment operation implemented using the lookup table.
15. A device, comprising:
hardware data processing circuitry; and
software data processing circuitry coupled to the hardware data processing circuitry, wherein the device, in operation:
executes a plurality of rounds of a symmetrical data cipher algorithm; and
protects the execution of the plurality of rounds of the symmetrical data cipher algorithm against attacks during the execution of the plurality of rounds, wherein the protecting includes:
executing data masking and unmasking operations using the hardware data processing circuitry;
executing linear operations applied to data using the software data processing circuitry;
executing linear operations applied to masks using the hardware data processing circuitry; and
executing non-linear operations applied to data during rounds of the plurality of rounds using one of the hardware data processing circuitry or the software data processing circuitry, wherein each non-linear operation of the non-linear operations applied to data during a current round of the plurality of rounds is preceded in the current round by a mask refreshment operation implemented using one or more lookup tables.
16. The device of claim 15 , wherein the protecting includes:
applying a linear operation to a mask in parallel with application of a same linear operation to data.
17. The device according to claim 15 , wherein the symmetrical data cipher algorithm employs a data path and a key path, said data masking and unmasking operations, said linear operations applied to data, and said non-linear operations applied to data being operations of the data path.
18. The device according to claim 15 , wherein said data masking and unmasking operations comprise masking operations, unmasking operations, and mask refreshment operations.
19. The device of claim 18 , wherein each non-linear operation is followed by a mask refreshment operation.
20. The device according to claim 18 , wherein each non-linear operation is preceded by an unmasking operation.
21. The device according to claim 18 , wherein said mask refreshment operations are implemented using one or more lookup tables.
22. The device according to claim 18 , wherein non-linear operations executed by the hardware processing circuitry are executed using one or more lookup tables.
23. A system, comprising:
an application processor; and
cryptographic circuitry coupled to the application processor and including hardware processing circuitry and software processing circuitry, wherein the cryptographic circuitry, in operation:
executes a plurality of rounds of a symmetrical data cipher algorithm; and
protects the execution of the plurality of rounds of the symmetrical data cipher algorithm against software attacks during the execution of the plurality of rounds, wherein the protecting includes:
executing data masking and unmasking operations using the hardware processing circuitry;
executing linear operations applied to data using the software processing circuitry;
executing linear operations applied to masks using the hardware processing circuitry; and
executing non-linear operations applied to data during rounds of the plurality of rounds using one of the hardware processing circuitry or the software processing circuitry, wherein each non-linear operation of the non-linear operations applied to data during a current round of the plurality of rounds is preceded in the current round by a mask refreshment operation implemented using one or more lookup tables.
24. The system of claim 23 , wherein the protecting includes:
applying a linear operation to a mask in parallel with application of a same linear operation to data.
25. The system according to claim 23 , wherein the symmetrical data cipher algorithm employs a data path and a key path, said data masking and unmasking operations, said linear operations applied to data, and said non-linear operations applied to data being operations of the data path.
26. The system according to claim 23 , wherein said data masking and unmasking operations comprise masking operations, unmasking operations, and mask refreshment operations.
27. The system according to claim 23 , wherein the hardware processing circuitry comprises one or more lookup tables.
28. The system according to claim 27 , wherein:
in a first round of the plurality of rounds, a lookup table of one or more lookup tables is initialized; and
in a second round of the plurality of rounds, the lookup table is refreshed prior to a mask refreshment operation implemented using the lookup table.