Device and method for extraction and insertion of binary words

Abstract

Embodiments of the present disclosure relate to devices and methods for extracting and inserting binary words. The present disclosure relates to a device and method for processing masked binary data values, comprising: extracting a first portion of a first masked binary data value and inserting it into a second masked binary data value, wherein the first masked binary data value and the second masked binary data value remain masked throughout the processing.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of French Application No. 1911349, filed on October 11, 2019, which is incorporated herein by reference. Technical Field

[0003] The present disclosure relates generally to electronic systems, circuits and methods, and more particularly to methods and electronic devices (such as, for example, processors) configured to perform calculations on binary words. The present disclosure relates more particularly to methods and devices configured to process masked data values. Background Art

[0004] Among various devices configured to perform calculations on binary words, a processor is an electronic component found in many electronic systems and circuits that is configured to process data values ​​by executing commands and instructions from a computer program.

[0005] In some cases, the processor may have to process secret data values. These secret data values ​​are usually encrypted, for example by masking.

[0006] It would be desirable to be able to improve, at least in part, certain aspects of known devices configured to perform calculations on binary words. Summary of the invention

[0007] There is a need for more reliable devices configured to perform computations on binary words.

[0008] There is a need for a device configured to perform calculations on binary words that are configured to operate on masked data values.

[0009] There is a need for a device configured to perform calculations on binary words that are configured to process masked data values ​​without performing operations to unmask the data values.

[0010] One embodiment addresses all or some of the disadvantages of known devices configured to perform calculations on binary words.

[0011] One embodiment addresses all or some of the disadvantages of known processors configured to perform processing on masked data values.

[0012] One embodiment provides a method for processing masked binary data values, which is implemented by a device configured to perform calculations on binary data values, the method including operations for extracting a first portion of a first masked binary data value and inserting it into a second masked binary data value, wherein the first masked binary data value and the second masked binary data value remain masked during all processing.

[0013] According to one embodiment, the method does not comprise performing any demasking operation on the first masked binary data value and the second masked binary data value.

[0014] According to one embodiment, the first masked binary data value and the second masked binary data value are masked by a masking operation comprising only arithmetic operations.

[0015] According to one embodiment, a masking operation is an operation in which a data value to be masked is added to a mask in order to obtain a masked data value.

[0016] According to one embodiment, the third binary data value is a result of the extraction and insertion operations, and the third binary data value is a data value masked by a third mask.

[0017] According to one embodiment, the second masked binary data value is obtained by performing a masking operation on a binary data value having all bits equal to "0".

[0018] According to one embodiment, the second masked binary data value is equal to the second mask used during the masking operation.

[0019] According to one embodiment, the third masked binary data value Z_M is given by the following formula:

[0020] Z_M[n-1;0]=(Z_M[n-1;p+1]*2 p+1 +CB(p+m)*2 p +B_M[p+m-1;m])mod2 n

[0021] in:

[0022] - "+" represents addition;

[0023] - "mod" stands for modulo operation;

[0024] -n represents the number of bits of the third masked binary data value Z_M, and n is a natural integer;

[0025] -p is a natural integer between 0 and n-1;

[0026] -m is a natural integer between 0 and np;

[0027] - P[i; j] represents all bits from the i-th bit to the j-th bit of the binary data value P; i and j are natural integers;

[0028] - CB(i) represents a carry digit of the i-th position that may occur during the masking operation resulting in the first masked data value;

[0029] -B_M represents the first masked data value,

[0030] -The carry digit CB(i+1) is given by the following formula, where i is a natural integer less than or equal to n:

[0031]

[0032] wherein MB represents a first mask associated with a first masked binary data value, and

[0033] The third mask MZ associated with the third masked binary data value is given by the following formula:

[0034] MZ[n-1;0]=(MZ[n-1;p+1]*2 (p+1) +CB(m)+MB[p+m-1;m])mod2 n

[0035] According to one embodiment, the third masked binary data value X_M is given by the following formula:

[0036] X_M[n-1;0]=(Z_M[n-1;p+1]*2 p+1 +CB(p+m)*2 p +B_M[p+m-1;m]-CB(m))mod2 n

[0037] in

[0038] - "+" represents addition;

[0039] - "mod" stands for modulo operation;

[0040] -n represents the number of bits of the third masked binary data value X_M, and n is a natural integer;

[0041] -p is a natural integer between 0 and n-1;

[0042] -m is a natural integer between 0 and np;

[0043] - P[i; j] represents all bits from the i-th bit to the j-th bit of the binary data value P; i and j are natural integers;

[0044] - CB(i) represents a carry digit of the i-th position that may occur during the masking operation resulting in the first masked data value;

[0045] -B_M represents the first masked data value,

[0046] -The carry digit CB(i+1) is given by the following formula, where i is a natural integer less than or equal to n:

[0047]

[0048] wherein MB represents a first mask associated with a first masked binary data value, and

[0049] The third mask MX associated with the third mask binary data value is given by the following formula:

[0050] MX[n-1;0]=(MX[n-1;p+1]*2 (p+1) +MB[p+m-1;m])mod2 n

[0051] According to one embodiment, the third masked binary data value F_M is given by the following formula:

[0052] F_M[n-1;0]={(E_M[n-1;k+p]+CEF(k+p))*2^((k+p))+(D_M[m+p-1;m]+ME[k+p-1;k]-MD[m+p-1;m]+CE(k)-CD(k))*2^k+E_M[k-1;0]}mod2^n

[0053] in:

[0054] - "+" represents addition;

[0055] - "mod" stands for modulo operation;

[0056] -n represents the number of bits of the third masked binary data value X_M, and n is a natural integer;

[0057] -p is a natural integer between 0 and n-1;

[0058] -m is a natural integer between 0 and np;

[0059] -k is a natural integer between 0 and np;

[0060] - P[i; j] represents all bits from the i-th bit to the j-th bit of the binary data value P; i and j are natural integers;

[0061] -CEF(i) represents the carry digit correction of the i-th position;

[0062] - CD(i) represents the carry digit of the i-th position that may occur during the masking operation resulting in the first masked data value;

[0063] - CD(i) represents the carry digit of the i-th position that may occur during the masking operation resulting in the second masked data value;

[0064] -D_M represents the first masked data value;

[0065] - MD represents the mask associated with the first masked data value;

[0066] - E_M represents the second masked data value; and

[0067] -ME represents a mask associated with the second masked data value,

[0068] The carry digit CD(i+1) is given by the following formula:

[0069]

[0070] The carry digit CE(i+1) is given by the following formula:

[0071]

[0072] The carry digit correction CEF(i) is given by the following formula:

[0073]

[0074] The third mask associated with the third binary data value is equal to the mask associated with the second masked data value.

[0075] The method according to claim 5, wherein the third masked binary data value F_M is given by the following formula:

[0076] F_M[n-1;0]

[0077] ={E_M[n-1; k+p]*2 (k+p) +(D_M[m+p-1;m]+ME[k+p-1;k]-MD[m+p-1;m]+CE(k)-CD(k))*2 k +E_M[k-1;0]}mod2 n

[0078] in:

[0079] - "+" represents addition;

[0080] - "mod" stands for modulo operation;

[0081] -n represents the number of bits of the third masked binary data value X_M, and n is a natural integer;

[0082] -p is a natural integer between 0 and n-1;

[0083] -m is a natural integer between 0 and np;

[0084] -k is a natural integer between 0 and np;

[0085] - P[i; j] represents all bits from the i-th bit to the j-th bit of the binary data value P; i and j are natural integers;

[0086] - C(i) represents a carry digit of the i-th position that may occur during the masking operation resulting in the first masked data value;

[0087] - CD(i) represents the carry digit of the i-th position that may occur during the masking operation resulting in the second masked data value;

[0088] -D_M represents the first masked data value;

[0089] - MD represents the mask associated with the first masked data value;

[0090] - E_M represents the second masked data value; and

[0091] -ME represents a mask associated with the second masked data value,

[0092] The carry digit CD(i+1) is given by the following formula:

[0093]

[0094] The carry digit CE(i+1) is given by the following formula:

[0095]

[0096] The third mask MF associated with the third binary data value is given by:

[0097] MF[n-1;0]=ME[n-1;0]-CEF(k+p)*2 k+p

[0098] where CEF(i) represents the carry correction of the digit at the i-th position given by the following formula:

[0099]

[0100] According to one embodiment, the third masked binary data value I_M is given by the following formula:

[0101] I_M[n-1;0]={(H_M[n-1;k+p]-CH(k+p))*2 (k+p) +(G_M[m+p-1;m]-CG(m)+CG(m+p)*2 p )*2 k +(H_M[k-1;0]+CH(k)*2 k )}mod2 n

[0102] in:

[0103] - "+" represents addition;

[0104] - "mod" stands for modulo operation;

[0105] -n represents the number of bits of the third masked binary data value X_M, and n is a natural integer;

[0106] -p is a natural integer between 0 and n-1;

[0107] -m is a natural integer between 0 and np;

[0108] -k is a natural integer between 0 and np;

[0109] - P[i; j] represents all bits from the i-th bit to the j-th bit of the binary data value P; i and j are natural integers;

[0110] - CG(i) represents a carry digit of the i-th position that may occur during the masking operation resulting in the first masked data value;

[0111] - CH(i) represents a carry digit of the i-th bit that may occur during the masking operation resulting in the second masked data value;

[0112] - G_M represents the first masked data value;

[0113] - G_M represents the second masked data value; and

[0114] The carry digit CG(i+1) is given by the following formula:

[0115]

[0116] The carry digit CH(i+1) is given by the following formula:

[0117]

[0118] The third mask MI associated with the third masked binary data value is given by the following formula:

[0119] MI[n-1;0]=MH[n-1;k+p]*2 p+k +MG[m+p-1;m]*2 k +MH[k-1;0]

[0120] in:

[0121] - wherein MG represents the mask associated with the first masked binary data value; and

[0122] - wherein MH represents the mask associated with the second masked binary data value.

[0123] According to one embodiment, the third masked binary data value I_M is given by the following formula:

[0124] I_M[n-1;0]={H_M[n-1;k+p]*2 (k+p) +(G_M[m+p-1;m]+CG(m+p)*2 p )*2 k +(H_M[k-1;0]+CH(k)*2 k )}mod2 n

[0125] in

[0126] - "+" represents addition;

[0127] - "mod" stands for modulo operation;

[0128] -n represents the number of bits of the third masked binary data value X_M, and n is a natural integer;

[0129] -p is a natural integer between 0 and n-1;

[0130] -m is a natural integer between 0 and np;

[0131] -k is a natural integer between 0 and np;

[0132] - P[i; j] represents all bits from the i-th bit to the j-th bit of the binary data value P; i and j are natural integers;

[0133] - CG(i) represents a carry digit of the i-th position that may occur during the masking operation resulting in the first masked data value;

[0134] - CH(i) represents a carry digit of the i-th bit that may occur during the masking operation resulting in the second masked data value;

[0135] - G_M represents the first masked data value;

[0136] - G_M represents the second masked data value; and

[0137] The carry digit CG(i+1) is given by the following formula:

[0138]

[0139] The carry digit CH(i+1) is given by the following formula:

[0140]

[0141] The third mask MI associated with the third masked binary data value is given by the following formula:

[0142] MI[n-1;0]=(MH[n-1;k+p]+CH(k+p))*2 p+k +(MG[m+p-1;m]+CG(m))*2 k +)MH[k-1;0]

[0143] in:

[0144] - wherein MG represents the mask associated with the first masked binary data value; and

[0145] - wherein MH represents the mask associated with the second masked binary data value.

[0146] Another embodiment provides a device configured to perform calculations on binary data values ​​masked by a previously disclosed masking operation, the device configured to perform a previously disclosed method.

[0147] An electronic device comprises the device as previously disclosed. BRIEF DESCRIPTION OF THE DRAWINGS

[0148] The foregoing features and advantages, as well as other features, are described in detail in the following description of particular embodiments given by way of example and not limitation with reference to the accompanying drawings, in which

[0149] Figure 1 One embodiment of a processor is schematically illustrated in block diagram form;

[0150] Figure 2 One embodiment of a method for processing masked binary data values ​​is schematically illustrated;

[0151] Figure 3 Another embodiment of a method for processing masked binary data values ​​is schematically illustrated;

[0152] Figure 4 Another embodiment of a method for processing masked binary data values ​​is schematically illustrated;

[0153] Figure 5 A further embodiment of a method for processing masked binary data values ​​is schematically illustrated. DETAILED DESCRIPTION

[0154] In the various drawings, similar features have been designated by similar reference numerals. Specifically, structural features and / or functional features common between various embodiments may have the same reference numerals and may be provided with the same structural characteristics, dimensional characteristics, and material characteristics.

[0155] For purposes of clarity, only the operations and elements useful for understanding the embodiments described herein are illustrated and described.

[0156] Unless otherwise specified, when referring to two elements being connected together, this means a direct connection without any intermediate elements other than conductors; and when referring to two elements being coupled together, this means the two elements may be connected or they may be coupled via one or more other elements.

[0157] In the following disclosure, unless otherwise stated, when referring to absolute position qualifiers such as terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers such as terms "above", "below", "upper", "lower", etc., or orientation qualifiers such as "horizontal", "vertical", etc., reference is made to the orientation shown in the figure.

[0158] Unless otherwise indicated, the expressions "around", "approximately", "substantially" and "about" mean within 10%, preferably, within 5%.

[0159] In the remainder of this disclosure, data values, masked data values, and masks are considered to be binary words, for example, having n bits, where n is a natural integer. The following notation is used:

[0160] -P[m;k] specifies the bit set from the kth bit to the mth bit of the binary word P, where m and k are natural integers less than or equal to n. Strictly speaking, m is greater than k.

[0161] -P[m] specifies the bit with the mth bit number in the binary word P.

[0162] Figure 1 An embodiment of a processor 10 (CPU) is illustrated very schematically in block diagram form. The processor may in particular receive a data value and supply it to an electronic component of an electronic device to which the data value belongs, for example a memory. As a variant, the processor 10 may be any entity configured to perform calculations on binary words, for example an electronic device configured to perform cryptographic calculations.

[0163] The processor 10 is particularly configured to process data values, particularly masked data values.The processor receives as input a masked data value Data_In and its mask Mask_In, and provides as output a masked data value Data_Out and its mask Mask_Out.

[0164] By implementing an arithmetic type mask, the input data value Data_In or the output data value Data_Out is masked using the mask Mask_In and Mask_Out, respectively. An arithmetic type mask is a mask that includes only arithmetic operations and not logical operations. In the case described in this article, an arithmetic mask is an additive mask in which the mask is added to the data value to be masked. As an example, the mask and the data value to be masked are binary words of equal size. According to a variant, the mask and the data value to be masked are binary words of different sizes. More specifically, the masked data value A_M is given by the following formula:

[0165] A_M=(A+MA)mod2 n

[0166] in:

[0167] -A represents the data value to be masked;

[0168] -MA stands for mask;

[0169] - "+" represents addition;

[0170] - "mod" stands for modulo operation; and

[0171] -n is the number of bits that make up the data value to be masked A, the mask MA, and the masked data value A_M.

[0172] The processor 10 is configured to process the masked data values ​​Data_In and their masks Mask_In by applying different operations to them (e.g., addition, subtraction, complement of 1 operations, or operations that process data values ​​by extracting parts of the data values ​​and inserting these parts into other data values). Figures 2 to 5 Embodiments of extract and insert operations performed by processor 10 are disclosed.

[0173] Figure 2 Schematically illustrates an embodiment of a method of processing masked data values, the method comprising the following operations: extracting data value parts and inserting these parts into other data values, the operation being performed by Figure 1 The disclosed processor 10 performs. Figure 2 The disclosed extraction and insertion operations are extraction and insertion operations with "compensation by mask".

[0174] about Figure 2 The disclosed embodiments are directed to the specific case of extraction and insertion operations of a portion of a binary word in a zero data value (that is, a binary word with all bits equal to "0"). Figure 1 Masking operations of the type disclosed provide a masked data value that is equal to a mask associated with the provided masked data value.

[0175] To illustrate the operation of this embodiment, two masked data values ​​B_M and Z_M and their masks MB and MZ are considered. The masked data value B_M is the result of mask MB on the data value B. Figure 1 The result of the disclosed additive masking operation. The masked data value Z_M is the result of the mask MZ on the data value Z. Figure 1 As a result of the disclosed additive masking operation, the data value Z_M is therefore initially equal to the mask MZ. In the case disclosed herein, the binary words constituting the data values ​​B_M, B, Z_M and the masks MB and MZ are all binary words having n bits, n being a natural integer.

[0176] During the extraction and insertion operation, a portion of a data value (in the case illustrated herein, a portion B1_M of a masked data value B_M) is extracted and then inserted into a second data value (in the case disclosed herein, data value Z_M). Since data value B_M is a masked data value with mask MB, a portion MB1 of mask MB is also extracted and then inserted into mask MZ. This portion MB1 has the same position in mask MB as portion B1M in masked data value B_M.

[0177] More specifically, the portion B1_M extracted from the masked data value B_M is a binary word having p bits corresponding to the bits of the masked data value B_M from the mth bit to the m+p-1th bit, where p is a natural integer less than or equal to n, and m is a natural integer between 0 and np. Similarly, the portion MB1 extracted from the mask MB is a binary word having p bits corresponding to the bits of the mask MB from the mth bit to the m+p-1th bit.

[0178] According to one embodiment, the portion B1_M is inserted into the data value Z_M and the p+1 bit of the data value Z_M is modified. As an example, the p+1 bit of low weight of the data value Z_M is modified, but as a variant, the p+1 modified bits can be in any position in the data value Z_M. When the p+1 modified bits are low weight bits, the data value Z_M is given by the following formula:

[0179] Z_M[n-1;0]=(Z_M[n-1;p+1]*2 p+1+CB(p+m)*2 p +B_M[p+m-1:m])mod2 n

[0180] Where CB(i) represents the carry digit of the i-th position, which can be used in the data value B using the mask MB to generate the data value. Figure 1 During the disclosed masking operation, i is an integer between 1 and n.

[0181] The carry digit CB(i+1) is given by the following formula:

[0182]

[0183] Part MB1 is inserted into the mask MZ, and the p+1 bit of the mask MZ is modified. As an example, the p+1 bits of the mask MZ with low weight are modified, but as a variant, the p+1 modified bits can be anywhere in the mask MZ. The p+1 modified bits of the mask MZ are located at the same position as the p+1 modified bits of the data value Z_M. When the p+1 modified bits are low weight bits, the mask MZ is given by the following formula:

[0184] MZ[n-1;0]=(MZ[n-1;p+1]*2 (p+1) +CB(m)+MB[p+m-1;m])mod2 n

[0185] The extraction and insertion operations have "compensation by mask", since the carry digit CB(m) is added to the mask MZ, the carry digit will be compensated by the mask. Figure 3 A variant is disclosed in which the carry digit is compensated in a different way.

[0186] The masked data value Z_M and the mask MZ make it possible to find the zero data value again:

[0187] Z[n-1;0]=(Z_M[n-1;0]-MZ[n-1;0])mod2 n

[0188] Then, the data value Z is given by the following simplified formula:

[0189] Z[n-1;0]=B[m+p-1;m]

[0190] One advantage of this embodiment is that Figure 2 The disclosed extraction and insertion operation does not include a step for unmasking the masked data value B_M. Therefore, during this operation, the data value B cannot be accessed.

[0191] Another advantage of this embodiment is that it allows for increased diversity between the masks used for the masked data values.

[0192] Figure 3 Another embodiment of a method for processing masked data values ​​is schematically illustrated, the method comprising: Figure 1 The extraction and insertion operations performed by the disclosed processor 10. Figure 3 The disclosed extraction and insertion operations are extraction and insertion operations with "compensation by masked data values".

[0193] about Figure 3 The disclosed operations and Figure 2 The disclosed operations are similar and the elements shared by the two operations will not be described again.

[0194] To illustrate the operation of this embodiment, consider the masked data value B_M and its mask MB and the masked data value X_M and its mask MX. The masked data value X_M is the mask MX applied to the zero data value X. Figure 1 As a result of the disclosed additive masking operation, the data value X_M is therefore initially equal to the mask MX. The binary word constituting the masked data value X_M and the mask MX is a binary word having n bits.

[0195] It is considered herein that a portion B1_M of the masked data value B_M is extracted and then inserted into the neutral data value X_M. A portion MB1 of the mask MB is also extracted and then inserted into the mask MX.

[0196] like Figure 2 Similarly, the portion B1_M extracted from the masked data value B_M is a binary word having p bits corresponding to the bits of the masked data value B_M from the mth bit to the m+p-1th bit. Likewise, the portion MB1 extracted from the mask MB is a binary word having p bits corresponding to the bits of the mask MB from the mth bit to the m+p-1th bit.

[0197] The extraction and insertion operations disclosed in this article have the effect of "compensating for the masked data value", thereby causing the carry digit CB(m) of the mth bit that may appear during the additive masking operation of the data value B_M using the mask MB to be compensated on the masked data value X_M instead of on the mask MX.

[0198] In this case, the masked data value X_M is given by:

[0199] X_M[n-1;0]=(X_M[n-1;p]*2 p+1 +CB(p+m)*2 p+B_M[p+m-1;m]-CB(m))mod2 n

[0200] The mask MX is given by the following formula:

[0201] MX[n-1;0]=(MX[n-1;p+1]*2 (p+1) +MB[p+m-1;m])mod2 n

[0202] like Figure 2 Similarly, before the insertion of the masked data value B_M and its mask MB, the masked data value X_M and its mask MX are equal. After this operation, the binary words X_M[n-1; p-1] and MX[n-1; p-1]. After the masked data value X_M and the mask MX defined by the formula given above, that is, before the insertion operation, the data value X can be found again by unmasking the data value X_M by applying the following formula:

[0203] X[n-1;0]=X_M[n-1;0]-MX[n-1;0]

[0204] Then, the data value X is given by:

[0205] X[n-1;0]=B[m+p-1;m]

[0206] One advantage of this embodiment is that Figure 2 The disclosed extraction and insertion operation does not include a step for unmasking the masked data value B_M. Therefore, during this operation, the data value B cannot be accessed.

[0207] Another advantage of this embodiment is that it can be used with mask data values ​​where the mask is not a modifiable data value.

[0208] Figure 4 Another embodiment of a method for processing masked data values ​​is schematically illustrated, the method comprising: Figure 1 The extraction and insertion operations performed by the processor 10 are disclosed.

[0209] about Figure 4 The disclosed embodiments are more Figure 2 and Figure 3 The situation disclosed is more general. Indeed, in the Figure 4 In the disclosed case, a portion of a first masked data value is extracted and then inserted into another masked data value.

[0210] To illustrate the operation of this embodiment, three masked data values ​​D_M, E_M and F_M are considered. The masked data values ​​D_M, E_M, F_M are respectively the mask values ​​MD, ME, MF respectively on the data values ​​D, E, F. Figure 1 Results of the disclosed additive masking operations. The data values ​​D_M, D, E_M, E, F_M, F and the masks MD, ME and MF are all binary words with n bits.

[0211] In About Figure 4 In the disclosed extraction and insertion operation, a portion D1_M of the masked data value D_M is extracted and then inserted into the masked data value E_M to form a final masked data value F_M. According to one embodiment, the mask MF associated with the masked data value F_M is equal to the mask ME associated with the data value E_M. Figure 5 Variants are disclosed in which the mask MF is different.

[0212] More specifically, the portion D1_M extracted from the masked data value D_M is a binary word having p bits corresponding to the bits of the masked data value D_M from the mth bit to the m+p-1th bit, p being a natural integer less than or equal to n, and m being a natural integer between 0 and np.

[0213] According to one embodiment, the portion D1_M is inserted into the masked data value E_M to form the masked data value F_M, and more specifically, the p bits of the masked data value E_M from the kth bit to the k+p-1th bit are modified to form the masked data value F_M, where k is a natural integer from 0 to np. Figure 2 and Figure 3 As disclosed, extraction and insertion operations may have "compensation for mask" or "compensation for masked data values".

[0214] The extraction and insertion operations disclosed in this article are intended to generate a masked data value F_M so that the data value F obtained by demasking the masked data value F_M with the mask MF is equal to the data value E, wherein the data value D of p bits from the mth bit to the m+p-1th bit is inserted between the kth bit and the k+p-1th bit of the data value E.

[0215] In the case of extraction and insertion operations with "compensation for masked data values", the masked data value F_M is then given by:

[0216] F_M[n-1;0]=((E_M[n-1;k+p]+CEF(k+p)*2( k+p)+D_M[m+p-1;m]+ME[k+p-1;k]-MD[m+p-1;m]+CE(k)-CD(k))*2 k +E_M[k-1;0]]mod2 n

[0217] in:

[0218] -CEF(i) represents the carry digit correction of the i-th position as defined below, i being an integer between 1 and n;

[0219] - CE(i) represents the carry digit of the i-th position that may occur during the additive masking operation using the mask ME resulting in the masked data value E_M; and

[0220] -CD(i) represents the carry digit of the i-th position that may occur during the additive masking operation using the mask MD resulting in the masked data value D_M.

[0221] The carry digit CE(i+1) is given by the following formula:

[0222]

[0223] The carry digit CD(i+1) is given by the following formula:

[0224]

[0225] The carry digit correction CEF(i+1) depends on the carry digit CE(i+1) and the carry digit CF(i+1) and is given by the following formula:

[0226]

[0227] With the operation of “compensating the masked data value”, the mask MF associated with the masked data value F_M is strictly equal to the mask ME associated with the data value E_M.

[0228] In the case where the extraction and insertion operations have "compensation for masking", the masked data value F_M is given by the following formula:

[0229] F_M[n-1;0]={E_M[n-1;k+p]*2 (k+p) +(D_M[m+p-1;m]+ME[k+p-1;k]-MD[m+p-1;m]+CE(k)-CD(k))*2 k +E_M[k-1;0])mod2 n

[0230] The mask MF is given by the following formula:

[0231] MF[n-1;0]=ME[n-1;0]-CEF(k+p)*2 k+p

[0232] In the case of extraction and insertion operations with either "compensation by mask" or "compensation by masked data value", the above defined formula can be used to find the data value F again from the masked data value F_M and the mask MF by applying the unmasking operation defined by the following formula:

[0233] F[n-1;0]=(F_M[n-1;0]-MF[n-1;0])mod2 n

[0234] An advantage of these embodiments is that the extraction and insertion operations do not require unmasking operations on the masked data values ​​D_M, E_M and F_M. Therefore, during this operation, the data values ​​D, E and F cannot be accessed.

[0235] Figure 5 Another embodiment of a method for processing masked data values ​​is schematically illustrated, the method comprising: Figure 1 The extraction and insertion operations performed by the processor 10 are disclosed.

[0236] about Figure 5 The disclosed operations and Figure 4 The disclosed operations are similar and the common elements of the two operations will not be described again.

[0237] To illustrate the operation of this embodiment, consider data values ​​G_M, H_M and I_M and their masks MG, MH and MI. The masked data values ​​G_M, H_M, I_M are respectively the mask values ​​MG, MH, MI respectively applied to the data values ​​G, HI. Figure 1 Results of the disclosed arithmetic masking operations. The binary words constituting the data values ​​G_M, G, H_M, H, I_M, I and the masks MG, MH and MI are all binary words having n bits.

[0238] In About Figure 5 In the disclosed extraction and insertion operation, a portion G1_M of the masked data value G_M is extracted and then inserted into the masked data value H_M to form the final masked data value I_M. According to one embodiment, a portion MG1 of the mask MG is also extracted and then inserted into the mask MH to form the mask MI.

[0239] More specifically, the part G1_M and the part MG1 are binary words having p bits corresponding to the bits of the masked data value G_M from the mth bit to the (m+p-1th) bit of the mask MG, respectively.

[0240] According to one embodiment, the portion G1_M and the portion MG1 are respectively inserted into the masked data value H_M and the mask MH to form the masked data value I_M and the mask MI, respectively, and more specifically, the p bits of the masked data value H_M from the kth bit to the k+p-1th bit of the mask MH are respectively modified to form the masked data value I_M and the mask MI, respectively. Figure 2 and Figure 3 As disclosed, extraction and insertion operations may have "compensation for mask" or "compensation for masked data values".

[0241] The extraction and insertion operations disclosed in this article are intended to generate a masked data value I_M, so that the data value I obtained by demasking the masked data value I_M with the mask MI is equal to the data H, where the data value G is inserted between the kth bit and the k+p-1th bit, with p bits of data value from the mth bit to the m+p-1th bit.

[0242] In the case of extraction and insertion operations with "compensation for masked data values", the masked data value I_M is given by the following formula:

[0243] I_M[n-1;0]={H_M[n-1;k+p]-CH(k+p))*2 (k+p) +(G_M[m+p-1;m]-CG(m)+CG(m+p)*2 p )*2 n +(H_M[k-1;0]+CH(k)*2 k )}mod2 n

[0244] in:

[0245] - CH(i) represents a carry digit that may occur during an additive masking operation using mask MH resulting in the i-th bit of the masked data value H_M; and

[0246] -CG(i) represents a carry digit that may occur during an additive masking operation using mask MG resulting in the i-th bit of the masked data value G_M.

[0247] The carry digit CH(i+1) is given by the following formula:

[0248]

[0249] The carry digit CG(i+1) is given by the following formula:

[0250]

[0251] In the case of extraction and insertion operations with "compensation for masked data values", the mask MI associated with the data value I_M is given by the following formula:

[0252] MI[n-1;0]=MH[n-1;k+p]*2 k+p +MG[m+p-1;m]*2 k +MH[k-1;0]

[0253] In the case of extraction and insertion operations with "compensation for masking", the masked data value I_M is given by the following formula:

[0254] I_M[n-1;0]={H_M[n-1;k+p]*2 (k+p) +(G_M[m+p-1;m]+CG(m+p)*2 p )*2 k +(H_M[k

[0255] -1;0]+CH(k)*2 k )}mod2 n

[0256] In this case, the mask MI is given by:

[0257] MI[n-1;0]=(MH[n-1;k+p]+CH(k+p))*2 k +p+(MG[m+p-1;m]+CG(m))*2 k +MH[p

[0258] -1;0]mod2 n

[0259] In the case of both extraction and insertion operations with "compensation by mask" and with "compensation by masked data value", the above defined formulas make it possible to find the data value I again from the masked data value I_M and the mask [sic] MI by applying the unmasking operation defined by the following formula:

[0260] I[n-1;0]=(I_M[n-1;0]-MI[n-1;0])mod2 n

[0261] An advantage of these embodiments is that the extraction and insertion operations do not require a demasking operation for the masked data values ​​G_M, H_M and I_M. Therefore, during this operation, the data values ​​G, H and I cannot be accessed.

[0262] Various embodiments and variations have been described. It will be appreciated by those skilled in the art that certain features of these embodiments may be combined, and that other variations will be readily apparent to those skilled in the art.

[0263] Finally, based on the functional description provided above, it is within the capabilities of those skilled in the art to practically implement the embodiments and variations described herein.

Claims

1. A method for processing a masked binary data value, the method being implemented by a device configured to perform cryptographic calculations on the binary data value, the method comprising: receiving, by a processor, from an electronic component, a first masked binary data value, the first masked binary data value being masked by a first mask; extracting, by the processor, a first portion of the first masked binary data value; Obtaining a second masked binary data value by performing a masking operation on the binary data value having all bits equal to "0"; inserting the first portion of the first masked binary data value into the second masked binary data value, the second masked binary data value being masked by a second mask; providing, by the processor, the second masked binary data value to the electronic component; as well as maintaining the first masked binary data value and the second masked binary data value masked throughout the receiving, extracting, inserting and providing; wherein the binary words constituting the first masked binary data value, the second masked binary data value, the first mask, and the second mask are all binary words having n bits, wherein n is a natural integer; wherein a third masked binary data value is a result of said extracting and said inserting, and said third masked binary data value is a data value masked by a third mask; The third masked binary data value Z_M is given by the following formula: Z_M[n-1;0]=(Z_M[n-1;p+1]* 2 p+1 +CB(p+m) *2 p +B_M[p+m-1;m])mod2 n in: -"+" represents addition operation; - "mod" stands for modulo operation; -n represents the number of bits of the third masked binary data value Z_M, and n is a natural integer; -p is a natural integer between 0 and n-1; -m is a natural integer between 0 and np; - CB(i) represents a carry digit of the i-th position which may occur during said masking operation resulting in the first masked binary data value; -B_M represents the first masked binary data value, -The carry digit CB(i+1) is given by the following formula, where i is a natural integer less than or equal to n: wherein MB represents the first mask associated with the first masked binary data value, and The third mask MZ associated with the third masked binary data value is given by the following formula: MZ[n-1;0]=(MZ[n-1;p+1]*2 (p+1) +CB(m)+MB[p+m-1;m])mod2 n 。 2. A method for processing a masked binary data value, the method being implemented by a device configured to perform cryptographic calculations on the binary data value, the method comprising: receiving, by a processor, from an electronic component, a first masked binary data value, the first masked binary data value being masked by a first mask; extracting, by the processor, a first portion of the first masked binary data value; Obtaining a second masked binary data value by performing a masking operation on the binary data value having all bits equal to "0"; inserting the first portion of the first masked binary data value into the second masked binary data value, the second masked binary data value being masked by a second mask; providing, by the processor, the second masked binary data value to the electronic component; as well as maintaining the first masked binary data value and the second masked binary data value masked throughout the receiving, extracting, inserting and providing; wherein the binary words constituting the first masked binary data value, the second masked binary data value, the first mask, and the second mask are all binary words having n bits, wherein n is a natural integer; wherein a third masked binary data value is a result of said extracting and said inserting, and said third masked binary data value is a data value masked by a third mask; The third masked binary data value X_M is given by the following formula: X_M[n-1;0]=(X_M[n-1;p]*2 p+1 +CB(p+m)*2 p +B_M[p+m-1;m]-CB(m))mod2 n in: -"+" represents addition operation; - "mod" stands for modulo operation; -n represents the number of bits of the third masked binary data value X_M, and n is a natural integer; -p is a natural integer between 0 and n-1; -m is a natural integer between 0 and np; - CB(i) represents a carry digit of the i-th position which may occur during said masking operation resulting in the first masked binary data value; -B_M represents the first masked binary data value, -The carry digit CB(i+1) is given by the following formula, where i is a natural integer less than or equal to n: wherein MB represents the first mask associated with the first masked binary data value, and The third mask MX associated with the third masked binary data value is given by the following formula: MX[n-1;0]=(MX[n-1;p+1]*2 (p+1) +MB[p+m-1;m])mod2 n 。 3. A method for processing a masked binary data value, the method being implemented by a device configured to perform cryptographic calculations on the binary data value, the method comprising: receiving, by a processor, from an electronic component, a first masked binary data value, the first masked binary data value being masked by a first mask; extracting, by the processor, a first portion of the first masked binary data value; Obtaining a second masked binary data value by performing a masking operation on the binary data value having all bits equal to "0"; inserting the first portion of the first masked binary data value into the second masked binary data value, the second masked binary data value being masked by a second mask; providing, by the processor, the second masked binary data value to the electronic component; as well as maintaining the first masked binary data value and the second masked binary data value masked throughout the receiving, extracting, inserting and providing; wherein the binary words constituting the first masked binary data value, the second masked binary data value, the first mask, and the second mask are all binary words having n bits, wherein n is a natural integer; wherein a third masked binary data value is a result of said extracting and said inserting, and said third masked binary data value is a data value masked by a third mask; The third masked binary data value I_M is given by the following formula: I_M[n-1;0]={(H_M[n-1;k+p]-CH(k+p))*2 (k+p) +(G_M[m+p-1; m]-CG(m)+CG(m+p)*2 p )*2 k +(H_M[k-1;0]+CH(k)*2 k )}mod2 n in: -"+" represents addition operation; - "mod" stands for modulo operation; -n represents the number of bits of the third masked binary data value I_M, and n is a natural integer; -p is a natural integer between 0 and n-1; -m is a natural integer between 0 and np; -k is a natural integer between 0 and np; - CG(i) represents the first carry digit of the i-th position that may occur during the masking operation resulting in the first masked binary data value; - CH(i) represents the second carry digit of the i-th position that may occur during the masking operation resulting in the second masked binary data value; - G_M represents the first masked binary data value; - H_M represents the second masked binary data value; and -The carry digit CG(i+1) is given by the following formula: -The carry digit CH(i+1) is given by the following formula: - said third mask MI associated with said third masked binary data value is given by the following formula: MI[n-1;0]=MH[n-1;k+p]*2 p+k +MG[m+p-1;m]*2 k +MH[k-1;0] in: -MG represents the mask associated with said first masked binary data value; and -MH represents the mask associated with the second masked binary data value.

4. A method for processing a masked binary data value, the method being implemented by a device configured to perform cryptographic calculations on the binary data value, the method comprising: receiving, by a processor, from an electronic component, a first masked binary data value, the first masked binary data value being masked by a first mask; extracting, by the processor, a first portion of the first masked binary data value; Obtaining a second masked binary data value by performing a masking operation on the binary data value having all bits equal to "0"; inserting the first portion of the first masked binary data value into the second masked binary data value, the second masked binary data value being masked by a second mask; providing, by the processor, the second masked binary data value to the electronic component; as well as maintaining the first masked binary data value and the second masked binary data value masked throughout the receiving, extracting, inserting and providing; wherein the binary words constituting the first masked binary data value, the second masked binary data value, the first mask, and the second mask are all binary words having n bits, wherein n is a natural integer; wherein a third masked binary data value is a result of said extracting and said inserting, and said third masked binary data value is a data value masked by a third mask; The third masked binary data value I_M is given by the following formula: I_M[n-1;0]={H_M[n-1;k+p]*2 (k+p) +(G_M[m+p-1;m]+CG(m+p)* 2 p )* 2 k +(H_M[k-1;0]+CH(k)*2 k )}mod2 n in: -"+" represents addition operation; - "mod" stands for modulo operation; -n represents the number of bits of the third masked binary data value I_M, and n is a natural integer; -p is a natural integer between 0 and n-1; -m is a natural integer between 0 and np; -k is a natural integer between 0 and np; - CG(i) represents the first carry digit of the i-th position that may occur during the masking operation resulting in the first masked data value; - CH(i) represents the second carry digit of the i-th position that may occur during the masking operation resulting in the second masked data value; - G_M represents the first masked binary data value; - H_M represents the second masked binary data value; and -The carry digit CG(i+1) is given by the following formula: -The carry digit CH(i+1) is given by the following formula: - said third mask MI associated with said third masked binary data value is given by the following formula: MI[n-1;0]=(MH[n-1;k+p]+CH(k+p))*2 p+k +(MG[m+p-1;m]+CG(m))*2 k +MH[k-1;0] in: -MG represents the mask associated with said first masked binary data value; and -MH represents the mask associated with the second masked binary data value.

5. The method according to any one of claims 1 to 4, further comprising: No demasking operation is performed on the first masked binary data value and the second masked binary data value.

6. The method according to any one of claims 1 to 4, further comprising: The first masked binary data value and the second masked binary data value are masked by a masking operation comprising only arithmetic operations.

7. The method according to claim 6, wherein the masking operation comprises: The binary data value to be masked is added to the mask to obtain the masked binary data value.

8. The method of any one of claims 1 to 4, wherein the second masked binary data value is equal to a second mask used during the masking operation.

9. A device configured to perform cryptographic calculations on masked binary data values, the device comprising: The processor is configured as: receiving a first masked binary data value from an electronic component; extracting a first portion of a first masked binary data value, the first masked binary data value being masked by a first mask; Obtaining a second masked binary data value by performing a masking operation on the binary data value having all bits equal to "0"; inserting the first portion of the first masked binary data value into the second masked binary data value, the second masked binary data value being masked by a second mask; providing the second masked binary data value to the electronic component; and maintaining both the first masked binary data value and the second masked binary data value masked throughout said receiving, said extracting, said inserting and said providing; wherein the binary words constituting the first masked binary data value, the second masked binary data value, the first mask, and the second mask are all binary words having n bits, wherein n is a natural integer; wherein a third masked binary data value is a result of said extracting and said inserting, and said third masked binary data value is a data value masked by a third mask; The third masked binary data value Z_M is given by the following formula: Z_M[n-1;0]=(Z_M[n-1;p+1]*2 p+1 +CB(p+m)*2 p +B_M[p+m-1;m])mod2 n in: -"+" represents addition operation; - "mod" stands for modulo operation; -n represents the number of bits of the third masked binary data value Z_M, and n is a natural integer; -p is a natural integer between 0 and n-1; -m is a natural integer between 0 and np; - CB(i) represents a carry digit of the i-th position which may occur during said masking operation resulting in the first masked binary data value; -B_M represents the first masked binary data value, -The carry digit CB(i+1) is given by the following formula, where i is a natural integer less than or equal to n: wherein MB represents a first mask associated with the first masked binary data value, and The third mask MZ associated with the third masked binary data value is given by the following formula: MZ[n-1;0]=(MZ[n-1;p+1]*2 (p+1) +CB(m)+MB[p+m-1;m])mod2 n 。 10. A device configured to perform cryptographic calculations on masked binary data values, the device comprising: The processor is configured as: receiving a first masked binary data value from an electronic component; extracting a first portion of a first masked binary data value, the first masked binary data value being masked by a first mask; Obtaining a second masked binary data value by performing a masking operation on the binary data value having all bits equal to "0"; inserting the first portion of the first masked binary data value into the second masked binary data value, the second masked binary data value being masked by a second mask; providing the second masked binary data value to the electronic component; and maintaining both the first masked binary data value and the second masked binary data value masked throughout said receiving, said extracting, said inserting and said providing; wherein the binary words constituting the first masked binary data value, the second masked binary data value, the first mask, and the second mask are all binary words having n bits, wherein n is a natural integer; wherein a third masked binary data value is a result of said extracting and said inserting, and said third masked binary data value is a data value masked by a third mask; The third masked binary data value X_M is given by the following formula: X_M[n-1;0]=(X_M[n-1;p]*2 p+1 +CB(p+m)*2 p +B_M[p+m-1;m]-CB(m))mod2 n in: -"+" represents addition operation; - "mod" stands for modulo operation; -n represents the number of bits of the third masked binary data value X_M, and n is a natural integer; -p is a natural integer between 0 and n-1; -m is a natural integer between 0 and np; - CB(i) represents a carry digit of the i-th position which may occur during said masking operation resulting in the first masked binary data value; -B_M represents the first masked binary data value, -The carry digit CB(i+1) is given by the following formula, where i is a natural integer less than or equal to n: wherein MB represents a first mask associated with the first masked binary data value, and The third mask MX associated with the third masked binary data value is given by the following formula: MX[n-1;0]=(MX[n-1;p+1]*2 (p+1) +MB[p+m-1;m])mod2 n 。 11. A device configured to perform cryptographic calculations on masked binary data values, the device comprising: The processor is configured as: receiving a first masked binary data value from an electronic component; extracting a first portion of a first masked binary data value, the first masked binary data value being masked by a first mask; Obtaining a second masked binary data value by performing a masking operation on the binary data value having all bits equal to "0"; inserting the first portion of the first masked binary data value into the second masked binary data value, the second masked binary data value being masked by a second mask; providing the second masked binary data value to the electronic component; as well as maintaining the first masked binary data value and the second masked binary data value masked throughout the receiving, extracting, inserting and providing; wherein the binary words constituting the first masked binary data value, the second masked binary data value, the first mask, and the second mask are all binary words having n bits, wherein n is a natural integer; wherein a third masked binary data value is a result of said extracting and said inserting, and said third masked binary data value is a data value masked by a third mask; The third masked binary data value I_M is given by the following formula: I_ M[n-1;0]={(H _ M[n-1; k+p]-CH(k+p))*2 (k+p) +(G_ M[m+p-1; m]-CG(m)+CG(m+p)*2 p )*2 k +(H_M[k-1;0]+CH(k)*2 k )}mod2 n in: -"+" represents addition operation; - "mod" stands for modulo operation; -n represents the number of bits of the third masked binary data value I_M, and n is a natural integer; -p is a natural integer between 0 and n-1; -m is a natural integer between 0 and np; -k is a natural integer between 0 and np; - CG(i) represents the first carry digit of the i-th position that may occur during the masking operation resulting in the first masked binary data value; - CH(i) represents the second carry digit of the i-th position that may occur during the masking operation resulting in the second masked binary data value; - G_M represents the first masked binary data value; - H_M represents the second masked binary data value; and -The carry digit CG(i+1) is given by the following formula: -The carry digit CH(i+1) is given by the following formula: - said third mask MI associated with said third masked binary data value is given by the following formula: MI[n-1;0]=MH[n-1;k+p]*2 p+k +MG[m+p-1;m]*2 k +MH[k-1;0] in: -MG represents the mask associated with said first masked binary data value; and -MH represents the mask associated with the second masked binary data value.

12. A device configured to perform cryptographic calculations on masked binary data values, the device comprising: The processor is configured as: receiving a first masked binary data value from an electronic component; extracting a first portion of a first masked binary data value, the first masked binary data value being masked by a first mask; Obtaining a second masked binary data value by performing a masking operation on the binary data value having all bits equal to "0"; inserting the first portion of the first masked binary data value into the second masked binary data value, the second masked binary data value being masked by a second mask; providing the second masked binary data value to the electronic component; and maintaining both the first masked binary data value and the second masked binary data value masked throughout said receiving, said extracting, said inserting and said providing; wherein the binary words constituting the first masked binary data value, the second masked binary data value, the first mask, and the second mask are all binary words having n bits, wherein n is a natural integer; wherein a third masked binary data value is a result of said extracting and said inserting, and said third masked binary data value is a data value masked by a third mask; The third masked binary data value I_M is given by the following formula: I_M[n-1;0]={H_M[n-1;k+p]*2 (k+p) +(G_M[m+p-1;m]+CG(m+p)*2 p )*2 k +(H_M[k-1;0]+CH(k)*2 k )}mod2 n in: -"+" represents addition operation; - "mod" stands for modulo operation; -n represents the number of bits of the third masked binary data value I_M, and n is a natural integer; -p is a natural integer between 0 and n-1; -m is a natural integer between 0 and np; -k is a natural integer between 0 and np; - CG(i) represents the first carry digit of the i-th position that may occur during the masking operation resulting in the first masked binary data value; - CH(i) represents the second carry digit of the i-th position that may occur during the masking operation resulting in the second masked binary data value; - G_M represents the first masked binary data value; - H_M represents the second masked binary data value; and -The carry digit CG(i+1) is given by the following formula: -The carry digit CH(i+1) is given by the following formula: The third mask MI associated with the third masked binary data value is given by the following formula: MI[n-1;0]=(MH[n-1;k+p]+CH(k+p))*2 p+k +(MG[m+p-1;m]+CG(m))*2 k +MH[k-1;0] in: -MG represents the mask associated with said first masked binary data value; and -MH represents the mask associated with the second masked binary data value.

13. The apparatus of any one of claims 9 to 12, the processor being further configured not to perform any demasking operations on the first masked binary data value and the second masked binary data value.

14. The apparatus according to any one of claims 9 to 12, wherein the processor is configured to mask the first masked binary data value and the second masked binary data value by a masking operation comprising only arithmetic operations.

15. The apparatus of claim 14, wherein the masking operation comprises: The processor is configured to add the binary data value to be masked to the mask to obtain the masked binary data value.

16. Apparatus according to any one of claims 9 to 12, wherein the second masked binary data value is equal to a second mask used during the masking operation.

Images