Computer program product, computer system and computer-implemented method comprising instruction to accelerate cryptographic processing

Abstract

Execute a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. Perform a cryptographic operation on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. Provide a result of the cryptographic operation.

Description

Technical Field

[0001] Generally speaking, one or more states relate to encryption processing within the computing environment, and more specifically, to improving the encryption operations used for encryption processing. Prior Technology

[0002] Encryption is used to protect data. Various encryption algorithms or techniques exist, including XTS-AES (XEX (XOR Encryption XOR) Fine-tunable Block Cipher with Ciphertext Stealing—Advanced Encryption Standard) algorithm, and others. The XTS-AES standard uses a secret value (e.g., a fine-tuning value) to provide additional protection. This secret value is encrypted using a data key called a protected key.

[0003] Encryption processing involves performing one or more cryptographic operations, including, for example, encryption and decryption. The processing associated with these operations will be improved. Summary of the Invention

[0004] This invention overcomes the shortcomings of prior art and provides additional advantages by providing a computer program product. The computer program product includes: a set of one or more computer-readable storage media; and program instructions, commonly stored in the set of one or more computer-readable storage media, for causing at least one computing device to perform computer operations. These computer operations include executing a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. A result of the cryptographic operation is provided.

[0005] In one or more embodiments, a computer system is provided. The computer system includes at least one hardware accelerator for executing a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. One result of the cryptographic operation is provided.

[0006] This document describes and claims protection for computer implementations, computer systems, and computer program products associated with one or more formats. Each embodiment of the computer program product may be an embodiment of a computer system and / or a computer implementation method, and vice versa. Furthermore, each embodiment may be separate from and selected as appropriate. Additionally, embodiments may be combined with each other. Each embodiment of the computer program product may be combined with formats and / or embodiments of computer systems and / or computer implementation methods, and vice versa. Furthermore, this document also describes and may claim protection for services associated with one or more formats.

[0007] Additional features and advantages are achieved through the techniques described herein. Other embodiments and patterns are described in detail herein and are considered part of the claimed patterns. Simple Explanation of the Diagram

[0008] One or more embodiments are specifically pointed out and clearly claimed by way of example in the claims section at the end of this specification. The foregoing contents, objectives, features, and advantages of one or more embodiments are apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: Figure 1 depicts an example of a computing environment that uses one or more of the present invention; Figure 2 depicts an example of further details of one of the processors in the processor group of Figure 1 according to one or more embodiments of the present invention; Figure 3A depicts an example of the encryption processing code of Figure 1 according to one or more forms of the present invention; Figure 3B depicts an example of the execution instruction code of the encryption processing code of Figure 3A according to one or more forms of the present invention; Figure 4A depicts an example of an encryption process according to one or more of the present invention; Figure 4B depicts an example of a protection process for protecting encrypted confidential values ​​according to one or more of the present invention; Figure 5A depicts an example of the format of a cryptographic message instruction according to one or more of the present invention; Figures 5B to 5D depict examples of the contents of a register used by the cryptographic message instructions of Figure 5A according to one or more forms of the present invention; Figures 5E to 5F depict examples of the contents of a general-purpose temporary register used by the cryptographic message instructions of Figure 5A according to one or more of the present invention; Figure 5G depicts an example of a parameter block used by the cryptographic message instruction of Figure 5A according to one or more states of the present invention; Figure 6A depicts an example of an operational operation performed according to one or more states of the present invention; Figure 6B depicts an example of an encryption operation performed according to one or more of the present invention; Figure 6C depicts an example of a decryption operation performed according to one or more of the present invention; Figure 7 depicts an example of hardware for performing encryption processing according to one or more embodiments of the present invention, the encryption processing including accelerated encryption processing and / or protection processing; and Figures 8A and 8B depict another example of a computing environment that uses one or more of the present invention. Implementation

[0009] According to one or more embodiments of the present invention, the ability to accelerate encryption processing is provided, including but not limited to accelerating the execution of cryptographic operations (e.g., encryption or decryption) of messages. In one or more embodiments, encryption processing is accelerated by providing instructions (e.g., a single structured instruction) to perform multiple operations or functions of encryption processing, including, for example, encrypting confidential values ​​(e.g., fine-tuning values) used in cryptographic operations and performing cryptographic operations on messages. Furthermore, encryption processing is accelerated by allowing the instruction to be interrupted and then restored from its interrupted position using a saved state of the instruction. This contrasts with repeated encryption / decryption or the need to determine the interrupted position and the point to be restored separately outside of the instruction.

[0010] In one or more states, a single instruction (e.g., a cryptographic instruction, such as a cryptographic message instruction or other instruction) is provided that encodes parameters to be used for encryption processing (e.g., XTS operations of encryption functions or operations). This single instruction is interruptible and includes a means to restore the state of the encryption processing without compromising security. In one instance, this single instruction is executed in hardware (e.g., at least one hardware accelerator) to order the complete encryption function (e.g., including XTS encoding and decryption operations) without exposing mask values ​​(e.g., modifying the mask, such as an XTS mask also referred to herein as TAU). In one or more states, an interruptible encryption function (e.g., including AES-XTS operations) is implemented without revealing mask values ​​and preserving state information for restoring the interrupted processing, such as the exponentiation block ordering value (e.g., the next exponentiation of alpha (NAP)).

[0011] In one or more forms, the ability to protect encrypted confidential values ​​(e.g., encrypted fine-tuning values) is provided by a protection mask value used in the encryption process and initially generated from the encrypted confidential value. This mask value is not stored outside of hardware or the processor, but instead is generated as part of the execution of the instruction, thereby providing protection for the mask and ultimately for the encrypted confidential value (by not implementing the use of the mask to determine the encrypted confidential value).

[0012] In one or more states, the instruction (e.g., a cryptographic message instruction) is formatted to include one or more parameters, such as: one or more keys (e.g., key 1 (K1), key 2 (K2)), a message address, a secret value (e.g., a fine-tuning value), a block index (also known as a power block ordering value (e.g., the next power of alpha)), and a message length. Additional, fewer, and / or other parameters may be used. For example, in one or more states, instead of the individual keys key 1 and key 2, these parameters include encrypted dual keys or multiple keys, where multiple keys (e.g., key 1, key 2) are encrypted together into a single encrypted key. In this case, the instruction decrypts the single encrypted key to obtain the individual key (e.g., key 1, key 2). Again, additional, fewer, and / or other parameters may be used. In one or more states, the instruction enables the use of a software-protected key that is indexed (e.g., a wrapper key verification mode used in decryption operations). In one or more states, the instruction uses state information (e.g., the next alpha power, which is an instance of a chain or exponentiation block order value) to allow interrupted and resumed encryption processes (e.g., including at least cryptographic operations) without compromising security.

[0013] In one or more states, encryption processing is accelerated by using at least one hardware accelerator, which is capable of performing a plurality of operations of the instruction and / or the encryption processing. For example, the hardware accelerator is configured to: sequence various operations used in encryption processing, including, for example, AES-GCM (Advanced Encryption Standard - Galois Counter Mode), GHASH (a hash function of AES-GCM), and AES-XTS multiplication operations on shared accelerator hardware capable of handling data in formats specific to various operations; sequence fine-tuning encryption, XOR masking, GF(2) (Galois field 2) multiplication, and data encryption / decryption in a manner to compute the entire encryption function (e.g., AES-XTS); schedule various operations (e.g., of the AES-XTS function) in the hardware in a manner to allow interruption and resumption of operations; maintain firmware-readable state information (e.g., 128-bit state information) in the hardware to enable interruption and resumption of processing; and / or protect the key latch on the scan dump.

[0014] In one or more embodiments, a computer program product is provided. The computer program product includes: a set of one or more computer-readable storage media; and program instructions commonly stored in the set of one or more computer-readable storage media for causing at least one computing device to perform computer operations. The computer operations include executing a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. A result of the cryptographic operation is provided. By providing a single instruction to perform encryption of a confidential value and perform a cryptographic operation, system performance is improved and processing speed is increased. Furthermore, latency is reduced.

[0015] Alternatively or concurrently, in one or more embodiments, generating the mask value includes multiplying the encrypted secret value by a power-law block ordering value to generate the mask value. The mask value is generated as part of an execution instruction and is not stored and is not visible outside the processor or hardware executing the instruction. This protects the mask value.

[0016] Alternatively, in one or more embodiments, the power block ordering value is input to the cryptographic instructions and is a modified value depending on the portion of the message to which the cryptographic operation is being performed. By using the power block ordering value, the execution of the cryptographic instructions can be resumed, thereby enabling the cryptographic operation to be performed on the entire message in a streamlined manner.

[0017] Alternatively or concurrently, in one or more embodiments, generating the mask value includes using an encrypted secret value and an exponential block ordering value to generate the mask value. Executing the cryptographic instruction further includes performing a block-by-block update on the exponential block ordering value and the mask value, wherein the exponential block ordering value and the mask value are kept synchronized with each other. By synchronizing the exponential block ordering value and the mask value with each other, the instruction can be interrupted and resumed from the point of interruption. This improves the efficiency and processing speed of performing cryptographic operations. Furthermore, protection is provided for the mask value.

[0018] Alternatively or concurrently, in one or more embodiments, these computer operations further include interrupting the execution of cryptographic instructions at one location of the message, wherein the cryptographic operation of the message ends before the completion of the cryptographic operation of the message. The cryptographic instructions are then re-executed. This re-execution obtains an updated idempotent block ordering value to resume the cryptographic operation of the message at that location of the message. The updated idempotent block ordering value is the input to the re-executed cryptographic instructions and is based on block-by-block updates. By providing the ability to interrupt cryptographic instructions, high-priority interrupts can be serviced, thereby providing improved processor responsiveness. Using instructions to perform cryptographic processing including cryptographic operations provides a streamlined pipeline for performing cryptographic processing.

[0019] Alternatively or concurrently, in one or more embodiments, the message comprises a plurality of message blocks, and the location of the message is one of the plurality of message blocks. By providing the ability to interrupt cryptographic instructions at a message block within the message, high-priority interrupts can be served, thereby providing improved processor responsiveness.

[0020] Alternatively or concurrently, in one or more embodiments, performing a block-by-block update includes updating the exponentiation block ordering value and the mask value based on progress to the next message block during cryptographic operations. By using the exponentiation block ordering value to resume execution of cryptographic instructions, cryptographic operations are performed on the entire message in a streamlined manner.

[0021] Alternatively or concurrently, in one or more embodiments, the cryptographic operations are ordered using at least one hardware accelerator to allow for interruption and re-execution. Using at least one hardware accelerator facilitates processing and improves performance. By ordering the operations, they can be interrupted and then resumed.

[0022] Alternatively or concurrently, in one or more embodiments, the power-ordered value is maintained in at least one hardware accelerator. Using at least one hardware accelerator to store the value improves latency by avoiding memory accesses to obtain the value.

[0023] Alternatively, in one or more embodiments, the cryptographic instruction receives as input a plurality of encryption parameters to be used to perform encryption and cryptographic operations on the confidential value. These plurality of encryption parameters are specified using one or more registers of the instruction. Using a single instruction and a plurality of encryption parameters achieves lower software processing overhead and improved performance.

[0024] Alternatively or concurrently, in one or more embodiments, the plurality of encryption parameters includes a key to be used to encrypt the confidential value, a data key to be used in the cryptographic operation, the address of the message, the confidential value, and a power-ordered block value to be used to generate the mask value. As part of the cryptographic instructions, providing encryption parameters including the key to be used to encrypt the confidential value, the data key to be used in the cryptographic operation, the address of the message, the confidential value, and the power-ordered block value improves performance by avoiding memory access, reducing latency, and providing instruction pipelined functionality. Lower software processing overhead and improved performance are achieved using a single instruction and a plurality of parameters. The use of the key to be used to encrypt the confidential value provides additional security.

[0025] Alternatively or concurrently, in one or more embodiments, the key to be used to encrypt the confidential value, the data key to be used in the cryptographic operation, the confidential value, and the exponential block ordering value are included in a parameter block. This parameter block is the input to the cryptographic instruction. The instruction's register includes at least a portion of the address of the parameter block. Providing the key to be used to encrypt the confidential value, the data key to be used in the cryptographic operation, the confidential value, and the exponential block ordering value in the parameter block input to the cryptographic instruction improves performance by avoiding memory access, reducing latency, and providing instruction pipelined functionality. Lower software processing overhead and improved performance are achieved using a single instruction and multiple parameters.

[0026] Alternatively or concurrently, in one or more embodiments, the message comprises a plurality of message blocks. Performing cryptographic operations includes determining a block mask value for one of the plurality of message blocks using the mask value, and performing cryptographic operations on the message block using the block mask value. By determining the block mask value using the mask value, rather than storing the mask value, the mask value is protected and the cryptographic operations are improved.

[0027] Alternatively, in one or more embodiments, the block mask value for the next message block is determined based on the block mask value of the previous message block. This improves performance by facilitating the calculation of the block mask value.

[0028] Depending on one or more embodiments, each of the embodiments may be separate from each other and may be selected as appropriate. In addition, embodiments may be combined with each other.

[0029] In one or more embodiments, a computer system is provided. The computer system includes: at least one computing device; one or more computer-readable storage media; and program instructions commonly stored in the one or more computer-readable storage media for causing the at least one computing device to perform computer operations. The computer operations include executing a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. A result of the cryptographic operation is provided. By providing a single instruction to perform the encryption of the confidential value and the execution of the cryptographic operation, system performance is improved and processing speed is increased. Furthermore, latency is reduced.

[0030] Alternatively or concurrently, in one or more embodiments, generating the mask value includes using an encrypted secret value and an exponential block ordering value to generate the mask value. Executing the cryptographic instruction further includes performing a block-by-block update on the exponential block ordering value and the mask value, wherein the exponential block ordering value and the mask value are kept synchronized with each other. By synchronizing the exponential block ordering value and the mask value with each other, the instruction can be interrupted and resumed from the point of interruption. This improves the efficiency and processing speed of performing cryptographic operations. Furthermore, protection is provided for the mask value.

[0031] Alternatively or concurrently, in one or more embodiments, these computer operations further include interrupting the execution of cryptographic instructions at one location of the message, wherein the cryptographic operation of the message ends before the completion of the cryptographic operation of the message. The cryptographic instructions are then re-executed. This re-execution obtains an updated idempotent block ordering value to resume the cryptographic operation of the message at that location of the message. The updated idempotent block ordering value is the input to the re-executed cryptographic instructions and is based on block-by-block updates. By providing the ability to interrupt cryptographic instructions, high-priority interrupts can be serviced, thereby providing improved processor responsiveness. Using instructions to perform cryptographic operations provides a streamlined pipeline operation for performing cryptographic operations and / or other cryptographic processes.

[0032] Alternatively or concurrently, in one or more embodiments, the cryptographic instruction receives as input a plurality of encryption parameters to be used to perform encryption and cryptographic operations on a confidential value. These plurality of encryption parameters are specified using one or more registers of the instruction. The plurality of encryption parameters include a key to be used to encrypt the confidential value, a data key to be used in the cryptographic operations, the address of the message, the confidential value, and a power-ordered block value to be used to generate a mask value. As part of the cryptographic instruction, providing encryption parameters including a key to be used to encrypt the confidential value, a data key to be used in the cryptographic operations, the address of the message, the confidential value, and a power-ordered block value improves performance by avoiding memory access, reducing latency, and providing instruction pipelined functionality. Lower software processing overhead and improved performance are achieved using a single instruction and a plurality of encryption parameters. The use of a key to be used to encrypt the confidential value provides additional security.

[0033] Depending on one or more embodiments, each of the embodiments may be separate from each other and may be selected as appropriate. In addition, embodiments may be combined with each other.

[0034] In one or more embodiments, a computer-implemented method is provided. The computer-implemented method includes executing a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. A result of the cryptographic operation is provided. By providing a single instruction to perform encryption of a confidential value and perform a cryptographic operation, system performance is improved and processing speed is increased. Furthermore, latency is reduced.

[0035] Alternatively or concurrently, in one or more embodiments, generating the mask value includes using an encrypted secret value and a power-ordered block value to generate the mask value. Executing the cryptographic instruction further includes performing a block-by-block update on the power-ordered block value and the mask value, wherein the power-ordered block value and the mask value are kept synchronized with each other. By synchronizing the power-ordered block value and the mask value, the instruction can be interrupted and resumed from the point of interruption. This improves the performance and speed of performing cryptographic processing. Furthermore, protection is provided for the mask value.

[0036] Alternatively or concurrently, in one or more embodiments, these computer operations further include interrupting the execution of cryptographic instructions at one location of the message, wherein the cryptographic operation on the message ends before the cryptographic operation on the message is completed. The cryptographic instructions are then re-executed. This re-execution obtains an updated idempotent block ordering value to resume the cryptographic operation on the message at that location of the message. The updated idempotent block ordering value is the input to the re-executed cryptographic instructions and is based on block-by-block updates. By providing the ability to interrupt cryptographic instructions, high-priority interrupts can be serviced, thereby providing improved processor responsiveness. Using instructions to perform cryptographic operations provides a streamlined pipeline for performing cryptographic operations.

[0037] Alternatively or concurrently, in one or more embodiments, the cryptographic instruction receives as input a plurality of encryption parameters to be used to perform encryption and cryptographic operations on a confidential value. These plurality of encryption parameters are specified using one or more registers of the instruction. The plurality of encryption parameters include a key to be used to encrypt the confidential value, a data key to be used in the cryptographic operations, the address of the message, the confidential value, and a power-ordered block value to be used to generate a mask value. As part of the cryptographic instruction, providing encryption parameters including a key to be used to encrypt the confidential value, a data key to be used in the cryptographic operations, the address of the message, the confidential value, and a power-ordered block value improves performance by avoiding memory access, reducing latency, and providing instruction pipelined functionality. Lower software processing overhead and improved performance are achieved using a single instruction and a plurality of encryption parameters. The use of a key to be used to encrypt the confidential value provides additional security.

[0038] Depending on one or more embodiments, each of the embodiments may be separate from each other and may be selected as appropriate. In addition, embodiments may be combined with each other.

[0039] In one or more embodiments, a computer system is provided. The computer system includes at least one hardware accelerator for executing a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. A result of the cryptographic operation is provided. By providing a single instruction to perform the encryption of the confidential value and to perform the cryptographic operation, system performance is improved and processing speed is increased. Furthermore, latency is reduced. Using an instruction to perform the cryptographic operation provides a streamlined pipeline for performing the cryptographic operation. Using at least one hardware accelerator facilitates processing and improves performance.

[0040] Alternatively or concurrently, in one or more embodiments, generating a mask value includes using an encrypted secret value and an exponential block ordering value to generate the mask value. Furthermore, executing cryptographic instructions includes performing a block-by-block update on the exponential block ordering value and the mask value. The exponential block ordering value and the mask value are kept synchronized with each other. The computer system is used to perform computer operations including interrupting the execution of cryptographic instructions at a location of the message, wherein the cryptographic operation of the message ends before the completion of the cryptographic operation of the message. The cryptographic instructions are re-executed. The re-execution obtains an updated exponential block ordering value to resume the cryptographic operation of the message at that location of the message. The operations of the cryptographic operations are ordered to enable interruption and re-execution. By providing the ability to interrupt cryptographic instructions, high-priority interrupts can be serviced, thereby providing improved processor responsiveness. Using instructions to perform cryptographic processing including encryption of a secret value and cryptographic operations provides a streamlined pipeline operation for performing cryptographic processing.

[0041] Depending on one or more embodiments, each of the embodiments may be separate from each other and may be selected as appropriate. In addition, embodiments may be combined with each other.

[0042] In one or more embodiments, a computer-implemented method is provided. The computer-implemented method includes executing a cryptographic instruction using at least one hardware accelerator. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. A result of the cryptographic operation is provided. By providing a single instruction to perform the encryption of the confidential value and the cryptographic operation, system performance is improved and processing speed is increased. Furthermore, latency is reduced. Using an instruction and at least one hardware accelerator to perform the cryptographic operation provides a streamlined pipeline for performing the cryptographic operation.

[0043] Depending on one or more embodiments, each of the embodiments may be separate from each other and may be selected as appropriate. In addition, embodiments may be combined with each other.

[0044] In one or more embodiments, a computer program product is provided. The computer program product includes: a set of one or more computer-readable storage media; and program instructions commonly stored in the set of one or more computer-readable storage media for causing at least one computing device to perform computer operations. The computer operations include executing a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. Generating the mask value includes multiplying the encrypted confidential value by a power-order block value to generate the mask value. Block-by-block updates are performed on the power-order block value and the mask value, wherein the power-order block value and the mask value are kept synchronized with each other. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. A result of the cryptographic operation is provided. By providing a single instruction to perform encryption of a confidential value and perform a cryptographic operation, system performance is improved and processing speed is increased. Furthermore, latency is reduced. A mask value is generated as part of the executed instruction. This mask value is not stored and is not visible outside the processor or hardware executing the instruction. This protects the mask value. By synchronizing the power block ordering value and the mask value, the instruction can be interrupted and resumed from the point of interruption. This improves the performance and processing speed of cryptographic operations. Furthermore, it provides protection for the mask value.

[0045] Depending on one or more embodiments, each of the embodiments may be separate from each other and may be selected as appropriate. In addition, embodiments may be combined with each other.

[0046] In one or more embodiments, a computer program product is provided. The computer program product includes: a set of one or more computer-readable storage media; and program instructions commonly stored in the set of one or more computer-readable storage media for causing at least one computing device to perform computer operations. The computer operations include executing a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. Generating the mask value includes generating the mask value using the encrypted confidential value and a power-order block value. Block-by-block updates are performed on the power-order block value and the mask value, wherein the power-order block value and the mask value are kept synchronized with each other. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. The message includes a plurality of message blocks. Performing cryptographic operations includes determining a block mask value for one of a plurality of message blocks using a mask value, and performing cryptographic operations on that message block using the block mask value. A result of the cryptographic operation is provided. By providing a single instruction to encrypt a confidential value and perform cryptographic operations, system performance is improved and processing speed is increased. Furthermore, latency is reduced. The mask value is generated as part of the execution instruction; this mask value is not stored and is not visible outside the processor or hardware executing the instruction. This protects the mask value. By determining the block mask value using this mask value, rather than storing it, the mask value is protected and cryptographic operations are improved. This improves the performance and processing speed of performing cryptographic operations. Furthermore, protection is provided for the mask value. Using instructions to perform cryptographic operations provides a streamlined pipeline for performing cryptographic operations.

[0047] Depending on one or more embodiments, each of the embodiments may be separate from each other and may be selected as appropriate. In addition, embodiments may be combined with each other.

[0048] In one or more embodiments, a computer program product is provided. The computer program product includes: a set of one or more computer-readable storage media; and program instructions, commonly stored in the set of one or more computer-readable storage media, for causing at least one computing device to perform computer operations. The computer operations include executing a cryptographic instruction. Executing the cryptographic instruction includes encrypting a confidential value to provide an encrypted confidential value and generating a mask value using the encrypted confidential value. Generating the mask value includes using the encrypted confidential value and a power-order block value to generate the mask value. Block-by-block updates are performed on the power-order block value and the mask value, wherein the power-order block value and the mask value are kept synchronized with each other. A cryptographic operation is performed on at least a portion of a message specified by the cryptographic instruction. The mask value is used to perform the cryptographic operation on the at least that portion of the message. A result of the cryptographic operation is provided. The cryptographic instruction receives a plurality of encryption parameters as input to perform the encryption of the confidential value and the cryptographic operation. The plurality of encryption parameters are specified using one or more registers of the instruction. The plurality of encryption parameters include a key to be used to encrypt the confidential value, a data key to be used in the cryptographic operation, the address of the message, the confidential value, and a power-order block value to be used to generate the mask value. The key to be used to encrypt the confidential value, the data key to be used in the cryptographic operation, the confidential value, and the power-order block value are included in a parameter block. The parameter block is the input to the cryptographic instruction. The register of the instruction includes at least a portion of the address of the parameter block. By providing a single instruction to perform encryption of the confidential value and perform cryptographic operations, system performance is improved and processing speed is increased. Furthermore, latency is reduced. As part of the cryptographic instruction, providing encryption parameters including a key to be used to encrypt the confidential value, a data key to be used in the cryptographic operation, the address of the message, the confidential value, and the power-order block value improves performance by avoiding memory access, reducing latency, and providing instruction pipelined functionality. Using a single instruction and multiple encryption parameters achieves lower software processing overhead and improved performance. An additional security is provided by using a key to encrypt the confidential value. The parameter block input to the cryptographic instruction provides the key to encrypt the confidential value, the data key for cryptographic operations, the confidential value, and the exponentiation block ordering value, thereby improving performance by avoiding memory access, reducing latency, and providing instruction pipelined functionality.

[0049] Depending on one or more embodiments, each of the embodiments may be separate from each other and may be selected as appropriate. In addition, embodiments may be combined with each other.

[0050] This document describes and claims computer implementation methods, computer systems, and computer program products associated with one or more embodiments. Each embodiment of the computer program product may be an embodiment of a computer system and / or a computer implementation method, and vice versa. Furthermore, each embodiment may be separate from and selected as appropriate. Additionally, embodiments may be combined with each other. Each embodiment of the computer program product may be combined with embodiments and / or examples of computer systems and / or computer implementation methods, and vice versa.

[0051] One or more embodiments of the present invention are incorporated into a computing environment, executed by the computing environment, and / or used by the computing environment. As examples, the computing environment may have various architectures and types, including but not limited to: personal computing; client-server; distributed; virtual; simulation; partitioned; unpartitioned; cloud-based; quantum; grid; time-sharing; clustered; peer-to-peer; wearable; mobile; having one or more nodes; having one or more processors; and / or any other type of environment and / or configuration, capable of executing one or more programs that perform encryption processing, including, for example (e.g., encryption with encrypted secret values ​​and / or masking values) accelerated encryption processing, interruptible encryption processing and / or protection processing, and / or one or more other embodiments of the present invention. The embodiments of the present invention are not limited to a specific architecture or environment.

[0052] Various forms of the present invention are described by descriptive text, flowcharts, block diagrams of computer systems, and / or block diagrams of machine logic included in embodiments of a computer program product (CPP). Depending on the technology involved, operations may be performed in a different order than shown in a given flowchart, relative to any flowchart. For example, also depending on the technology involved, two operations shown in consecutive flowchart blocks may be performed in reverse order, as a single integrated step, in parallel, or in a manner that at least partially overlaps in time.

[0053] Computer Program Product Embodiment (“CPP Embodiment” or “CPP”) is a term used in this invention to describe any group of storage media (also referred to as “media”) commonly included in a group of storage devices, which collectively include machine-readable program code corresponding to instructions and / or data for performing computer operations specified in a given CPP. “Storage device” is any tangible means capable of retaining and storing instructions for use by a computer processor. Without limitation, computer-readable storage media may be electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, mechanical storage media, or any suitable combination of the foregoing. Known types of storage devices that include such media include: magnetic disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), optical disc read-only memory (CD-ROM), digital universal disk (DVD), memory flash drives, floppy disks, mechanical encoding devices (such as punch cards or dimples / pads formed in the main surface of an optical disc), or any suitable combination of the foregoing. As used in this disclosure, computer-readable storage media should not be construed as storing transient signals in themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides, light pulses passing through fiber optic cables, electrical signals transmitted through wires, and / or other transmission media. Those familiar with this technology will understand that data typically moves at random points in time during the normal operation of the storage device (such as during access, defrauding, or garbage collection), but this does not make the storage device temporary, because the data is not temporary when it is stored.

[0054] Referring to Figure 1, an example of a computing environment for executing and / or using one or more forms of the present invention is described. In one example, computing environment 100 includes an example of an environment for executing at least some of the computer program code involved in executing the methods of the present invention, such as encryption processing code 150 (also referred to herein as block 150). In addition to block 150, computing environment 100 also includes, for example, a computer 101, a wide area network (WAN) 102, an end-user device (EUD) 103, a remote server 104, a public cloud 105, and a private cloud 106. In this embodiment, computer 101 includes processor group 110 (including processing circuitry 120 and cache memory 121), communication mesh architecture 111, volatile memory 112, persistent storage 113 (including operating system 122 and block 150, as identified above), peripheral device group 114 (including user interface (UI) device group 123, storage 124 and Internet of Things (IoT) sensor group 125), and network module 115. Remote server 104 includes remote database 130. Public cloud 105 includes gateway 140, cloud orchestration module 141, host physical machine group 142, virtual machine group 143, and container group 144.

[0055] Computer 101 may take the form of a desktop computer, laptop computer, tablet computer, smartphone, smartwatch or other portable computer, mainframe computer, quantum computer, or any other form of computer or mobile device known now or to be developed in the future capable of running programs, accessing networks, or querying databases (such as remote database 130). As is fully understood in the field of computer technology, and depending on the technology, the performance of a computer implementation method may be distributed across multiple computers and / or multiple locations. On the other hand, in this presentation of computing environment 100, the detailed discussion focuses on a single computer, specifically computer 101, to keep the presentation as simple as possible. Computer 101 may reside in the cloud, even if it is not shown in the cloud in Figure 1. On the other hand, computer 101 does not need to be in the cloud except to any extent that can be definitively indicated.

[0056] Processor group 110 includes one or more computer processors of any type known or to be developed in the future. Processing circuitry 120 may be distributed over multiple packages, such as multiple coordinated integrated circuit chips. Processing circuitry 120 may implement multiple processor threads and / or multiple processor cores. Cache memory 121 is memory located within one or more processor chip packages and is typically used for data or code that should be readily accessible by threads or cores running on processor group 110. Cache memory is typically organized into multiple tiers depending on its relative proximity to the processing circuitry. Alternatively, some or all of the cache memory used in the processor group may be located "off-chip". In some computing environments, processor group 110 may be designed to use qubits and perform quantum operations.

[0057] Computer-readable program instructions are typically loaded onto computer 101 to cause the processor assembly 110 of computer 101 to perform a series of operational steps and thereby implement a computer-implemented method, such that the instructions executed thereby embody the methods specified in the flowcharts and / or descriptions of the computer-implemented method included in this document (collectively, the "method of the invention"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as cache memory 121 and other storage media discussed below. The program instructions and associated data are accessed by processor assembly 110 to control and direct the execution of the method of the invention. In computing environment 100, at least some of the instructions for executing the method of the invention may be stored in block 150 of persistent storage 113.

[0058] The communication mesh architecture 111 is a signal transmission path that allows various components of computer 101 to communicate with each other. Typically, this mesh architecture is made up of switches and conductive paths, such as switches and conductive paths that constitute buses, bridges, physical input / output ports, and the like. Other types of signal communication paths, such as fiber optic communication paths and / or wireless communication paths, can be used.

[0059] Volatile memory 112 can be any type of volatile memory known now or to be developed in the future. Examples include dynamic random access memory (RAM) or static RAM. Typically, volatile memory 112 is characterized by random access, but this is not necessary unless explicitly indicated. In computer 101, volatile memory 112 is located in a single package and inside computer 101, but alternatively or additionally, volatile memory may be distributed across multiple packages and / or located externally relative to computer 101.

[0060] Persistent storage 113 is any form of non-volatile storage in a known or future computer. Non-volatile means that the stored data is maintained regardless of whether power is supplied to the computer 101 and / or directly to the persistent storage 113. Persistent storage 113 may be read-only memory (ROM), but typically at least a portion of persistent storage allows data to be written, deleted, and rewritten. Some common forms of persistent storage include magnetic disks and solid-state storage devices. Operating system 122 may take several forms, such as various known proprietary operating systems or open-source portable operating system interfaces employing a kernel. The code included in block 150 typically includes at least some of the computer code involved in performing the methods of the present invention.

[0061] Peripheral device group 114 includes a group of peripheral devices for computer 101. Data communication connections between peripheral devices and other components of computer 101 can be implemented in various ways, such as Bluetooth connectivity, Near Field Communication (NFC) connectivity, cable-based connections (e.g., Universal Serial Bus (USB) cables), plug-in connections (e.g., Secure SD cards), connections via local area networks, and even connections via wide area networks such as the Internet. In various embodiments, UI device group 123 may include components such as a display screen, speakers, microphones, wearable devices (e.g., goggles and smartwatches), keyboard, mouse, printer, touchpad, game controller, and haptic devices. Storage 124 is external storage such as an external hard drive or insertable storage such as an SD card. Storage 124 may be persistent and / or volatile. In some embodiments, storage 124 may take the form of a quantum computing storage device for storing data in qubit form. In embodiments requiring computer 101 to have a large amount of storage (e.g., computer 101 locally stores and manages a large database), this storage can be provided by peripheral storage devices designed for storing extremely large amounts of data, such as a Storage Area Network (SAN) shared by multiple geographically distributed computers. The IoT sensor group 125 consists of sensors that can be used in Internet of Things (IoT) applications. For example, one sensor could be a thermometer, and another sensor could be a motion detector.

[0062] Network module 115 is a collection of computer software, hardware, and firmware that allows computer 101 to communicate with other computers via WAN 102. Network module 115 may include: hardware, such as a modem or Wi-Fi transceiver; software for packetizing and / or depacketizing data for transmission over a communication network; and / or web browser software for transmitting data over the Internet. In some embodiments, network control and forwarding functions of network module 115 are performed on the same physical hardware device. In other embodiments (e.g., embodiments utilizing Software Defined Networking (SDN)), the control and forwarding functions of network module 115 are executed on physically separate devices, such that the control functions manage several different network hardware devices. Computer-readable program instructions for performing the methods of the present invention can generally be downloaded to computer 101 from an external computer or external storage device via a network adapter card or network interface included in network module 115.

[0063] WAN 102 is any wide area network (e.g., the Internet) capable of transmitting computer data over non-local distances using any known or future technology for transmitting computer data. In some embodiments, WAN 102 may be replaced and / or supplemented by a local area network (LAN) designed to transmit data between devices located in a local area such as a Wi-Fi network. WANs and / or LANs typically include computer hardware such as copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and edge servers.

[0064] End-user device (EUD) 103 is any computer system used and controlled by an end-user (e.g., a customer of an enterprise operating computer 101), and may take any of the forms described above in connection with computer 101. EUD 103 typically receives helpful and useful information from the operation of computer 101. For example, assuming computer 101 is designed to provide recommendations to the end-user, these recommendations will typically be communicated to EUD 103 via WAN 102 from network module 115 of computer 101. In this way, EUD 103 may display or otherwise present recommendations to the end-user. In some embodiments, EUD 103 may be a client device, such as a thin client, a heavy client, a mainframe, a desktop computer, etc.

[0065] Remote server 104 is any computer system that provides at least some data and / or functionality to computer 101. Remote server 104 can be controlled and used by the same entity operating computer 101. Remote server 104 refers to a machine that collects and stores helpful and useful data for use by other computers such as computer 101. For example, in a hypothetical scenario where computer 101 is designed and programmed to provide recommendations based on historical data, this historical data can be provided to computer 101 from a remote database 130 of remote server 104.

[0066] The public cloud 105 is any computer system available to multiple entities, providing on-demand availability of computer system resources and / or other computer capabilities, particularly data storage (cloud storage) and computing power, without requiring direct active management by the user. Cloud computing typically utilizes resource sharing to achieve coherence and economies of scale. Direct and active management of the computing resources of the public cloud 105 is performed by the computer hardware and / or software of the cloud provisioning module 141. The computing resources provided by the public cloud 105 are typically implemented by virtual computing environments running on various computers constituting the host entity machine group 142, which is the total range of physical computers in and / or available to the public cloud 105. Virtual computing environments (VCEs) typically take the form of virtual machines from virtual machine group 143 and / or containers from container group 144. It should be understood that such VCEs can be stored as images and can be transmitted as images or, after being materialized, between various physical machine hosts. The cloud orchestration module 141 manages the transmission and storage of images, and embodies the new manifestation of VCE deployment and management of VCE deployment. The gateway 140 is a collection of computer software, hardware and firmware that allows the public cloud 105 to communicate through WAN 102.

[0067] Here is a further explanation of Virtualized Computing Environments (VCEs). A VCE can be stored as an "image." New examples of VCEs can be materialized from images. Two common types of VCEs are virtual machines and containers. Containers are VCEs that use operating system-level virtualization. This refers to an operating system feature where the kernel allows multiple isolated user-space instances called containers. From the perspective of the programs running within them, these isolated user-space instances typically behave like a real computer. A computer program running on a normal operating system can utilize all the resources of that computer, such as connected devices, files and folders, network sharing, CPU power, and quantifiable hardware capabilities. However, a program running inside a container can only use the contents of the container and the devices assigned to the container; this feature is called containerization.

[0068] Private cloud 106 is similar to public cloud 105, except that its computing resources are available only to a single enterprise. While private cloud 106 is depicted as communicating with WAN 102, in other embodiments, private cloud may be completely disconnected from the internet and accessed only through a local area network (LAN). A hybrid cloud is composed of multiple clouds of different types (e.g., private, community, or public cloud types), typically implemented by different vendors. Each of the multiple clouds remains a separate and discrete entity, but the larger hybrid cloud architecture is bound together by standardized or proprietary technologies that enable orchestration, management, and / or data / application portability across the constituent clouds. In this embodiment, both public cloud 105 and private cloud 106 are parts of a larger hybrid cloud.

[0069] Cloud computing services and / or microservices (not shown separately in Figure 1): Private cloud 106 and public cloud 105 are programmed and configured to deliver cloud computing services and / or microservices (unless otherwise indicated, the term "microservice" should be interpreted as including the larger "service," regardless of size). Cloud services are infrastructure, platforms, or software typically hosted by a third-party provider and available to users via the Internet. Cloud services facilitate the flow of user data from front-end user terminals (e.g., user-side servers, tablets, desktops, laptops) to and from the provider's systems via the Internet. In some embodiments, cloud services may be configured and configured according to a "as-a-service" technology paradigm, wherein some content is presented to internal or external customers in the form of cloud computing services. As-a-service products typically provide various endpoints for customer interaction. These endpoints are typically based on a set of APIs. One category of service products is Platform as a Service (PaaS), in which service providers supply, realize, run, and manage modular code packages that customers can use to realize computing platforms and one or more applications, without the complexity of building and maintaining the infrastructure typically associated with such content. Another category is Software as a Service (SaaS), in which software is centrally hosted and distributed on a subscription basis. SaaS is also known as on-demand software, web-based software, or web-hosted software. The four technical sub-fields involved in cloud services are: deployment, integration, on-demand, and virtual private networks (VPNs).

[0070] The computing environment described above is merely one example of a computing environment that has, executes, and / or uses one or more aspects of the present invention. Other examples are possible. For instance, in one or more embodiments, one or more of the components / modules / blocks of FIG1 are not included in the computing environment and / or are not used in one or more aspects of the present invention. Furthermore, in one or more embodiments, additional and / or other components / modules / blocks may be used. Other variations are possible.

[0071] In one instance (e.g., in processor group 110), the processor includes a plurality of functional components (or subsets thereof) for executing instructions. As depicted in FIG2, in one instance, processor 200 includes, for example: an instruction fetching component 201 for fetching instructions to be executed; an instruction decode / operand fetching component 202 for decoding the fetched instructions and obtaining the operands of the decoded instructions; one or more instruction execution components 204 for executing the decoded instructions; a memory access component 206 for accessing memory as needed for instruction execution; and a write-back component 208 for providing the results of the executed instructions. One or more of these components may access and / or use one or more registers 210 during instruction processing. In addition, one or more of the components may access and / or use encryption processing code 150. Additional, fewer, and / or other components may be used in one or more embodiments of the present invention.

[0072] In one embodiment, according to one or more embodiments of the invention, encryption processing code (e.g., encryption processing code 150) is used to perform encryption processing, which includes, for example, accelerated encryption processing, interruptible encryption processing, and / or protection processing for one or more parameters in the encryption processing. According to one or more embodiments of the invention, the encryption processing code (e.g., encryption processing code 150) includes program code or instructions for performing accelerated encryption processing, interruptible encryption processing, protection processing, and / or other tasks. In one embodiment, the encryption processing code (e.g., encryption processing code 150) includes various program code to be used to perform encryption processing, which includes accelerated encryption processing, interruptible encryption processing, and / or protection processing. The program code is, for example, computer-readable program code (e.g., instructions) in a computer-readable medium, such as a storage device (e.g., persistent storage 113, cache memory 121, storage device 124, other storage devices). Such computer-readable storage media may be part of one or more computer program products, and the computer-readable code may be executed by and / or used by: one or more computing devices (e.g., one or more computers, such as computer 101 and / or other computers; one or more servers, such as remote server 104 and / or other remote servers; one or more devices, such as end-user device 103 and / or other end-user devices; one or more processors or nodes, such as processors or nodes in processor group 110 (e.g., processor 200) and / or other processors or nodes; processing circuitry, such as processing circuitry system 120 of processor group 110 and / or other processing circuitry systems; one or more hardware accelerators, which are separate from and / or part of one or more processors and / or processing circuitry systems; and / or other computing devices, etc.). Additional and / or other computers, servers, devices, processors, nodes, processing circuitry systems, accelerators, and / or computing devices may be used to execute the code and / or parts thereof. Many instances are possible.

[0073] Referring to Figure 3A, one example of encryption processing code 150 is described. In one example, encryption processing code 150 includes: an acquisition instruction code 300 for acquiring (e.g., receiving, providing, pulling, capturing, extracting, etc.) an instruction, such as a cryptographic instruction (e.g., a cryptographic message instruction); another instruction for performing encryption processing including accelerated encryption processing, interruptible encryption processing, and / or protection processing; and an execution instruction code 330 for executing the instruction.

[0074] Further details of the execution instruction code 330 are described with reference to Figure 3B. In one example, the execution instruction code 330 includes: obtaining operand code 332 for obtaining one or more operands and / or information of the obtained instruction; and executing encryption processing code 336 for performing encryption processing of the instruction, the encryption processing including, for example, one or more cryptographic operations of the instruction (e.g., encryption, decryption) and / or other operations associated therewith.

[0075] According to one or more of the present inventions, at least a portion of codes (e.g., codes 300 to 330, 332 to 336) are used to perform encryption processing including accelerated encryption processing, interruptible encryption processing, and / or protection processing. In one example, referring to FIG4A, the encryption program 400 (also referred to herein as program 400) for performing encryption processing is executed by: one or more computing devices (e.g., one or more computers, such as computer 101 and / or other computers; one or more servers, such as remote server 104 and / or other remote servers; one or more devices, such as end-user device 103 and / or other end-user devices; one or more processors or nodes, such as processors or nodes in processor group 110 (e.g., processor 200) and / or other processors or nodes; processing circuitry, such as processing circuitry system 120 of processor group 110 and / or other processing circuitry systems; one or more hardware accelerators, which are separate from and / or part of one or more processors and / or processing circuitry systems; and / or other computing devices, etc.). Additional and / or other computers, servers, devices, processors, nodes, processing circuitry systems, accelerators and / or computing devices may be used to perform processing and / or their manner. Many examples are possible.

[0076] Referring to Figure 4A, in one example, program 400 detects 402 that a selected encryption function (e.g., a full XTS encryption function) will be executed. In one example, the detection includes obtaining (e.g., using obtain instruction code 300) an instruction, such as a cipher instruction (e.g., a cipher message instruction) or another instruction, and executing 410 the instruction (e.g., using execute instruction code 330) to determine the operation / function to be performed. In another example, detection is performed by decoding one or more of the operands of the obtained instruction before executing the instruction. Other examples are possible.

[0077] In one instance, based on the detection of a selected encryption function, program 400 obtains the operands and / or information of instruction 412 (e.g., using obtained operand code 332). For example, program 400 obtains the operation code, function code, and modifier control of the instruction to determine the operation / function to be performed, such as a full XTS encryption function. For example, the operation code is read from the operation code field of the instruction, and the function code and modifier control are obtained, for example, from the registers used by the instruction. Furthermore, in one instance, program 400 reads the source value (e.g., the message to be encrypted or decrypted) and source length, for example, from one or more registers specified by the instruction; and obtains (e.g., reads) one or more encryption keys (e.g., key 1 (K1), key 2 (K2)) and a secret value (e.g., a fine-tuning value), for example, through the parameter block input to the instruction. Other instances are possible. Additional, fewer and / or other operands / information can be obtained using this instruction and / or such operands / information can be obtained from additional, fewer and / or other locations.

[0078] Based on the obtained computational elements / information, program 400 performs an encryption operation on confidential data (e.g., a fine-tuning value). For example, an Advanced Encryption Standard - Electronic Codebook (AES-ECB) encryption operation is performed to encrypt the confidential data (e.g., the fine-tuning value) using key 2.

[0079] In one instance, based on the acquired computational elements / information, the hardware is initialized to be able to execute the operation of the instruction. For example, initially, within the hardware, a micro-operation of the instruction is selected to perform an operation, such as the plaintext encryption of a confidential value (e.g., a fine-tuning value). For the micro-operation, the length of the source value (e.g., the confidential value, such as the fine-tuning value) is set to a selected value (e.g., 16 bytes); and the value of the protected key (e.g., the key used to encrypt the confidential data (e.g., the fine-tuning value) (Key 2)) and the confidential value (e.g., the fine-tuning value) are read. The hardware encrypts the confidential value, thereby providing an encrypted confidential value (e.g., an encrypted fine-tuning value).

[0080] Program 400 obtains a 416-bit encrypted secret value (e.g., an encrypted fine-tuned value) and parameters to be used for encryption processing (e.g., encryption or decryption), such as a power block ordering value (e.g., the next alpha power). For example, program 400 reads the next alpha power value from the parameter block input to the instruction. Furthermore, program 400 generates a 418-bit mask value (e.g., TAU) by performing a product operation, for example, on a dedicated multiplier for Gaussian field (GF) (2) arithmetic. For example, the encrypted fine-tuned value is multiplied by the next alpha power obtained from the parameter block to produce the mask value referred to herein as TAU. In one instance, the multiplication operation is performed on a Gaussian field (GF) 2128.

[0081] Program 400 uses, for example, a mask value, key 1, and plaintext to perform a cipher operation, such as encryption (also known as ciphering), on one or more of the message blocks to produce ciphertext data (e.g., one or more ciphertext blocks). Encoding continues until all message blocks are ciphertexted or the instruction is interrupted.

[0082] In another instance, the cryptographic operation includes a decryption operation (also known as a decipher operation), which uses, for example, a mask value, key 1, and ciphertext to perform operations on one or more of the message blocks to produce decrypted data (e.g., one or more plaintext blocks). The decryption continues until all message blocks have been decrypted or the instruction is interrupted.

[0083] In one instance, based on the generated mask, the hardware receives a mask value, such as an AES-XTS mask or TAU, and selects a micro-operation of the instruction to perform a selected cryptographic operation (e.g., encryption or decryption) using the mask value. Based on the selected micro-operation, the source length of the message to be encrypted / decrypted is read from one or more registers (e.g., accelerator registers) input to the instruction. Additionally, in one instance, key 1 is read, which is obtained from the parameter block input to the instruction. In one instance, the message comprises multiple message blocks (e.g., multiple plaintext blocks or ciphertext blocks). The micro-operation is executed.

[0084] In one instance, before the instruction ends due to the complete completion of the encryption process (e.g., the instruction ends with condition code zero) or the partial completion of the encryption process (e.g., the instruction ends with condition code three), program 400 updates 422 the selected state of the instruction, such as the power block ordering value (e.g., the next alpha power).

[0085] Program 400 determines whether the encryption process (430) was interrupted. For example, program 400 determines whether the execution of the instruction was completed with a selected condition code (e.g., condition code 3). If, for example, the execution of the instruction was interrupted before the encryption / decryption of the source message was completed, program 400 saves (432) a selected state (e.g., the power block sequence value (e.g., the next alpha power)) for re-execution of the instruction to continue the encryption / decryption operation from the point where the instruction was interrupted. In one instance, the selected state is saved in the parameter block (or other selected location). However, if program 400 does not detect that the cryptographic instruction has been interrupted, the instruction is complete for the entire source length and sets a condition code, for example, zero. Other instances are possible.

[0086] Furthermore, in one instance, program 400 stores the final state (e.g., the final value of the power block ordering value (e.g., the next alpha power)) 434 in, for example, the parameter block or other location. Furthermore, in one instance, program 400 provides 436 the result of the cryptographic operation (e.g., plaintext, ciphertext, etc.). For example, it provides the operands (e.g., the first operand) that include the result. Other instances are possible.

[0087] In one instance, the selected state can be saved before it is determined that the instruction execution was interrupted. For example, the selected state can be saved during an update. Other instances are possible.

[0088] In one or more formats, as described herein, an initial mask value (e.g., TAU) is generated for a first input message block (e.g., a first plaintext block for encryption or a first ciphertext block for decryption), and the mask value is updated for subsequent input message blocks. In one instance, an input fine-tuning value (which is encrypted in one instance) is used to generate the initial mask value. The generated mask values ​​for each input message block are used as input for encrypting or decrypting each input message block. The purpose of the encrypted fine-tuning value is to prevent multiple data blocks with the same content on the storage device from generating the same ciphertext.

[0089] In one instance, according to one or more embodiments of the invention, since the instruction executing the cryptographic technique and / or its function can be interrupted (e.g., the technical processing can terminate before the machine completes (partially completes) the entire cryptographic operation), and the program can be redistributed so that the machine can resume processing from the point where it stopped processing the cryptographic technique, the mask value will be saved and provided as input to the machine. This will allow the machine to resume processing from the point where it previously stopped processing the cryptographic technique. However, storing the mask value, such as in a parameter block input to the instruction, could lead to unauthorized access to the mask value, which could potentially provide unauthorized access to confidential values ​​(e.g., fine-tuning values) based on knowledge of the mask value and other cryptographic parameters. If unauthorized access to confidential values ​​occurs, the protection provided by the unique confidential value in the cryptographic technique is lost, and an unauthorized user can use the function used to compute the same input message block. Therefore, protecting encrypted confidential values ​​is beneficial. Therefore, according to one or more embodiments of the present invention, a fast and efficient capability is provided that protects encrypted confidential values ​​and masked values ​​from exposure in parameter blocks (or other locations) and thereby prevents unauthorized users from observing encrypted confidential values ​​when repeatedly processing the entire cryptographic technique using the same instructions and functions.

[0090] Referring to Figure 4B, further details relating to one or more forms of encryption processing are described, including protection processing for, for example, encrypted confidential values ​​(e.g., encrypted fine-tuned values) and / or masking values. In one example, protection procedure 450 (also referred to herein as procedure 450) for performing protection processing is executed by: one or more computing devices (e.g., one or more computers, such as computer 101 and / or other computers; one or more servers, such as remote server 104 and / or other remote servers; one or more devices, such as end-user device 103 and / or other end-user devices; one or more processors or nodes, such as processors or nodes in processor group 110 (e.g., processor 200) and / or other processors or nodes; processing circuitry, such as processing circuitry system 120 of processor group 110 and / or other processing circuitry systems; one or more hardware accelerators, which are separate from and / or part of one or more processors and / or processing circuitry systems; and / or other computing devices, etc.). Additional and / or other computers, servers, devices, processors, nodes, processing circuitry systems, accelerators, and / or computing devices may be used to perform processing and / or its manner. Numerous examples are possible.

[0091] In one instance, program 400 and program 450 are a single program; in other instances, they are separate programs. In one instance, the processing of Figure 4B is part of executing the instruction and / or related to it.

[0092] Referring to Figure 4B, in one example, program 450 obtains 452 (as part of executing the instruction) offset input parameters (e.g., key 1 (K1), key 2 (K2), secret value (e.g., fine-tuning value), and power block ordering value (e.g., NAP)) from, for example, the parameter block of an instruction (e.g., a cryptographic instruction or other instruction) to be executed by a computing device (e.g., a central processing unit). In one example, the program provides one or more of the parameters of the parameter block. As an example, the program determines the power block ordering value (e.g., the next alpha power (NAP)) for the first message block of the input message of the instruction (e.g., a cryptographic instruction or other instruction) and provides it for input in the parameter block.

[0093] In one instance, program 450 encrypts a confidential value (e.g., the fine-tuning value) using a protected key (e.g., a fine-tuning key, e.g., K2) and AES encryption 456 (as part of executing the instruction) to obtain an encrypted confidential value (e.g., an encrypted fine-tuning value). In one instance, as part of executing the instruction, program 450 multiplies the encrypted fine-tuning value (e.g., the encrypted confidential value) by a 458-powered block ordering value (e.g., NAP) to generate an initial masking value (e.g., TAU) for internal hardware use (i.e., not outside the hardware or central processing unit).

[0094] In one instance, as part of executing the instruction, based on performing cryptographic operations (e.g., encryption, decryption) on a message block of the message specified by the instruction, program 450 updates the 460 exponentiation block order value (e.g., NAP). For example, the processor multiplies the current exponentiation block order value (e.g., NAP) by the value 2 in the Gaussian field (2128) to obtain the updated exponentiation block order value for the next message block. This operation is repeated for each message block for which encryption processing (e.g., cryptographic operations) is performed during the execution of the instruction.

[0095] Before terminating function / instruction processing with a condition code indicating completion of encryption processing for the message (e.g., CC=0) or a condition code indicating incomplete encryption processing for the message (e.g., CC=3), program 450 stores an updated exponential block ordering value 462 in a parameter block for use in the next message block. Program 450 determines 470 whether the condition code generated by executing the instruction indicates partial completion (i.e., the instruction was interrupted before completing the encryption processing of the message). If the instruction ends with completion (e.g., CC=0), processing is complete. Otherwise, if program 450 determines that the instruction was interrupted (e.g., CC=3), processing continues, and program 450 obtains one or more input parameters from, for example, the parameter block input to the instruction (e.g., based on the re-execution of the instruction) to re-execute the instruction from the point where it was interrupted. The updated input parameters include at least an updated exponential block ordering value.

[0096] In one or more states, the program determines the power block ordering value for the first password input message block and provides it in the parameter block input to the instruction. When the instruction is executed and encrypted on the disk starting from the first input message block, the ordering value J is, for example, zero, which in one instance is equal to, for example, the power block ordering value of one. When J is, for example, zero, the program does not perform any calculations, thus achieving optimal performance. The program also provides offset input parameters (e.g., fine-tuning values) in the parameter block. In one instance, these input parameters also include Key 1 (data key) and Key 2 (fine-tuning key). Other instances are possible.

[0097] In another instance, instead of Key 1 and Key 2, the input parameters include an encrypted dual key provided as a single encrypted key. If a single encrypted dual key is provided, the processor decrypts the encrypted dual key to obtain a fine-tuning key (e.g., Key 2). The processor encrypts the fine-tuning value using the fine-tuning key and cryptographic techniques, obtaining an encrypted fine-tuning value. The processor then multiplies the encrypted fine-tuning value by a power block ordering value (e.g., NAP) to generate an initial masking value (e.g., TAU). The calculated initial masking value is not stored anywhere outside of the hardware's secure storage to protect the encrypted fine-tuning value (e.g., from software, unauthorized users, etc.).

[0098] In one instance, after each input message block is encrypted, the processor multiplies the current power block ordering value by, for example, the value 2 in Gaussian field (2128) to obtain the power block ordering value for the next block. This step is repeated until the last input message block is encrypted (ending the instruction's processing with, for example, a condition code of zero), or the machine prematurely terminates the instruction and its processing with partial completion (ending the instruction's processing with, for example, a condition code of three). If the machine prematurely terminates the instruction and its processing with partial completion, the machine determines (e.g., calculates) the power block ordering value for the next input message block and stores it as the power block ordering value in the parameter block. In this case, the program provides the machine with the ability to continue processing the cryptographic algorithm from the previous point of partial completion. In one instance, the calculated next mask value is not stored anywhere outside the hardware's secure storage to protect the encrypted fine-tuning value from software influence. In this example, only the next power block ordering value is stored in the parameter block. This does not reduce the protection of the encrypted fine-tuning value because the next power block ordering value does not include the encrypted fine-tuning value. Therefore, storing the next power block ordering value in the parameter block provides a saved state for restoring the execution of instructions in the technical processing, while protecting the encrypted fine-tuning value.

[0099] As indicated above, cryptographic processing, including accelerated processing, interruptible processing, and / or protective processing, uses cryptographic instructions. A specific example of a cryptographic instruction is a cryptographic message instruction. In one instance, a cryptographic instruction such as a cryptographic message instruction is a single, structured hardware machine instruction at the hardware / software interface. As an example, it is part of an instruction set architecture. An example of an instruction set architecture used and / or employing cryptographic instructions such as cryptographic message instructions and / or the present invention is the z / Architecture® instruction set architecture provided by International Business Machines Corporation, Armonk, New York. An embodiment of the z / Architecture instruction set architecture is described in the disclosure entitled "z / Architecture Principles of Operation" (IBM Publication No. SA22-7832-13, 14th edition, May 2022), which is hereby incorporated herein by reference in its entirety. However, the z / Architecture instruction set architecture is only one example architecture; other architectures and / or other types of computing environments of IBM and / or other entities / companies may include and / or use one or more versions of this invention. z / Architecture and IBM are trademarks or registered trademarks of IBM in at least one jurisdiction.

[0100] Referring to Figure 5A, in one example, the cryptographic message instruction 500 has a format called a register-register plus extended opcode format, which has, for example, 32 bits, and the cryptographic message instruction includes, for example: an opcode field 502 (e.g., bits 0-15); a register field (R1) 504 (e.g., bits 24-27); and another register field (R2) 506 (e.g., bits 28-31). Although there is one opcode field 502 in this example, there may be more than one opcode field in other examples. For example, there may be an opcode field at the beginning of the instruction format and an opcode field at the end of the instruction format. Other examples are also possible.

[0101] In one example, referring to Figures 5A and 5B, register field (R1) 504 specifies register 510 (R1), which includes the address 512 of the first operand of the instruction. Furthermore, in one example, referring to Figures 5A and 5C, register field (R2) 506 specifies register 520 (R2), which includes the address 522 of the second operand of the instruction. Referring to Figure 5D, another register 530 (R2+1) includes the length 532 of the second operand.

[0102] In one instance, field R1 specifies a general-purpose register, and will specify a register with an even number other than, for example, general-purpose register 0; otherwise, in one instance, a canonical anomaly will be identified. In one instance, field R2 specifies an even-odd pair general-purpose register, and will specify a register with an even number other than, for example, general-purpose register 0. In other instances, registers of other types than general-purpose registers may be used. Furthermore, registers other than even-numbered registers may be used. Many instances are possible.

[0103] In one instance, the positions of the leftmost bytes of the first and second operands are specified by the contents of general-purpose registers R1 and R2, respectively. The number of bytes in the second operand position is specified, for example, in general-purpose register R2+1. In one instance, the first and second operands have the same length.

[0104] As part of the operation, the addresses in general-purpose registers R1 and R2 are incremented by the number of processed bytes, and the length of general-purpose register R2+1 is decreased by the same number. The formation and updating of addresses and lengths depend on, for example, the addressing mode.

[0105] In, for example, a 24-bit addressing mode, the contents of bits 40-63 in general-purpose registers R1 and R2 constitute the addresses of the first operand and the second operand, respectively, and the contents of bits 0-39 are ignored; the updated address bits 40-63 replace the corresponding bits in general-purpose registers R1 and R2, the carry of the updated address bit 40 is ignored, and the contents of bits 32-39 in general-purpose registers R1 and R2 are set to, for example, zero. In 31-bit addressing mode, the contents of bits 33-63 in general-purpose registers R1 and R2 constitute the addresses of the first and second operands, respectively, and the contents of bits 0-32 are ignored. Bits 33-63 of the updated address replace the corresponding bits in general-purpose registers R1 and R2. For example, carry from bit 33 of the updated address is ignored, and the contents of bit 32 of general-purpose registers R1 and R2 are set to zero. In 64-bit addressing mode, the contents of bits 0-63 in general-purpose registers R1 and R2 constitute the addresses of the first and second operands, respectively. Bits 0-63 of the updated address replace the contents of general-purpose registers R1 and R2, and for example, carry from bit 0 is ignored. Other examples are possible.

[0106] In both 24-bit and 31-bit addressing modes, the contents of bits 32-63 in the general-purpose register R2+1 form a 32-bit unsigned binary integer specifying the number of bytes in the first and second operands, and the contents of bits 0-31 are ignored; the updated bits 32-63 replace the corresponding bits in the general-purpose register R2+1. In 64-bit addressing mode, the contents of bits 0-63 in the general-purpose register R2+1 form a 64-bit unsigned binary integer specifying the number of bytes in the first and second operands; and the updated value replaces the contents of the general-purpose register R2+1.

[0107] In one instance, in either 24-bit or 31-bit addressing mode, the contents of bits 0-31 of general-purpose registers R1, R2, and R2+1 remain unchanged.

[0108] In the access register mode, access registers 1, R1, and R2 specify address spaces containing parameter blocks, first operands, and second operands, respectively.

[0109] Furthermore, in one instance, the password message instruction uses several implicit general-purpose registers, such as general-purpose register 0 (GR0) and general-purpose register 1 (GR1). These registers are called implicit registers because they are not explicitly referenced by one or more fields of the instruction; however, they are used by the instruction. Examples of registers are described below.

[0110] In one instance, referring to Figure 5E, general-purpose temporary register 0 (540) includes, for example:

[0111] Modifier 544 (e.g., bit 56): In one instance, when the function code (e.g., bits 57-63 of general-purpose register 0) is, for example, non-zero, the modifier field 544 (e.g., bit 56) includes modifier control (e.g., modifier bits) indicating whether encryption or decryption will be performed by the function. When the modifier field 544 is, for example, zero, the function performs encryption of the second operand (e.g., the value obtained using R2); when the modifier field 544 is, for example, one, the function performs decryption of the second operand; and

[0112] Function code 546 (e.g., bits 57-63): In one instance, function code field 546 includes a function code specifying the function to be performed by the ciphertext message instruction. The instruction is configured to specify and implement a plurality of functions and individual function codes. According to one or more embodiments of the invention, the instance function codes to be used include, for example, function code (e.g., function code 82) specifying, for example, the complete ciphertext message XTS AES 128 function, etc., for the ciphertext message instruction. Although instance functions and / or function codes may be specified, additional, fewer, and / or other functions / function codes may be specified and used. Numerous instances are possible.

[0113] In one instance, based on the function code (e.g., all function codes other than the query function code), as specified by the function code, the second operand is encrypted (e.g., encrypted or decrypted) using the encryption key in the parameter block, and the result is placed in the first operand position.

[0114] Furthermore, in one instance, depending on the selected function code, selected bits of general register 0, such as one or more bits 0-55, are ignored. This is only one example. In other instances, one or more bits, or no bits, will include a specific value, such as zero. Additionally, in other instances, values ​​other than zero may be used. Many instances are possible. For example, when specifying the password message instruction with full XTS AES 128 functionality, bits 0-31 of general register 0 are ignored and bits 32-55 of general register 0 are reserved and will contain a selected value, such as zero; otherwise, the program may not operate incompatiblely in the future. Other instances are possible for this instruction and for its various functions.

[0115] Figure 5F depicts an example of a general-purpose register 1. In one example, general-purpose register 1 (550) includes the address 552 of a parameter block in memory (e.g., a memory module, storage device, etc.). For example, address 552 is, for example, the logical address of the leftmost byte of the parameter block in memory. In one example, the location of the address in the general-purpose register depends on the addressing mode. For example, in a 24-bit addressing mode, the contents of bits 40-63 of general-purpose register 1 constitute the address, and the contents of bits 0-39 are ignored. In a 31-bit addressing mode, the contents of bits 33-63 of general-purpose register 1 constitute the address, and the contents of bits 0-32 are ignored. In a 64-bit addressing mode, the contents of bits 0-63 of general-purpose register 1 constitute the address. In access register mode, access register 1 specifies the address space containing the parameter block. Other instances are possible.

[0116] Referring to Figure 5G, an example of a parameter block used by the cryptographic message complete XTS AES 128 function is described. In one example, a parameter block used by the cryptographic message complete XTS AES 128 function, such as parameter block 560, includes, for example: encryption key 1 (K1) 562 (e.g., byte offset 0-15); encryption key 2 (K2) 564 (e.g., byte offset 16-31); fine-tuning value (i) 566 (e.g., byte offset 32-47; an example of a secret value); and next alpha power (NAP) 568 (e.g., byte offset 48-63; an example of a power block ordered value). In one example, the fine-tuning value and the next alpha power are in, for example, little-endian format. However, in one instance, for example, the 8 bits in each tuple of the parameter block are not in bit-reversed format; that is, the leftmost bit of the tuple is bit 0, and the rightmost bit is bit 7. Furthermore, in one instance, the 128-bit encryption key 1 (K1), also known as the data key, and the 128-bit encryption key 2 (K2), also known as the protected or fine-tuning key, are, for example, located at tuple offsets 0-31 in the parameter block. Additional, less, and / or other information, as well as other instances and variations, are possible.

[0117] In one instance, when executing instructions and specifying functions, as specified by the function code (and, for example, modifiers), the second operand is encrypted using the encryption key (e.g., key 1) in the parameter block, and the result is placed in the first operand position. This encryption uses the next alpha power (an instance of the power block ordering value) provided in the parameter block and is updated as part of the operation and instruction execution, as described herein.

[0118] In one instance, as shown in Figure 6A, when executing one or more functions of the cryptographic message instruction, the 128-bit fine-tuning value (i) 600 is encrypted using a 128-bit fine-tuning key (K2) 602 and an AES encryption algorithm (AES e) 604, and the result 606 (e.g., the encrypted fine-tuned value) is multiplied by 608 by the next alpha power (NAP) 610 (also called the power block ordering value) to produce an initial TAU 612 (e.g., the XTS parameter; also called the masking value). In one instance, the multiplication operation is performed on GF(2^128). This is an example of the processing performed in steps 414 to 418 of Figure 4A or steps 456 to 458 of Figure 4B.

[0119] In one instance, the encryption operation is performed when the modifier (M) bit in general register 0 is, for example, zero. In one instance, as depicted in Figure 6B, the 16-byte plaintext block (P1, P2...Pn) 620 (also referred to herein as the message block) in operand 2 is encrypted using the AES encryption algorithm (AES e) 622.

[0120] Except for the first message block, the TAU used for the current message block is the TAU from the previous block multiplied by the value 2 (646) in 644 GF (2128). To encrypt the first plaintext block, an initial TAU of 640 is used (e.g., an initial TAU of 612).

[0121] Except for the first message block, the next power of alpha (NAP) used for the current message block is the value 2 (636) from the next power of alpha (NAP) 632 of the previous message block multiplied by 634 GF (2128). For the first plaintext block, the initial next power of alpha (NAP) 630 from the parameter block is used (e.g., the next power of alpha 568 in Figure 5G).

[0122] In one example, as depicted in Figure 6B, the TAU used for each block is subjected to a mutually exclusive OR (⊕) operation 650 with the corresponding plaintext (P) block 620. The result of the mutually exclusive OR operation is then encrypted 622 using the AES encryption algorithm and a 128-bit data key (K1) 652. The result of the encryption operation is subjected to a mutually exclusive OR operation 654 with the TAU (e.g., 644 multiplied by 646, resulting in 640 and 642 respectively) to produce a ciphertext (C) block 658. The next alpha power (NAP) used for the current message block is multiplied by the value 2 in GF(2^128) to obtain the next alpha power (NAP) used for the next message block.

[0123] As an example, the ciphertext blocks (C1, C2...Cn) are stored in operand 1.

[0124] When the modifier bit in general register 0 is, for example, one, the decryption operation is performed. In one instance, as depicted in Figure 6C, the AES-decryption algorithm (AES d) 682 is used to decrypt the 16-bit ciphertext block (C1, C2...Cn) 680 (also referred to herein as the message block) in operand 2.

[0125] Except for the first message block, the TAU used for the current message block is the value 2 (676) from the TAU 672 of the previous block multiplied by 674 GF (2128). To decrypt the first message block of the ciphertext, the initial TAU 670 is used.

[0126] Except for the first message block, the next alpha power (NAP) used for the current message block is the value 2 (666) from the next alpha power (NAP) 662 of the previous block multiplied by 664 GF (2128). For the first message block of the ciphertext, the initial next alpha power (NAP) 660 from the parameter block is used.

[0127] In one instance, the TAU used for each block is ORed with the corresponding ciphertext block (680) (690). The result of the OR operation is then decrypted using the AES decryption algorithm and a 128-bit data key (K1) (692) (682). The result of the decryption operation is ORed with the TAU (674 multiplied by 676, resulting in 670 or 672 respectively) (694) to produce a plaintext block (698). The next power of alpha (NAP) used for this block is multiplied by the value 2 in GF (2^128) to obtain the next power of alpha (NAP) used for the next block.

[0128] As an example, plaintext blocks (P1, P2...Pn) are stored in operand 1.

[0129] After the last input text (message) block is encrypted and the selection condition code (e.g., condition code 0) is set, the processing of this function is completed. When the operation ends due to partial completion, the selection condition code (e.g., condition code 3) is set. In one instance, the result of what is called the final next-next-alpha (NAP) multiplication by outputting the next alpha is stored in the next-next-alpha (NAP) field of the parameter block.

[0130] Condition codes obtained from instances of password message commands include, for example: 0 normal completion; 1 verification mode mismatch; 2 -; 3 partial completion.

[0131] In one instance, the result is obtained as if processing had begun at the left end of both the first and second operands and proceeded block by block to the right. The cryptographic operation ends when the number of bytes in the second operand, as specified in the general register R2+1, has been processed and placed at the first operand's position, or when the number of blocks smaller than the length of the second operand, as determined by the central processing unit (CPU), has been processed. The number of blocks determined by the CPU depends on the model and can be different each time the instruction is executed. The number of blocks determined by the CPU is typically, for example, non-zero. In some exceptional cases, this number can be zero, and a selection condition code (e.g., condition code 3) can be set without any progress. However, the CPU prevents this lack of progress from recurring indefinitely.

[0132] The result in the first operand position and the next alpha field is unpredictable if any of the following occurs: the encryption key field or the encrypted encryption key field overlaps with any part of the first operand; the next alpha field overlaps with any part of the first or second operand; or the first and second operands overlap cancelily. Assuming processing proceeds from left to right and one byte at a time, the operands reportedly overlap cancelily when the first operand position will be used as a source after data has been moved into it.

[0133] As an example, normal completion occurs after the cryptographic operation has finished. Partial completion occurs when the number of blocks smaller than the length of the second operand, as determined by the central processing unit, has been processed.

[0134] When the operation terminates due to normal completion, a condition code of, for example, 0 is set, and the value obtained in R2+1 is, for example, zero. When the operation terminates due to partial completion, a condition code of, for example, 3 is set. In this case, in one instance, if the central processing unit is enabled to update, for example, the counter in the encryption counter group, all second operands have been processed, and the appropriate counter is inaccessible, then the value obtained by placing it in the general-purpose register R2+1 is zero; otherwise, the value obtained by placing it in the general-purpose register R2+1 is non-zero.

[0135] In one instance, a Program Event Record (PER) store change event can be identified for both the first operand location and the stored portion of the parameter block. A PER zero-address detection event can be identified for both the first and second operand locations and for the parameter block. When a PER event is detected for one or more of these locations, it is unpredictable which location will be identified in the PER access identification and PER ASCE (Address Space Control Element) ID (identifier).

[0136] In one instance, when a storage change PER event is identified, less than 4K extra bytes are stored in the first operand location before the event is reported.

[0137] In one instance, when the second operand length is initially zero, the following occurs: The parameter block, the first operand, and the second operand are not accessed, and the general registers R1, R2, and R2+1 are not changed. If the CPU is not enabled to update the counters in the cryptographic counter group, a condition code of, for example, 0 is set. If the CPU is enabled to update the counters in the cryptographic counter group and the appropriate counter is inaccessible, the appropriate counter is updated and a condition code of, for example, 0 is set. If the CPU is enabled to update the counters in the cryptographic counter group and the appropriate counter is inaccessible, the condition code remains unchanged, and an access anomaly is identified for the position of the appropriate counter.

[0138] When the contents of fields R1 and R2 are the same, the contents of the specified register are only incremented by the number of processed bytes, not by twice the number of processed bytes.

[0139] As observed by this central processing unit, other central processing units, and channel programs, the references to parameter blocks and storage operands can be multiple access references. Access to these storage locations is not necessarily block-parallel, and the sequence of such accesses or references is uncertain.

[0140] In certain exceptional circumstances, instruction execution can be accomplished by setting a selected condition code (e.g., condition code 3) without updating registers and linked values ​​(e.g., exponential block ordering values) to reflect the last unit of the processed first and second operands. In this case, the size of the processed unit depends on the situation and model, but is limited to ensure that the processed and unreported portions of the first and second operands do not overlap in memory. In one instance, in all cases, where applicable, a change bit is set for the location of the processed first operand, and a PER store change event is reported.

[0141] For the function of comparing the wrapped key verification mode field and the wrapped key verification mode register in the execution parameter block (with the same function), it is unpredictable whether an access exception and PER zero address detection event are identified for the first operand and the second operand when a mismatch occurs in the comparison.

[0142] Access exceptions can be reported for a larger portion of an operand compared to the portion processed in a single execution of the instruction; however, access exceptions are not identified for positions exceeding the length of the operand or for positions exceeding, for example, 4KB beyond the currently processed position. In one or more instances, for the full XTS functionality, the entire parameter block can be tested for stored access, even if parts of it may not be stored. For all other functionality, only the stored portion of the parameter block can be tested for stored access.

[0143] Instance exceptions that may occur during the execution of cryptographic message instructions include, for example: access (extracting operand 2, cryptographic key and cryptographic key 1, cryptographic key 2, wrap key verification mode and fine-tuning value; storing operand 1; extracting and storing link value, XTS parameter, next alpha power (NAP) and cryptographic counter); operation (if message security aids are not installed); specification; anomaly constraints.

[0144] One example of execution priority is indicated as follows:

[0145] 1.-6. Exceptions with the same priority as normal program interrupt conditions.

[0146] 7.A Second instruction half-word access exception.

[0147] 7.B Operational error.

[0148] 7.C Anomaly Constraints.

[0149] 8. Due to an invalid function code or an invalid temporary register number specification error.

[0150] 9. Due to a specification anomaly in the length of an invalid operand.

[0151] 10. Exceptions regarding access to the encryption counter and access to the length of the second operand, which is initially zero.

[0152] 11. Because the second operand's length was initially zero, the condition code 0.

[0153] 12.A.1 Access error in access parameter block.

[0154] 12.A.2. Condition code 1 due to verification pattern mismatch.

[0155] 12.B Access exception to the first or second operand.

[0156] 13. Condition code 3 due to partial completion (the length of the second operand is still non-zero).

[0157] 14. Due to the second operand length stepping to zero and the condition code 3 for an access exception condition detected for access to the encryption counter.

[0158] 15. Condition code 0 due to normal completion (the second operand length was initially non-zero, but stepped to zero).

[0159] In the description of password instructions such as password message instructions (e.g., password message instruction 500) herein, a specific location, specific field, and / or a specific size of the field (e.g., a specific tuple and / or bit) may be specified. However, other locations, fields, and / or sizes may be provided. Furthermore, although it is possible to specify a bit as a specific value, such as one or zero, this is merely an example. In other instances, if specified, the bit may be set to a different value, such as the opposite value or another value. Many variations are possible.

[0160] In one embodiment, the fields of the instruction are separate and independent; however, in other embodiments, more than one field may be combined. Furthermore, although an instance-type register is used, other types of registers may be used. Other instances are possible.

[0161] Furthermore, in one or more instances, the parameter block depends on the function to be performed. As described herein, in one or more instances, the parameter block may include Key 1, Key 2, a fine-tuning value, and the next alpha power for, for example, the Cipher Message Integrity XTS AES 128 function; and for the Cipher Message Integrity XTS Encrypted AES 128 function, as an example, the parameter block includes the encrypted key combination Key 1 and Key 2 (instead of Key 1 and Key 2), the fine-tuning value, the next alpha power, and the wrapper key verification mode. Other instances of functions and / or parameter blocks are possible.

[0162] Password instructions, such as password message instructions, may have additional, fewer, and / or other fields. For example, one or more fields of a password message instruction, such as a password message instruction, may be selected as appropriate. Many variations are possible.

[0163] While various examples are provided for one or more formats of this instruction, additional and / or other formats may be used. Furthermore, the processing may be used for purposes other than those described herein.

[0164] Referring to Figure 7, an example of a hardware design for implementing one or more embodiments of the present invention is described. In one example, the computing environment 700 includes a plurality of coprocessors, including, for example, a coprocessor 702 (e.g., an encryption coprocessor, such as an AES coprocessor) coupled to another coprocessor 750 (e.g., a GHASH coprocessor). The coprocessor is a computer processor used to supplement a main processor such as a central processing unit. In one example, the central processing unit (also referred to as a processor core) may include one or more coprocessors. The one or more coprocessors are one or more hardware accelerators. Many examples are possible.

[0165] In one example, the coprocessor 702 receives a parameter block 704 as input via, for example, an input buffer 715. This parameter block includes, for example, encryption key 1 (K1) 705, encryption key 2 (K2) 706, a fine-tuning value 708, and a next alpha power 712. The coprocessor 702 includes, for example, a private computation core (PCC) 720 for encrypting the fine-tuning value and a cryptographic unit 740 (e.g., a cryptographic message (KM)-XTS) for encrypting or decrypting message blocks (e.g., plaintext blocks or ciphertext blocks). The private computation core 720 includes, for example, an encryption unit 722 coupled to a plurality of other units, including a byte-by-byte bit-flipping unit 730 and a pulse generator 732. The encryption unit 722 includes an encryption component 724 for encrypting the fine-tuning value and a read-next-alpha component 726 for reading the next alpha power. The output of the read-next-alpha component is provided to an update component 727 for updating the next alpha power. In one example, the updated next alpha power is provided to an update link buffer 728 and used to update a selected register 729 (e.g., a selected dedicated register).

[0166] For example, pulse generator 732 includes: an encrypted fine-tuning pulse 734 for providing an encrypted fine-tuning signal; a GHASH enable pulse 736 for providing a signal to enable GHASH processing; and a next alpha pulse 738 for providing a next alpha power signal. These enable signals are provided to, for example, a coprocessor 750. A bit-by-bit inversion 730 of the encrypted fine-tuning value is also provided to the coprocessor 750.

[0167] In one example, coprocessor 750 receives the output from byte-by-byte bit inversion 730 and the output from pulse generator 732 (e.g., a cryptographically adjusted enable signal, a GHASH enable signal, and a signal to obtain the next alpha power enable signal) as inputs. Coprocessor 750 multiplies the cryptographically adjusted value 754 by the next alpha power value 756 based on one or more of the enable signals to produce a product (e.g., a mask value (e.g., TAU)), which is based on the enable signal from the multiplication-generated pulse unit 758 and input to the cryptographic unit 740 of coprocessor 702. For example, this product is input to the byte-by-byte bit inversion unit 742 of cryptographic unit 740. The output of byte-by-byte bit inversion unit 742 is input to update mask unit 744, whose output is a mask (e.g., TAU) input to mutex OR 766. The mutex 766 also receives plaintext 780 (e.g., plaintext block 782 during GHASH) as input. Assuming an encryption operation and a mutex are performed, its output is input to the encryption / decryption unit 768, which in this case encrypts the output of the mutex using data key 770 (e.g., key 1). In one instance, the encrypted output (encrypted output) is input to another mutex 772.

[0168] The mutex OR 772 also receives the output of the update masking unit 744, which provides the mask. The mutex OR is executed to produce the output of the warp-coded ciphertext 786.

[0169] In one or more configurations, the GF 2128 multiplier used to implement the AES-XTS algorithm can also be reused; that is, the same underlying hardware can be used to perform multiplication in both AES-GCM mode and GHASH. However, the endianness of the input operands used for AES-XTS does not match the endianness used for GCM and GHASH. Therefore, additional hardware circuitry is provided to perform full-length byte swapping and bit-flipping on the multiplier's input and output ports to allow the same multiplier to be reused across all algorithms. This allows for improved area and power efficiency of the processor hardware.

[0170] In one or more states, cryptographic processing capabilities are provided, including the ability to interrupt instructions to perform cryptographic operations, including accelerated cryptographic operations, without compromising security during interruption or recovery of cryptographic operations. In one or more states, protection capabilities are provided, which protect the cryptographically tuned value by not providing the idempotent block order value external to the hardware.

[0171] Although one or more instances of a computing environment of one or more forms of the present invention are described and used herein, Figures 8A and 8B depict another embodiment of a computing environment of one or more forms of the present invention.

[0172] In this example, referring first to FIG8A, the computing environment 36 includes, for example, a native central processing unit (CPU) 37 based on an architecture having an instruction set architecture, memory 38, and one or more input / output devices and / or interfaces 39 coupled to each other via, for example, one or more buses 40 and / or other connections.

[0173] The native central processing unit 37 includes one or more native registers 41, such as one or more general-purpose registers and / or one or more dedicated registers used during processing within the environment. These registers include information representing the state of the environment at any given point in time.

[0174] In addition, the native central processing unit 37 executes instructions and code stored in memory 38. In a particular instance, the central processing unit executes emulator code 42 stored in memory 38. This code enables a computing environment configured in one architecture to emulate another architecture (different from one architecture) and execute software and instructions developed based on that other architecture.

[0175] Referring to Figure 8B, further details relating to emulator code 42 are described. The object instructions 43 stored in memory 38 contain software instructions (e.g., machine instructions) developed for execution on an architecture other than the native CPU 37. For example, the object instructions 43 may be designed to execute on a processor based on a different instruction set architecture, but instead, they are emulated on the native central processing unit 37, which may be, for example, an instruction set architecture. In one instance, emulator code 42 includes instruction fetching routines 44 to fetch one or more object instructions 43 from memory 38, and, where appropriate, provides local buffering for the fetched instructions. The emulator code also includes instruction translation routines 45 to determine the type of the fetched object instruction and translate it into one or more corresponding native instructions 46. This translation includes, for example, identifying the function to be executed by the object instruction and selecting native instructions to execute that function.

[0176] Furthermore, the emulator code 42 includes an emulation control constant 47 to enable the execution of native instructions. The emulation control constant 47 enables the native central processing unit 37 to execute a native instruction constant that emulates one or more previously obtained object instructions, and upon completion of this execution, transfers control back to the instruction fetch constant to emulate the acquisition of the next object instruction or a set of object instructions. The execution of the native instructions 46 may include loading data from memory 38 into a register; storing data from a register back into memory; or performing a certain type of arithmetic or logical operation, such as by interpreting a constant.

[0177] Each routine is implemented, for example, in software, which is stored in memory and executed by the native central processing unit 37. In other instances, one or more of these routines or operations are implemented in firmware, hardware, software, or a combination thereof. The native central processing unit's register 41 can be used, or the emulated processor's register can be emulated by using locations in memory 38. In embodiments, the object instruction 43, the native instruction 46, and the emulator code 42 may reside in the same memory or may be allocated across different memory devices.

[0178] According to one or more of the present invention, the simulated example instructions are the cryptographic message instructions described herein.

[0179] The computing environments described herein are merely examples of usable computing environments. One or more forms of the present invention can be used in many types of environments. The computing environments provided herein are merely examples. Each computing environment can be configured to include one or more forms of the present invention. For example, each computing environment can be configured to implement encryption processes including accelerated encryption, interruptible encryption, and / or protection encryption, and / or execute one or more other forms of the present invention.

[0180] One or more aspects of this invention are associated with computer technology and facilitate processing within a computer, thereby improving its performance. For example, processing speed is increased and latency is reduced by using an instruction, such as a cryptographic instruction for performing encryption processing. Furthermore, security is enhanced by protecting masking and fine-tuning values ​​used during cryptographic operations and / or during interruptions and recovery of instructions used to perform cryptographic operations. Processing within the processor, computer system, and / or computing environment is improved.

[0181] In one or more states, the ability to accelerate encryption and decryption operations using cryptographic techniques such as XTS-AES within the processor core is provided (e.g., instructions, techniques, etc.). In one or more states, the machine uses input parameters (e.g., Key 1, Key 2, and the Power Block Ordering (NAP) value in a parameter block), one or more of which are deviation parameters different from the inputs defined in the cryptographic technique. In one or more states, the same instruction and its function (e.g., a single instruction) are used to combine and process multiple parts of the cryptographic technique (e.g., encrypting a fine-tuned value, performing cryptographic operations on a message), instead of using two or more instructions and their functions. This accelerates execution.

[0182] In one or more states, the machine multiplies both the power block ordering value and the mask value by a selected value, such as 2 (in GF 2128), to bypass the lengthy calculation of deriving J (block sequence number) from the power block ordering value, incrementing J by one (for the next input message block), then recalculating the power block ordering value for the next input message block using exponential multiplication, and then calculating the mask value based on the calculated power block ordering value. This improves processing speed.

[0183] In one or more states, use deviated state information or link value formats to allow interrupted and resumed operations without compromising security.

[0184] This technique can be applied to encrypt both data-at-rest and data-in-flight in one or more samples.

[0185] In one or more configurations, block-by-block masking is not exposed to the software, thereby enhancing the system's security. Furthermore, system security is further enhanced by wrapping the key to be used in encryption processing with the system key, which protects the key. In one or more configurations, key 1 and key 2 can be combined to generate a larger combined key, which is then decrypted to obtain key 2, used to encrypt the fine-tuning value.

[0186] In one or more versions, encryption is used to protect the encrypted fine-tuned values ​​of cryptographic techniques from unauthorized users. In one or more versions, the program first provides at least one deviated input parameter (e.g., (in a parameter block) as a power block ordering value of the input parameter), rather than having the machine compute the at least one deviated input parameter, which differs from inputs defined for, for example, one or more cryptographic techniques such as XTS-AES.

[0187] In one or more states, the program determines an initial exponential block ordering value and provides it in a parameter block. The machine determines subsequent exponential block ordering values ​​until it reaches a partial completion point. The machine determines an exponential block ordering value for the next input message block and stores it as an output exponential block ordering value in the parameter block. If the machine prematurely terminates the instruction and its function due to partial completion, the program provides the previously output exponential block ordering value as an input exponential block ordering value in the parameter block and reissues the same instruction and its function so that the machine can continue processing cryptographic techniques from the previous partial completion point.

[0188] In one or more states, the machine stores the determined power block ordering value of the next input message block, rather than the generated masking value of the next input message block, in the parameter block to hide the encrypted fine-tuning value from unauthorized users.

[0189] In one or more states, the machine does not store any values ​​that could reveal the encrypted fine-tuned value in the parameter block. In one or more states, the machine uses off-cryptography techniques (provided as a standard) to generate the mask value in a specific way that accelerates cryptography (e.g., XTS-AES) and protects the encrypted fine-tuned value (rather than first calculating the mask value and then encrypting it).

[0190] Other forms, variations and / or embodiments are possible.

[0191] In addition to the above, one or more forms of services can be provided, supplied, deployed, managed, and serviced by a service provider that manages the customer environment. For example, a service provider can create, maintain, support, and execute computer code and / or computer infrastructure for one or more customers in one or more forms. In return, the service provider can receive payments from customers according to subscription and / or charging agreements, as an example. Alternatively, the service provider can receive payments from the sale of advertising content to one or more third parties.

[0192] In one scenario, an application can be deployed to execute one or more embodiments. As an example, the deployment of an application includes providing computer infrastructure that can be used to execute one or more embodiments.

[0193] As another example, a deployable computing infrastructure can be included, comprising integrating computer-readable code into a computing system, wherein the code, in conjunction with the computing system, can execute one or more embodiments.

[0194] As another example, a program for integrating computing infrastructure may be provided, the integration including integrating computer-readable code into a computer system. The computer system includes computer-readable media, wherein the computer media includes one or more embodiments. The code, combined with the computer system, enables the execution of one or more embodiments.

[0195] Although various embodiments are described above, they are merely examples. For instance, other instructions, instruction formats, operands, and / or registers may be used. Furthermore, other encryption algorithms may be used. Additionally, additional, less, and / or other code may be used, although specific code may be provided as an instance of performing a particular operation, function, or task. Code may be combined and / or separated into subsets of code. Many variations are possible.

[0196] Various forms and embodiments are described herein. Furthermore, many variations are possible without departing from the spirit of the forms of the invention. It should be noted that, unless otherwise inconsistent, the forms or features described and / or claimed herein, and variations thereof, may be combined with any other forms or features.

[0197] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, unless the context clearly indicates otherwise, the singular forms "a / an" and "the" are intended to include the plural forms as well. It should be further understood that the terms "comprises and / or comprising," when used in this specification, designate the presence of stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0198] All components or steps plus functional elements, their corresponding structures, materials, actions, and equivalents (if any) within the following claims are intended to include any structure, material, or action used to perform a function in conjunction with other claimed elements, such as those specifically claimed. One or more embodiments have been described for illustrative and descriptive purposes, but are not intended to be exhaustive or limited to the disclosed forms. Many modifications and variations will be apparent to those skilled in the art. The embodiments have been chosen and described to best explain the various forms and practical applications, and to enable others skilled in the art to understand the various embodiments and modifications suitable for the specific uses covered.

[0199] 36: Computing Environment 37: Native Central Processing Unit (CPU) 38: Memory 39: Input / output devices and / or interface interfaces 40: Busbar 41: Native temporary registers 42: Emulator Program Code 43: Object Instruction 44: Instruction Fetching Conventions 45: Instruction Translation Conventions 46: Native Commands 47: Simulation Control Conventions 100: Computing Environment 101: Computer 102: Wide Area Network (WAN) 103: End User Device (EUD) 104: Remote Server 105: Public Cloud 106: Private Cloud 110: Processor Group 111: Communication Mesh Architecture 112: Volatile memory 113: Persistent storage 114: Peripheral Device Group 115: Network Module 120: Processing circuit system 121: Cache memory 122: Operating System 123: User Interface (UI) Device Group 124: Storage 125: Internet of Things (IoT) Sensor Pack 130: Remote Database 140: Gate device 141: Cloud-based orchestration module 142: Mainframe machine group 143: Virtual Machine Group 144: Container Group 150: Encryption code / block 200: Processor 201: Instruction Extraction Component 202: Instruction Decoding / Arithmetic Element Extraction Component 204: Instruction Execution Component 206: Memory Access Component 208: Write back to the component 210: Temporary Register 300: Obtain instruction code 330: Execution instruction code 332: Obtain the operation code 336: Execute encryption code 400: Encryption program / program 402: Steps 410: Steps 412: Steps 414: Steps 416: Steps 418: Steps 420: Steps 422: Steps 430: Steps 432: Steps 434: Steps 436: Steps 450: Protection program / program 452: Steps 456: Steps 458: Steps 460: Steps 462: Steps 470: Steps 500: Password Message Command 502: Work Code Field 504: Temporary register field (R1) 506: Temporary register field (R2) 510: Temporary Register 512: Address of the first operand 520: Temporary Register 522: Address of the second operand 530: Temporary Register 532: Length 540: General purpose temporary register 0 544: Modifiers / Modifier Fields 546: Function Code / Function Code Field 550: General Purpose Temporary Register 1 552: Address 560: Parameter Block 562: Cryptographic Key 1 (K1) 564: Cryptographic Key 2 (K2) 566: Fine-tuning value (i) 568: Next Alpha Power (NAP) 600:128-bit fine-tuning value (i) 602:128-bit fine-tuning key (K2) 604: AES encryption algorithm (AES e) 606: Result 608: Steps 610: Next Alpha Power (NAP) 612: Initial TAU 620: 16-byte plaintext block 622: AES Encryption Algorithm (AES e) 630: Initial Next Alpha Power (NAP) 632: Next Alpha Power (NAP) 634: Steps 636: Value 2 640: Initial TAU 642:TAU 644: Steps 646: Value 2 650: Steps 652:128-bit Data Key (K1) 654: Steps 658: Ciphertext (C) Block 660: Initial Next Alpha Power (NAP) 662: Next Alpha Power (NAP) 664: Steps 666: Value 2 670: Initial TAU 672:TAU 674: Steps 676: Value 2 680: 16-byte ciphertext block 682: AES Decryption Algorithm (AES d) 690: Steps 692:128-bit Data Key (K1) 694: Steps 698: Plaintext Block 700: Computing Environment 702: Coprocessor 704: Parameter Block 705: Cryptographic Key 1 (K1) 706: Cryptographic Key 2 (K2) 708: Fine-tuning value 712: Next Alpha Power 715: Input Buffer 720: Private Processing Core (PCC) 722: Encryption Unit 724: Encryption Component 726: Read the next Alpha power component 727: Updated components 728: Update Link Buffer 729: Selected temporary register 730: Bit-by-bit inversion unit 732: Pulse Generator 734: Encrypted fine-tuning pulse 736: GHASH Energizing Pulse 738: The Next Alpha Power Pulse 740: Cryptographic Unit 742: Bit-by-bit inversion unit 744: Update masking unit 750: Coprocessor 752: Steps 754: Encrypted fine-tuning value 756: Next Alpha Power 758: Pulse generation unit after multiplication 766: Mutually exclusive OR 768: Encryption / Decryption Unit 770: Data Key 772: Another mutually exclusive or 780: Plaintext 782: Plaintext blocks during GHASH 786: Warp-printed ciphertext GR0: General purpose temporary register 0 GR1: General purpose temporary register 1

Claims

1. A computer program product comprising: a group of one or more computer-readable storage media; and program instructions commonly stored in the group of one or more computer-readable storage media for causing at least one computing device to perform computer operations including: executing a cryptographic instruction, the execution of the cryptographic instruction comprising performing a plurality of operations as part of executing the cryptographic instruction, wherein performing the plurality of operations as part of executing the cryptographic instruction includes: Encrypting a confidential value to provide an encrypted confidential value, the confidential value and one or more other encrypted parameters used to perform at least one of the plurality of operations as part of performing the cryptographic instruction are input to one of the cryptographic instructions and specified using one or more locations of the cryptographic instruction; generating a mask value using the encrypted confidential value; performing a cryptographic operation on at least a portion of a message specified by the cryptographic instruction, the mask value being used to perform the cryptographic operation on the at least that portion of the message; and providing one result of the cryptographic operation.

2. The computer program product of claim 1, wherein generating the mask value includes multiplying the encrypted secret value by a power block ordering value to generate the mask value.

3. The computer program product of claim 2, wherein the power block ordering value is input to the password instruction and is a modified value depending on a portion of the message to which the password operation is being performed.

4. The computer program product of claim 1, wherein generating the mask value includes generating the mask value using the encrypted secret value and a power-order block value, and wherein executing the cryptographic instruction further includes performing a block-by-block update on the power-order block value and the mask value, wherein the power-order block value and the mask value are kept synchronized with each other.

5. The computer program product as described in claim 4, wherein such computer operation further includes: The execution of the cipher instruction is interrupted at one of the locations in the message, wherein the cipher operation of the message ends before the cipher operation of the message is completed; And re-execute the cipher instruction, the re-execution obtaining an updated exponential block ordering value to restore the cipher operation of the message at the position of the message, the updated exponential block ordering value being an input to one of the re-executed cipher instructions and based on the block-by-block updates.

6. The computer program product of claim 5, wherein the message comprises a plurality of message blocks, and wherein the location of the message is one of the plurality of message blocks of the message.

7. The computer program product of claim 6, wherein the block-by-block update includes updating the power block ordering value and the mask value based on progressing to the next message block of the message in the cryptographic operation.

8. The computer program product of claim 5, wherein the operation of the password operation is sequenced using at least one hardware accelerator to allow the interruption and the re-execution.

9. The computer program product of claim 8, wherein the power block ordering value is maintained in the at least one hardware accelerator.

10. The computer program product of claim 1, wherein the cryptographic instruction receives as input a plurality of encrypted parameters to be used to perform at least one of the plurality of operations performed as part of the execution of the cryptographic instruction, the plurality of encrypted parameters including the secret value and the one or more other encrypted parameters and specified using one or more registers of the cryptographic instruction.

11. The computer program product of claim 10, wherein the plurality of encryption parameters includes a key to be used to encrypt the confidential value, a data key to be used in the cryptographic operation, an address of the message, the confidential value, and a power block ordering value to be used to generate the mask value.

12. The computer program product of claim 11, wherein the key to be used to encrypt the confidential value, the data key to be used in the cryptographic operation, the confidential value, and the power block ordering value are included in a parameter block, the parameter block being an input to the cryptographic instruction, wherein a register of the cryptographic instruction includes at least a portion of an address of the parameter block.

13. The computer program product as described in claim 1, wherein the message comprises a plurality of message blocks, and wherein performing the password operation includes: Use the masking value to determine a block masking value for one of the plurality of message blocks; And use the block mask value to perform the password operation on the message block.

14. The computer program product of claim 13, wherein the determination of the block mask value for a next message block is based on the block mask value of a previous message block.

15. A computer system comprising: at least one computing device; a group of one or more computer-readable storage media; and program instructions commonly stored in the group of one or more computer-readable storage media for causing the at least one computing device to perform computer operations including: executing a cryptographic instruction, the execution of the cryptographic instruction including performing a plurality of operations as part of executing the cryptographic instruction, wherein performing the plurality of operations as part of executing the cryptographic instruction includes: Encrypting a confidential value to provide an encrypted confidential value, the confidential value and one or more other encrypted parameters used to perform at least one of the plurality of operations as part of performing the cryptographic instruction are input to one of the cryptographic instructions and specified using one or more locations of the cryptographic instruction; generating a mask value using the encrypted confidential value; performing a cryptographic operation on at least a portion of a message specified by the cryptographic instruction, the mask value being used to perform the cryptographic operation on the at least that portion of the message; and providing one result of the cryptographic operation.

16. The computer system of claim 15, wherein generating the mask value includes using the encrypted secret value and a power-order block value to generate the mask value, and wherein executing the cryptographic instruction further includes performing a block-by-block update on the power-order block value and the mask value, wherein the power-order block value and the mask value are kept synchronized with each other.

17. The computer system as described in claim 16, wherein such computer operations further include: The execution of the cipher instruction is interrupted at one of the locations in the message, wherein the cipher operation of the message ends before the cipher operation of the message is completed; And re-execute the cipher instruction, the re-execution obtaining an updated exponential block ordering value to restore the cipher operation of the message at the position of the message, the updated exponential block ordering value being an input to one of the re-executed cipher instructions and based on the block-by-block updates.

18. The computer system of claim 15, wherein the cryptographic instruction receives as input a plurality of cryptographic parameters to be used to perform at least one of the plurality of operations as part of the execution of the cryptographic instruction, the plurality of cryptographic parameters including the secret value and the one or more other cryptographic parameters and specified by one or more registers of the cryptographic instruction, and wherein the plurality of cryptographic parameters includes a key to be used to encrypt the secret value, a data key to be used in the cryptographic operation, an address of the message, the secret value, and a power-block ordering value to be used to generate the mask value.

19. A computer-implemented method comprising: executing a cryptographic instruction, the execution of the cryptographic instruction including performing a plurality of operations as part of executing the cryptographic instruction, wherein performing the plurality of operations as part of executing the cryptographic instruction includes: Encrypting a confidential value to provide an encrypted confidential value, the confidential value and one or more other encrypted parameters used to perform at least one of the plurality of operations as part of performing the cryptographic instruction are input to one of the cryptographic instructions and specified using one or more locations of the cryptographic instruction; generating a mask value using the encrypted confidential value; performing a cryptographic operation on at least a portion of a message specified by the cryptographic instruction, the mask value being used to perform the cryptographic operation on the at least that portion of the message; and providing one result of the cryptographic operation.

20. The computer implementation method of claim 19, wherein generating the mask value includes using the encrypted secret value and a power block ordering value to generate the mask value, and wherein executing the cryptographic instruction further includes performing a block-by-block update on the power block ordering value and the mask value, wherein the power block ordering value and the mask value are kept synchronized with each other.

21. The computer implementation method of claim 20, further comprising: interrupting the execution of the cipher instruction at a location of the message, wherein the cipher operation of the message ends before the completion of the cipher operation of the message; and re-executing the cipher instruction, the re-executing obtaining an updated idempotent block ordering value to resume the cipher operation of the message at the location of the message, the updated idempotent block ordering value being an input to the re-executed cipher instruction and based on the block-by-block updates.

22. The computer implementation method of claim 19, wherein the cryptographic instruction receives as input a plurality of encryption parameters to be used to perform at least one of the plurality of operations as part of the execution of the cryptographic instruction, the plurality of encryption parameters including the secret value and the one or more other encryption parameters and specified using one or more registers of the cryptographic instruction, and wherein the plurality of encryption parameters includes a key to be used to encrypt the secret value, a data key to be used in the cryptographic operation, an address of the message, the secret value, and a power-order block value to be used to generate the mask value.

23. A computer system comprising: at least one hardware accelerator configured to execute a cryptographic instruction, the execution of the cryptographic instruction including performing a plurality of operations as part of the execution of the cryptographic instruction, the plurality of operations as part of the execution of the cryptographic instruction including: Encrypting a confidential value to provide an encrypted confidential value, the confidential value and one or more other encrypted parameters used to perform at least one of the plurality of operations as part of performing the cryptographic instruction are input to one of the cryptographic instructions and specified using one or more locations of the cryptographic instruction; generating a mask value using the encrypted confidential value; performing a cryptographic operation on at least a portion of a message specified by the cryptographic instruction, the mask value being used to perform the cryptographic operation on the at least that portion of the message; and providing one result of the cryptographic operation.

24. The computer system of claim 23, wherein generating the mask value includes generating the mask value using the encrypted secret value and an exponential block ordering value, and executing the cryptographic instruction further includes performing a block-by-block update of the exponential block ordering value and the mask value, wherein the exponential block ordering value and the mask value are kept synchronized with each other, and wherein the computer system is further configured to perform computer operations including: interrupting the execution of the cryptographic instruction at a location of the message, wherein the cryptographic operation of the message ends before the completion of the cryptographic operation of the message; and re-executing the cryptographic instruction, the re-execution obtaining an updated exponential block ordering value to restore the cryptographic operation of the message at that location of the message, wherein the operations of the cryptographic operation are ordered to achieve the interruption and the re-execution.

25. A computer implementation method comprising: executing a cryptographic instruction using at least one hardware accelerator, the execution of the cryptographic instruction including performing a plurality of operations as part of executing the cryptographic instruction, the plurality of operations as part of executing the cryptographic instruction including: Encrypting a confidential value to provide an encrypted confidential value, the confidential value and one or more other encrypted parameters used to perform at least one of the plurality of operations as part of performing the cryptographic instruction are input to one of the cryptographic instructions and specified using one or more locations of the cryptographic instruction; generating a mask value using the encrypted confidential value; performing a cryptographic operation on at least a portion of a message specified by the cryptographic instruction, the mask value being used to perform the cryptographic operation on the at least that portion of the message; and providing one result of the cryptographic operation.

Images