Using a shared computing device

Abstract

Some embodiments are directed to a computing device for performing calculations on at least one set of values. The values ​​are stored in a memory as a plurality of shares defining the values. A calculation operation may be performed on a set of input values ​​to obtain an output value. The output value may be defined by at least one shared share and at least one calculated share. The at least one shared share may also define an additional value, such as the output of a previously performed calculation or the output of another operation performed in parallel with the operation. The at least one calculated share is calculated based on the at least one shared share and the shares of the set of input values. An error in the shared share affects the additional value, but an error in the calculated share does not, complicating a share reduction attack.

Description

Technical Field

[0001] The present invention relates to a computing device, a computing method and a computer readable medium. Background Art

[0002] Computations involving sensitive data (e.g., cryptographic operations) can be attacked by various types of attackers. For example, a cryptographic primitive is said to be secure in a black-box model if an attacker who only knows the inputs and outputs of the primitive cannot escalate his privileges (e.g., obtain secret keys, encrypt messages, decrypt messages, etc.). For other types of computations involving sensitive information, such as in modeling, machine learning, statistics, etc., it is also important that attackers cannot obtain sensitive information used in the computation.

[0003] In practice, however, attackers do not usually operate in a black-box model, and in fact have access to more information than just the inputs and outputs. For example, in a gray-box model, it is assumed that the attacker has access to some information about the execution of the computation. These additional sources of information are called "side channels." Side channels include, for example, how long an operation takes, or how much power it consumes. In an even more powerful model, the so-called white-box model, the attacker has full access to all the internal values ​​of the computation. The attacker may be able to modify the values ​​even while the program is running. Even so, white-box implementations are designed to prevent sensitive values ​​from being extracted from the computation.

[0004] In known white-box implementations, for example as described in European patent application EP 3363142 A1, a sensitive value may be represented by a plurality of shares. The use of shares may improve protection against various types of side-channel attacks, since any information that an attacker can infer about one or several shares of a sensitive value does not contain information about the stored sensitive value. In practice, the use of shares allows a lot of entropy to be introduced into the implementation, while keeping variables small to ensure that the implementation remains acceptable in terms of runtime and code size. Unfortunately, such an implementation may be susceptible to various types of share reduction and / or share localization attacks, in which an attacker is able to reduce the number of shares, destroying the entropy introduced by the shares, thereby reducing the protection provided by the introduction of shares.

[0005] Therefore, there is a need to provide an apparatus for calculating shares of a value that provides better protection against share reduction and / or share positioning attacks. Summary of the invention

[0006] In order to better solve one or more of the above problems, a computing device as defined in the claims is proposed. The computing device performs a calculation on at least one set of values. Each value in the set of values ​​can be stored in a memory as a plurality of shares defining the value.

[0007] According to a first aspect, a calculated operation may be performed on a set of input values ​​to obtain an output value. The output value may be defined by at least one shared share and at least one calculated share. The at least one shared share may also define additional values. The at least one calculated share may be calculated from the at least one shared share and the shares of the set of input values.

[0008] Because at least one shared share also defines an additional value, but at least one calculated share does not, introducing an error in at least one shared share generally affects the computation differently than introducing an error in at least one calculated share. For example, an error in a shared share may affect future operations using the additional value, whereas an error in a calculated share does not affect future operations using the additional value. Thus, it is made more difficult for an attacker to determine that at least one shared share and at least one calculated share are both shares of the output value. This complicates various attacks, for example, share reduction or share location attacks may be made more difficult.

[0009] In one embodiment, the calculation may include the evaluation of a cryptographic function such as a block cipher. For example, a cryptographic key used by the cryptographic function may be hard-coded into the calculation, and the use of a shared share makes it more difficult to extract this key.

[0010] In one embodiment, the input value and the output value may not be calculated as an intermediate result of performing the operation. This may further complicate the attack because, for example, share reduction or share positioning attacks cannot be launched against the intermediate results of the operation.

[0011] In one embodiment, calculating the at least one calculated share may include calculating a sequence of multiple intermediate results, each intermediate result is calculated from the at least one shared share. In this way, the intermediate results of performing the operation include contributions from the at least one shared share. This can ensure that the intermediate results of calculating the at least one calculated share are as independent of the input values ​​as possible.

[0012] In one embodiment, the further value may be independent of the input value, e.g. uncorrelated. Since introducing an error in the at least one share may affect the further value, choosing a further value that is independent of the input value may increase the unpredictability of the effect of the error. For example, the error occurs in a different part of the calculation. This may make an attack more difficult.

[0013] In one embodiment, each share that defines an output value also defines another value. This has the advantage that the likelihood of invalid errors in the shares of the output values ​​can be reduced. For example, an error in the output value may not always affect the overall output of the calculation, but each error in the share of the output value may also cause an error in the additional value, making it more likely that the total output of the calculation will be affected. Therefore, statistically invalid error analysis type attacks become more difficult.

[0014] In one embodiment, the further value is the output of a previous operation of a calculation performed before the operation. This allows a share of the further value to be reused as a share of the share without the need for recalculation.

[0015] In one embodiment, the calculation may include additional operations on another set of input values ​​to obtain additional values. Like the output value, the additional value may be defined by at least one shared share and additionally by at least one additional calculated share. The processor may calculate the at least one calculated share from the at least one shared share and the share of the set of input values. The processor may calculate the at least one additional calculated share from the at least one shared share and the share of another set of input values. This allows the shared share to be obtained with relatively little overhead by performing two operations simultaneously.

[0016] In one embodiment, the processor may be further configured to calculate the share of the at least one share using at least one share of the output of a previously executed operation as a random value. This may ensure that the share of the at least one share appears sufficiently random to an attacker without the need for an external source of randomness.

[0017] In one embodiment, the operation and the further operation may be the same operation. This may make the operation and the further operation appear more similar to an attacker.

[0018] In one embodiment, the calculation may include a first and a second parallel calculation branch. Each calculation branch may calculate a copy of the same output. The average calculation may combine these multiple copies of the same output into a single output. The operation and the additional operation may be included in different parallel calculation branches. Such parallel calculation branches may prevent various attacks and may be combined in this manner with relatively little overhead.

[0019] In one embodiment, a first parallel computation branch may include an obfuscated computation, followed by an inverse of the obfuscated computation, followed by a functional computation, followed by a dummy computation, and a second parallel computation branch may include a dummy computation, followed by a functional computation, followed by an obfuscated computation, followed by an inverse of the obfuscated computation. This may result in computations at the same depth in the circuit for each parallel computation branch to compute on different inputs, thereby increasing the unpredictability of introducing errors in each share.

[0020] In one embodiment, each parallel computation branch may also include an additional obfuscation computation after the functional computation. The computation may also include the inverse of the additional obfuscation computation after the average computation. This may further complicate the attack by ensuring that the average computation is performed on data that appears independent of the computation output.

[0021] In one embodiment, the calculations may also include an initial obfuscated calculation followed by an inverse of the initial obfuscated calculation. These initial calculations may provide shares that may be used as shares for subsequent operations and / or shares from which the shares are calculated without affecting the calculation results.

[0022] In one embodiment, the value may be a bit and the computation may include a binary circuit. The binary circuit may be particularly suitable for performing various computations, such as block cipher computations.

[0023] In one embodiment, further operations (e.g., to computations) that use the output value as input are interleaved. This complicates attacks where an attacker introduces an error in the shares of the output value before one operation that uses the output value but after another operation that uses the output value. Such attacks could otherwise undermine the share reduction / share positioning protections provided.

[0024] In one embodiment, a share of the plurality of shares may be stored encoded, which makes it more difficult to derive sensitive data from the memory contents. In one embodiment, multiple values ​​of a set of values ​​may be composed into a combined value, which is stored encoded. By applying encoding at a different granularity than shares, attacks targeting a single granularity become more difficult.

[0025] According to another aspect, the processor of the computing device is configured to reshare the first value and the second value. To this end, the processor can calculate at least one new shared share defining the first value and the second value based on the previous share defining the first value and the previous share defining the second value. The processor can also calculate at least one additional new share defining the first value based on the at least one new shared share and the previous share defining the first value. The processor can also calculate at least one additional new share defining the second value based on the at least one new shared share and the previous share defining the second value. In this way, new shares of the first value and the second value that are independent of the previous shares can be obtained. This may make it more difficult for an attacker to track the values ​​through calculations. It can also enable some of these operations to be performed in pairs with other operations, and some other operations are not calculated using the various techniques described herein.

[0026] Another aspect relates to a computing device configured to reshare a value. The value may be defined after resharing by at least one shared share and at least one calculated share. The at least one shared share may also define an output of a calculated operation performed prior to resharing. Resharing may include calculating the at least one calculated share based on the at least one shared share and the share that defined the value prior to resharing. This provides another method of obtaining a new share of a value that is independent of the share prior to resharing. In addition, it facilitates combining executed operations with additional operations and unexecuted operations in a single computation.

[0027] Another aspect relates to a computing method. The method according to the invention can be implemented on a computer as a computer-implemented method, or can be implemented in dedicated hardware, or in a combination of the two. The executable code of the method according to the invention can be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transient program code stored on a computer-readable medium for performing the method according to the invention when the program product is executed on a computer.

[0028] In a preferred embodiment, the computer program comprises computer program code adapted to perform all the steps of the method according to the invention when the computer program is run on a computer.Preferably, the computer program is embodied on a computer readable medium.

[0029] Another aspect of the invention provides a method for making a computer program available for download. This aspect is used when the computer program is uploaded to, for example, Apple's App Store, Google's Play Store, or Microsoft's Windows Store and can be downloaded from such stores. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Further details, aspects and embodiments of the invention will be described, by way of example only, with reference to the accompanying drawings. The elements in the drawings are shown for simplicity and clarity and are not necessarily drawn to scale. In the drawings, elements corresponding to elements already described may have the same reference numerals. In the drawings,

[0031] Figure 1 schematically illustrates an example of an embodiment of a computing device,

[0032] Figure 2 schematically illustrates an example of an embodiment of a computing device,

[0033] Figure 3a schematically illustrates an example of an embodiment of a computing device,

[0034] Figure 3b schematically illustrates an example of an embodiment of a computing device,

[0035] Figure 4 schematically illustrates an example of an embodiment of a computing device,

[0036] Figure 5 schematically illustrates an example of an embodiment of a computing device,

[0037] Figure 6 schematically illustrates an example of an embodiment of a computing device,

[0038] Figure 7a schematically illustrates an example of an embodiment of a computing device,

[0039] Figure 7b schematically illustrates an example of an embodiment of a computing device,

[0040] Figure 8a schematically illustrates an example of an embodiment of a calculation method,

[0041] Figure 8b schematically shows a computer-readable medium having a writable portion comprising a computer program according to an embodiment,

[0042] Figure 8c A representation of a processor system according to one embodiment is schematically shown.

[0043] List of reference numerals:

[0044] 100 computing devices

[0045] 130 processors

[0046] 131 Operation unit

[0047] 140 Memory

[0048] 141, 142 Input value

[0049] 143 Output value

[0050] 144 Additional values

[0051] 141.1, 141.2, 142.1, 142.2, 144.2 shares

[0052] 143.2 Calculated Shares

[0053] 143.1 = 144.1 shared shares

[0054] 200 computing devices

[0055] 230 processors

[0056] 231 Operation Unit

[0057] 240 Memory

[0058] 241, 243 Input value in a set of input values

[0059] 242, 244 Input value from another set of input values

[0060] 245 output value

[0061] 246 Additional values

[0062] 241.2, 242.2, 243.2, 244.2, 245.2, 246.2 shares

[0063] 241.1 = 242.1, 243.1 = 244.1, 245.1 = 246.1 shared shares

[0064] 300, 300' computing equipment

[0065] 330, 330' processor

[0066] 340, 340' memory

[0067] 331, 332 parallel computing branch units

[0068] 333, 338, 339 operating units

[0069] 335 Average calculation unit

[0070] 336 Confusion Computing Unit

[0071] 337 Anti-obfuscation calculation unit

[0072] 343 output value

[0073] 343.1 Shared Share

[0074] 400 computing devices

[0075] 430 processor

[0076] 431 First parallel computing branch unit

[0077] 432 Second parallel computing branch unit

[0078] 433 Operation Unit

[0079] 435 Average calculation unit

[0080] 451, 454, 458, 459 Confusion calculation unit

[0081] 452, 460, 461 anti-obfuscation calculation unit

[0082] 453, 457 Functional Computing Unit

[0083] 455, 456 virtual calculation unit

[0084] 440 Memory

[0085] 500 computing devices

[0086] 530 processor

[0087] 531 coded operation unit

[0088] 540 Memory

[0089] 541 Input value

[0090] 542 output value

[0091] 544 Additional value

[0092] 541.1, 541.2, 544.1 shares

[0093] 542.1 Calculated Shares

[0094] 542.2 = 544.2 shared shares

[0095] 600 computing devices

[0096] 630 processor

[0097] 631 Encoding Function Unit

[0098] 640 Memory

[0099] 641, 644 combination value

[0100] 642, 643, 645, 646 constitute the value of the combination

[0101] 700 computing devices

[0102] 730 processor

[0103] 731 Re-sharing Unit

[0104] 740 Memory

[0105] 741 first value

[0106] 742 Second Value

[0107] 741.1, 741.1 defines the previous share of the first value

[0108] 742.1, 742.2 Define the previous share of the second value

[0109] 741.1'=742.1' defines the new share of the first value and the second value

[0110] 741.2' Define another new share of the first value

[0111] 742.2' Define another new share of the second value

[0112] 800 computing devices

[0113] 830 processor

[0114] 831 Re-shared unit

[0115] 840 Memory

[0116] 841 value

[0117] 841.1, 841.2 define the share of the value before re-sharing

[0118] 841.1' = 844.1 shared share

[0119] 841.2' Calculated share

[0120] 844 Output of the operations performed before re-sharing

[0121] 844.2 Output share

[0122] 900 Calculation Method

[0123] 910 provides a set of values

[0124] 920 Execute Operation

[0125] 921 Calculate at least one calculated share

[0126] 1000 Computer readable medium

[0127] 1010 Writable part

[0128] 1020 Computer Programs

[0129] 1110 Integrated Circuit

[0130] 1120 Processing Unit

[0131] 1122 Memory

[0132] 1124 ASIC

[0133] 1126 Communication Components

[0134] 1130 Interconnect

[0135] 1140 processor system DETAILED DESCRIPTION

[0136] Although the present invention may be implemented in many different forms, one or more specific embodiments are shown in the drawings and will be described in detail herein, but it should be understood that this disclosure is considered as an example of the principles of the invention and is not intended to limit the invention to the specific embodiments shown and described.

[0137] Hereinafter, for the sake of understanding, the elements of the embodiments are described in operation. However, it will be apparent that the various elements are arranged to perform the functions described as being performed by them.

[0138] Furthermore, the invention is not limited to the embodiments, and the invention lies in each and every novel feature or combination of features described herein or recited in mutually different dependent claims.

[0139] To introduce the present invention, first, several attacks on white-box implementations are discussed. In various white-box implementations, sensitive variables are represented by multiple shares. For example, a value x can be represented by n additive shares (x0, ..., x n-1 ) means, for example But for any ∑ i∈S x i is random. Therefore, information derived from a subset of the value shares may contain no information about the value, while information from all shares may contain information that allows the value to be derived. In general, entropy, such as random values ​​x0,…,x n-1 , which helps resist side-channel attacks. At the same time, the variables stored as shares can still be relatively small, so the white-box implementation can still be acceptable in terms of runtime and code size.

[0140] Unfortunately, white-box implementations using shares can be vulnerable to share reduction attacks. In this attack, the attacker reduces the number of shares, effectively destroying the entropy introduced by the shares. Eventually, the attacker may be able to reduce the number of shares for a value to one, thereby completely eliminating the effect of the introduced shares. To launch a share reduction attack, the attacker typically aims to find the locations of shares that correspond to the same value, e.g., finding two shares with the same value.

[0141] A possible attack on the share representation is based on the following observation: if {z i} i is a set of additive shares that represent or define a value z in a particular computation, then any z can be i Change to z i +δ and converts the value z represented by z+δ. Now, if the result of the calculation depends only on the value z represented by z, then for z i Each of the introduced causes z i +δ, the calculated output may be the same. Now, suppose the attacker is provided with a gate C0,…,C n Calculation of z i ←C i (x i ) indicates that gate i has a i The case is evaluated as z i Then, for all i = 1,…,n, the attacker may run the computation on a constant input and wait until the evaluation exits door i. Then, for any δ, the attacker can set z i Change to z i +δ and collect the corresponding output O i,δ If for any δ we assume that there exists δ' (where O i,δ =O j,δ′ ), then the attacker can infer that gates i and j operate on the same value. Note that δ can be different from δ′ when, for example, the shares are stored encoded.

[0142] After an attacker has found two or more shares that operate on the same value, the attacker may be able to reduce those shares. For example, if the shares are not encoded, the attacker can reduce the shares by adding them. If the shares are stored encoded, the operation of reducing the shares can be performed based on additional analysis. For example, in this case, it can be observed that for any Δ there exists a Δ' such that

[0143] Enc(z j )+Δ=Enc(z j +δ), and

[0144] Enc(z k)+Δ′=Enc(z k -δ).

[0145] Such that the output remains unchanged. Such pairs can be equivalent with respect to the represented sum, e.g., define the same value. The set can be labeled 0. The process can be repeated starting with a pair outside the set just created, e.g., until all pairs are labeled. Such an attack can be performed recursively, e.g., until each set of n shares has a label, e.g., of size a single share. During execution, the attacker can then replace the observed set of n corresponding shares with a label that can be viewed as a single encoding of the value z represented. This can enable attacks such as mutual information analysis (MIA) or differential computation analysis (DCA) to extract sensitive information.

[0146] Various embodiments herein make it more difficult for an attacker to launch share reduction and / or share positioning attacks. Nonetheless, the protection mechanisms described herein do not require a high cost in terms of, for example, the number of shares required. For example, in some embodiments, values ​​are stored in fewer than five shares, such as three shares, four shares, or even only two shares. Furthermore, in various embodiments, linear operations, such as addition or XOR gates, can be implemented as functions on individual shares. In various embodiments, security is further improved by allowing multiplication (e.g., AND gates) to be performed and re-randomization to further complicate statistical attacks.

[0147] A wide variety of computations may be performed using the techniques described herein, for example, computations specified by binary or arithmetic circuits, or various iterative algorithms with reversible iterations.

[0148] In particular, embodiments of the present invention allow for the execution of calculations including the evaluation of cryptographic primitives (such as, for example, block ciphers of the AES algorithm) with enhanced protection against share reduction / share location attacks. Some of the examples below focus on the AES block cipher described in the Advanced Encryption Standard of the United States Federal Information Processing Standards Publication 197, 2001. AES is an important and heavily used cryptographic primitive. However, it should be emphasized that the following techniques can also be applied to other cryptographic primitives. For example, other block ciphers can be implemented as embodiments. In particular, block ciphers designed for SLT (substitution / linear transformation block ciphers, sometimes also referred to as substitution permutation network (SPN) block ciphers) can be adjusted without difficulty, such as AES (Rijndael), 3-Way, Kuznyechik, PRESENT, SAFER, SHARK and Square. Cryptographic primitives can be symmetric primitives, for example, where the encryption / decryption keys are the same, or are signature / verification keys. Cryptographic primitives can also be keyless, such as hash functions. Protecting hash functions can be important because they may be applied to secret data. In practice, the hash function may be part of a keyed design, for example if it is used in an HMAC.

[0149] One of the inventors' insights that led to these improvements was the use of shared shares. The same shared share can define multiple values. For example, two values ​​x and y can be stored in memory as shares (s0, s1, s2) = (r, xr, yr), where x = s0 + s1 and y = s0 + s2. Therefore, s0 is a shared share that defines x and y. Introducing an error in s0 may change both the x and y values, while introducing an error in s1 (or s2, respectively) may only change the x value (y, respectively). Therefore, the overall computational output obtained by an error in any of the three shares may be different.

[0150] The operation of a computation can result in an output value defined by shares. In addition to shares being output values, shared shares can also be shares of other values. For example, consider a computation where at some point in time each value is represented by two shares, where is the set of shares introduced at that point in time. Then, to calculate the output value z = f(x, y) on the shares of input values ​​x, y, we can create a function about the input x0, x1 (both x's share) and y0, y1 (both in In the circuit, the share of y) is obtained, and the calculated share of the output value z0 is obtained, for example, z0 = f(x, y) - s j The other share of the output value can be implicitly defined as Here, jThis can be the output of a previously executed operation, for example, So that for some value v, s j +s k = v. In the calculation of the share z o After that, we now have z0+s j = z, so s j Now we define the share of value z and value v. Therefore, if the attacker j If an error is introduced at z0 or s k Introducing an error at may only affect z or u. However, other ways of obtaining a shared share are possible, for example, two operations performed simultaneously may result in a shared share defining the output of the two operations. Various detailed embodiments combining the above insights are provided below.

[0151] There are various other attacks that an attacker might use that actively interfere with the execution of a computation. One attack is what is known as differential fault analysis (DFA). In some DFA attacks, the attacker introduces an error during the computation, and the change in the output due to that error might be able to obtain information about the secret.

[0152] Another type of attack where an attacker may actively interfere with the execution of an algorithm is the so-called Statistical Invalidity Error Analysis (SIFA). SIFA focuses on invalidity errors, e.g., errors that do not affect the output of a computation for some inputs but do affect the output for other inputs. An attacker may find, for example, input / output pairs for which the error is invalid. The fact that the error is invalid can be used as an indication that some internal variable in the circuit is not uniformly distributed for these particular inputs, whereas it would be if the inputs were uniformly distributed. When inhomogeneities appear in internal variables that are related to a relatively small part of the input or output and a small part of the secret, it can be used to extract this part of the secret.

[0153] As a possible countermeasure against DFA, redundancy can be introduced into the calculation. The introduction of errors that will cause the output to change can be detected by observing the output differences of the redundant parts of the circuit. For example, the calculation can be designed to give no output or to give useless output. If the error is invalid, such countermeasures may not be effective and therefore may not be sufficient to defend against SIFA attacks.

[0154] In general, to protect against SIFA attacks, it is beneficial to reduce the number of invalid errors, especially in sensitive parts of the computation. For example, a computation may be performed in such a way that for at least some of the computed values, a single bit flip in any share of the values ​​may affect the output. Eliminating such single-bit invalid errors may be particularly advantageous because an attacker can exploit them relatively easily. For example, looking for an invalid single-bit flip in a portion of a computation with N operations may take N^k order of time, which may be feasible if N is not too large. On the other hand, looking for an invalid error with multiple (e.g., k>1) bit flips in that same portion of the circuit may require N^k order of time and is therefore more difficult.

[0155] The use of shared shares may help reduce the number of invalid errors and / or make it more difficult to find errors. For example, since an error in a shared share that defines multiple values ​​may affect these multiple values, such an error may not be invalid because it will always affect the output, or at least it may be difficult to detect that the error is invalid because there are fewer calculation input values ​​that do not affect the output. In various embodiments, invalid errors become more unlikely and / or more difficult to detect because each share of the output value that defines an operation also defines a corresponding other value. In other words, this value does not have a non-shared share, and the non-shared share is more likely to be invalid than the shared share.

[0156] Figure 1 An example of an embodiment of a computing device 100 is schematically shown. The computing device 100 includes a processor 130 and a memory 140. The memory 140 may be used for data and / or instruction storage. For example, the memory 140 may include software and / or data on which the processor 130 is configured to function. The memory 140 may also store values ​​141-144. The processor 130 may be implemented as one or more processor circuits, such as a microprocessor, an ASIC, an FPGA, etc. The memory 140 may include computer program instructions that may be executed by the processor 130. The processor 130 is configured according to an embodiment of the computing device, possibly together with the memory 140.

[0157] The computing device 100 can be used to perform calculations on at least one set of values. The values ​​can be bits, bytes, field elements, ring elements, integers modulo a given modulus, such as a prime modulus, etc. The calculation can, for example, include a binary circuit that evaluates the bit value, for example, a binary circuit that includes AND and / or XOR operations. The calculation can alternatively or additionally include an arithmetic circuit, for example, an arithmetic circuit that includes addition and / or multiplication operations. The calculation typically includes, for example, a plurality of operations performed according to various embodiments described herein, also referred to as gate operations. For example, the calculation can include at least 100 operations, at least 1000 operations, and the like.

[0158] The computing device 100 can advantageously perform various types of computations, such as cryptographic operations, statistical computations, data analysis computations, simulations of physical systems, and the like. For example, in various embodiments, the computations can include evaluations of cryptographic functions, such as evaluations of block ciphers on input messages using symmetric keys, computations of digital signatures on input messages using private signature keys, or decryption of encrypted messages using private decryption keys. The set of values ​​can include various sensitive values. For example, in the above examples, the values ​​that make up the symmetric key and the private key can be sensitive, and thus computational values ​​that depend on them can be intermediate values. In various types of computations, such as statistical / data analysis / simulation computations, some input data can be sensitive, for example, it can be privacy-sensitive or commercially sensitive. Therefore, it is advantageous to improve the protection of such data, such as to prevent share reduction and / or share location attacks.

[0159] The memory 140 may be configured to store a set of values ​​{z i}. A calculation may be performed on at least the set of values. Each value in the set of values ​​may be stored as a plurality of shares s defining the value i,j , such as a secret share. For example, in the figure four values ​​z1 141, z2 142, z3 143, and z4 144 are shown. For example, the value z1 141 can be stored as a share s 1,1 141.1 and s 1,2 141.2; the value z2 142 can be stored as share s 2,1 142.1 and s 2,2 142.2; the value z3 143 can be stored as share s 3,1 143.1 = 144.1 and s 3,2 143.2; the value z4 144 can be stored as a share s 4,1 143.1 = 144.1 and s 4, 2144.2. Both the number of values ​​and the number of shares for each value are illustrative, for example, at least one value may be stored as more than two shares, for example, three shares, four shares, five shares or more. The number of values ​​may be, for example, at least 100 or at least 1000.

[0160] Throughout, we say that one or more shares define a value if the share is contained in the multiple shares that the value is stored as. It will be understood that this is non-limiting, for example, there may be additional shares in the multiple shares and / or the shares may define additional values. Similarly, when we say that a value is "defined" by shares, etc., it means that the share is contained in the multiple shares that the value is stored as, and there may be other shares that define the value and / or other values ​​defined by the shares. Sometimes, to emphasize this aspect, we will say "a value is at least partially defined by shares", "shares at least partially define a value", and so on.

[0161] A reconstruction function may be used to calculate a value from a plurality of shares, defined by the plurality of shares stored as a plurality of shares s i,j The value of z i Conversely, a share of a defined value may be obtained from an unshared value using a sharing function (eg, a secret sharing function) that computes a share from the unshared value.

[0162] Various sharing and reconstruction methods are known and can be used here. For example, the value v i and its share i,1 ,…,s i,n can be bits, the reconstruction function of the value is defined as the exclusive OR (XOR) of the fraction v i =s i,1 xor…xors i,n Another value v j and its share v j,1 ,…,v j,m Can be a ring element, value v j According to its share is defined as the sum of the shares v j =v j,1 +…+v j,m Various other types of shares may be used instead or in addition, such as Shamir shares or replicated secret shares. i,1 ,…,s i,n can be obtained from the unshared value v i obtained, for example, by setting all but one of the shares independently of the unshared values, for example, randomly or to a fixed value, and then calculating the remaining shares from them, for example, s i,1 =v i xors i, 2xor…xors i,n .

[0163] In general, a single share cannot fix the value. In fact, a value that is partially defined by a share may be undefined given the share, e.g., all possibilities for the value are equally possible. For example, for a value v defined as v=s1+s2 in terms of shares s1 and s2, if s2 is fixed by letting s1=V-s2, the value v can still take any value V. In some cases, the value can even still take any value even if all its shares except one are fixed, e.g., if s2,…,s7 are fixed by letting s1=V-s2-…-s7, then v=s1+…+s7 can still take any value V. As a result, storing values ​​as shares may already provide a degree of protection, since the value cannot be determined from a subset of the shares.

[0164] Interestingly, the shared shares 143.1=144.1 stored in the memory 140 may partially define multiple values, for example, the first value 143 may be stored as a first plurality of shares, such as shares 143.1=144.1 and 143.2, and the second value 144 may be stored as a second plurality of shares, such as shares 143.1=144.1 and 144.2. At least one shared share, such as share 143.1=144.1, may be included in the first plurality of shares and the second plurality of shares. Having a shared share that defines multiple values ​​may allow different shares to define different sets of values. For example, share 143.1=144.1 in the figure defines values ​​143 and 144, while share 143.2 defines value 143 but does not define value 144. This is advantageous because it helps mitigate attacks on individual values, such as share reduction and / or share positioning attacks, as explained.

[0165] Specifically, as illustrated in various embodiments below, the value 143 defined by the shared share 143.1=144.1 may be an output value obtained by the operation performed by the operation unit 131 to perform a calculation. Such an output value, such as the output value 143, may be defined by at least one shared share (e.g., the shared share 143.1=144.1) and at least one calculated share (e.g., the calculated share 143.2), wherein at least one shared share also defines another value, such as the another value 144. For example, the operation unit 131 may perform an operation on a set of input values ​​(e.g., the input values ​​141 and 142), wherein at least one calculated share (e.g., the calculated share 143.2) is calculated based on at least one shared share and a set of input values ​​(e.g., the shares 141.1, 141.2 of the input value 141 and / or the shares 142.1, 142.2 of the input value 142). The input value, the output value, and the another value are included in the set of values. Operation 131 may be, for example, a unary operation such as NOT or negation; a binary operation such as AND, XOR, addition or multiplication; a ternary operation, an invalidation operation or any other operation.

[0166] As a result of the operation performed by the operation unit 131, the output value 143 may be composed of at least one shared share (e.g., shared share 143.1=144.1 that also defines the additional value 144) and at least one calculated share (e.g., calculated share 143.2) calculated from the at least one shared share and the input value share. In particular, the calculated share 143.2 may not define the additional value 144 itself. This helps to mitigate attacks, such as reducing share reduction and / or share positioning attacks on the output value 143.

[0167] For example, suppose that the output value 143 has been defined by exactly two shares, and that these two shares do not define any other values ​​of the computation. This is not the case in computing device 100. In this case, an attacker may have detected that the two shares are shares of the same value by observing that errors in the two shares have similar effects. For example, a bit flip of a first share and a bit flip of a second share may result in the two shares still defining the same output value, and therefore resulting in the computation still being performed on the same set of values. As a result, the total output of the computation may not be affected by the two bit flips. More generally, for each first error added to the first share, it may be possible to add a second error to the second share so that the output value, and therefore the entire set of values ​​on which the computation is performed, will still be the same. This is undesirable, for example, because it may allow an attacker to reduce (sometimes also referred to as collapse) the two shares into one share, thereby allowing the attacker to determine or otherwise learn information about the output value.

[0168] However, in computing device 100, at least one shared share 143.1=144.1 also defines another value 144. As a result, introducing an error in at least one shared share (e.g., shared share 143.1=144.1) typically results in an error in at least output value 143 and another value 144, and thus, the overall computation output is obtained based on errors in both the output value and the other value. On the other hand, introducing an error in at least one computed share (e.g., computed share 143.2) may not result in an error in another value 144. Thus, the overall computation output may be based on an error in output value 143, but not on an error in another value 144. Thus, an attacker may not be able to infer that at least one shared share and at least one computed share are shares of the same value by introducing errors in the corresponding shares and observing that they result in the same set of values ​​(e.g., by means of the overall computation output). Thus, share reduction and / or share positioning attacks are reduced.

[0169] Although the figure only shows one share 143.1=144.1 defining multiple values ​​143, 144, it should be understood that, typically, the memory 140 of the computing device 100 stores multiple shares, each share defining multiple values. For example, an input value in a set of input values, such as input value 141 or 142, or each input value 141, 142 of a set of input values, can be defined by at least one shared share, and the shared share also defines respective additional values. A share also does not have to define exactly one or two values, for example, a share of the memory 140 can define at least three or at least five values. Similarly, the output value 143 does not have to be defined by exactly one shared share and exactly one calculated share, for example, a value can be defined by multiple shared shares and / or multiple calculated shares. For example, each shared share can also define at least one corresponding additional value.

[0170] Moreover, a calculated share, such as calculated share 143.2, may define additional values; for example, the calculation may include another operation whose output value is at least partially defined by share 143.2 and another share, the other share being calculated using share 143.2 as input. However, in general, it is advantageous if, for a first share and a second share in memory 140 that at least partially define a value, the sets of values ​​defined by the first share and the second share are different. In a preferred embodiment, the property holds for each first share and second share that at least partially defines the value. For example, value 144 is in a set of values ​​defined by share 143.1=144.1 of value 143, but not in a set of values ​​defined by share 143.2 of value 143. Indeed, this property helps to mitigate attacks such as share reduction and / or share positioning attacks as described above.

[0171] The operation unit 131 may employ various techniques to perform the operation, for example, to calculate at least one calculated share 143.1=144.1. Various examples are provided in detail below. In a preferred embodiment, the operation unit 131 does not explicitly calculate the output value 143 as an intermediate result of performing the operation, and / or when performing the operation, the output value 143 is not directly stored in the memory 140, for example, not stored in a non-shared form. Similarly, the operation unit 131 preferably performs the operation in a manner that avoids explicit calculation or storage of the input values ​​141, 142. This can further assist in share reduction / positioning and similar attacks based on such intermediate data.

[0172] In various embodiments, the operation unit 131 calculates at least one calculated share 143.2 by calculating a sequence of multiple intermediate results. Each intermediate result can be calculated based on at least one shared share, for example, each intermediate result directly depends on at least one shared share, or indirectly depends on another intermediate result that depends on at least one shared share. Since the value of at least one shared share is usually independent of the input value of the operation, such as irrelevant or independent, the intermediate result will usually also be independent of the input value. Therefore, the intermediate result exhibits sufficiently random behavior with the input value and / or output value, such as irrelevant or independent. This makes it more difficult to associate the calculated share with the input value. For example, the intermediate result can be a function of at least one shared share 143.1=144.1, such as its value or its negation. The intermediate result can also be a function of at least one shared share 143.1=144.1 and the input share of the operation 131. Other intermediate results can depend on at least one shared share by being calculated based on such intermediate results.

[0173] In various embodiments, the additional value 144 is independent of the input values ​​141, 142. When a value is referred to as "independent", this generally means that there is no direct relationship between the two, for example, one value may not follow another value, or may even be statistically unrelated to another and / or statistically independent of each other. For example, according to the probability distribution of the input and / or the randomness of the calculation, the additional value 144 may be unrelated to the input values ​​141, 142, for example, its correlation coefficient is close to zero, for example, between -0.25 and 0.25 or between -0.1 and 0.1. For example, such a correlation can be established by experiment in order to select a suitable additional value 144. The additional value 144 may also be statistically independent of the input values ​​141, 142, for example, the probability that the additional value 144 takes a specific value may not depend to a large extent on the probability that the input value has a specific value, for example, the difference between the probability that the additional value 144 takes a specific value and the probability that the input value has a specific value can be approximately the same, for example, the difference is at most 0.01 or at most 0.1. In some embodiments, the current operation and the operation of calculating additional value 144 have at least a minimum distance, for example, in terms of a minimum number of instructions executed between the respective operations, in terms of a distance between the operations in circuitry used for the calculation, and so on.

[0174] The further value 144 may be randomly selected, for example, at compile time, from a set of values ​​(e.g., all values, all previously calculated values, all sufficiently independent values, etc.). Similarly, the shared shares 143.1=144.1 may be randomly selected from a set of shares, for example, all shares, all previously calculated shares, all sufficiently independent values, etc. It is advantageous that the further value 144 is independent of the input values ​​141, 142, because an error introduced in the shared shares 143.1=144.1 may lead to errors in different parts of the computation, for example, a part that uses the output value 143 and a part that uses the further value 144, making it more difficult for an attacker to identify operations in the computation.

[0175] In some embodiments, each share that defines output value 143 also defines a respective additional value. For example, not only is share 143.1=144.1 a shared share, but share 143.2 is a shared share that also defines another additional value (not shown). For example, calculated share 143.2 can play the role of a shared share in a subsequent operation, for example, output value 143 is used as an additional value for the subsequent operation.

[0176] This may have the advantage of reducing the likelihood of invalid errors in shares of output value 143 and / or making invalid errors more difficult to detect. If for some inputs the overall computation output does not change due to an error, but for some other inputs the overall computation output does change, an error (e.g., a bit flip) in a share such as share 143.1=144.1 or share 143.2 may be considered invalid. It has been found that invalid errors are undesirable because they may lead to certain statistically invalid error analysis attacks. If the calculated share 143.2 does not define an additional value, it may be a particularly likely candidate for a valid error because an error in the share may only directly affect the output value 143. However, if the calculated share 143.2 does define a corresponding additional value, this makes it more likely that an error in the calculated share 143.2 may affect the overall computation output by changing the output value 143 and / or the corresponding additional value. For example, an error in a calculated share may be more likely to be valid, e.g., for all inputs, the error is more likely to affect the output, or it may be more difficult to detect that the error is invalid, e.g., because there are few inputs that do not affect its output.

[0177] In some embodiments, for each operation of a calculation or of a particularly sensitive part of a calculation, each of each share of each output of the calculation or of an operation of a part of a calculation may also define a respective further value.

[0178] For certain types of calculations, invalid errors can be completely eliminated in this way, or at least made unlikely. For example, the calculation can include an evaluation of a block cipher such as AES. For example, the calculation can include a coded substitution box, such as an AES S-box. Such an S-box can be considered as a binary circuit with 8 input bits and 8 output bits, and the binary circuit is optionally encoded by byte, for example, on 8 bits combined into a byte. The calculation can also include a coded addition circuit such as an AES MixColumns operation. Using byte encoding, the addition can be considered as a circuit with 16 input bits and 8 output bits. Using half-byte encoding, the addition can be considered as a circuit with 8 input bits and 4 output bits. For example, for one or more such sub-calculation operations, each share that defines the output value also defines a respective additional value. The respective additional values ​​in the AES-related embodiments can belong to an AES state, for example, an AES state of different parts of the plaintext. By constructing the AES function, it can be guaranteed that any error in such a shared share will result in a modified ciphertext.

[0179] In various embodiments, the output value 143 can be used as an input to multiple other operations (e.g., operations of calculations). In some embodiments, some of these other operations are interleaved. For example, a first additional operation and a second additional operation are performed during at least partially overlapping time intervals. Typically, an operation includes multiple parts, such as machine code instructions, source code instructions, etc. When operations are interleaved, some instructions of the second operation can be performed before the last instruction of the first operation, while some other instructions of the second operation can be performed after the last instruction of the first operation.

[0180] Interleaving operations may further complicate certain types of attacks. For example, an attacker may attempt to introduce errors not only in the shares of output value 143 when the shares are calculated, but also later when they are used. Introducing an error in the shares of output value 143 when calculating them may cause internal changes in all subsequent operations that use the share. In particular, if a share defines multiple values, an error may affect several or even all of these values. On the other hand, introducing an error in a share after it has been used in a first additional operation but before it has been used in a second additional operation may only affect the output of the second additional operation, thereby partially reversing the impact of the shared shares between multiple values. Interleaving the other operations may make such attacks more complicated because it avoids the situation where an error introduced at a single point in time affects the first additional operation but does not affect the second additional operation.

[0181] Several detailed embodiments are now presented in which the various techniques for performing operations discussed above are advantageously combined.

[0182] In some embodiments, the operation unit 131 performs the operation based on the shared shares 143.1=144.1, which also defines the output 144 of the calculated operation performed before the current operation. For example, when performing the previous operation, for example, as described herein, the value of at least one shared share 143.1=144.1 has been calculated by the operation unit 131. In this case, the at least one shared share may not need to be recalculated and / or modified as part of the current operation. The operation unit 131 can calculate the at least one calculated share 143.2 based on the previously calculated shared shares 143.1=144.1 and the shares of a set of input values ​​of the operation 131.

[0183] For example, in one embodiment, the operation unit 131 may be configured to perform an AND operation. k , 141 can be stored as share z k =s k,0 xors k,1 , 141.1, 141.2. Input value zl , 142 can be stored as share z l =s l, 0xors l,1 , 142.1, 142.2. After the operation, the output value z j =z k and z l , 143 is stored as share z j =s j, 0xors j,1 , where s j,0 , 143.1=144.1 is the shared share, s j,1 , 143.2 is the calculated share. Calculating the calculated share may include calculating one or more ANDs of the share of the first value and the share of the second value, for example, each pair of the share of the first value and the share of the second value. The shares of the first value and the second value may also be partially combined, for example, an AND of the XOR of multiple shares of the first value and one or more shares of the second value may be calculated, row by row. Then, calculating the calculated share may also include XORing the shared share with the calculated one or more ANDs. For example, the operation unit 131 may use the following steps to perform the AND operation, and the intermediate result is represented by the variable c i express:

[0184] 1.c0=s k,1 ands l,1

[0185] 2.c4=s j,1 xorc0

[0186] 3.c1=s k,0 ands l,1

[0187] 4.c5=c4xorc1

[0188] 5.c2=s k,1 ands l,0

[0189] 6. c6 = c5xorc2

[0190] 7.c3=s k,0 ands l,0

[0191] 8.s j,0 =c6xorc3

[0192] As shown in this example, the input value z k =a k,0 xora k,1 and z l =s l,0xors l,1 and the output value z j =s j,0 xors j,1 may not be calculated as an intermediate result of performing an AND operation. In addition, the share s of the calculation j,0 Can include share-based shares j,1 and some share of the input value, such as based on the share s k,1 and l,1 , to determine the intermediate result c4, but not based on others, for example, not based on the share s k,0 and l,0 As mentioned above, these measures further complicate attacks on operations. j,1 The share of another value 144 may be independent of the input values ​​141 and 142, for example, the shared share 143.1=144.1 may be randomly selected from a set of previously calculated shares, and / or the further value 144 may be randomly selected from a set of previously calculated values, for example, a previously calculated value that is sufficiently independent of the input values.

[0193] It will be appreciated that the above examples may be adapted in various ways while still achieving the same results, for example by changing the order of steps and / or swapping shares of input values.

[0194] It will be appreciated that the above techniques for performing AND operations using XOR sharing can be adapted to perform similar kinds of operations, e.g., operations where the shared reconstruction operation (e.g., XOR) is distributed. For example, the above process can be adapted to perform multiplication, e.g., multiplying a given modulus modulo an integer ring with an additive share. For example, to perform multiplication, in steps 1-8 above, a ring multiplication can be performed in place of AND, a ring addition can be performed in place of XOR, and the shared share s can be eliminated in step 2. j,1 .

[0195] In another embodiment, the operation unit 131 may be configured to perform an XOR operation. k , 141 can be stored as share z k =s k,0 xors k,1 , 141.1, 141.2. Input value z l , 142 can be stored as share z l =s l, 0xors l,1 , 142.1, 142.2. After the operation, the output value z j =z k xorz l , 143 is stored as share z j=s j, 0xors j,1 , where s j,0 , 143.1=144.1 is the shared share, and s j,1 , 143.2 is the calculated share. Performing an XOR operation may include calculating the shared share 143.1=144.1, the shares of the input values ​​141.1, 141.2, 142.1, 142.2, and / or intermediate results from calculating the XOR. For example, the following steps may be used to perform an XOR operation, with the intermediate result being represented by the variable c i express:

[0196] 1.c0=s j,1 xors k,1

[0197] 2.c1=c0xors l,1

[0198] 3.c2=c1xors k,0

[0199] 4.s j,0 =c2xors l,0

[0200] Likewise for the XOR operation, the input and output values ​​may not be calculated as intermediate results of performing the operation. In addition, an intermediate result such as c0 may be determined that does not depend at least on the share s. j,0 and k,0 , and its determination may not require any of the shares that are not used j,1 Therefore, further attacks on the operation become more complicated. As mentioned above, s j,1 The defined additional values ​​may be independent of the input values ​​141, 142. It will be appreciated that the above techniques for performing XOR operations may be applicable to other kinds of computations, such as performing addition or subtraction on additive shares and / or making changes to the above steps, such as swapping shares or changing the order of steps.

[0201] Figure 2 Schematically illustrated is an example of an embodiment of a computing device 200. The computing device 200 is for performing computations on at least one set of values, such as values ​​241, 242, 243, 244, 245, and / or 246. The device 200 may include a memory 240 configured to store the set of values.

[0202] Each value in a set of values ​​can be stored as multiple shares that define the value. For example, value 241 can be stored as shares 241.1=242.1 and 241.2. Value 242 can be stored as shares 241.1=242.1 and 242.2. Value 243 can be stored as shares 243.1=244.1 and 243.2. Value 244 can be stored as shares 243.1=244.1 and 244.2. In this figure, a pair of values ​​241, 242 and a pair of values ​​243, 244 have shared shares, but this is not necessary at least for some embodiments discussed below. Value 245 can be stored as shares 245.1=246.1 and 245.2. Value 246 can be stored as shares 245.1=246.1 and 246.2, for example, share 245.1=246.1 can be a shared share.

[0203] The computing device 200 may also include a processor configured to perform computing operations. Various examples of such computing device 200, processor 230, and / or memory 240 have been provided above, for example, the computing device 200, processor 230, and / or memory 240 may be based on the computing device 100, processor 130, and / or memory 140, respectively.

[0204] Similar to other computing devices described herein, computing device 200 may include an operation unit 231 configured to perform a computational operation on a set of input values ​​241, 243 to obtain an output value 245. Additionally, operation unit 231 may be configured to perform a further computational operation on another set of input values ​​242, 244 to obtain a further output value 246. Although in the figure, each operation has two inputs, this is not required: the operations may be null values, ternary values, etc. Operations also do not have to have the same number of inputs.

[0205] Interestingly, at least one shared share 245.1=246.1 defines an output value 245 and a further output value 246. The output value 245 is further defined by at least one calculated share 245.2, and the further output value 246 is further defined by at least one calculated share 246.2. The operations performed by the operation unit 231 are typically independent of each other, for example the input of the operation does not depend on the output of the further operation, and vice versa. Therefore, the two operations can be performed substantially simultaneously, for example in an interleaved manner. Preferably, the operations are independent of each other, so that the shared share 245.1=246.1 affects unrelated parts of the calculation. In some embodiments, the operation and the further operation are the same operation, but typically they are applied to different inputs.

[0206] To perform an operation, the operation unit 231 may calculate at least one calculated share 245.2 and at least one further calculated share 246.2 based on the shared share 245.1=246.1. Preferably, the value of at least one shared share is independent of the inputs (e.g., inputs 241-244) of the corresponding operation, e.g., has a low correlation with them. This may ensure that the shared share 245.1=246.1 and / or other shares of the values ​​245, 246 leak as little information as possible about the corresponding values.

[0207] In some embodiments, the shared share 245.1=246.1 also defines a previous value, which is the output of an operation performed before the operation. Therefore, the shared share 245.1=246.1 is a shared share between at least three values ​​calculated. In this case, the operation unit 231 generally does not calculate the shared share 245.1=246.1 when performing the operation. Then, performing the operation includes, for example, along the line of operation 131 performed by the computing device 100, calculating at least one calculated share 245.2 from at least one shared share 245.1=246.1 and shares 241.1=242.1, 241.2, 243.1=244.1, 243.2 in a set of input values. Similarly, performing further operations may include calculating at least one calculated share 246.2 from at least one shared share 245.1=246.1 and shares 241.1=242.1, 242.2, 243.1=244.2, 244.2 of a further set of input values, e.g., along the lines of the operating unit 131 of the computing device 100. In such an embodiment, the value pairs 241, 242 and 243, 244 do not necessarily have shared shares.

[0208] In other embodiments, the operation unit 231 calculates the shared share 245.1=246.1 as part of performing the operation. In order to ensure the independence of the shared shares of the input values ​​241-244, in various embodiments, at least one shared share 245.1=246.1 is determined based on a random value. For example, the random value can be a value generated by a random source or a virtual random number generator. However, in some attack scenarios, the attacker may control such a random source. Therefore, in some embodiments, the random value is advantageously a share of the output of a previously performed operation.

[0209] After having calculated the shared shares 245.1=246.1, the operating unit 231 may continue to perform operations by calculating at least one calculated share 245.2 based on at least one shared share 245.1=246.1 and the shares 241.1=242.1, 241.2, 241.2=243.1=244.1, 243.2 of a set of input values. Similarly, the operating unit 231 may calculate at least one calculated share 246.2 based on at least one shared share 245.1=246.1 and the shares 241.1=242.1, 242.2, 243.1=244.2, 244.2 of another set of input values.

[0210] These calculations can all be performed along the lines of the operating unit 131 of the computing device 100 discussed above. However, the computing device 200 can also advantageously exploit the fact that the inputs to the various calculations have a shared share between them, for example, a first input 241 of an operation and a first input 242 of another operation can have a shared share 241.1=242.2, and similarly for the second inputs 243 and 244. In this case, the operating unit 231 can calculate at least one shared share 245.1=246.1 based on the shared share between the respective inputs of the respective calculations, for example, also using random values ​​as described above. The calculated at least one shared share 245.1=246.1 can then be used to calculate the share of the calculation.

[0211] For example, in one embodiment, these operations can all be AND operations. The input value and the output value can be stored as shares by XOR sharing. For example, the input value z k , 241 can be achieved by XOR sharing is performed and stored as share r k , 241.1=242.1 and 241.2. The additional input value z k ′, 242 can be obtained by XOR sharing is performed and stored as share r k , 241.1=242.2 and 242.2. Similarly, input value z l , 243 can be achieved by XOR sharing is performed and stored as share r l , 243.1 = 244.1 and 243.2. Additional input value z l ′, 244 can be obtained by XOR sharing is performed and stored as share r l , 243.1 = 244.2 and 244.2. Other input values ​​can be shared in the same way. Output value z j =z k and z l , 245 can be achieved by XOR sharing is performed and stored as share r j , 245.1 = 246.1 and 245.2. The other output value z j ′=z′ k and z l ′, 245 can be obtained by XOR sharing is performed and stored as share r j , 245.1 = 246.2 and 242.2.

[0212] To perform an AND operation, the operation unit 231 may calculate at least one shared share as an AND of the shared shares of the respective inputs masked with a random value. The operation unit 231 may further calculate at least one calculated share as an XOR of the AND of the shares of the corresponding inputs masked with the same value. Similarly, the operation unit 231 may calculate at least one further calculated share as a combination of AND, e.g., XOR, of the shares of the additional inputs masked with the same random value. Masking the output shares with random values ​​may improve their independence from the input values ​​and the output values.

[0213] For example, the operation unit 231 may use the following steps to use the intermediate value c i Two AND operations are computed with a random value s, where s can be a share of the output of the previously performed operation.

[0214] 1.c0=r k andr l

[0215] 2.r j =c0xor s

[0216] 3.

[0217] 4.

[0218] 5.

[0219] 6.c3=r j xor c1

[0220] 7.

[0221] 8.

[0222] 9.

[0223] 10.

[0224] 11.c3=r j xor c1

[0225] 12.

[0226] In particular, as shown in this example, input values ​​241 and 243, further input values ​​242, 244, output value 245 and / or further output value 246 may not be calculated as an intermediate result of performing the operation. The random value s may be first XORed with c0, then with c1, then with c2. Thus, the independence of the intermediate values ​​of the operation from the inputs and outputs of the respective computations may be improved, thereby complicating attacks on these values, as described above. It will be appreciated that the above steps may be adjusted, for example, by reordering or swapping the shares of the input values. It will also be appreciated that the above steps may be generalized to perform any operation distributed on the shares used, for example, using an additive share, such as modulo a given modulus, performing a ring multiplication.

[0227] In some embodiments, these operations may be XOR operations. As described above for AND operations, input values ​​and output values ​​may be XOR shared. To perform an XOR operation, the operation unit 231 may calculate at least one shared share 245.1=246.1 as the XOR of the shared shares of the respective inputs (e.g., shared shares 241.1=242.1 and shared shares 243.1=244.1). The operation unit 231 may also calculate at least one calculated share (e.g., share 245.2) as the XOR of the shares of the respective input values ​​(e.g., shares 241.2 and 243.2). The operation unit 231 may also calculate at least one additional share (e.g., share 246.2) as the XOR of the shares of the corresponding additional input values ​​(e.g., shares 242.2 and 244.2). For example, performing an XOR operation may include the following steps or variations, e.g., by reordering or swapping:

[0228] 1.r j =r k xor r l

[0229] 2.

[0230] 3.

[0231] Similarly, these operations can be1 and K 2 The XOR operation is performed on them as described above. For example, the output value is calculated as the sum of the input value and the constant K 1 XOR, and calculate the other output value based on the other input value as the constant K 2 In this case, both the output value and the further output value may be defined by the shared shares, which also define the input value and the further input value. The output value may be further defined by the calculated shares calculated from the shares of the input value, and the further output value may be further defined by the further calculated shares calculated from the shares of the further input value. The operation unit 231 may perform such an XOR operation using the following steps:

[0232] 1.

[0233] 2.

[0234] For example, the output value and the other output value share r j is the share r that is shared between the input values k The same share. Share according to the input value For example, the share of calculations, the share of calculations of output values According to the share of other input values For example, the calculated share, calculate the calculated share of another output value Likewise, input values, further input values, output values ​​and / or further output values ​​may occur as intermediate results of performing operations and further operations. In the case of an XOR operation, a separate random value may not be required.

[0235] Figure 3a An example of an embodiment of a computing device 300' for performing calculations on at least one set of values ​​is schematically shown. The computing device 300' can be based on various suitable computing devices described herein, such as the computing device 100 or 200. The computing device 300' includes a processor 330' and a memory 340', such as the processor 130 or 230 and the memory 140 or 240.

[0236] The computing device 300' may include an operation unit 338 configured to perform an operation. The operation may result in an output value 343 defined at least in part by at least one shared share 343.1. In various embodiments described herein, the operation unit 338 uses a share of the output of an operation previously performed by the operation unit 339. For example, the operation unit 338 is based on the operation unit 131. For example, the at least one shared share 343.1 may define the output of the operation of the operation unit 339 by itself, or use at least one share of the output of the operation of the operation unit 339 as a random value to calculate the at least one share 343.1. In this case, it may be beneficial if the output of the previously performed operation and / or its share is random and independent of the operation performed by the unit 338, for example, the value of the output of the previously performed operation is not related to the value of any input of the operation of the unit 338. Although the operation units 338 and 339 are shown as separate units in the figure, they can be combined into a single unit.

[0237] Interestingly, the computing device 300' may include an initial obfuscation calculation unit 336 configured to perform an initial obfuscation calculation. The computing device 300' may also include an inverse obfuscation calculation unit 337, which is configured to calculate the inverse of the initial obfuscation calculation based on, for example, the output from the unit 336. The obfuscation calculation unit 336 and / or the inverse obfuscation calculation unit 337 may be operated at least in part using shares (e.g., using operation units according to embodiments described herein). For example, in one embodiment, the obfuscation calculation unit 336 does not use shares, while the inverse obfuscation calculation unit 337 uses shares. Performing an obfuscation calculation and its inverse operation may not affect the overall output of the calculation, but may advantageously produce shares that can be used for subsequent operations as described above. The operation unit 339 may perform operations of the obfuscation calculation unit 336 or the inverse obfuscation calculation unit 337, the operations being performed using shares as previously performed operations.

[0238] For example, as shown, operation unit 339 may perform an operation to inverse an obfuscated computation. This may have the advantage that the output of the operation of unit 339 and / or the output of its share is random, for example, independent of the computation input due to the obfuscated computation having been applied, and / or independent of the output of the operation of unit 338 due to the inverse step between the operation of unit 339 and the operation of unit 338 and / or the remainder of the other steps. If performed using shares (preferably near the end of the obfuscated computation), the previously performed operation may also be included in the obfuscated computation of unit 336. The obfuscated computation and its inverse operation may be performed at or near the beginning of the overall computation, but at least before the operation of unit 338.

[0239] Various obfuscation computations may be applied. In one embodiment, the obfuscation computation comprises, for example, one or more rounds of a block cipher with randomly selected round keys, such as an SLT cipher such as AES. In one embodiment, the obfuscation computation comprises a random linear function followed by a random nonlinear function, for example, followed again by a random linear function and a random nonlinear function. In one embodiment, the inverse obfuscation computation may comprise the inverse of a random nonlinear function followed by the inverse of a random linear function, for example, followed again by the inverse of a random linear function and the inverse of a random linear function. For example, for i=0, ..., 15, a random nonlinear bijective function S may be generated. i :{0,1} 8 →{0,1} 8 and a random linear function L:{0,1} 128 →{0,1} 128 The entire computation can have a 128-bit input x, where x b represents its bth byte, and x i represents its i-th bit, for example, x=x 0 …x 15 =x0…x 127 Function S: {0,1} 128 →{0,1} 128 It can be obtained by S(x)=S0(x 0 )…S 15 (x 15 The obfuscated computation may include, for example, computing y=S(L(S(L(x)))) using an arithmetic Boolean circuit that computes y on input x.

[0240] In various embodiments, the obfuscated computation and / or its inverse operation may result in a share of computational input values. For example, the operation unit 338 may perform its operation on the computational input values. Obtaining the shared computational input values ​​may include: performing the obfuscated computation on the computational input to obtain the obfuscated computational input, e.g., without using shares; converting the obfuscated computational input into the obfuscated computational input value stored as a share; and performing the inverse operation of the obfuscated computation on the obfuscated computational input value to obtain a set of shares of the computational input value.

[0241] For example, sharing obfuscated computation inputs can result in at least one shared share z j and at least one calculated share s i , for example as z j xors i . At least one shared share z iFor example, it can be selected as an intermediate result of the obfuscated calculation, preferably near the end of the obfuscated calculation, for example, the result of the above calculation S(L(x)). The at least one shared share can also be another obfuscated calculation input, etc. The obfuscated calculation input value y can be selected from i and at least one shared share, e.g., s i =y i xorz j , to calculate at least one calculated share. Thus, it is interesting that the shares of obfuscated calculation input values ​​may be random and / or independent of the values ​​they represent, for example, by means of at least one shared share having a random value, and at least one calculated share calculated therefrom.

[0242] Figure 3b An example of an embodiment of a computing device 300 is schematically shown. The computing device 300 includes a processor 330, which performs a calculation on at least a set of values, such as stored in a memory 340, based on the computing device 100, 200 and / or 300'. The computing device 300 may include a parallel computing branch unit 331 that performs a first parallel computing branch of the calculation and a parallel computing branch unit 332 that performs a second parallel computing branch of the calculation. Each parallel computing branch, such as the branches of units 331 and 332 and any other parallel computing branches, can calculate a copy of the same output. The computing device 300 may also include an average computing unit 335, which is configured to perform an average calculation that combines these multiple copies of the same output into a single calculation output.

[0243] As is known in the art, the use of parallel computation branches and / or average computations may complicate various attacks (e.g., differential error analysis attacks, etc.) on computations performed by the computing device 300. For example, this may be because introducing an error in one parallel computation branch but not another parallel computation branch and / or introducing different errors in the corresponding parallel computation branches may result in random outputs of the average computation.

[0244] In one embodiment, the average calculation unit 335 can be arranged to return the value given two equal values ​​as input, but otherwise return a random value. For example, given the output W1′ of the first parallel calculation branch unit 331 and the output W2′ of the second parallel calculation branch unit 332, the average calculation unit 335 can evaluate the random function with respect to W1′, and the identity function minus the random function with respect to W2′, and add the two results. For example, using XOR sharing on 128 bits, a reversible linear function L′: {0,1} can be used 128 →{0,1} 128, so that L2(x)=(L′xorI)(x)=L′(x)xorx is also reversible, and the output Z′ of the average calculation unit 335 can be calculated as Z′=L′(W1′)xorL2(W2′), for example, using a binary circuit that evaluates the share. For example, the operation of the average calculation unit 335 can be evaluated as discussed with respect to the operation unit 131 of the computing device 100, or the shared values ​​of the various parallel calculation branches can be re-shared before being provided to the average calculation unit 335, for example, as discussed with respect to the computing device 800.

[0245] When the calculation of the computing device 300 includes an operation and another operation, wherein the shared share defines both the output of one operation and the output of the other operation, it is particularly advantageous to use parallel computing branches. For example, the computing device 300 may include an operation unit 333 configured to perform an operation, for example, based on the operation unit 231 of the computing device 200. In this case, the operation can be included in the first parallel computing branch, and the other operation can be included in the second parallel computing branch. Therefore, parallelism can be effectively used for free to obtain the shared share in the following sense: the two parallel computing branches provide them with sufficiently independent computing paths to be able to effectively use the shared share. In some embodiments, the parallel computing branch units 331, 332 calculate similar functions, for example, functions described by circuits of similar structure. In this case, for example, the shared share can define the corresponding operations of the two circuits, thereby providing a particularly effective way to perform operations on the shared share and other operations.

[0246] It will be appreciated that more than two parallel computation branches may be applied, with the average computation unit 335 being adapted accordingly. In such a case, a single shared share may be shared between values ​​from two or more parallel computation branches, for example, a shared share may define a value from each parallel computation branch.

[0247] Figure 4 An example of an embodiment of a computing device 400 is schematically shown. The computing device 400 includes a processor 430 that calculates at least one set of values ​​stored in a memory 440 as shares, as described in various embodiments discussed herein. The computing device 400 may include at least a first parallel computing branch unit 431 and a second parallel computing branch unit 432. Each parallel computing branch unit, such as parallel computing branch units 431 and 432, may calculate a copy of the same output, and the computing device may also include an average computing unit 435 that combines these multiple copies into a single output. For example, the units of the computing device 400 may be based on the individual units of the computing device 300'.

[0248] In one embodiment, the first parallel computing branch unit 431 may include an obfuscation computing unit 451 that performs an obfuscation computation. Its output may be used by an inverse obfuscation computing unit 452 that computes the inverse of the obfuscation computation. The output of unit 452 may be used by a functional computing unit 453 that performs a functional computation. A virtual computation unit 455 may use the output of unit 453 to perform a virtual computation.

[0249] The second parallel computing branch unit 432 may include a virtual computing unit 456 configured to perform virtual computing. The output of unit 456 can be used by a functional computing unit 457 configured to perform functional computing. The output of unit 457 can be used by an obfuscated computing unit 459 configured to perform obfuscated computing. The output of unit 459 can be used by an inverse obfuscated computing unit 460, which is configured to calculate the inverse of the obfuscated computing. The advantage of introducing obfuscation and / or virtual computing is that the various operations of the parallel computing branches operate on different values, such as values ​​that are independent or unrelated to each other. Moreover, it may be more difficult for an attacker to understand the structure of the calculation. For example, since the functional computing units 453 and 457 operate in different stages of each parallel computing branch due to obfuscation and virtual computing, it may be more difficult to identify the functional computing.

[0250] Preferably, the obfuscated computations, their inverse operations, virtual computations and / or functional computations include similar or even identical parts, such as circuits having similar shapes or identical shapes. This may make identification of corresponding values ​​of different parallel computation branches more difficult and / or allow operations of branches to be performed in pairs, such as by the operation unit 231 of the computing device 200. For example, the obfuscated computation unit 451 may be similarly configured as the virtual computation unit 456, the inverse unit 452 may be similarly configured as the initial part of the functional computation unit 457, and / or the virtual computation unit 455 may be similarly configured as the inverse unit 460, for example, they compute circuits of similar structure.

[0251] For example, in one embodiment, the functional computation may include multiple rounds of reversible iterative computation. The reversible iterative computation may be, for example, a block cipher round of AES. However, other types of reversible iterative computations are also possible, for example, iterations of a simplex algorithm for linear programming. For example, the reversible iterative computation may be provided as a binary circuit obtained, for example, using a synthesis tool / circuit compiler.

[0252] The obfuscated calculation unit 451 may be configured to perform two iterations of the iterative calculation. The inverse unit 452 may be configured to calculate each inverse of the two iterations. The functional calculation units 453 and 457 may be configured to perform multiple rounds of reversible iterative calculations, such as 10, 12 or 14 AES rounds, respectively. The virtual calculation unit 455 may be configured to calculate the iteration of the iterative calculation and its inverse. The virtual calculation unit 456 may be configured to calculate the iteration and its inverse. The obfuscated calculation unit 459 may be configured to calculate two iterations of the iterative algorithm, and the inverse unit 460 may be configured to calculate each inverse. In this way, each parallel calculation branch may perform calculations of similar structures in pairs on their respective inputs. For example, at a certain moment, the parallel calculation branch unit 431 and the parallel calculation branch unit 432 may perform the same calculation function at different points, but for example, in different rounds on different data. For example, in the first parallel calculation branch unit 431, the functional calculation unit 453 may operate at a later stage in the branch than the corresponding functional calculation unit 457 of the second parallel calculation branch unit 432. It will be appreciated that variations that achieve the same effect can also be used. Various operations of units 451-460 can be performed using the techniques described herein. For example, one or more operations of the corresponding calculations can be performed as discussed for the operation unit 131 of the computing device 100. Alternatively or in addition, one or more pairs of corresponding operations of the first parallel calculation branch unit 431 and the second parallel calculation branch unit 432 can be performed by an operation unit 433 similar to the operation unit 231 of the computing device 200. For example, the operation unit 233 can perform the operation of the obfuscated calculation unit 451 and the additional operation of the virtual calculation unit 456, and so on. For example, these operations can be operations at similar or identical locations in the circuit for calculations of each parallel calculation branch unit 431, 432. Interestingly, the various input values ​​of these operations can be independent. In order to facilitate the operations performed according to various embodiments, the outputs of the obfuscated operation unit 451 and the virtual operation unit 456 can be re-shared by, for example, the re-sharing unit 731 of the computing device 700. Alternatively or additionally, re-sharing, for example, by a re-sharing unit 831 of the computing device, may be performed on respective inputs of the dummy operation unit 455 and the deobfuscation operation unit 460 .

[0253] In one embodiment, the operation of the operation unit 433 may be the operation of the inverse operation unit 452 or the function calculation unit 453, and the additional operation of the operation unit 433 may be the operation of the function operation unit 457 or the obfuscated operation unit 459. As an advantage, the operation and the additional operation are performed before and after several other calculations, thereby making it more difficult to identify the execution of the operation.

[0254] In one embodiment, each parallel computation branch may further include an additional obfuscated computation after the functional computation, for example, the first parallel computation branch unit 431 may include an additional obfuscated computation unit 454 configured to perform an additional obfuscated operation, the second parallel computation branch unit 432 may include another obfuscated computation unit 458 configured to perform an additional obfuscated operation, and similarly any additional parallel computation branch applies. As described above, the additional obfuscated computation units 454, 458 are preferably similar to the above-described units, for example, having similar or identical circuits, for example, the obfuscated operation units 454, 458 compute one or more block cipher rounds, for example, AES rounds, for example, two rounds. The operation of the operation unit 433 may be included in the obfuscated computation of the unit 454 and / or the additional operation of the unit 433 may be included in the obfuscated computation of the unit 458. The computing device may further include an inverse obfuscated computation unit 461, which is configured to compute the inverse of the additional obfuscated operation of the units 454, 458 on the output of the average computation unit 435. Therefore, the overall calculation output may not be affected by the obfuscation operation, while the individual values ​​processed by the average calculation unit 435 may be calculated independently of the final value output, making the computing device more difficult to attack.

[0255] Although the deobfuscation operation unit 461 can act on shares, such as discussed for computing devices 100 and 200, in one embodiment, the deobfuscation unit 461 is configured to act on unshared values, such as values ​​that are not stored in memory as multiple shares. For example, the processor 430 can reconstruct the output value of the average calculation unit 435 to obtain the unshared output value, such as by applying a reconstruction function (e.g., XOR or addition of the individual shares) to the individual shares of the output value. The deobfuscation calculation unit 461 can then act on the unshared value, such as by evaluating a binary circuit with respect to the unshared value, etc. For example, the output of the deobfuscation calculation unit 461 can be the overall output of the calculation.

[0256] Figure 5 An example of an embodiment of a computing device 500 for performing calculations on at least one set of values, each value being stored as a plurality of shares, is schematically shown. The computing device 500 includes a processor 530 and a memory 540. For example, the computing device 500 may be based on the computing devices 100, 200, 300, 300' and / or 400. Interestingly, a share of the plurality of shares stored in the memory 540, such as the share 542.1 of the value 542, may be stored in an encoded manner, which further complicates the attack because the value of the share 540 cannot be directly read from the memory without knowing the encoding used.

[0257] In one embodiment, the shares of a value stored in the memory may be encoded and stored by applying an encoding function to the shares themselves. For example, storing the value as multiple shares may include: obtaining shares of the value; calculating encoded shares from the obtained shares using the encoding function; and storing the encoded shares. Obtaining the shares from the memory may include obtaining the encoded shares and applying the inverse of the encoding function.

[0258] For example, computing device 500 may include encoding operation unit 531 configured to perform an operation on at least input value 541 to obtain output value 542. Input value 541 may be stored as shares 541.1 and 541.2, where share s 1,1 , 541.1 can be stored as the encoded value E1(s 1,1 ), and share s 1,2 , 541.2 is stored as the encoded value E2(s 1,2 ). Similarly, the output value 542 may be stored as shares 542.1 and 542.2=544.2, where the share s 2,1 , 542.1 can be stored as the encoded value E3(s 2,1 ), share s 2,2 , 542.2=544.2, can be stored as the encoded value E4(s 2,2 ). For example, share 542.1 may be a calculated share calculated when performing operation 531, and share 542.2=544.2 may be a share that also defines a share of another value 544, for example, share 542.2=544.2 may define another value 544 together with another share 544.1, which may or may not be stored in an encoded manner. For example, the encoding operation unit 531 may be based on the operation unit 131 or 231 suitable for application encoding.

[0259] E i It can be an encoding function. For example, the encoding function E i Randomized non-linear reversible functions and / or randomized linear functions or other known encodings may be included. Not all values ​​need to be stored encoded, or even all shares of a single value: attacks are made more difficult even if not all shares and / or values ​​are encoded. For example, sensitive values ​​may be stored encoded; some less sensitive values ​​may be stored unencoded. Different encoding functions may be used for different values, but the same encoding function may also be used to encode multiple values, for example for efficiency reasons.

[0260] For example, in an adaptation of the operation unit 131, the encoding operation unit 531 may calculate at least one calculated share 542.1 of the operation 531 from at least one shared share 542.2=544.2 by, for example, calculating one or more shares of the input value from the encoded shares of the input value stored in the memory 540 using respective inverse functions of the encoding function. For example, as shown in the figure, the encoding operation unit 531 may calculate at least one calculated share 542.1 from the encoded share E1(s 1,1 ) Calculate the share and / or from the coded share E2(s 1,2 ) Calculate the share The encoding operation unit 531 may further calculate the uncoded at least one calculated share s according to the at least one shared share 542.2 and the share of a set of input values. 2,1 , and calculating the encoded at least one calculated share 542.1 from the uncoded at least one calculated share, for example, E3(s 2,1 ), for example, by applying a corresponding encoding function E3. For example, if at least one shared share 542.2=544.2 is encoded and stored as, for example, E4(s 2,2 ). At least one shared share 542.2=544.2 can be obtained from the encoding, for example, To calculate at least one shared share s 2,2 .

[0261] For example, if input value 541 and output value 542 are additively shared and operation 531 is represented as f, performing operation 531 may include performing the following operations according to E1(s 1,1 ), E2(s 1,2 ) and E4(s 2,2 ) to calculate The calculation can be easily adapted to other types of sharing and / or other numbers of input and output values.The calculation can be implemented using various known techniques, for example, using machine code instructions, lookup tables, etc.

[0262] Figure 6 Schematically illustrates an example of an embodiment of a computing device 600 for performing calculations on at least one set of values, each value being stored as a plurality of shares. The computing device 600 includes a processor 630 and a memory 640. For example, the computing device 600 may be based on the computing devices 100, 200, 300, 300' and / or 400. Similar to Figure 5, a share of a plurality of shares stored in the memory 640 may be stored in an encoded manner. In particular, in the computing device 600, a plurality of values ​​in a set of values ​​may constitute a combined value stored in an encoded manner. For example, the figure shows two values ​​642, 643 constituting a combined value 641 and two values ​​645, 646 constituting a combined value 644. In general, any number of values ​​may constitute a combined value. For example, a combined value may constitute a number of bits, such as 8 bits or 16 bits, and the combined value is a concatenation of these bits. Similarly, the value may be k-ary, and the individual values ​​constituting the combined value are represented as a k-ary representation.

[0263] Any suitable encoding of the combined values ​​may be used, for example, a value encoded by a set of values ​​641 may be where z1 is value 642, z2 is value 643, | denotes concatenation, and E1 is an encoding function. Similarly, a value encoded by a set of values ​​644 may be Wherein z3 is value 645, z4 is value 646, and E2 is an encoding function. Encoding function E2 may be the same as or different from encoding function E1, and may also encode and store only value group 641 or only value group 644.

[0264] The computing device 600 may include an encoding function unit 631 configured to perform operations using input and / or output values ​​that constitute the encoded stored combined value. To this end, the encoding function unit 631 may apply an inverse encoding function to a combined value including a plurality of input values ​​to obtain an unencoded combined value, e.g., computing and / or applying an encoding function to a combined value comprising a plurality of output values ​​to obtain an encoded combined output value, such as calculating where f is the operation to be performed, and the output values ​​z3 and z4 are the encoded combined output values Definition. For example, The calculations may include multiple operations that can be performed using the various techniques described herein, for example, as described for operation unit 131 or 231.

[0265] For example, a function that performs an operation on an encoded value (such as ) is written as a set of Lagrange interpolation polynomials, such interpolation polynomials give the values ​​of the output values ​​in a set of output values ​​644. The encoding function unit 631 can then evaluate the interpolation polynomials as a circuit, such as a binary circuit. These interpolation polynomials may differ only in the coefficients used. In particular, the shape of such a circuit can be independent of the operation f and / or different output values ​​can have circuits of similar shapes. This can be particularly suitable for use in conjunction with the parallel calculation branches described herein using interpolation polynomials, where multiple branches execute similar circuits. In addition, having circuits with similar shapes for different operations may make the operations difficult to identify in the overall calculation.

[0266] More generally, the use of encodings complicates attacks because it becomes more difficult to read computed values ​​from memory. Furthermore, because the operations f in the encodings can be expressed in terms of operations that can be performed using the techniques herein, the encodings can be effectively implemented as a layer on top of the share computation techniques described herein, thereby inheriting and further improving their protection against share reduction attacks, share positioning attacks, etc.

[0267] Figure 7a An example of an embodiment of a computing device 700 is schematically shown. The computing device 700 includes a memory 740 configured to store a set of values, each value in the set of values ​​being stored as a plurality of shares. For example, the figure shows a value stored as a share. 741.1 and The value of 741.2 742 and stored as shares 742.1 and 742.2 742 values, for example, shared using XOR. The computing device 700 is used to perform a calculation on at least a set of values, for example, the processor 730 of the computing device 700 performs the calculation. For example, the computing device 700 can be based on the computing device 100, 200, 300, 300', 400, 500 or 600.

[0268] The computing device 700 may include a resharing unit 731 configured to reshare a first value (e.g., value 741) and a second value (e.g., value 742). For example, value 741 may be an output of an operation performed by the computing device 700 according to an embodiment described herein. For example, value 741 may be output value 143 calculated by operation unit 131, output value 245 or 246 of operation unit 231, and so on. For example, shares 741.1 may be calculated shares calculated as part of an operation, and / or shares 741.2 may be shares that define a share of output value 741 and other values ​​prior to resharing. Similarly, value 742 may be an output of an operation performed by the computing device 700, for example, shares 741.1 are calculated shares and / or shares 742.2 are shared shares. Resharing may involve more than two values.

[0269] As a result of resharing, at least one new shared share, e.g., share r l , 741.1'=742.1', value 741 and value 742 can be defined. Similarly, at least one additional new share, for example, share 741.2', the first value 741 may be defined, but the second value 742 may not be defined, and / or at least one additional new share, e.g. 742.2', the second value 742 may be defined, but the first value 741 may not be defined. For example, the values ​​741 and 742 may be respective input values ​​for operations and further operations according to the embodiments described herein, for example, the first value 741 may be the input value 241 or 243, and the second value 742 may be the further input value 242 or 244 of the computing device 200. If other values ​​are re-shared, a single shared share may define each value to be re-shared. Different subsets of a set of values ​​may also have different common shared shares.

[0270] Thus, resharing can enable operations and additional operations to be applied to input values ​​and additional input values ​​that were not defined in at least one party by a common share prior to resharing. In one embodiment, resharing as described herein can be applied to the output of calculations 451 and / or 456 to be used as input to corresponding calculations 452 and 457, so that operations of calculations 452 and 457 and possible subsequent calculations can be performed on respective value pairs defined by at least one shared share.

[0271] In order to re-share the first value 741 and the second value 742, the re-sharing unit 731 may calculate at least one new shared share 741.1′=742.1′ defining the first value 741 and the second value 742 based on the previous share defining the first value 741 and the previous share defining the second value 742, such as one or more of the shares 741.1, 741.2, 742.1 and 742.2. Preferably, at least one share of the first value and at least one share of the second value are used such that the shared share, and therefore also the share calculated therefrom, depends on at least two input values. For example, the shared share r l This can include the sum of the shares of the individual input values, such as XOR. For example, The calculated shares for each value may then be calculated based on the shared shares and the previous shares defining the respective value.

[0272] For example, the re-sharing unit 731 may select at least one newly shared share r l , 741.1'=742.1' and the previous share defining the first value 741.1, 741.2 to calculate at least one additional new share defining the first value 741 741.2'. For example, the calculation may calculate a value equal to the difference between the first value and at least one shared share, for example, Interestingly, the calculation typically does not include calculating the first value itself, eg, the first value does not appear as an intermediate result of the calculation.

[0273] Similarly, the re-sharing unit 731 can select at least one new shared share r l , 741.1'=742.1' and the previous share defining the second value 742.1, 742.2, to calculate at least one additional new share of 742 defining a second value 742.2'. For example, the calculation may calculate a value equal to the difference between the second value and at least one shared share, e.g., As noted above, it is interesting to note that the calculations typically do not include calculating the second value itself.

[0274] Figure 7b Schematically there is shown an example of an embodiment of a computing device 800. The computing device 800 comprises a memory 840 configured to store a set of values, each value in the set of values ​​being stored as a number of shares.

[0275] For example, the figure shows that storage is a share 841.1 and The value z of 841.2 l,841, e.g. The computing device 800 is used to perform calculations on at least a set of values. For example, the computing device 800 can be based on the computing device 100, 200, 300, 300', 400, 500, 600 or 700.

[0276] The computing device 800 may include a re-sharing unit 831 configured to re-share values, such as value 841. For example, value 841 may be an output of an operation of a computation performed by the computing device 800 according to embodiments described herein. For example, value 841 may be output value 143 of operation unit 131 or any other output value. However, preferably, value 841 is an output value of an operation that has been performed with another operation to obtain another value, as described herein, the output value shares a share with the other value, such as output value 245 or 246 of operation unit 231. For example, share 841.1 may be shared between the operation and the other operation of operation unit 231, and share 841.2 may be calculated from share 841.1 or in other ways.

[0277] As a result of resharing, at least one shared share s may be shared after resharing. r,b , 841.1'=844.1 and at least one calculated share w l , 841.2' to define the value 841. The at least one shared share may also define an additional value 844, which is the output of the operation of the calculation performed before the re-sharing, for example, the shares 841.1'=844.1 and 844.2 may define the additional value 844. The additional value 844 may be similar to the additional value 144 of the computing device 100, for example, randomly selected from a set of outputs of the previously performed operation.

[0278] Thus, resharing may result in value 841 being defined by the shared share, which also defines values ​​that are generally unrelated to value 841 itself, such as value 844. For example, value 844 need not be the value of a corresponding additional computation (e.g., another parallel computation branch), such as in computing device 400. As a result, resharing further complicates an attacker's analysis of program flow. After resharing, value 841 may be an input to an operation of computing device 800, such as value 841 may be a value 141, 142, etc., of operating unit 131 of computing device 800.

[0279] In order to reshare the value 841, the resharing unit 831 can calculate at least one calculated share 841.2' from at least one shared share 841.1'=844.1 and the shares 841.1, 841.2 that define the value before resharing. For example, at least one calculated share can be calculated so that it is reconstructed into the value together with at least one shared share, preferably without calculating the value as an intermediate result. For example, if the value 841 is additively shared, the calculation may include determining that the shared share 841.1'=844.1 is negative, and adding subsequent shares of the value, such as shares 841.1 and 841.2, before resharing. If the value is XOR shared, the calculation may similarly include adding subsequent shares of the value (such as shares 841.1 and 841.2) to the shared share 841.1'=844.1 before resharing. For example, the calculated share 841.2 may be calculated as Etc. Interestingly, this calculation usually does not include the calculated value itself, making it more difficult for an attacker to obtain that value.

[0280]

[0046] Various aspects of the foregoing are now elaborated in a detailed example of an embodiment for computing an AES encryption function as a Boolean circuit including AND and XOR gates.

[0281] Step 1. Randomness creation

[0282] For i = 0…15, choose a random nonlinear bijective function S i :{0,1} 8 →{0,1} 8 and a random reversible linear function L:{0,1} 128 →{0,1} 128 For any 128-bit value x, let x b Indicates the bth byte, and let x i Represents its i-th bit as follows:

[0283] x=x 0 …x 15 =x0…x 127 .

[0284] The function S is defined as follows: {0,1} 128 →{0,1} 128

[0285] S(x)=S0(x 0 )…S 15 (x 15 ).

[0286] It is possible to create arithmetic Boolean circuits C0,…,C n, which calculates y=S(L(S(L(x)))) on input x, for example, it can be calculated by the initial obfuscation calculation unit 336. Let z i Indicates gate C i Output.

[0287] Step 2. Share introduction

[0288] Assumed value z t ,…,z n corresponds to the value after calling function S. Let is the initial set of shares. Then the next 128 operations C can be used n+1 ,…,C n+128 Introduce the share of y:

[0289]

[0290] For i = 0, ..., 127, where r i ∈ R [t,n] will be insert

[0291] Step 3. Shared input / reverse operation of initial obfuscation operation

[0292] It is possible to create Boolean operation circuits C′0,…,C′ n′ , calculate x=L on input y -1 (S -1 (L -1 (S -1 (y)))), for example, is performed by the inverse obfuscation calculation unit 337. Each operation (for example, a gate) of the Boolean arithmetic circuit, for example, each operation on the share, may be performed, for example, by the operation unit 131 as follows.

[0293] AND Gate The execution is as follows:

[0294] (a) c0 = s k,1 and

[0295] (b) c1 = s k,0 and

[0296] (c) c2 = s k,1 and

[0297] (d) c3 = s k,0 and

[0298] (e) c4 = c0xor sr,b (For a random index of another value output by a previously executed computation operation and its share b∈[0,1]).

[0299] (f) c5 = c4xorc1,

[0300] (g) c6 = c5 x or c2,

[0301] (h)z j =c6xorc3,

[0302] and includes the calculated share z j and shared shares r,b (s j,0 ,s j,1 )=(z j ,s r,b ) is added to middle.

[0303] XOR gate (z j =z k xor ) can be executed as follows:

[0304] (a) c0 = s k,1 xor

[0305] (b) c1 = c0 xor s r,b (For a random index of another value output by a previously executed computation operation and its share b∈[0,1]).

[0306] (c) c2 = c1 x or s k,0 ,

[0307] (d)z j =c2xor

[0308] and includes the calculated share z j and shared shares r,b s j :=(s j,0 ,s j,1 ):=(z j ,s r,b ) is added to

[0309] Step 4. Introduce two asynchronous parallel computing branches

[0310] The two Boolean circuits on the shares can be created and evaluated as in the previous step and in Calculate the virtual key K (for example, performed by the obfuscation calculation unit 451) d1 and K d2 Two reverse rounds of AES on (e.g., calculated by the virtual calculation unit 456) under the same virtual key K d The reverse AES rounds are calculated above, and then the forward AES rounds are calculated.

[0311] Step 5. Share Restructuring / Re-sharing

[0312] make express The shared results, express You can create the following for Boolean circuit to reorganize Z 1 and Z 2 The share of, for example, is performed by the re-sharing unit 731:

[0313]

[0314]

[0315]

[0316] Therefore, after re-sharing, both the first value and the second value can be divided by the shared share r l Defined, the first value is the new share of further defined, and the second value is determined by the additional new share Further definition.

[0317] make The triple Add to middle.

[0318] Step 6. Parallel AES rounds

[0319] It is possible to create a Boolean circuit that runs 14 forward AES rounds The AND and XOR gates can be transformed to operate on two parallel shared tracks calculated by, for example, parallel calculation branch units 431 and 432, as described below. The operations on the respective parallel shared tracks can be performed, for example, by operation unit 231, as described in detail below.

[0320] AND gate (z j =z k and ) can be converted to:

[0321] (a) c0 = r kand

[0322] (b)r j = c0xor s, for a random bit in S, such as a share of the output of a previously performed operation.

[0323] (c)

[0324] (d)

[0325] (e)

[0326] (f)c3=r j xorc1,

[0327] (g)

[0328] (h)

[0329] (i)

[0330] (j)

[0331] (k)c3=r j xorc1,

[0332] (l)

[0333] XOR gate not related to key addition (z j =z k xor ) can be converted to:

[0334] (a)r j =r k xor

[0335] (b)

[0336] (c)

[0337] XOR gate related to key addition (z j =z k xor K) can be converted to:

[0338] (a)

[0339] (b)

[0340] where the shared share r between the output value and the other output valuej is the share r shared between the input value and the other input value k Alternatively, the key K 1 and / or K 2 The key is stored as a share and can be added using an XOR gate process that is independent of the key. This can increase the uniformity of the circuit, making it more difficult to identify the XOR gate using the key as a constant.

[0341] The ternary term Add to Here, the share may correspond to the calculated share 245.2; the share r j Can correspond to the shared share 245.1 = 246.1; share May correspond to the calculated share 246.2.

[0342] In Z 1 The sequence of keys operated on may be, for example, K used by the deobfuscation computation unit 452. d2 ,K d1 ; or K0,…,K used by the functional computing unit 453 10 , and K used by the obfuscation calculation unit 454, for example d3 ,K d4 .

[0343] About Z 2 , the sequence may be, for example, K0, ..., K used by the functional computing unit 457 10 ; For example, K used by the obfuscation calculation unit 454 d3 ,K d4 ; For example, K used by the obfuscation calculation unit 459 d5 K d6 .

[0344] Virtual key K d3 ,K d4 ,K d5 ,K d6 Can be randomly generated.

[0345] Step 7. Reorganize shares / re-share

[0346] make express The shared combination result. Let [W 1 ] indicates the shared result of the first track (for example, in the input Z 1 Executed on ), [W 2 ] indicates the shared result of the second track (for example, in the input [Z 2 ] ).

[0347] The following Boolean circuits for i=0, ..., 127 may be created to reorganize the shares of Z, for example, corresponding to two resharings of the resharing unit 831 of the computing device 800:

[0348]

[0349]

[0350]

[0351]

[0352] For a random And b1,b2∈[0,1].

[0353] For example, re-sharing the previous share It may correspond to shares 841.1 and 841.2. The share s after re-sharing r1,b1 , may correspond to shares 841.1'=844.1 and 841.2', respectively, and similarly for s r2,b2 and

[0354] make Will and Add to middle.

[0355] Step 8. Synchronous orbit

[0356] The two Boolean circuits can be evaluated with respect to the shares as in step 3 and in For the fictitious key K d Compute an inverse AES round and a positive round, for example, performed by virtual computation unit 455, and Use K d6 and K d5 Two inverse AES rounds are calculated using the virtual key, respectively, and are performed by, for example, the inverse obfuscation calculation unit 460.

[0357] Step 9. Combination 3

[0358] Let W′1 denote the input W′1. The result of W′2 represents the input W 2 superior The result is that a reversible linear function L′:{0,1} can be generated that satisfies the mapping L2(x)=(L′+I)(x)=L′(x)+x and is also reversible 128 →{0,1} 128 A Boolean circuit may be created that calculates Z′=L′(W′1)+L2(W′2), for example, by calculating the shares by the average calculation unit 435 as in step 3 .

[0359] Step 10. Revoke sharing

[0360] make represents the result of the previous step. The sharing can be undone, for example, the value can be rebuilt as follows: for i = 0, ..., 127

[0361]

[0362] Step 11. Rewind to output

[0363] A Boolean circuit can be created, which is respectively, for example, d4 and K d3 Two inverse AES rounds are calculated, for example, by the inverse obfuscation calculation unit 461, to obtain a calculation output.

[0364] Execution of the computing device described herein is implemented in a processor, examples of which are shown herein. Figure 1-7b The functional units shown may be functional units of a processor. For example, Figure 1 Can be used as a blueprint for possible functional organization of a processor. For example, Figure 4 The functional units shown in the figure may be implemented in whole or in part in computer instructions stored at the device 400, such as in an electronic memory of the device 400, and executable by a microprocessor of the device 400, and similarly for other computing devices. In a hybrid embodiment, the functional units are implemented partially in hardware, such as a coprocessor, such as a cryptographic coprocessor, and partially in software stored and executed on the corresponding device.

[0365] The computing device 100, 200, 300, 300', 400, 500, 600, 700 or 800 may have a user interface, which may include well-known elements such as one or more buttons, a keyboard, a display, a touch screen, etc. The user interface may be arranged to accommodate user interaction for initiating calculations on at least one set of values.

[0366] Typically, each computing device includes a microprocessor (not shown separately) that executes appropriate software stored in the respective device. For example, the software may have been downloaded and / or stored in a corresponding memory, for example, a volatile memory such as RAM or a non-volatile memory such as flash memory (not shown separately). Alternatively, the computing device may be implemented in whole or in part in programmable logic, for example, as a field programmable gate array (FPGA). The computing device may be implemented in whole or in part as a so-called application specific integrated circuit (ASIC), for example, an integrated circuit (IC) customized for its specific use. For example, the circuit may be implemented in CMOS, for example, using a hardware description language such as Verilog, VHDL, etc.

[0367] In one embodiment, computing device 100 includes operation circuit 131. Device 100 may include additional circuits, such as confusion calculation circuits, average calculation circuits, etc. Similarly, computing device 200 may include operation circuit 231, computing device may include parallel calculation branch circuits 331, 332, operation circuit 333, etc. Computing device 400 may include operation circuit 433, etc. Computing device 500 may include encoding operation circuit 531, etc. Computing device 600 may include encoding function circuit 631, etc. Computing device 700 may include re-sharing circuit 731, etc. Computing device 800 may include re-sharing circuit 831, etc. The circuit implements the corresponding operations and / or calculations described herein. The circuit may be a processor circuit and a storage circuit, and the processor circuit executes instructions electronically represented in the storage circuit.

[0368] The processor circuit may be implemented in a distributed manner, for example, as a plurality of sub-processor circuits. The storage device may be distributed across a plurality of distributed sub-storage devices. Part or all of the memory may be electronic memory, magnetic memory, etc. For example, the storage device may have volatile and non-volatile portions. Portions of the storage device may be read-only. The circuit may also be an FPGA, an ASIC, etc. The system may include additional circuits, for example, a first parallel computing branch circuit, etc.; etc.; the circuit implements the corresponding operations and / or calculations described herein.

[0369] Figure 8aAn example of an embodiment of a calculation method 900 for performing a calculation on at least one set of values ​​is schematically shown. The calculation method 900 may include providing 910 a set of values, each value in the set of values ​​being stored as a plurality of shares. The calculation method 900 may also include performing 920 a calculation operation on a set of input values ​​to obtain an output value. The output value may be defined by at least one shared share and at least one calculated share. The at least one shared share may also define additional values. Performing 920 the operation may include calculating 921 at least one calculated share from the at least one shared share and the shares of the set of input values.

[0370] As will be apparent to those skilled in the art, many different ways of performing the method are possible. For example, the order of the steps may be changed, or some steps may be performed in parallel. In addition, other method steps may be inserted between steps. The inserted steps may represent improvements to the method such as described herein, or may be unrelated to the method. For example, steps 910 and 920 may be performed at least partially in parallel. In addition, a given step may not be fully completed before starting the next step.

[0371] The method according to the present invention can be performed using software, the software including instructions for causing a processor system to perform method 900. The software can include only those steps taken by a specific sub-entity of the system. The software can be stored in a suitable storage medium, such as a hard disk, a floppy disk, a memory, an optical disk, etc. The software can be sent as a signal along a line, wirelessly or using a data network (e.g., the Internet). The software can be made available for downloading and / or remote use on a server. The method according to the present invention can be performed using a bitstream that is arranged to configure programmable logic (e.g., a field programmable gate array (FPGA)), to perform the method.

[0372] It will be appreciated that the present invention also extends to a computer program suitable for putting the present invention into practice, in particular a computer program on or in a carrier. The program may be in the form of source code, object code, a code intermediate between source and target, such as a partially compiled form, or any other form suitable for use in the implementation of the method according to the present invention. An embodiment relating to a computer program product comprises computer executable instructions corresponding to each processing step of at least one of the methods described. These instructions may be subdivided into subroutines and / or stored in one or more files that may be statically or dynamically linked. Another embodiment relating to a computer program product comprises computer executable instructions corresponding to each device of at least one of the systems and / or products described.

[0373] Figure 8bA computer readable medium 1000 is shown having a writable portion 1010 including a computer program 1020 according to an embodiment, the computer program 1020 comprising instructions for causing a processor system to perform a computational method for performing a computation on at least one set of values. The computer program 1020 may be embodied on the computer readable medium 1000 as a physical mark or by means of magnetization of the computer readable medium 1000. However, any other suitable embodiments are also conceivable. Furthermore, it will be understood that although the computer readable medium 1000 is shown here as an optical disk, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, a solid state memory, a flash memory, etc., and may be non-recordable or recordable. The computer program 1020 comprises instructions for causing a processor system to perform the computational method.

[0374] Figure 8c A schematic diagram shows a processor system 1140 according to an embodiment. The processor system includes one or more integrated circuits 1110. Figure 8c The architecture of one or more integrated circuits 1110 is schematically shown in FIG. The circuit 1110 includes a processing unit 1120, such as a CPU, for running a computer program component to perform a method according to an embodiment and / or implement its module or unit. The circuit 1110 includes a memory 1122 for storing programming code, data, etc. A portion of the memory 1122 may be read-only. The circuit 1110 may include a communication element 1126, such as an antenna, a connector, or both, and the like. The circuit 1110 may include a dedicated integrated circuit 1124 for performing some or all of the processing defined in the method. The processor 1120, the memory 1122, the dedicated IC 1124, and the communication element 1126 may be connected to each other via an interconnect 1130 (e.g., a bus). The processor system 1110 may be arranged to use an antenna and / or a connector for contact and / or contactless communication, respectively.

[0375] For example, in one embodiment, the computing device may include a processor circuit and a memory circuit, and the processor is arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In one embodiment, the processor circuit may be an ARM Cortex M0. The memory circuit may be a ROM circuit or a non-volatile memory, such as a flash memory. The memory circuit may be a volatile memory, such as an SRAM memory. In the latter case, the device may include a non-volatile software interface, such as a hard drive, a network interface, etc., which is arranged to provide software. The software includes an operation instruction arranged to perform a calculation on a set of input values ​​according to an embodiment.

[0376] It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments.

[0377] In the claims, any reference signs between parentheses shall not be construed as limiting the claim. The use of the verb "comprise" and its conjugations does not exclude the presence of other elements or steps not mentioned in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same piece of hardware. Although certain measures are recited in mutually different dependent claims, this does not mean that a combination of these measures cannot be used to advantage.

[0378] In the claims, references in parentheses refer to reference numerals in the drawings of exemplary embodiments or formulas of the embodiments, thereby increasing the understandability of the claims. These references should not be interpreted as limiting the claims.

Claims

1. A cryptographic computing device (100, 200) for performing a calculation on at least one set of sensitive values, the cryptographic computing device comprising: a memory (140, 240) configured to store the set of sensitive values, each value in the set of sensitive values ​​being stored as a plurality of shares to prevent disclosure of the value, wherein the plurality of shares defines the value; A processor (130, 230) configured as follows: The operation of the calculation is performed on a set of input values ​​from the set of sensitive values ​​to obtain an output value (143, 245), the output value is stored as multiple shares to prevent disclosure of the output value, the output value is defined by at least one shared share (143.1, 144.1, 245.1, 246.1) and at least one calculated share, the at least one shared share also defining another value (144, 246) different from the output value, wherein performing the operation includes: calculating the at least one calculated share based on the at least one shared share and the shares of the set of input values.

2. The cryptographic computing device according to claim 1, wherein: The computation includes the evaluation of a block cipher on the input message.

3. A cryptographic computing device according to any one of the preceding claims, wherein: Computing the at least one calculated share includes computing a sequence of a plurality of intermediate results, each intermediate result being computed based on the at least one shared share.

4. The cryptographic computing device according to claim 1 or 2, wherein: The further value is independent of the set of input values.

5. The cryptographic computing device according to claim 1 or 2, wherein: Each share that defines the output value also defines a corresponding further value.

6. The cryptographic computing device according to claim 1 or 2, wherein: The further value (144) is the output of a previous operation of the calculation performed prior to the operation.

7. The cryptographic computing device (200) according to claim 1 or 2, wherein: The calculation comprises another operation on another set of input values ​​to obtain the further value (246), the further value being defined by the at least one shared share (245.1, 246.1) and at least one further calculated share, the processor being configured to: calculating the at least one calculated share as a function of the at least one shared share and the share of the set of input values; The at least one further calculated share is calculated as a function of the at least one shared share and the shares of the further set of input values.

8. The cryptographic computing device according to claim 7, wherein: The processor is further configured to calculate a share of the at least one share using at least one share of an output of a previously executed operation as a random value.

9. The cryptographic computing device according to claim 7, wherein: The calculation includes at least: a first parallel calculation branch and a second parallel calculation branch, each calculation branch calculates a copy of the same output; and an average calculation of combining multiple copies of the same output into a single output, the operation and the other operation are included in different parallel calculation branches.

10. The cryptographic computing device according to claim 1 or 2, wherein: The calculations also include an initial obfuscated calculation followed by an inverse of the initial obfuscated calculation.

11. The cryptographic computing device according to claim 1 or 2, wherein: The values ​​are bits and the calculations include binary circuits.

12. The cryptographic computing device according to claim 1 or 2, wherein: Further operations using the output values ​​as input are interleaved.

13. The cryptographic computing device according to claim 1 or 2, wherein: One share of the plurality of shares is stored in an encoded manner.

14. The cryptographic computing device of claim 13, wherein: A plurality of values ​​in the set of sensitive values ​​constitute a combined value, and the combined value is stored in an encoded manner.

15. A cryptographic computing device (700) for performing a computation on at least one set of sensitive values, the cryptographic computing device comprising: a memory (740) configured to store the set of sensitive values, each value in the set of sensitive values ​​being stored as a plurality of shares to prevent disclosure of the value; A processor (730) is configured to re-share a first value (741) and a second value (742) in the set of sensitive values, wherein the re-sharing comprises: calculating at least one new shared share defining both the first value and the second value based on a previous share defining the first value and a previous share defining the second value (741.1', 742.1'); calculating at least one further new share defining said first value from said at least one new shared share and from previous shares defining said first value (741.2'); From the at least one new shared share and the previous shares defining the second value, at least one further new share defining the second value is calculated (742.2').

16. A cryptographic computing device (800) for performing a computation on at least one set of sensitive values, the cryptographic computing device comprising: a memory (840) configured to store the set of sensitive values, each value in the set of sensitive values ​​being stored as a plurality of shares to prevent disclosure of the value; A processor (830) configured to reshare a value (841), the value being defined after resharing by at least one shared share (841.1', 844.1) and at least one calculated share (841.2'), the at least one shared share also defining an output of a calculated operation performed prior to the resharing, the resharing comprising calculating the at least one calculated share based on the at least one shared share and the share defining the value prior to the resharing.

17. A cryptographic calculation method (900) for performing calculations on at least one set of sensitive values, the cryptographic calculation method comprising: providing (910) the set of sensitive values, each value in the set of sensitive values ​​being stored as a plurality of shares to prevent disclosure of the value; The operation of the calculation is performed (920) on a set of input values ​​from the set of sensitive values ​​to obtain an output value, the output value being defined by at least one shared share and at least one calculated share to prevent disclosure of the output value, the at least one shared share also defining another value different from the output value, wherein performing the operation includes calculating (921) the at least one calculated share based on the at least one shared share and the shares of the set of input values.

18. A computer readable medium (1000) comprising transient or non-transient data (1020) representing instructions for causing a processor system to perform the method of claim 17.

Images