Granted Patent B2

US 12,413,387 · App. 18/265,980 · Granted Sep 9, 2025

Inventors: Mylène Roussellet (Saint Savournin, FR); David Vigilant (Malakoff, FR); Olivier Adjonyo Koffi Benit (Rosny-sous-bois, FR)

Assignee: THALES DIS FRANCE SAS

H04L9/0631H04L9/003

Abstract

Claims (17)

1. A method for securing against high-order side-channel attacks an execution of a SubBytes step of a block cipher algorithm based on Advanced Encryption Standard and operating on an internal state x split into a first set of (n+1) shares (x0, x1, x2 . . . xn) by a (n+1)-additive sharing, with n a non-zero integer,

said SubBytes step comprising: a substep of affine transformation in GF(2 8 ) on the state x and a substep of a field inversion in GF(256)*,

wherein said substep of field inversion is performed by a cryptographic device ( 101 ) and comprises:

computing (S 1 ) a Dirac output value by executing at least one Dirac function on a plurality of shares xi of the internal state x, with i an integer in [0,n], said Dirac function being a function defined in GF(256) such that said Dirac output value is equal to 1 when x equals 0 and is equal to 0 otherwise;

adding (S 2 ) said Dirac output value to one of said shares of the first set of shares to obtain a second set of shares;

performing a conversion of the second set of shares (S 3 ) from said (n+1) additive sharing to a (n+1)-multiplicative sharing;

performing an inversion of each share of the (n+1)-multiplicative sharing (S 4 );

performing a conversion of the inverted shares (S 5 ) from said multiplicative sharing to a (n+1)-additive sharing to obtain a third set of shares; and

adding (S 6 ) said Dirac output value to one of said shares of the third set of shares

and wherein the step of computing the Dirac output value (S 1 ) comprises:

replacing one of the shares xi by its binary complementary ˜xi with i an integer in {0, 1, . . . n} and ˜ the Boolean negation operation; and

performing a XOR between (n+1) binary values, each of said binary values being computed by performing a Boolean conjunction AND operation & between a plurality of bits of said shares having different indexes in said shares, with XOR the Boolean exclusive disjunction operation.

2. The method of claim 1 , comprising previously computing and storing in a Non-Volatile Memory the at least one Dirac function implemented as at least one precomputed table, and wherein the step of computing the Dirac output value comprises performing a lookup in said at least one precomputed table implementing said at least one Dirac function.

3. The method of claim 1 , wherein computing the Dirac output value (S 1 ) comprises computing Delta_0(x)=XOR(xA 0 & xB 1 & xC 2 & xD 3 & xE 4 & xF 5 & xG 6 & XH 7 ), for all possible combinations of A, B, C, D, E, F, G, H in {0, 1, . . . n} with & the Boolean conjunction AND operation.

4. The method of claim 3 , comprising previously: computing and storing in a Non Volatile Memory for each Dirac function (Delta_0_i) to be executed, two binary complemented versions (M io′ , M ir′ ) of the precomputed table implementing said Dirac function (Delta_0_i), said binary complemented versions of the precomputed table being said precomputed table masked with either 0 or 1; and, wherein executing a Dirac function on the shares of the internal state x comprises performing a lookup in one of said two binary complemented versions of the precomputed table implementing said function depending on a random mask bit.

5. The method of claim 1 , wherein computing the Dirac output value (S 1 ) comprises: executing a first Dirac function Delta_0_0 on the shares of the internal state x such that: Delta_0_0(x)=XOR(xA 0 & xB 1 & xC 2 & xD 3 ), for all possible combinations of A, B, C, D in {0, 1, . . . , n}; executing a second Dirac function Delta_0_1 on the shares of the internal state x such that: Delta_0_1(x)=XOR(xA 4 & xB 5 & xC 6 & xD 7 ), for all possible combinations of A, B, C, D in {0, 1, . . . , n}; and performing a Boolean conjunction AND operation & between the results of the execution of the first Dirac function and of the second Dirac function Delta_0_0(x) & Delta_0_1(x).

6. The method of claim 1 , wherein computing the Dirac output value (S 1 ) comprises: executing a first Dirac function Delta_0_00 on the shares of the internal state x such that: Delta_0_00(x)=XOR (xA 0 & xB 1 ), for all possible combinations of A, B in {0, 1, . . . , n}; executing a second Dirac function Delta_0_01 on the shares of the internal state x such that: Delta_0_1(x)=XOR (xC 2 & xD 3 ), for all possible combinations of A, B, C, D in {0, 1, . . . , n}; executing a third Dirac function Delta_0′_10 on the shares of the internal state x such that: Delta_0_10(x)=XOR (xA 4 & xB 5 ), for all possible combinations of A, B in {0, 1, . . . , n}; executing a fourth Dirac function Delta_0_11 on the shares of the internal state x such that: Delta_0_11(x)=XOR (xC 6 & xD 7 ), for all possible combinations of C, D in {0, 1, . . . , n}; and performing a Boolean conjunction AND operation & between the results of the execution of the first Dirac function, of the second Dirac function, of the third Dirac function and of the fourth Dirac function: Delta_0(x)=Delta_0_00(x) & Delta_0_01(x) & Delta_0_10(x) & Delta_0_11(x).

Assignments (4)

Priority Claims (1)

Continuity (1)

References Cited (18)