S box circuit capable of resisting power consumption analysis

Abstract

The embodiment of the invention provides an anti-power-consumption-analysis S box circuit, and relates to the technical field of information security. The S-box circuit with the mask comprises a mixing circuit, a standard S-box circuit and a demasking operation circuit, the S-box circuit with the mask receives the first data and the mask data and outputs second data and demasked data; the obfuscation circuit obfuscates the first data and the mask data and outputs masking data; the standard S-box circuit processes the masking data and outputs second data; the demasking operation circuit is coupled with the standard S box circuit; and the de-mask operation circuit performs operation on the mask data and intermediate data of the standard S-box circuit, outputs de-mask data, and performs obfuscation operation which is the same as the operation executed by the obfuscation circuit on the de-mask data and the second data, so that output data obtained by performing standard S-box operation on the first data can be obtained. According to the S-box circuit with the mask, the input data and the output data are masked through the mask data, and the S-box circuit with the mask has the capability of resisting power consumption analysis attack.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an S-box circuit resistant to power consumption analysis. Background Art

[0002] In cryptography, power analysis attacks and protection of hardware devices that implement information security have a vital impact on data security. As a common algorithm used by hardware devices to implement information security, the security of block cipher algorithms is mainly guaranteed by nonlinear S-boxes (Substitution-boxes). In "Research on VLSI-related technologies of SMS4 cryptographic algorithm against power analysis attacks" (Bai Xuefei, University of Science and Technology of China, doctoral dissertation), the algebraic calculation process of the S-box in the SMS4 algorithm is given, including radioactive transformation and multiplication inversion operations, where the S-box performs multiplication inversion on the finite field GF(2^8). In addition, in order to reduce the amount of calculation, the concept of synthetic field is also proposed in the paper. In the algebraic calculation process of the S-box, the GF(2^8) field can be isomorphically mapped to a field with fewer elements for calculation. For example, the data on the GF(2^8) field can be isomorphically mapped to the GF(2^4), GF(2^2) or GF(2) field for calculation. However, since the S-box performs multiplication inversion on the GF(2^8) field, after isomorphically mapping the data on the GF(2^8) field to the GF(2^4), GF(2^2) or GF(2) field for calculation, it is also necessary to perform an inverse isomorphic mapping to map the calculation results of the GF(2^4), GF(2^2) or GF(2) field to the GF(2^8) field. Among them, GF(2^k) represents a finite field with (2^k) elements. If k=8, GF(2^8) represents a finite field containing 2^8=256 elements. GF(2^n^m) is the synthetic domain of GF(2^k), where k=n*m. For example, the synthetic domain corresponding to the GF(2^8) domain is GF((2^4)^2), and GF(2^8)=GF(2^4)+GF(2^4); the synthetic domain corresponding to the GF(2^4) domain is GF((2^2)^2), and GF(2^4)=GF(2^2)+GF(2^2).

[0003] Power consumption analysis attack technology uses the power consumption generated during the operation of cryptographic hardware devices, combined with input and output data for analysis, to obtain the key stored in the circuit. Therefore, when designing cryptographic hardware devices, various protection technologies are needed to enable them to resist power consumption analysis attacks. With the research on anti-power consumption analysis and countermeasures, various factors related to power consumption are sought in cryptographic algorithms and cryptographic hardware implementation schemes. The main countermeasures against power consumption analysis include: (1) rewriting or optimizing encryption and decryption algorithms from the level of algorithm implementation; (2) using random masking technology to process the input and output signals of the hardware using random numbers; (3) improving the implementation methods of logic and operation circuits from the perspective of logic circuit types. Among them, random masking technology introduces mask data in the hardware implementation process of the cryptographic algorithm, and masks all data related to the key. The attacker cannot obtain information about the masked data, so it is impossible to obtain confidential information such as the key through power consumption analysis attacks. Based on random masking, anti-power consumption analysis first masks the input data with mask data before the key is used, and then removes the mask data when the calculation reaches the final result to restore the expected result. During the operation process, the linear operation link can be simply masked using XOR operations, and the XOR operation can be used again to restore the correct result. The masking and recovery of the nonlinear operation link is relatively complicated. In "Research on VLSI-related Technologies of SMS4 Cryptographic Algorithm Against Power Analysis Attacks" (Bai Xuefei, University of Science and Technology of China, Ph.D. thesis), the random masking and recovery of the S-box in the nonlinear link of the SMS4 cryptographic algorithm are studied. Chapter 5 of the article proposes a solution that uses random masking technology to process the input and output signals of the S-box using random numbers, so that the S-box can resist power analysis. In the article, the input of the S-box is (a, M), and the output is Sbox(a)+M. By performing an XOR operation on Sbox(a)+M and M, Sbox(a) is restored. Among them, a represents the original input data and M represents the mask data. Summary of the invention

[0004] The embodiment of the present application hopes to improve the S-box circuit structure, and improve the power consumption analysis attack and protection capabilities through the improved S-box circuit.

[0005] According to a first aspect of the present application, a masked S-box circuit is provided, comprising: an obfuscation circuit, a standard S-box circuit, and a demasking operation circuit; the masked S-box circuit receives first data and masked data as input, and outputs second data and demasked data;

[0006] The obfuscation circuit obfuscates the first data and the mask data and outputs masked data;

[0007] The standard S-box circuit receives the masked data, processes the masked data, and outputs the second data;

[0008] The demasking operation circuit is coupled to the standard S-box circuit; the demasking operation circuit receives the mask data as input, operates the mask data and the intermediate data of the standard S-box circuit, and outputs the demasking data;

[0009] The same obfuscation operation as the operation performed by the obfuscation circuit is performed on the demasked data and the second data, so that output data obtained by the standard S-box operation of the first data can be obtained.

[0010] In an optional embodiment of the present application, the standard S-box circuit includes a first isomorphic mapping circuit, a first calculation circuit, an inversion circuit, a second calculation circuit, a third calculation circuit, and a second isomorphic mapping circuit;

[0011] The first isomorphic mapping circuit receives the masked data, performs isomorphic mapping on the masked data, and outputs third data and fourth data;

[0012] The first calculation circuit receives the third data, the fourth data and the fifth data, calculates the third data, the fourth data and the fifth data, and outputs sixth data;

[0013] The inversion circuit receives the sixth data, performs a multiplication inversion operation on the sixth data, and outputs seventh data;

[0014] The second calculation circuit receives the third data, the fourth data and the seventh data, calculates the third data, the fourth data and the seventh data, and outputs eighth data;

[0015] The third calculation circuit receives the fourth data and the seventh data, calculates the fourth data and the seventh data, and outputs ninth data;

[0016] The second isomorphic mapping circuit receives the eighth data and the ninth data, performs inverse isomorphic mapping on the eighth data and the ninth data, and outputs the second data.

[0017] In an optional embodiment of the present application, the first calculation circuit includes a first adder, a second adder, a first multiplier, a second multiplier, and a third multiplier;

[0018] An input port of the first adder receives the third data and the fourth data, and an output port of the first adder is coupled to an input port of the first multiplier;

[0019] The input port of the first multiplier also receives the third data, and the output port of the first multiplier is coupled to the input port of the second adder;

[0020] Both input ports of the second multiplier receive the fourth data, and an output port of the second multiplier is coupled to an input port of the third multiplier;

[0021] The input port of the third multiplier further receives fifth data, and the output port of the third multiplier is coupled to the input port of the second adder;

[0022] An output port of the second adder is coupled to an input port of the inversion circuit.

[0023] In an optional embodiment of the present application, the inversion circuit includes a third isomorphic mapping circuit, a fourth calculation circuit and a fourth isomorphic mapping circuit;

[0024] The third isomorphic mapping circuit receives the sixth data output by the first calculation circuit, performs isomorphic mapping on the sixth data, and outputs tenth data and eleventh data;

[0025] The fourth calculation circuit receives the tenth data, the eleventh data and the twelfth data, calculates the tenth data, the eleventh data and the twelfth data, and outputs the thirteenth data and the fourteenth data;

[0026] The fourth isomorphic mapping circuit receives the thirteenth data and the fourteenth data, performs inverse isomorphic mapping on the thirteenth data and the fourteenth data, and outputs the seventh data.

[0027] In an optional embodiment of the present application, the demasking operation circuit includes a fifth isomorphic mapping circuit, a fifth calculation circuit, a sixth calculation circuit and a sixth isomorphic mapping circuit;

[0028] The fifth isomorphic mapping circuit receives the mask data, performs isomorphic mapping on the mask data, and outputs fifteenth data and sixteenth data;

[0029] The fifth calculation circuit receives the fifteenth data, the third data, the fourth data, the seventh data and the seventeenth data, calculates the fifteenth data, the third data, the fourth data, the seventh data and the seventeenth data, and outputs eighteenth data;

[0030] The sixth calculation circuit receives the sixteenth data, the third data, the fourth data, the seventh data and the seventeenth data, calculates the sixteenth data, the third data, the fourth data, the seventh data and the seventeenth data, and outputs nineteenth data;

[0031] The sixth isomorphic mapping circuit receives the eighteenth data and the nineteenth data, performs inverse isomorphic mapping on the eighteenth data and the nineteenth data, and outputs the demasked data.

[0032] In an optional embodiment of the present application, the fifth calculation circuit includes a seventh calculation circuit, a seventh isomorphic mapping circuit, an eighth calculation circuit, an eighth isomorphic mapping circuit and a ninth calculation circuit;

[0033] The seventh calculation circuit calculates the third data, the fifteenth data, the sixteenth data, the seventeenth data, and the twentieth data output by the first adder, and outputs twenty-first data;

[0034] The seventh isomorphic mapping circuit receives the twenty-first data, performs isomorphic mapping on the twenty-first data, and outputs twenty-second data and twenty-third data;

[0035] the eighth calculation circuit receives the tenth data, the eleventh data, the twelfth data, the twenty-second data, the twenty-third data, and the twenty-fourth data and the twenty-fifth data from the fourth calculation circuit, calculates the tenth data, the eleventh data, the twelfth data, the twenty-second data, the twenty-third data, the twenty-fourth data, and the twenty-fifth data, and outputs twenty-sixth data and twenty-seventh data;

[0036] the eighth isomorphic mapping circuit receives the twenty-sixth data and the twenty-seventh data, performs inverse isomorphic mapping on the twenty-sixth data and the twenty-seventh data, and outputs twenty-eighth data;

[0037] The ninth calculation circuit receives the fourth data, the seventh data, the twenty-third data and the twenty-eighth data, calculates the fourth data, the seventh data, the twenty-third data and the twenty-eighth data, and outputs the eighteenth data.

[0038] In an optional embodiment of the present application, the seventh calculation circuit includes a third adder, a fourth adder, a fifth adder, a sixth adder, a fourth multiplier, a fifth multiplier, a sixth multiplier, a seventh multiplier and an eighth multiplier;

[0039] The input port of the third adder receives the fifteenth data and the sixteenth data, and the output port of the third adder is coupled to the input port of the fifth multiplier and the input port of the seventh multiplier;

[0040] Both input ports of the fourth multiplier receive the sixteenth data, and the output port of the fourth multiplier is coupled to the input port of the eighth multiplier;

[0041] The input port of the fifth multiplier also receives the third data, and the output port of the fifth multiplier is coupled to the input port of the fourth adder;

[0042] The input port of the sixth multiplier is coupled to the output port of the first adder, the input port of the sixth multiplier further receives the fifteenth data, and the output port of the sixth multiplier is coupled to the input port of the fourth adder;

[0043] The input port of the seventh multiplier also receives the fifteenth data, and the output port of the seventh multiplier is coupled to the input port of the fifth adder;

[0044] The input port of the eighth multiplier also receives the seventeenth data, and the output port of the eighth multiplier is coupled to the input port of the fifth adder;

[0045] The output port of the fourth adder is coupled to the input port of the sixth adder;

[0046] The output port of the fifth adder is coupled to the input port of the sixth adder;

[0047] An output port of the sixth adder is coupled to an input port of the seventh isomorphic mapping circuit.

[0048] In an optional embodiment of the present application, the eighth calculation circuit includes: a seventh adder, an eighth adder, a ninth adder, a tenth adder, an eleventh adder, a twelfth adder, a ninth multiplier, a tenth multiplier, an eleventh multiplier, a twelfth multiplier, a thirteenth multiplier, a fourteenth multiplier, a fifteenth multiplier, a sixteenth multiplier, a seventeenth multiplier, an eighteenth multiplier, a nineteenth multiplier and a twentieth multiplier;

[0049] The input port of the seventh adder receives the twenty-second data and the twenty-third data, and the output port of the seventh adder is coupled to the input port of the twelfth multiplier, the input port of the thirteenth multiplier, the input port of the eighteenth multiplier and the input port of the twentieth multiplier;

[0050] Both input ports of the ninth multiplier receive the twenty-third data, and the output port of the ninth multiplier is coupled to the input port of the tenth multiplier;

[0051] The input port of the tenth multiplier also receives the twelfth data, and the output port of the tenth multiplier is coupled to the input port of the eighth adder;

[0052] The input port of the eleventh multiplier is coupled to the output port of the third adder, the input port of the eleventh multiplier further receives the twenty-second data, and the output port of the eleventh multiplier is coupled to the input port of the ninth adder;

[0053] The input port of the twelfth multiplier receives the tenth data frame, and the output port of the twelfth multiplier is coupled to the input port of the ninth adder;

[0054] The input port of the thirteenth multiplier also receives the twenty-second data, and the output port of the thirteenth multiplier is coupled to the input port of the eighth adder;

[0055] The output port of the eighth adder is coupled to the input port of the tenth adder;

[0056] The output port of the ninth adder is coupled to the input port of the tenth adder;

[0057] The output port of the tenth adder is coupled to the input port of the fourteenth multiplier;

[0058] Both input ports of the fourteenth multiplier are coupled to the output port of the tenth adder, and the output port of the fourteenth multiplier is coupled to the input port of the fifteenth multiplier, the input port of the sixteenth multiplier, the input port of the nineteenth multiplier, and the input port of the twentieth multiplier;

[0059] The input port of the fifteenth multiplier also receives the eleventh data, and the output port of the fifteenth multiplier is coupled to the input port of the twelfth adder;

[0060] The input port of the sixteenth multiplier also receives the twenty-third data, and the output port of the sixteenth multiplier is coupled to the input port of the twelfth adder;

[0061] The input port of the seventeenth multiplier is coupled to the output port of the eighth multiplier, the input port of the seventeenth multiplier further receives the twenty-third data, and the input port and output port of the seventeenth multiplier are coupled to the input port of the twelfth adder;

[0062] The input port of the eighteenth multiplier is coupled to the output port of the eighty-seventh multiplier, and the output port of the eighteenth multiplier is coupled to the input port of the eleventh adder;

[0063] The input port of the nineteenth multiplier is coupled to the output port of the third adder, and the output port of the nineteenth multiplier is coupled to the input port of the eleventh adder;

[0064] The output port of the 20th multiplier is coupled to the input port of the 11th adder;

[0065] The eleventh adder outputs the twenty-sixth data;

[0066] The twelfth adder outputs the twenty-seventh data.

[0067] In an optional embodiment of the present application, the ninth calculation circuit includes: a twenty-first multiplier, a twenty-second multiplier, a twenty-third multiplier and a thirteenth adder;

[0068] An input port of the twenty-first multiplier is coupled to an output port of the eighth isomorphic mapping circuit, the input port of the twenty-first multiplier further receives the fourth data, and the output port of the twenty-first multiplier is coupled to an input port of the thirteenth adder;

[0069] An input port of the twenty-second multiplier is coupled to the output port of the eighth isomorphic mapping circuit, the input port of the twenty-second multiplier further receives the twenty-third data, and the output port of the twenty-second multiplier is coupled to the input port of the thirteenth adder;

[0070] An input port of the twenty-third multiplier receives the twenty-third data and the seventh data, and an output port of the twenty-third multiplier is coupled to an input port of the thirteenth adder;

[0071] The output port of the thirteenth adder is coupled to the input port of the fourth isomorphic mapping circuit to output the eighteenth data.

[0072] In an optional embodiment of the present application, the sixth calculation circuit includes a twenty-fourth multiplier, a twenty-fifth multiplier, a twenty-sixth multiplier and a fourteenth adder;

[0073] An input port of the twenty-fourth multiplier is coupled to the output port of the first adder and the output port of the eighth isomorphic mapping circuit, and an output port of the twenty-fourth multiplier is coupled to the input port of the fourteenth adder;

[0074] An input port of the twenty-fifth multiplier is coupled to the output port of the eighth isomorphic mapping circuit and the output port of the third adder, and an output port of the twenty-fifth multiplier is coupled to the input port of the fourteenth adder;

[0075] An input port of the twenty-sixth multiplier is coupled to an output port of the third adder and an output port of the sixth isomorphic mapping circuit, and an output port of the twenty-sixth multiplier is coupled to an input port of the fourteenth adder;

[0076] The output port of the fourteenth adder is coupled to the input port of the fourth isomorphic mapping circuit to output the nineteenth data.

[0077] In an optional embodiment of the present application, the fourth calculation circuit includes a fifteenth adder, a sixteenth adder, a twenty-seventh multiplier, a twenty-eighth multiplier, a twenty-ninth multiplier, a thirtieth multiplier, a thirty-first multiplier and a thirty-second multiplier;

[0078] An input port of the fifteenth adder receives the tenth data and the eleventh data, and an output port of the fifteenth adder is coupled to an input port of the twenty-seventh multiplier and an input port of the thirty-second multiplier;

[0079] The input port of the twenty-seventh multiplier further receives the tenth data, and the output port of the twenty-seventh multiplier is coupled to the input port of the sixteenth adder;

[0080] Both input ports of the twenty-eighth multiplier receive the eleventh data, and the output port of the twenty-eighth multiplier is coupled to the input port of the twenty-ninth multiplier;

[0081] The input port of the twenty-ninth multiplier also receives the twelfth data, and the output port of the twenty-ninth multiplier is coupled to the input port of the sixteenth adder;

[0082] The output port of the sixteenth adder is coupled to the input port of the thirtieth multiplier;

[0083] Both input ports of the 30th multiplier are coupled to the output port of the 16th adder, and the output port of the 30th multiplier is coupled to the input port of the 31st multiplier and the input port of the 32nd multiplier;

[0084] The input port of the thirty-first multiplier also receives the eleventh data and outputs the fourteenth data;

[0085] The thirty-second multiplier outputs the thirteenth data.

[0086] In an optional embodiment of the present application, the second calculation circuit includes a thirty-third multiplier, an input port of the thirty-third multiplier is coupled to the output port of the first adder and the output port of the inversion circuit, and the output port of the thirty-third multiplier is coupled to the input port of the second isomorphic mapping circuit, and sends the eighth data to the second isomorphic mapping circuit.

[0087] In an optional embodiment of the present application, the third calculation circuit includes a thirty-fourth multiplier, an input port of the thirty-fourth multiplier receives the fourth data, the input port of the thirty-fourth multiplier is also coupled to the output port of the inversion circuit, and the output port of the thirty-fourth multiplier is coupled to the input port of the second isomorphic mapping circuit to send the ninth data to the second isomorphic mapping circuit.

[0088] In an optional embodiment of the present application, the mask data is a random number or an exclusive OR result of a random number and the demasked data last output by the demasking operation circuit.

[0089] According to a second aspect of the present application, there is provided an S-box circuit, which receives first data in a GF(2^8) domain and mask data in a GF(2^8) domain as input, and outputs second data in a GF(2^8) domain;

[0090] The S-box circuit includes a confusion adder, a first isomorphic mapping circuit, a first calculation circuit, an inversion circuit, a second calculation circuit, a third calculation circuit and a second isomorphic mapping circuit;

[0091] The obfuscated adder receives the first data and the mask data, and the output of the obfuscated adder serves as the mask data;

[0092] The first isomorphic mapping circuit receives the masked data, performs isomorphic mapping on the masked data, and maps the masked data in the GF(2^8) domain into third data in the GF(2^4) domain and fourth data in the GF(2^4) domain;

[0093] The first calculation circuit receives the third data, the fourth data and the fifth data, calculates the product of the square of the fourth data and the fifth data, the square of the third data, and the product of the third data and the fourth data, sums the three calculated results, and outputs sixth data in the GF(2^4) domain;

[0094] The inversion circuit receives the sixth data, performs an inversion operation on the sixth data, and outputs seventh data in the GF(2^4) domain;

[0095] The second calculation circuit receives the third data, the fourth data and the seventh data, calculates the product of the sum of the third data and the fourth data and the seventh data, and outputs eighth data in the GF(2^4) domain;

[0096] The third calculation circuit receives the fourth data and the seventh data, calculates the product of the fourth data and the seventh data, and outputs ninth data in the GF(2^4) domain;

[0097] The second isomorphic mapping circuit receives the eighth data and the ninth data, performs inverse isomorphic mapping on the eighth data and the ninth data, maps the eighth data in the GF(2^4) domain and the ninth data in the GF(2^4) domain into second data in the GF(2^8) domain, and outputs the second data.

[0098] According to a third aspect of the present application, a device is provided, comprising the S-box circuit with mask as shown in the first aspect or the S-box circuit as shown in the second aspect.

[0099] The masked S-box circuit of the embodiment of the present application confuses data a and mask data M through an obfuscation circuit to mask data a, calculates the masked data output by the obfuscation circuit through a standard S-box circuit, outputs masked data Sbox(a+M), performs a demasking operation on mask data M through a demasking operation circuit, outputs demasked data f(a,M), performs the same obfuscation operation as the obfuscation circuit on masked data Sbox(a+M) and demasked data f(a,M), and obtains Sbox(a). The masked S-box circuit masks its input data and output data through mask data, and has the ability to resist power consumption analysis attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0100] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0101] Figure 1 A schematic structural diagram of a masked S-box circuit according to an embodiment of the present application is shown;

[0102] Figure 2 A schematic diagram showing the structure of a standard S-box circuit according to an embodiment of the present application is shown;

[0103] Figure 3 A schematic diagram showing the structure of the md calculation circuit of an embodiment of the present application is shown;

[0104] Figure 4 A schematic diagram showing the structure of an inversion circuit according to an embodiment of the present application is shown;

[0105] Figure 5 A schematic diagram showing the structure of a K calculation circuit according to an embodiment of the present application is shown;

[0106] Fig. 6A A schematic diagram showing the structure of a mal' calculation circuit according to an embodiment of the present application is shown;

[0107] Figure 6B A schematic diagram showing the structure of a mal' calculation circuit according to another embodiment of the present application is shown;

[0108] Figure 7 A schematic diagram showing the structure of a de-masking operation circuit according to an embodiment of the present application is shown;

[0109] Figure 8 A schematic diagram showing the structure of a P calculation circuit according to an embodiment of the present application is shown;

[0110] Fig. 9 A schematic diagram showing the structure of a G calculation circuit according to an embodiment of the present application is shown;

[0111] Fig.10 A schematic diagram of the structure of an R calculation circuit according to an embodiment of the present application is shown;

[0112] Fig.11 A schematic diagram showing the structure of an S calculation circuit according to an embodiment of the present application is shown;

[0113] Fig.12 A schematic diagram showing the structure of a Q calculation circuit according to an embodiment of the present application is shown;

[0114] Fig.13 A schematic structural diagram of an S-box circuit according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0115] The following is a clear and complete description of the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0116] Figure 1 A schematic structural diagram of a masked S-box circuit according to an embodiment of the present application is shown.

[0117] like Figure 1 As shown, the masked S-box circuit includes: a confusion circuit, a standard S-box circuit and a demasking operation circuit. The input data of the masked S-box circuit includes two parts: data a and mask data M, and the output data also includes two parts: Sbox (a + M) and demasked data f (a, M).

[0118] The obfuscation circuit receives data a and mask data M, performs an obfuscation operation on a and M, and outputs mask data ma. The obfuscation circuit masks data a using mask data M. The obfuscation circuit is a logic XOR operation circuit, which performs an XOR operation on data a and mask data M to achieve masking of data a using mask data M.

[0119] In some optional embodiments, the mask data M is a random number. In other optional embodiments, the mask data is the XOR result of the random number and the demasked data f(a, M) output by the demasking operation circuit last time. For example, the calculation process of the S box in the SMS4 encryption algorithm has 32 rounds, and a random number is input and a demasked data is calculated in each round, and the random number input in each round is random. The XOR result of the demasked data f(a, M) output by the previous round of calculation and the random number M input by the next round is used as the masked data input by the next round of calculation. For example, the masked data input in the masked S box of this embodiment can be a random number, or it can be the XOR result of a random number and the demasked data output by the demasking operation circuit last time.

[0120] The standard S-box circuit is coupled to the garbled circuit. The standard S-box circuit receives the masked data ma output by the garbled circuit, processes ma, and outputs Sbox(a+M).

[0121] The demasking operation circuit is coupled to the standard S-box circuit. The demasking operation circuit receives the mask data M as input, operates the mask data M and the intermediate data of the standard S-box circuit, and outputs the demasked data f(a,M). The demasked data f(a,M) and Sbox(a+M) are subjected to the same obfuscation operation as that performed by the obfuscation circuit, and the output data obtained by the standard S-box operation of the data a can be obtained. For example, the data a is subjected to the standard S-box operation, and the output data obtained is Sbox(a). The obfuscation circuit performs an XOR operation on the data a and the mask data M, and performs an XOR operation on f(a,M) and Sbox(a+M) to obtain the output data Sbox(a) corresponding to the data a.

[0122] The masked S-box circuit of the embodiment of the present application confuses data a and mask data M through an obfuscation circuit to mask data a, calculates the masked data output by the obfuscation circuit through a standard S-box circuit, outputs masked data Sbox(a+M), performs a demasking operation on mask data M through a demasking operation circuit, outputs demasked data f(a,M), performs the same obfuscation operation as the obfuscation circuit on masked data Sbox(a+M) and demasked data f(a,M), and obtains Sbox(a). The masked S-box circuit masks its input data and output data through mask data, and has the ability to resist power consumption analysis attacks.

[0123] The masked S-box circuit of the embodiment of the present application can not only realize the function of masking data a, but also realize the function of not masking data a, for example, directly outputting Sbox(a) without mask. In order to output Sbox(a) without mask, the mask data M of the input circuit can be made to be all-zero data, for example, a random number of 8 bits 0 (00000000).

[0124] In an optional embodiment of the present application, the number of bits of data a and mask data M input to the masked S-box circuit is the same, and the number of bits of Sbox(a+M) and f(a,M) outputted therefrom is also the same as data a and mask data M. For example, if data a and mask data M are 8 bits, 16 bits or 32 bits, then Sbox(a+M) and f(a,M) outputted therefrom are 8 bits, 16 bits or 32 bits. The masked S-box circuit of the embodiment of the present application is described below by taking data a and mask data M as 8 bits as an example.

[0125] Figure 2 A schematic structural diagram of a standard S-box circuit in a masked S-box circuit according to an embodiment of the present application is shown.

[0126] like Figure 2 As shown, the standard S-box circuit includes: an H1 isomorphic mapping circuit, an md calculation circuit, an inversion circuit, a mal' calculation circuit, a mah' calculation circuit and an H2 isomorphic mapping circuit.

[0127] The H1 isomorphic mapping circuit receives the masked data ma output by the obfuscation circuit, performs isomorphic mapping on ma, and outputs data_0 and data_1. In this embodiment, the H1 isomorphic mapping circuit maps the masked data ma in the GF(2^8) domain to data_0 in the GF(2^4) domain and data_1 in the GF(2^4) domain.

[0128] The md calculation circuit receives data_0 and data_1 output by the H1 isomorphic mapping circuit, and also receives v as an external input, calculates data_0, data_1 and v, and outputs D7. The md calculation circuit calculates data_0, data_1 and v according to formula (1):

[0129] D7= (data_1) 2 *v+( data_0+ data_1 )* data_0 (1)

[0130] v represents external input data, for example, v may be data pre-stored in the memory. Since data_0 and data_1 are 4-bit data, v is also 4-bit data. As an example, v may be 1001 in binary.

[0131] According to formula (1), it is known that 3 multiplications and 2 additions are required to calculate md. As an example, the md calculation circuit includes 2 adders and 3 multipliers, wherein the md calculation circuit performs logical operations in the GF(2^4) domain.

[0132] Figure 3 FIG. 1 shows a schematic diagram of the structure of an md calculation circuit provided by an embodiment of the present application. Figure 3 As shown, the md calculation circuit includes an adder E1, an adder E2, a multiplier F1, a multiplier F2, and a multiplier F3.

[0133] The input port of adder E1 receives data_0 and data_1 output by H1 isomorphic mapping circuit, and the output port of adder E1 is coupled to the input port of multiplier F1. Adder E1 performs addition operation on data_0 and data_1 in GF(2^4) domain and outputs D4, where D4=data_0+data_1.

[0134] The input port of the multiplier F1 receives data_0 and D4, and the output port of the multiplier F1 is coupled to the input port of the adder E2. The multiplier F1 performs a multiplication operation on data_0 and D4 in the GF(2^4) domain and outputs D5, where D5=data_0*(data_0+data_1).

[0135] Both input ports of multiplier F2 receive data_1, and the output port of multiplier F2 is coupled to the input port of multiplier F3. Multiplier F2 performs multiplication operation on data_1 in the GF(2^4) domain and outputs D3, where D3=data_1*data_1.

[0136] The input port of the multiplier F3 receives D3 and external input v, and the output port of the multiplier F3 is coupled to the input port of the adder E2. The multiplier F3 performs a multiplication operation on D3 and v in the GF(2^4) domain and outputs D6, where D6 = (data_1) 2 *v.

[0137] The input port of adder E2 is coupled to the output ports of multipliers F1 and F3, and the output port of adder E2 is the output of the md calculation circuit, which is coupled to the input port of the inversion circuit. Adder E2 performs addition operation on D5 and D6 in the GF(2^4) domain and outputs D7.

[0138] The inversion circuit receives D7 output by the md calculation circuit, performs an inversion operation on D7, and outputs D16.

[0139] In an optional embodiment, the inversion circuit isomorphically maps the data D7 on the GF(2^4) domain output by the md circuit to data on the GF(2^2) domain for inversion operation, and then inversely isomorphically maps the inversion operation result to GF(2^4) data.

[0140] Figure 4 FIG. 2 shows a schematic diagram of the structure of the inversion circuit in the masked S-box circuit of an embodiment of the present application. Figure 4 As shown, the inversion circuit includes an H5 isomorphic mapping circuit, a K calculation circuit and an H6 isomorphic mapping circuit;

[0141] The H5 isomorphic mapping circuit receives D7 in the GF(2^4) domain output by the md calculation circuit, performs isomorphic mapping on D7, and outputs data_2 in the GF(2^2) domain and data_3 in the GF(2^2) domain.

[0142] The K calculation circuit receives data_2, data_3 output by the H5 isomorphic mapping circuit and external input data w, calculates data_2, data_3 and external input data w, and outputs D14 and D15.

[0143] Wherein, w represents external input data, for example, w may be data pre-stored in a memory. Since w is data on the GF(2^2) field, w includes 2 bits, and as an example, w may be 10 in binary.

[0144] Figure 5 FIG. 2 shows a schematic diagram of a K calculation circuit according to an embodiment of the present application. Figure 5 As shown, the K calculation circuit includes an adder E3, an adder E4, a multiplier F4, a multiplier F5, a multiplier F6, a multiplier F7, a multiplier F8 and a multiplier F9.

[0145] The input port of adder E3 receives data-2 and data-3, and the output port of adder E3 is coupled to the input port of multiplier F4 and the input port of multiplier F9. Adder E3 performs addition operation on data_2 and data_3 in GF(2^2) domain and outputs D8, where D8=data_2+data_3.

[0146] The input port of the multiplier F4 receives data_2 and D8, and the output port of the multiplier F4 is coupled to the input port of the adder E4. The multiplier F4 performs a multiplication operation on data_2 and D8 in the GF(2^2) domain and outputs D9, wherein D9=data_2*(data_2+data_3).

[0147] Both input ports of the multiplier F5 receive data_3, and the output port of the multiplier F5 is coupled to the input port of the multiplier F6. The multiplier F5 performs a multiplication operation on data_3 in the GF(2^2) domain and outputs D10, wherein D10=data_3*data_3.

[0148] The input port of multiplier F6 receives D10 and w, and the output port of multiplier F6 is coupled to the input port of adder E4. Multiplier F6 performs multiplication operation on D10 and w in GF(2^2) domain and outputs D11; wherein D11=D10*w=(data_3) 2 *w.

[0149] The input port of adder E4 receives D9 and D11, and the output port is coupled to the input port of multiplier F7. Adder E4 performs addition operation on D9 and D11 in GF(2^2) domain and outputs D12; wherein D12 = (data_2*(data_2+data_3))+(data_3) 2 *w.

[0150] Both input ports of multiplier F7 are coupled to the output port of adder E4 to receive D12 output by adder E4. The output port of multiplier F7 is coupled to the input port of multiplier F9 and the input port of multiplier F8. Multiplier F7 performs multiplication operation on D12 in the GF(2^2) domain and outputs D13; wherein D13=D12*D12.

[0151] The input port of the multiplier F8 receives data_3 and D13, and the output port is coupled to the input port of the H6 isomorphic mapping circuit. The multiplier F9 performs a multiplication operation on data_3 and D13 in the GF(2^2) domain and outputs D15, wherein D15=data_3*D13.

[0152] The input port of the multiplier F9 receives D8 and D13, and the output port is coupled to the input port of the H6 isomorphic mapping circuit. The multiplier F8 performs a multiplication operation on D8 and D13 in the GF(2^2) domain and outputs D14, wherein D14=D8*D13.

[0153] The H6 isomorphic mapping circuit receives D14 and D15, performs inverse isomorphic mapping on D14 and D15, and outputs D16 in the GF(2^4) domain.

[0154] In an optional embodiment, the inversion circuit can directly invert D7 on the GF(2^4) field to obtain D16.

[0155] In an optional embodiment, the inversion circuit can also isomorphically map the data D7 on the GF(2^4) domain output by the md circuit to data on the GF(2^4) domain for inversion operation, and then inversely isomorphically map the inversion operation result to the GF(2^4) data. The inversion circuit maps D7 to the GF(2) domain through an isomorphic mapping of GF(2^4)->GF(2^2)->GF(2) to obtain the corresponding data md' on the GF(2) domain, inverts md' on the GF(2) domain to obtain the inversion result, and then the inversion circuit maps the inversion result on the GF(2) domain to GF(2^4) through an inverse isomorphic mapping of GF(2)->GF(2^2)->GF(2^4) to obtain the inversion result D16 corresponding to D7.

[0156] As an example, the inversion circuit may be a lookup table circuit, which obtains the corresponding D16 by looking up the table according to the input D7.

[0157] The mal' calculation circuit receives data_0, data_1 output by the H1 isomorphic mapping circuit and D16 output by the inversion circuit, calculates data_0, data_1 and D16, and outputs D17. The mal' calculation circuit calculates data_0, data_1 and D16 according to formula (2):

[0158] D17=(data_0+data_1)*D16(2)

[0159] In order to realize the calculation of formula (2). Figure 2 , the mal' calculation circuit input port is coupled to the H1 isomorphic mapping circuit output port, receives data_0 and data_1 output from the H1 isomorphic mapping circuit, and is coupled to the inversion circuit output port, receives D16 output from the inversion circuit. In this case, the mal' calculation circuit needs to calculate data_0+data_1 and the product of data_0+data_1 and D16.

[0160] Fig. 6A A schematic diagram of the structure of a mal' calculation circuit provided in an embodiment of the present application is shown.

[0161] As an example, Fig. 6AThe mal' calculation circuit includes an adder and a multiplier. The two input ports of the adder are respectively coupled with the two output ports of the H1 isomorphic mapping circuit to receive data_0 and data_1 output by the H1 isomorphic mapping circuit. The adder performs an addition operation on data_0 and data_1 to obtain data_0+data_1. The output port of the adder is coupled with the input port of the multiplier F10 to input data_0+data_1 to the multiplier F10. In addition, the input port of the multiplier F10 is also coupled with the output port of the H6 isomorphic mapping circuit to obtain D16 from the H6 isomorphic mapping circuit. The multiplier F10 performs a multiplication operation on D4 and D16 in the GF(2^4) domain to output D17.

[0162] See also Figure 3 As shown, D4=data_0+data_1 output by adder E1 in the md calculation circuit means that adder E1 has calculated the value of data_0+data_1, and the input port of the mal' calculation circuit can be directly coupled to the output of adder E1, and the mal' calculation circuit directly receives the output data_0+data_1 from adder E1. In this case, the mal' calculation circuit does not need to calculate data_0+data_1, but only needs to calculate the product of data_0+data_1 and D16.

[0163] Figure 6B A structural schematic diagram of another mal' calculation circuit provided in an embodiment of the present application is shown.

[0164] As an example, Figure 6B As shown, the mal' calculation circuit includes a multiplier F10, the input port of the multiplier F10 is coupled to the output port of the adder E1 and the output port of the H6 isomorphic mapping circuit, data_0+data_1 is obtained from the adder E1, D16 is obtained from the H6 isomorphic mapping circuit, and the multiplier F10 performs a multiplication operation on D4 and D16 in the GF(2^4) domain and outputs D17. In addition, the output port of the multiplier F10 is coupled to the input port of the H2 isomorphic mapping circuit, and D17 output by the multiplier F10 is sent to the H2 isomorphic mapping circuit.

[0165] The mah' calculation circuit receives data_1 output by the H1 isomorphic mapping circuit and D16 output by the inversion circuit, calculates data_1 and D16, and outputs D18. The mah' calculation circuit calculates data_1 and D16 according to formula (3):

[0166] D18 = data_1* D16 (3)

[0167] It can be seen from formula (3) that the mah' calculation circuit needs to perform a multiplication operation to calculate D18. As an example, the mah' calculation circuit includes a multiplier F11, the input port of the multiplier F11 receives data_1, and the input port of the multiplier F11 is also coupled to the output port of the H6 isomorphic mapping circuit. The multiplier F11 performs a multiplication operation on data_1 and D16 in the GF(2^4) domain and outputs D18. The output port of the multiplier F11 is coupled to the input port of the H2 isomorphic mapping circuit and sends D18 to the H2 isomorphic mapping circuit.

[0168] The two input ports of the H2 isomorphic mapping circuit are coupled to the output ports of the mal' calculation circuit and the mah' calculation circuit respectively, receive D17 output by the mal' calculation circuit and D18 output by the mah' calculation circuit, perform inverse isomorphism mapping on D17 and D18 in the GF(2^4) domain, and output Sbox(a+M) in the GF(2^8) domain.

[0169] The standard S-box circuit in the masked S-box circuit in the embodiment of the present application converts the masked data ma in the GF(2^8) domain into calculation in the GF(2^2) domain through the isomorphic mapping of GF(2^8)->GF(2^4)->GF(2^2)->GF(2^4)->GF(2^8), which can effectively reduce latency and hardware area compared to the isomorphic mapping of GF(2^8)->GF(2^4)->GF(2^2)->GF(2)->GF(2^2)->GF(2^4)->GF(2^8).

[0170] For the S-box circuit, its input characteristics can be derived specifically according to its output, for example, its input data a can be derived according to Sbox(a). In the embodiment of the present application, since mask data is introduced into the input of the standard S-box circuit, the output data of the standard S-box circuit carries the mask data, and since the mask data is a random number, the input data a of the standard S-box cannot be derived according to the output data. For this reason, the embodiment of the present application also introduces a demasking operation circuit. In order to demask the masked data Sbox(a+M), for example, to recover Sbox(a) from the masked data Sbox(a+M), the demasking operation circuit calculates the masked data M to obtain the demasked data f(a,M).

[0171] The output of the demasking circuit is f(a,M)=Sbox(a+M)+Sbox(a), where f(a,M) is data in the GF(2^8) domain. Let the two data P and Q that are isomorphically mapped to the GF(2^4) domain be Sbox(a+M)+Sbox(a)=P+Qx.

[0172] according to Figure 1 and Figure 2From the circuit structure shown, we can see that:

[0173] Sbox(a+M)=f(data_0,data_1,D16), D16=(D7) -1 =((data_1) 2 *v+(data_0+data_1)*

[0174] data_0) -1

[0175] Sbox(m)=f(mask_0,mask_1,d -1 ), d -1 =((mask_1) 2 *v+(mask_0+mask_1)*mask_0) -1

[0176] Thus, we can solve P = fp(mask_0, mask_1, data_0, data_1, D16), Q = fq(mask_0, mask_1, data_0, data_1, D16), where fp() and fq() are both calculations on the GF(2^4) domain, mask_1 and mask_0 are obtained by isomorphic mapping of M from GF(2^8) to GF(2^4), and data_0, data_1, D16 are obtained from the standard S-box circuit of this application. Therefore, the demasking operation circuit needs to isomorphically map the mask data M to data on the GF(2^4) domain, and then set the P calculation circuit and the Q calculation circuit according to fp() and fq(). Since the output data of the P calculation circuit and the output data of the Q calculation circuit are data on the GF(2^4) domain, it is necessary to inversely isomorphically map the output data of the P calculation circuit and the output data of the Q calculation circuit to f(a, M) on the GF(2^8) domain.

[0177] like Figure 7 As shown, the demasking operation circuit includes an H3 isomorphic mapping circuit, a P calculation circuit, a Q calculation circuit and an H4 isomorphic mapping circuit.

[0178] The H3 isomorphic mapping circuit receives the mask data M on the GF(2^8) domain, performs isomorphic mapping on M, and outputs data mask_0 and mask_1 on two GF(2^4) domains. The circuit structure of the H3 isomorphic mapping circuit can be the same as that of the H1 isomorphic mapping circuit, and maps the mask data M in the GF(2^8) domain to mask_0 and mask_1 in the GF(2^4) domain.

[0179] The P calculation circuit receives mask_0, data_0, data_1, D16 and u, calculates mask_0, data_0, data_1, D16 and u, and outputs M35. u represents external input data, for example, u can be data pre-stored in the memory. The input and output of the P calculation circuit and the Q calculation circuit are data on the GF(2^4) domain, so mask_0, data_0, data_1, D16, and u are all data composed of 4 bits. Here, u is the same as v. As an example, v can be binary 1001, and u is also binary 1001.

[0180] The Q calculation circuit receives mask_1, data_0, data_1, D16 and u, calculates mask_1, data_0, data_1, D16 and u, and outputs M36.

[0181] The two input ports of the H4 isomorphic mapping circuit are coupled to the P computing circuit and the Q computing circuit respectively, receiving M35 output by the P computing circuit and M36 output by the Q computing circuit, performing inverse isomorphic mapping on M35 and M36, and outputting f(a,M). The H4 isomorphic mapping circuit has the same circuit structure as the H2 isomorphic mapping circuit, mapping M35 and M36 in the GF(2^4) domain to f(a,M) in the GF(2^8) domain.

[0182] Since the output of the demasking operation circuit f(a,M) = Sbox(a+M)+Sbox(a), the output result is not only related to the mask data M, but also to the input data a. The input of the demasking operation circuit is the mask data M. In order to introduce a into the output, see Figure 7 In addition to mask_0 and mask_1 output by the H3 isomorphic mapping circuit and the external input u, the inputs of the P calculation circuit and the Q calculation circuit in the demasking operation circuit also include the intermediate data data_0, data_1 and D16 from the standard S-box circuit.

[0183] In an optional embodiment, the P computing circuit and the Q computing circuit can perform logical operations directly in the GF(2^4) domain without isomorphic mapping and inverse isomorphic mapping; or the input data can be mapped to the GF(2^2) domain or the GF(2) domain through isomorphic mapping to perform logical operations, and then the operation results on the GF(2^2) domain or the GF(2) domain can be mapped to the GF(2^4) domain through inverse isomorphism.

[0184] The following briefly describes the circuit structure and working process of the P calculation circuit and the Q calculation circuit on the isomorphic mapping GF(2^2) field. Specifically, how the P calculation circuit and the Q calculation circuit receive mask_0, mask_1, data_0, data_1, and D16 and perform calculations based on mask_0, mask_1, data_0, data_1, and D16 is described below.

[0185] Figure 8 FIG. 1 is a schematic diagram showing a structure of a P calculation circuit according to an embodiment of the present application. Figure 8 As shown, the P computing circuit includes a G computing circuit, an H7 isomorphic mapping circuit, an R computing circuit, an H8 isomorphic mapping circuit and an S computing circuit.

[0186] The input port of the G calculation circuit is respectively connected to the output port of the H3 isomorphic mapping circuit, the output port of the H1 isomorphic mapping circuit, and the adder E1 (such as Figure 2 The H3 isomorphic mapping circuit is coupled to the external input, so that mask_0 and mask_1 are obtained from the H3 isomorphic mapping circuit, data_0 is obtained from the H1 isomorphic mapping circuit, D4 is obtained from the adder E1, and u is obtained from the outside. Mask_0, mask_1, data_0, D4, and u are calculated on the GF(2^4) domain, and M9 is output. Wherein, M9 is data on the GF(2^4) domain.

[0187] Optionally, the input port of the G calculation circuit is not coupled with the output port of the adder E1 in the md calculation circuit of the S-box standard circuit, but is only coupled with the output port of the H1 isomorphic mapping circuit of the S-box standard circuit, and data_0 and data_1 (not marked in the figure) are obtained from the H1 isomorphic mapping circuit. Mask_0, mask_1, data_0, data_1 and u are calculated on the GF(2^4) domain, and M9 is output.

[0188] The H7 isomorphic mapping circuit receives M9, performs isomorphic mapping on M9 on the GF(2^4) domain, and outputs data mask_2 and mask_3 on two GF(2^2) domains.

[0189] The input port of the R calculation circuit is coupled with the output port of the H7 isomorphic mapping circuit, the output port of the H5 isomorphic mapping circuit in the standard S-box circuit, and the output ports of the adder E3 and the multiplier F7 of the inversion circuit to obtain mask_2 and mask_3 from the H7 isomorphic mapping circuit, obtain D8 from the adder E3, obtain data_2 and data_3 from the H5 isomorphic mapping circuit, and obtain D13 from the multiplier F7 to obtain z from the outside. Mask_2, mask_3, D8, z, data_2, data_3, and D13 are calculated in the GF(2^2) domain, and M26 and M27 are output. z represents external input data, for example, z can be data pre-stored in the memory. Since the R calculation circuit performs calculations on the GF(2^2) domain, z is data consisting of 2 bits, and z is the same as w. As an example, w can be binary 1001, and z is also binary 1001.

[0190] The input port of the H8 isomorphic mapping circuit is coupled with the output port of the R computing circuit, receives M26 and M27, performs inverse isomorphic mapping on M26 and M27, and outputs M28. The two data M26 and M27 on the GF(2^2) domain are inversely isomorphically mapped, and the data M28 on the GF(2^4) domain is output.

[0191] The S calculation circuit input port is coupled with the H8 isomorphic mapping circuit output port, the H7 isomorphic mapping circuit output port, the H1 isomorphic mapping circuit output port, and the inversion circuit output port, so as to receive M28 from the H8 isomorphic mapping circuit and mask_3 from the H7 isomorphic mapping circuit, receive data_1 from the H1 isomorphic mapping circuit, and receive D16 from the inversion circuit. M28, data_1, mask_3, and D16 are received, and M28, data_1, mask_3, and D16 are calculated to output M35.

[0192] Fig. 9 FIG. 1 is a schematic diagram showing a structure of a G calculation circuit according to an embodiment of the present application. Fig. 9 As shown, the G calculation circuit includes adder E5, adder E6, adder E7, adder E8, multiplier F12, multiplier F13, multiplier F14, multiplier F15 and multiplier F16.

[0193] The input port of adder E5 receives mask_0 and mask_1, performs addition operation on mask_0 and mask_1 in GF(2^4) domain, and outputs M1. The output port of adder E5 is coupled to the input port of adder F13 and the input port of adder F15; wherein, M1=mask_0+mask_1.

[0194] Both input ports of the multiplier F12 receive mask_1, perform multiplication operation on mask_1 in the GF(2^4) domain, and output M2. The output port of the multiplier F12 is coupled to the input port of the adder F16; wherein, M2=mask_1*mask_1.

[0195] The input port of the multiplier F13 receives data_0 and M1, performs multiplication operation on data_0 and M1 in the GF(2^4) domain, and outputs M3. The output port of the multiplier F13 is coupled to the input port of the adder E6; wherein, M3=data_0*M1.

[0196] The input port of the multiplier F14 receives D4 and mask_0, performs multiplication operation on D4 and mask_0 in the GF(2^4) domain, and outputs M4. The output port of the multiplier F14 is coupled to the input port of the adder E6; wherein, M4=D4*mask_0.

[0197] The input port of the multiplier F15 receives M1 and mask_0, performs multiplication operation on M1 and mask_0 in the GF(2^4) domain, and outputs M5. The output port of the multiplier F15 is coupled to the input port of the adder E7; wherein, M5=M1*mask_0.

[0198] The input port of the multiplier F16 receives M2 and u, performs multiplication operation on M2 and u in the GF(2^4) domain, and outputs M6. The output port of the multiplier F16 is coupled to the input port of the adder E7; wherein, M6=M2*u.

[0199] The input interface of adder E6 receives M3 and M4, performs addition operation on M3 and M4 in the GF(2^4) domain, and outputs M7. The output port of adder E6 is coupled to the input port of adder E8; wherein, M7=M3+M4.

[0200] The input interface of adder E7 receives M5 and M6, performs addition operation on M5 and M6 in the GF(2^4) domain, and outputs M8. The output port of adder E7 is coupled to the input port of adder E8; wherein, M8=M5+M6.

[0201] The input interface of adder E8 receives M7 and M8, performs addition operation on M7 and M8 in GF(2^4) domain, and outputs M9. The output port of adder E8 is coupled to the input port of H7 isomorphic mapping circuit; wherein, M9=M7+M8.

[0202] Fig.10 FIG. 1 is a schematic diagram showing a structure of an R calculation circuit according to an embodiment of the present application. Fig.10As shown, the R calculation circuit includes: adder E9, adder E10, adder E11, adder E12, adder E13, adder E14, multiplier F17, multiplier F18, multiplier F19, multiplier F20, multiplier F21, multiplier F22, multiplier F23, multiplier F24, multiplier F25, multiplier F26, multiplier F27 and multiplier F28.

[0203] The input port of adder E9 receives mask_2 and mask_3, performs addition operation on mask_2 and mask_3 in the GF(2^2) domain, and outputs M10. The output port of adder E9 is coupled to the input port of multiplier F20, the input port of multiplier F21, the input port of multiplier F26 and the input port of multiplier F28; wherein, M10=mask_2*mask_3.

[0204] Both input ports of the multiplier F17 receive mask_3, perform multiplication operation on mask_3 in the GF(2^2) domain, and output M11. The output port of the multiplier F17 is coupled to the input port of the multiplier F18; wherein, M11=mask_3*mask_3.

[0205] The input port of the multiplier F18 receives M11 and z, performs multiplication operation on M11 and z in the GF(2^2) domain, and outputs M12. The output port of the multiplier F18 is coupled to the input port of the adder E10; wherein, M12=M11*z.

[0206] The input port of the multiplier F19 receives D8 and mask_2, performs multiplication operation on D8 and mask_2 in the GF(2^2) domain, and outputs M13; the output port of the multiplier F19 is coupled to the input port of the adder E11; wherein, M13 = D8*mask_2.

[0207] The input port of the multiplier F20 receives M10 and data_2, performs multiplication operation on M10 and data_2 in the GF(2^2) domain, and outputs M14. The output port of the multiplier F20 is coupled to the input port of the adder E11; wherein, M14=M10*data_2.

[0208] The input port of the multiplier F21 receives M10 and mask_2, performs multiplication operation on M10 and mask_2 in the GF(2^2) domain, and outputs M15. The output port of the multiplier F21 is coupled to the input port of the adder E10; wherein, M15=M10*mask_2.

[0209] The input port of adder E10 receives M12 and M15, performs addition operation on M12 and M15 in GF(2^2) domain, and outputs M16. The output port of adder E10 is coupled to the input port of adder E12; wherein, M16=M12+M15.

[0210] The input port of adder E11 receives M13 and M14, performs addition operation on M13 and M14 in GF(2^2) domain, and outputs M17. The output port of adder E11 is coupled to the input port of adder E12; wherein, M17=M13+M14

[0211] The input port of adder E12 receives M16 and M17, performs addition operation on M16 and M17 in GF(2^2) domain, and outputs M18. The output port of adder E12 is coupled to the input port of multiplier F22; wherein, M18=M16+M17.

[0212] The input port of multiplier F22 receives M18, performs multiplication operation on M18 in the GF(2^2) domain, and outputs M19. The output port of multiplier F22 is coupled to the input port of multiplier F23, the input port of multiplier F24, the input port of multiplier F27 and the input port of multiplier F28; wherein, M19=M18*M18.

[0213] The input port of the multiplier F23 receives M19 and data_3, performs multiplication operation on M19 and data_3 in the GF(2^2) domain, and outputs M20. The output port of the multiplier F23 is coupled to the input port of the adder E14; wherein, M20=M19*data_3.

[0214] The input port of the multiplier F24 receives M19 and mask_3, performs multiplication operation on M19 and mask_3 in the GF(2^2) domain, and outputs M21. The output port of the multiplier F24 is coupled to the input port of the adder E14; wherein, M21=M19*mask_3.

[0215] The input port of multiplier F25 receives D13 and mask_3, performs multiplication operation on D13 and mask_3 in GF(2^2) domain, and outputs M22. The input port of multiplier F25 also receives mask_3. The input port and output port of multiplier F25 are coupled to the input port of adder E14; wherein, M22=D13*mask_3.

[0216] The input port of the multiplier F26 receives D13 and M10, performs multiplication operation on D13 and M10 in the GF(2^2) domain, and outputs M23. The output port of the multiplier F26 is coupled to the input port of the adder E13; wherein, M23=D13*M10.

[0217] The input port of the multiplier F27 receives D8 and M19, performs multiplication operation on D8 and M19 in the GF(2^2) domain, and outputs M24. The output port of the multiplier F27 is coupled to the input port of the adder E13; wherein, M24=D8*M19.

[0218] The input interface of the multiplier F28 receives M19 and M10, performs multiplication operation on M19 and M10 in the GF(2^2) domain, and outputs M25. The output port of the multiplier F28 is coupled to the input port of the adder E13; wherein, M25=M19*M10.

[0219] The input interface of adder E13 receives M23, M24, and M25, performs addition operation on M23, M24, and M25 in the GF(2^2) domain, and outputs M26. The output port of adder E13 is coupled to the input port of H8 isomorphic mapping circuit; wherein, M26=M23+M24+M25.

[0220] The input interface of adder E14 receives M20, M21, and M22, performs addition operation on M20, M21, and M22 in the GF(2^2) domain, and outputs M27. The output port of adder E14 is coupled to the input port of H8 isomorphic mapping circuit; wherein, M27=M20+M21+M22.

[0221] Fig.11 FIG. 1 is a schematic diagram showing a structure of an S calculation circuit according to an embodiment of the present application. Fig.11 As shown, the S calculation circuit includes: a multiplier F29, a multiplier F30, a multiplier F31 and an adder E15.

[0222] The input port of multiplier F29 is coupled to the output port of the H8 isomorphic mapping circuit, and receives M28 which is the output of the H8 isomorphic mapping circuit. The input port of multiplier F29 also receives data_1, performs multiplication operation on data_1 and M28 in the GF(2^4) domain, and outputs M29. The output port of multiplier F29 is coupled to the input port of adder E15; wherein, M29=data_1*M28.

[0223] The input port of the multiplier F30 receives mask_3 and M28, performs a multiplication operation on mask_3 and M28 in the GF(2^4) domain, and outputs M30. The output port of the multiplier F30 is coupled to the input port of the adder E15; wherein, M30=mask_3*M28.

[0224] The input port of the multiplier F31 receives mask_3 and D16, performs multiplication operation on mask_3 and D16 in the GF(2^4) domain, and outputs M31. The output port of the multiplier F31 is coupled to the input port of the adder E15; wherein, M31=mask_3*D16.

[0225] The input interface of adder E15 receives M29, M30, and M31, performs addition operation on M29, M30, and M31 in the GF(2^4) domain, and outputs M35. The output port of adder E15 is coupled to the input port of the H4 isomorphic mapping circuit; wherein, M35=M29+M30+M31.

[0226] Fig.12 FIG. 2 shows a schematic diagram of a Q calculation circuit according to an embodiment of the present application. Fig.12 As shown, the Q calculation circuit includes a multiplier F32, a multiplier F33, a multiplier F34 and an adder E16.

[0227] The input port of the multiplier F32 is coupled to the output port of the adder E1 and the output port of the H8 isomorphic mapping circuit in the md calculation circuit of the standard S-box circuit, receives D4 output by the adder E1 and M28 output by the H8 isomorphic mapping circuit, performs multiplication operation on D4 and M28 in the GF(2^4) domain, and outputs M32. The output port of the multiplier F32 is coupled to the input port of the adder E16; wherein, M32=D4*M28.

[0228] The input port of multiplier F33 is coupled to the output port of the H8 isomorphic mapping circuit and the output port of the adder E5, receives M28 output by the H8 isomorphic mapping circuit and M1 output by the adder E5, performs multiplication operation on M28 and M1 in the GF(2^4) domain, and outputs M33. The output port of multiplier F33 is coupled to the input port of the adder E16; wherein, M33=M28*M1.

[0229] The input port of the multiplier F34 is coupled to the output port of the adder E5 and the output port of the H6 isomorphic mapping circuit, receives M1 output by the adder E5 and D16 output by the H6 isomorphic mapping circuit, performs multiplication operation on M1 and D16 in the GF(2^4) domain, and outputs M34. The output port of the multiplier F34 is coupled to the input port of the adder E16; wherein, M34=M1*D16.

[0230] Adder E16 performs addition operation on M32, M33, and M34 in the GF(2^4) domain, and outputs M36. The output port of adder E16 is coupled to the input port of the H4 isomorphic mapping circuit; wherein, M36=M32+M33+M34.

[0231] It should be understood that in the embodiments of the present application, the calculation process of the demasking operation circuit may be similar to or different from the calculation process of the standard S-box circuit. For example, the calculation of the standard S-box circuit may be converted from GF(2^8) to GF(2^4), GF(2^2) or GF(2) domains. When the standard S-box circuit is converted to the GF(2^2) or GF(2) domain, the demasking operation circuit may be transferred to the GF(2^2) or GF(2) domain, or may not be transferred to the GF(2^2) or GF(2) domain, such as the demasking operation circuit is transferred to GF(2^4).

[0232] exist Figure 1-Figure 11 In the circuit structure diagram shown in FIG. And the addition operations all represent GF domain addition operations, which perform bit-wise XOR operations on the input data, for example, out=in1^in2, or out=in1^in2^in3, out represents the output data of the GF domain addition operation, and in1, in2, and in3 respectively represent the three input data of the GF domain addition operation.

[0233] And the multiplication operations mentioned above all represent GF domain multiplication operations. The multiplication operations in the GF(2^4) domain are as follows:

[0234] out[3]=(in0[3]&in1[0])^(in0[2]&in1[1])^(in0[1]&in1[2])^(comb1&in1[3])

[0235] out[2]=(in0[2]&in1[0])^(in0[1]&in1[1])^(comb1&in1[2])^(comb2&in1[3])

[0236] out[1]=(in0[1]&in1[0])^(comb1&in1[1])^(comb2&in1[2])^(comb3&in1[3])

[0237] out[0]=(in0[0]&in1[0])^(in0[3]&in1[1])^(in0[2]&in1[2])^(in0[1]&in1[3])

[0238] comb1=in0[0]^in0[3]

[0239] comb2=in0[2]^in0[3]

[0240] comb3=in0[1]^in0[2]

[0241] Among them, out[0], out[1], out[2] and out[3] represent the first to fourth bits of the output data of the multiplication operation in the GF(2^4) domain. In0[0], in0[1], in0[2] and in0[3] represent the first to fourth bits of one input data participating in the multiplication operation in the GF(2^4) domain, and in1[0], in1[1], in1[2] and in1[3] represent the first to fourth bits of another input data participating in the multiplication operation in the GF(2^4) domain.

[0242] The multiplication operation in the GF(2^4) domain is as follows:

[0243] out[1]=(in1[1]&in1[0]&in0[0])

[0244] |(in1[1]&~in1[0]&in0[1]&~in0[0])

[0245] |(in1[1]&~in1[0]&~in0[1]&in0[0])

[0246] |(~in1[1]&in1[0]&in0[1])

[0247] out[0]=(~in1[1]&in1[0]&in0[0])

[0248] |(in1[1]&~in1[0]&in0[1])

[0249] |(in1[1]&in1[0]&~in0[1]&in0[0])

[0250] |(in1[1]&in1[0]&in0[1]&~in0[0])

[0251] Wherein, out[0] and out[1] represent the first and second bits of the output data of the multiplication operation in the GF(2^2) domain. In0[0] and in0[1] represent the first and second bits of one input data participating in the multiplication operation in the GF(2^2) domain, and in1[0] and in1[1] represent the first and second bits of another input data participating in the multiplication operation in the GF(2^2) domain.

[0252] The present application also provides a device, including: Figure 1-Figure 11The masked S-box circuit shown in the figure receives data a and mask data M as input, outputs masked data Sbox(a+M) and unmasked data f(a,M), and uses the unmasked data f(a,M) to recover Sbox(a) from the standard S-box circuit output Sbox(a+M). For example, f(a,M)=Sbox(a+M)+Sbox(a), and performs an XOR operation on the unmasked data f(a,M) and Sbox(a+M) to obtain Sbox(a).

[0253] Fig.13 FIG. 1 shows a schematic diagram of the structure of an S-box circuit according to an embodiment of the present application. The S-box circuit can be understood as Figure 1 Another implementation of a standard S-box circuit in the masked S-box circuit shown, the S-box circuit receives GF(2^8) domain data a and GF(2^8) domain mask data M as input, and outputs GF(2^8) domain masked data Sbox(a+M).

[0254] like Fig.13 As shown, the S-box circuit includes a confusion adder, an H1 isomorphic mapping circuit, an md calculation circuit, an inversion circuit, a mal' calculation circuit, a mah' calculation circuit and an H2 isomorphic mapping circuit. Among them, the confusion adder can be used as Figure 1 In a specific implementation of the garbled circuit shown, the garbled adder receives data a and mask data M, performs a logical XOR operation on the data a and the mask data M, and outputs data ma as mask data.

[0255] As an example, Fig.13 The H1 isomorphic mapping circuit, md calculation circuit, inversion circuit, mal' calculation circuit, mah' calculation circuit and H2 isomorphic mapping circuit shown in FIG. Figure 2 In the standard S-box circuit shown, the H1 isomorphic mapping circuit, the md calculation circuit, the inversion circuit, the mal' calculation circuit, the mah' calculation circuit and the H2 isomorphic mapping circuit have the same structure and are not described in detail here.

[0256] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application. Obviously, those skilled in the art may make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A masked S-box circuit, characterized in that: include: Obfuscation circuits, standard S-box circuits, and demasking operation circuits; The masked S-box circuit receives the first data and the masked data as input, and outputs the second data and the demasked data; The obfuscation circuit obfuscates the first data and the mask data and outputs masked data; The standard S-box circuit receives the masked data, processes the masked data, and outputs the second data; The demasking operation circuit is coupled to the standard S-box circuit; the demasking operation circuit receives the mask data as input, operates the mask data and the intermediate data of the standard S-box circuit, and outputs the demasking data; The same obfuscation operation as the operation performed by the obfuscation circuit is performed on the demasked data and the second data, so that output data obtained by the standard S-box operation of the first data can be obtained.

2. The masked S-box circuit according to claim 1, characterized in that: The standard S-box circuit includes a first isomorphic mapping circuit, a first calculation circuit, an inversion circuit, a second calculation circuit, a third calculation circuit and a second isomorphic mapping circuit; The first isomorphic mapping circuit receives the masked data, performs isomorphic mapping on the masked data, and outputs third data and fourth data; The first calculation circuit receives the third data, the fourth data and the fifth data, calculates the third data, the fourth data and the fifth data, and outputs sixth data; The inversion circuit receives the sixth data, performs a multiplication inversion operation on the sixth data, and outputs seventh data; The second calculation circuit receives the third data, the fourth data and the seventh data, calculates the third data, the fourth data and the seventh data, and outputs eighth data; The third calculation circuit receives the fourth data and the seventh data, calculates the fourth data and the seventh data, and outputs ninth data; The second isomorphic mapping circuit receives the eighth data and the ninth data, performs inverse isomorphic mapping on the eighth data and the ninth data, and outputs the second data.

3. The masked S-box circuit according to claim 2, characterized in that: The first calculation circuit includes a first adder, a second adder, a first multiplier, a second multiplier, and a third multiplier; An input port of the first adder receives the third data and the fourth data, and an output port of the first adder is coupled to an input port of the first multiplier; The input port of the first multiplier also receives the third data, and the output port of the first multiplier is coupled to the input port of the second adder; Both input ports of the second multiplier receive the fourth data, and an output port of the second multiplier is coupled to an input port of the third multiplier; The input port of the third multiplier also receives the fifth data, and the output port of the third multiplier is coupled to the input port of the second adder; The second adder outputs the sixth data.

4. The masked S-box circuit according to claim 2 or 3, characterized in that: The inversion circuit includes a third isomorphic mapping circuit, a fourth calculation circuit and a fourth isomorphic mapping circuit; The third isomorphic mapping circuit receives the sixth data output by the first calculation circuit, performs isomorphic mapping on the sixth data, and outputs tenth data and eleventh data; The fourth calculation circuit receives the tenth data, the eleventh data and the twelfth data, calculates the tenth data, the eleventh data and the twelfth data, and outputs the thirteenth data and the fourteenth data; The fourth isomorphic mapping circuit receives the thirteenth data and the fourteenth data, performs inverse isomorphic mapping on the thirteenth data and the fourteenth data, and outputs the seventh data.

5. The masked S-box circuit according to any one of claims 2 to 4, characterized in that: The demasking operation circuit includes a fifth isomorphic mapping circuit, a fifth calculation circuit, a sixth calculation circuit and a sixth isomorphic mapping circuit; The fifth isomorphic mapping circuit receives the mask data, performs isomorphic mapping on the mask data, and outputs fifteenth data and sixteenth data; The fifth calculation circuit receives the third data, the fourth data, the seventh data, the fifteenth data and the seventeenth data, calculates the third data, the fourth data, the seventh data, the fifteenth data and the seventeenth data, and outputs eighteenth data; The sixth calculation circuit receives the third data, the fourth data, the seventh data, the sixteenth data and the seventeenth data, calculates the third data, the fourth data, the seventh data, the sixteenth data and the seventeenth data, and outputs nineteenth data; The sixth isomorphic mapping circuit receives the eighteenth data and the nineteenth data, performs inverse isomorphic mapping on the eighteenth data and the nineteenth data, and outputs the demasked data.

6. The masked S-box circuit according to claim 5, characterized in that: The fifth calculation circuit includes a seventh calculation circuit, a seventh isomorphic mapping circuit, an eighth calculation circuit, an eighth isomorphic mapping circuit and a ninth calculation circuit; The seventh calculation circuit calculates the third data, the fifteenth data, the sixteenth data, the seventeenth data, and the twentieth data output by the first adder, and outputs twenty-first data; The seventh isomorphic mapping circuit receives the twenty-first data, performs isomorphic mapping on the twenty-first data, and outputs twenty-second data and twenty-third data; the eighth calculation circuit receives the tenth data, the eleventh data, the twelfth data, the twenty-second data, the twenty-third data, and the twenty-fourth data and the twenty-fifth data from the fourth calculation circuit, calculates the tenth data, the eleventh data, the twelfth data, the twenty-second data, the twenty-third data, the twenty-fourth data, and the twenty-fifth data, and outputs twenty-sixth data and twenty-seventh data; the eighth isomorphic mapping circuit receives the twenty-sixth data and the twenty-seventh data, performs inverse isomorphic mapping on the twenty-sixth data and the twenty-seventh data, and outputs twenty-eighth data; The ninth calculation circuit receives the fourth data, the seventh data, the twenty-third data and the twenty-eighth data, calculates the fourth data, the seventh data, the twenty-third data and the twenty-eighth data, and outputs the eighteenth data.

7. The masked S-box circuit according to claim 6, characterized in that: The seventh calculation circuit includes a third adder, a fourth adder, a fifth adder, a sixth adder, a fourth multiplier, a fifth multiplier, a sixth multiplier, a seventh multiplier and an eighth multiplier; The input port of the third adder receives the fifteenth data and the sixteenth data, and the output port of the third adder is coupled to the input port of the fifth multiplier and the input port of the seventh multiplier; Both input ports of the fourth multiplier receive the sixteenth data, and the output port of the fourth multiplier is coupled to the input port of the eighth multiplier; The input port of the fifth multiplier also receives the third data, and the output port of the fifth multiplier is coupled to the input port of the fourth adder; The input port of the sixth multiplier is coupled to the output port of the first adder, the input port of the sixth multiplier further receives the fifteenth data, and the output port of the sixth multiplier is coupled to the input port of the fourth adder; The input port of the seventh multiplier also receives the fifteenth data, and the output port of the seventh multiplier is coupled to the input port of the fifth adder; The input port of the eighth multiplier also receives the seventeenth data, and the output port of the eighth multiplier is coupled to the input port of the fifth adder; The output port of the fourth adder is coupled to the input port of the sixth adder; The output port of the fifth adder is coupled to the input port of the sixth adder; An output port of the sixth adder is coupled to an input port of the seventh isomorphic mapping circuit.

8. The masked S-box circuit according to claim 7, characterized in that: The eighth calculation circuit includes: a seventh adder, an eighth adder, a ninth adder, a tenth adder, an eleventh adder, a twelfth adder, a ninth multiplier, a tenth multiplier, an eleventh multiplier, a twelfth multiplier, a thirteenth multiplier, a fourteenth multiplier, a fifteenth multiplier, a sixteenth multiplier, a seventeenth multiplier, an eighteenth multiplier, a nineteenth multiplier and a twentieth multiplier; The input port of the seventh adder receives the twenty-second data and the twenty-third data, and the output port of the seventh adder is coupled to the input port of the twelfth multiplier, the input port of the thirteenth multiplier, the input port of the eighteenth multiplier and the input port of the twentieth multiplier; Both input ports of the ninth multiplier receive the twenty-third data, and the output port of the ninth multiplier is coupled to the input port of the tenth multiplier; The input port of the tenth multiplier also receives the twelfth data, and the output port of the tenth multiplier is coupled to the input port of the eighth adder; The input port of the eleventh multiplier is coupled to the output port of the third adder, the input port of the eleventh multiplier further receives the twenty-second data, and the output port of the eleventh multiplier is coupled to the input port of the ninth adder; The input port of the twelfth multiplier receives the tenth data, and the output port of the twelfth multiplier is coupled to the input port of the ninth adder; The input port of the thirteenth multiplier also receives the twenty-second data, and the output port of the thirteenth multiplier is coupled to the input port of the eighth adder; The output port of the eighth adder is coupled to the input port of the tenth adder; The output port of the ninth adder is coupled to the input port of the tenth adder; The output port of the tenth adder is coupled to the input port of the fourteenth multiplier; Both input ports of the fourteenth multiplier are coupled to the output port of the tenth adder, and the output port of the fourteenth multiplier is coupled to the input port of the fifteenth multiplier, the input port of the sixteenth multiplier, the input port of the nineteenth multiplier, and the input port of the twentieth multiplier; The input port of the fifteenth multiplier also receives the eleventh data, and the output port of the fifteenth multiplier is coupled to the input port of the twelfth adder; The input port of the sixteenth multiplier also receives the twenty-third data, and the output port of the sixteenth multiplier is coupled to the input port of the twelfth adder; The input port of the seventeenth multiplier is coupled to the output port of the seventh multiplier, the input port of the seventeenth multiplier further receives the twenty-third data, and the input port and output port of the seventeenth multiplier are coupled to the input port of the twelfth adder; The input port of the eighteenth multiplier is coupled to the output port of the seventh multiplier, and the output port of the eighteenth multiplier is coupled to the input port of the eleventh adder; The input port of the nineteenth multiplier is coupled to the output port of the third adder, and the output port of the nineteenth multiplier is coupled to the input port of the eleventh adder; The output port of the 20th multiplier is coupled to the input port of the 11th adder; The eleventh adder outputs the twenty-sixth data; The twelfth adder outputs the twenty-seventh data.

9. The masked S-box circuit according to any one of claims 6 to 8, characterized in that: The ninth calculation circuit comprises: a twenty-first multiplier, a twenty-second multiplier, a twenty-third multiplier and a thirteenth adder; An input port of the twenty-first multiplier is coupled to an output port of the eighth isomorphic mapping circuit, the input port of the twenty-first multiplier further receives the fourth data, and the output port of the twenty-first multiplier is coupled to an input port of the thirteenth adder; An input port of the twenty-second multiplier is coupled to the output port of the eighth isomorphic mapping circuit, the input port of the twenty-second multiplier further receives the twenty-third data, and the output port of the twenty-second multiplier is coupled to the input port of the thirteenth adder; An input port of the twenty-third multiplier receives the twenty-third data and the seventh data, and an output port of the twenty-third multiplier is coupled to an input port of the thirteenth adder; The output port of the thirteenth adder is coupled to the input port of the fourth isomorphic mapping circuit to output the eighteenth data.

10. The masked S-box circuit according to any one of claims 7 to 9, characterized in that: The sixth calculation circuit includes a twenty-fourth multiplier, a twenty-fifth multiplier, a twenty-sixth multiplier and a fourteenth adder; An input port of the twenty-fourth multiplier is coupled to the output port of the first adder and the output port of the eighth isomorphic mapping circuit, and an output port of the twenty-fourth multiplier is coupled to the input port of the fourteenth adder; An input port of the twenty-fifth multiplier is coupled to the output port of the eighth isomorphic mapping circuit and the output port of the third adder, and an output port of the twenty-fifth multiplier is coupled to the input port of the fourteenth adder; An input port of the twenty-sixth multiplier is coupled to an output port of the third adder and an output port of the sixth isomorphic mapping circuit, and an output port of the twenty-sixth multiplier is coupled to an input port of the fourteenth adder; The output port of the fourteenth adder is coupled to the input port of the fourth isomorphic mapping circuit to output the nineteenth data.

Images