S-box circuit against power analysis

Abstract

The embodiment of the application provides an S-box circuit resisting power analysis, and relates to the technical field of information security. The S-box circuit with a mask comprises an obfuscation circuit, a standard S-box circuit and a de-mask operation circuit; the S-box circuit with a mask receives first data and mask data, and outputs second data and de-mask data; the obfuscation circuit obfuscates the first data and the mask data, and outputs masked data; the standard S-box circuit processes the masked data, and outputs the second data; the de-mask operation circuit is coupled with the standard S-box circuit; the de-mask operation circuit operates the mask data and intermediate data of the standard S-box circuit, and outputs de-mask data; the de-mask data and the second data are subjected to the same obfuscation operation as that performed by the obfuscation circuit, and the output data obtained by the standard S-box operation on the first data can be obtained. The S-box circuit with a mask can mask the input data and the output data by the mask data, and has the ability of resisting power analysis attack.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to an S-box circuit resisting power analysis. BACKGROUND

[0002] In cryptography, power analysis attack and protection of hardware devices for information security have a vital influence on data security. As a common algorithm used by hardware devices for information security, the security of a block cipher algorithm is mainly guaranteed by a nonlinear S-box (Substitution-box). In the dissertation "Research on VLSI Technology of SMS4 Cipher Algorithm Resisting Power Analysis Attack" (Bai Xuefei, University of Science and Technology of China, doctoral dissertation), the algebraic calculation process of the S-box in the SMS4 algorithm is given, including a radiation transformation and a multiplicative inverse operation. In the S-box, the multiplicative inverse is performed on the GF(2^8) field. In addition, in order to reduce the calculation amount, the concept of a synthetic field is proposed in the dissertation, and in the algebraic calculation process of the S-box, the GF(2^8) field can be isomorphically mapped to a field with fewer elements for calculation, for example, the data on the GF(2^8) field can be isomorphically mapped to the GF(2^4), GF(2^2) or GF(2) field for calculation. However, since the multiplicative inverse is performed on the GF(2^8) field, after the data on the GF(2^8) field is isomorphically mapped to the GF(2^4), GF(2^2) or GF(2) field for calculation, inverse isomorphism mapping is further required to map the calculation results of the GF(2^4), GF(2^2) or GF(2) field to the GF(2^8) field. GF(2^k) represents a finite field with (2^k) elements, and if k = 8, GF(2^8) represents a finite field with 2^8 = 256 elements. GF(2^n^m) is a synthetic field of GF(2^k), and k = n*m, for example, the synthetic field of the GF(2^8) field is GF((2^4)^2), and GF(2^8) = GF(2^4) + GF(2^4); the synthetic field of the GF(2^4) field is GF((2^2)^2), and GF(2^4) = GF(2^2) + GF(2^2).

[0003] Power analysis attack technology uses the power consumption of the cryptographic hardware device during operation, combines the input and output data for analysis, and obtains the key stored in the circuit. Therefore, various protection technologies are needed to make the cryptographic hardware device have the ability to resist power analysis attacks. With the research on countermeasures against power analysis, various factors related to power consumption are sought in the implementation of cryptographic algorithms and cryptographic hardware. The main countermeasures against power analysis include: (1) from the level of algorithm implementation, rewriting or optimizing the encryption and decryption algorithm; (2) using random masking technology to process the input and output signals of the hardware with random numbers; (3) from the type of logic and electrical circuit, improving the implementation method of logic and operation circuit. Among them, the random masking technology introduces masking data in the hardware implementation process of the cryptographic algorithm, and all data related to the key are masked. Attackers cannot obtain information about the masked data, so they cannot obtain the key and other secret information through power analysis attacks. Based on the random masking of power analysis, the input data is first masked with masking data before the key is used, and the masking data is removed when the final result is obtained to restore the expected result. In the operation process, linear operation links can be simply masked using XOR operations and can be restored to the correct result using XOR operations again. The masking and restoration of the nonlinear operation link are relatively complex. In the "Research on the Technology of SMS4 Cryptographic Algorithm VLSI Against Power Analysis Attacks" (Bai Xuefei, University of Science and Technology of China, doctoral thesis), the random masking and restoration of the S-box in the nonlinear link of the SMS4 cryptographic algorithm are studied. Chapter 5 of the article presents a scheme that uses random masking technology to process the input and output signals of the S-box with random numbers, making the S-box resistant to power analysis. In the article, the input of the S-box is (a, M), and the output is Sbox(a) + M. By performing XOR operation on Sbox(a) + M and M, Sbox(a) is restored. Wherein, a represents the original input data, and M represents the masking data. SUMMARY

[0004] The embodiments of the present application hope to improve the S-box circuit structure, and improve the power analysis attack and protection ability through the improved S-box circuit.

[0005] According to a first aspect of the present application, a masked S-box circuit is provided, comprising: a confusion circuit, a standard S-box circuit, and a de-masking operation circuit; the masked S-box circuit receives first data and masking data as input, and outputs second data and de-masking data;

[0006] The confusion circuit confuses the first data and the masking data, and outputs the masked data;

[0007] The standard S-box circuit receives the masked data, processes the masked data, and outputs the second data;

[0008] The unmasking operation circuit is coupled with the standard S-box circuit; the unmasking operation circuit receives the mask data as input, operates the mask data and intermediate data of the standard S-box circuit, and outputs the unmasking data;

[0009] Wherein, the same confusion operation as the operation performed by the confusion circuit is performed on the unmasking data and the second data, and the output data of the first data subjected to the standard S-box operation can be obtained.

[0010] In an optional embodiment of the present application, the standard S-box circuit comprises a first isomorphic mapping circuit, a first calculation circuit, an inverse circuit, a second calculation circuit, a third calculation circuit and a second isomorphic mapping circuit.

[0011] The first isomorphic mapping circuit receives the masking data, performs isomorphic mapping on the masking data, and outputs third data and fourth data;

[0012] The first calculation circuit receives the third data, the fourth data and fifth data, performs calculation on the third data, the fourth data and the fifth data, and outputs sixth data;

[0013] The inverse circuit receives the sixth data, performs multiplicative inverse operation on the sixth data, and outputs seventh data;

[0014] The second calculation circuit receives the third data, the fourth data and the seventh data, performs calculation on the third data, the fourth data and the seventh data, and outputs eighth data;

[0015] The third calculation circuit receives the fourth data and the seventh data, performs calculation on the fourth data and the seventh data, and outputs ninth data;

[0016] The second isomorphic mapping circuit receives the eighth data and the ninth data, performs inverse isomorphic mapping on the eighth data and the ninth data, and outputs the second data.

[0017] In an optional embodiment of the present application, the first calculation circuit comprises a first adder, a second adder, a first multiplier, a second multiplier and a third multiplier.

[0018] The input port of the first adder receives the third data and the fourth data, and the output port of the first adder is coupled with the input port of the first multiplier;

[0019] The input port of the first multiplier further receives the third data, and the output port of the first multiplier is coupled with the input port of the second adder;

[0020] The two input ports of the second multiplier both receive the fourth data, and an output port of the second multiplier is coupled with an input port of the third multiplier;

[0021] An input port of the third multiplier further receives fifth data, and an output port of the third multiplier is coupled with an input port of the second adder;

[0022] An output port of the second adder is coupled with an input port of the inverse circuit.

[0023] In an optional embodiment of the present application, the inverse circuit comprises a third isomorphic mapping circuit, a fourth calculation circuit and a fourth isomorphic mapping circuit;

[0024] The third isomorphic mapping circuit receives sixth data output by the first calculation circuit, performs isomorphic mapping on the sixth data, and outputs tenth data and eleventh data;

[0025] The fourth calculation circuit receives the tenth data, the eleventh data and twelfth data, performs calculation on the tenth data, the eleventh data and the twelfth data, and outputs thirteenth data and fourteenth data;

[0026] The fourth isomorphic mapping circuit receives the thirteenth data and the fourteenth data, performs inverse isomorphic mapping on the thirteenth data and the fourteenth data, and outputs the seventh data.

[0027] In an optional embodiment of the present application, the de-masking operation circuit comprises a fifth isomorphic mapping circuit, a fifth calculation circuit, a sixth calculation circuit and a sixth isomorphic mapping circuit;

[0028] The fifth isomorphic mapping circuit receives the mask data, performs isomorphic mapping on the mask data, and outputs fifteenth data and sixteenth data;

[0029] The fifth calculation circuit receives the fifteenth data, the third data, the fourth data, the seventh data and seventeenth data, performs calculation on the fifteenth data, the third data, the fourth data, the seventh data and the seventeenth data, and outputs eighteenth data;

[0030] The sixth calculation circuit receives the sixteenth data, the third data, the fourth data, the seventh data and the seventeenth data, performs calculation on the sixteenth data, the third data, the fourth data, the seventh data and the seventeenth data, and outputs nineteenth data;

[0031] The sixth isomorphism circuit receives the eighteenth data and the nineteenth data, inversely isomorphically maps the eighteenth data and the nineteenth data, and outputs the unmasked data.

[0032] In an optional embodiment of the present application, the fifth calculation circuit includes a seventh calculation circuit, a seventh isomorphism circuit, an eighth calculation circuit, an eighth isomorphism circuit, and a ninth calculation circuit.

[0033] The seventh calculation circuit calculates the third data, the fifteenth data, the sixteenth data, the seventeenth data, and twentieth data output by the first adder, and outputs twenty-first data;

[0034] The seventh isomorphism circuit receives the twenty-first data, isomorphically maps the twenty-first data, and outputs twenty-second data and twenty-third data;

[0035] The eighth calculation circuit receives the tenth data, the eleventh data, the twelfth data, the twenty-second data, the twenty-third data, twenty-fourth data and twenty-fifth data from the fourth calculation circuit, calculates the tenth data, the eleventh data, the twelfth data, the twenty-second data, the twenty-third data, the twenty-fourth data, and the twenty-fifth data, and outputs twenty-sixth data and twenty-seventh data;

[0036] The eighth isomorphism circuit receives the twenty-sixth data and the twenty-seventh data, inversely isomorphically maps the twenty-sixth data and the twenty-seventh data, and outputs the eighteenth data.

[0037] The ninth calculation circuit receives the fourth data, the seventh data, the twenty-third data, and the twenty-eighth data, calculates the fourth data, the seventh data, the twenty-third data, and the twenty-eighth data, and outputs the eighteenth data.

[0038] In an optional embodiment of the present application, the seventh calculation circuit includes a third adder, a fourth adder, a fifth adder, a sixth adder, a fourth multiplier, a fifth multiplier, a sixth multiplier, a seventh multiplier, and an eighth multiplier.

[0039] The input port of the third adder receives the fifteenth data and the sixteenth data, and the output port of the third adder is coupled to the input port of the fifth multiplier and the input port of the seventh multiplier.

[0040] Both input ports of the fourth multiplier receive the sixteenth data, and the output port of the fourth multiplier is coupled to the input port of the eighth multiplier.

[0041] The input port of the fifth multiplier also receives the third data, and the output port of the fifth multiplier is coupled to the input port of the fourth adder;

[0042] The input port of the sixth multiplier is coupled to the output port of the first adder, the input port of the sixth multiplier also receives the fifteenth data, and the output port of the sixth multiplier is coupled to the input port of the fourth adder;

[0043] The input port of the seventh multiplier also receives the fifteenth data, and the output port of the seventh multiplier is coupled to the input port of the fifth adder;

[0044] The input port of the eighth multiplier also receives the seventeenth data, and the output port of the eighth multiplier is coupled to the input port of the fifth adder;

[0045] The output port of the fourth adder is coupled to the input port of the sixth adder;

[0046] The output port of the fifth adder is coupled to the input port of the sixth adder;

[0047] The output port of the sixth adder is coupled to the input port of the seventh isomorphic mapping circuit.

[0048] In an optional embodiment of the present application, the eighth computing circuit comprises a seventh adder, an eighth adder, a ninth adder, a tenth adder, an eleventh adder, a twelfth adder, a ninth multiplier, a tenth multiplier, an eleventh multiplier, a twelfth multiplier, a thirteenth multiplier, a fourteenth multiplier, a fifteenth multiplier, a sixteenth multiplier, a seventeenth multiplier, an eighteenth multiplier, a nineteenth multiplier, and a twentieth multiplier;

[0049] The input port of the seventh adder receives the twenty-second data and the twenty-third data, and the output port of the seventh adder is coupled to the input port of the twelfth multiplier, the input port of the thirteenth multiplier, the input port of the eighteenth multiplier, and the input port of the twentieth multiplier;

[0050] Both input ports of the ninth multiplier receive the twenty-third data, and the output port of the ninth multiplier is coupled to the input port of the tenth multiplier;

[0051] The input port of the tenth multiplier also receives the twelfth data, and the output port of the tenth multiplier is coupled to the input port of the eighth adder;

[0052] An input port of the eleventh multiplier is coupled to an output port of the third adder, the input port of the eleventh multiplier also receives the twenty-second data, and an output port of the eleventh multiplier is coupled to an input port of the ninth adder;

[0053] An input port of the twelfth multiplier receives the tenth data, and an output port of the twelfth multiplier is coupled to an input port of the ninth adder;

[0054] An input port of the thirteenth multiplier also receives the twenty-second data, and an output port of the thirteenth multiplier is coupled to an input port of the eighth adder;

[0055] An output port of the eighth adder is coupled to an input port of the tenth adder;

[0056] An output port of the ninth adder is coupled to an input port of the tenth adder;

[0057] An output port of the tenth adder is coupled to an input port of the fourteenth multiplier;

[0058] Both input ports of the fourteenth multiplier are coupled to an output port of the tenth adder, and an output port of the fourteenth multiplier is coupled to an input port of the fifteenth multiplier, an input port of the sixteenth multiplier, an input port of the nineteenth multiplier, and an input port of the twentieth multiplier;

[0059] An input port of the fifteenth multiplier also receives the eleventh data, and an output port of the fifteenth multiplier is coupled to an input port of the twelfth adder;

[0060] An input port of the sixteenth multiplier also receives the twenty-third data, and an output port of the sixteenth multiplier is coupled to an input port of the twelfth adder;

[0061] An input port of the seventeenth multiplier is coupled to an output port of the eighth multiplier, an input port of the seventeenth multiplier also receives the twenty-third data, and an output port of the seventeenth multiplier is coupled to an input port of the twelfth adder;

[0062] An input port of the eighteenth multiplier is coupled to an output port of the seventh multiplier, and an output port of the eighteenth multiplier is coupled to an input port of the eleventh adder;

[0063] An input port of the nineteenth multiplier is coupled to an output port of the third adder, and an output port of the nineteenth multiplier is coupled to an input port of the eleventh adder;

[0064] An output port of the twentieth multiplier is coupled to an input port of the eleventh adder;

[0065] The eleventh adder outputs the twenty-sixth data.

[0066] The twelfth adder outputs the twenty-seventh data.

[0067] In an optional embodiment of the present application, the ninth calculation circuit comprises a twenty-first multiplier, a twenty-second multiplier, a twenty-third multiplier and a thirteenth adder;

[0068] An input port of the twenty-first multiplier is coupled to an output port of the eighth isomapping circuit, and the input port of the twenty-first multiplier also receives the fourth data, and an output port of the twenty-first multiplier is coupled to an input port of the thirteenth adder;

[0069] An input port of the twenty-second multiplier is coupled to an output port of the eighth isomapping circuit, and the input port of the twenty-second multiplier also receives the twenty-third data, and an output port of the twenty-second multiplier is coupled to an input port of the thirteenth adder;

[0070] An input port of the twenty-third multiplier receives the twenty-third data and the seventh data, and an output port of the twenty-third multiplier is coupled to an input port of the thirteenth adder;

[0071] An output port of the thirteenth adder is coupled to an input port of the fourth isomapping circuit, and outputs the eighteenth data.

[0072] In an optional embodiment of the present application, the sixth calculation circuit comprises a twenty-fourth multiplier, a twenty-fifth multiplier, a twenty-sixth multiplier and a fourteenth adder;

[0073] An input port of the twenty-fourth multiplier is coupled to an output port of the first adder and an output port of the eighth isomapping circuit, and an output port of the twenty-fourth multiplier is coupled to an input port of the fourteenth adder;

[0074] An input port of the twenty-fifth multiplier is coupled to an output port of the eighth isomapping circuit and an output port of the third adder, and an output port of the twenty-fifth multiplier is coupled to an input port of the fourteenth adder;

[0075] An input port of the twenty-sixth multiplier is coupled to an output port of the third adder and an output port of the sixth isomapping circuit, and an output port of the twenty-sixth multiplier is coupled to an input port of the fourteenth adder;

[0076] An output port of the fourteenth adder is coupled to an input port of the fourth isomorphic mapping circuit, and outputs the nineteenth data.

[0077] In an optional embodiment of the present application, the fourth calculation circuit comprises a fifteenth adder, a sixteenth adder, a twenty-seventh multiplier, a twenty-eighth multiplier, a twenty-ninth multiplier, a thirtieth multiplier, a thirty-first multiplier, and a thirty-second multiplier.

[0078] An input port of the fifteenth adder receives the tenth data and the eleventh data, and an output port of the fifteenth adder is coupled to an input port of the twenty-seventh multiplier and an input port of the thirty-second multiplier.

[0079] An input port of the twenty-seventh multiplier further receives the tenth data, and an output port of the twenty-seventh multiplier is coupled to an input port of the sixteenth adder.

[0080] Both input ports of the twenty-eighth multiplier receive the eleventh data, and an output port of the twenty-eighth multiplier is coupled to an input port of the twenty-ninth multiplier.

[0081] An input port of the twenty-ninth multiplier further receives the twelfth data, and an output port of the twenty-ninth multiplier is coupled to an input port of the sixteenth adder.

[0082] An output port of the sixteenth adder is coupled to an input port of the thirtieth multiplier.

[0083] Both input ports of the thirtieth multiplier are coupled to the output port of the sixteenth adder, and an output port of the thirtieth multiplier is coupled to an input port of the thirty-first multiplier and an input port of the thirty-second multiplier.

[0084] An input port of the thirty-first multiplier further receives the eleventh data, and outputs the fourteenth data.

[0085] The thirty-second multiplier outputs the thirteenth data.

[0086] In an optional embodiment of the present application, the second calculation circuit comprises a thirty-third multiplier, an input port of the thirty-third multiplier is coupled to an output port of the first adder and an output port of the inverse circuit, and an output port of the thirty-third multiplier is coupled to an input port of the second isomorphic mapping circuit, and the eighth data is sent to the second isomorphic mapping circuit.

[0087] In an alternative embodiment of the present application, the third calculation circuit comprises a thirty-fourth multiplier, an input port of the thirty-fourth multiplier receives the fourth data, the input port of the thirty-fourth multiplier is further coupled to the output port of the inverse circuit, and an output port of the thirty-fourth multiplier is coupled to the input port of the second isomorphic mapping circuit to send the ninth data to the second isomorphic mapping circuit.

[0088] In an alternative embodiment of the present application, the mask data is a random number or an exclusive-OR result of a random number and the unmasking data output by the unmasking operation circuit last time.

[0089] According to a second aspect of the present application, an S-box circuit is provided, which receives first data in GF(2 8) field and mask data in GF(2 8) field as input and outputs second data in GF(2 8) field.

[0090] The S-box circuit comprises a confusion adder, a first isomorphic mapping circuit, a first calculation circuit, an inverse circuit, a second calculation circuit, a third calculation circuit and a second isomorphic mapping circuit.

[0091] The confusion adder receives the first data and the mask data, and an output of the confusion adder is used as masking data.

[0092] The first isomorphic mapping circuit receives the masking data, performs isomorphic mapping on the masking data, and maps the masking data in GF(2 8) field to third data in GF(2 4) field and fourth data in GF(2 4) field.

[0093] The first calculation circuit receives the third data, the fourth data and fifth data, calculates the product of the square of the fourth data and the fifth data, the square of the third data, the product of the third data and the fourth data, and sums the three results to output sixth data in GF(2 4) field.

[0094] The inverse circuit receives the sixth data, performs inverse operation on the sixth data, and outputs seventh data in GF(2 4) field.

[0095] The second calculation circuit receives the third data, the fourth data and the seventh data, calculates the product of the sum of the third data and the fourth data and the seventh data, and outputs eighth data in GF(2 4) field.

[0096] The third calculation circuit receives the fourth data and the seventh data, calculates the product of the fourth data and the seventh data, and outputs ninth data in GF(2 4) field.

[0097] The second isomorphic mapping circuit receives the eighth data and the ninth data, performs inverse isomorphic mapping on the eighth data and the ninth data, maps the eighth data in a GF(2 4) field and the ninth data in a GF(2 4) field into second data in a GF(2 8) field, and outputs the second data.

[0098] According to a third aspect of the present application, there is provided a device comprising a masked S-box circuit as described in the first aspect above or an S-box circuit as described in the second aspect above.

[0099] The masked S-box circuit of the embodiments of the present application performs masking on data a by means of a confusion circuit on data a and mask data M, performs calculation on the masked data output by the confusion circuit by means of a standard S-box circuit, outputs masked data Sbox(a+M), performs unmasking operation on the mask data M by means of an unmasking operation circuit, outputs unmasked data f(a, M), and performs the same confusion operation on the masked data Sbox(a+M) and the unmasked data f(a, M) as the confusion circuit, so as to obtain Sbox(a). The masked S-box circuit masks its input data and output data by means of mask data, and has the ability to resist power analysis attacks. BRIEF DESCRIPTION OF DRAWINGS

[0100] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art according to these drawings.

[0101] Figure 1 The structural schematic diagram of the masked S-box circuit of the embodiments of the present application is shown;

[0102] Figure 2 The structural schematic diagram of the standard S-box circuit of the embodiments of the present application is shown;

[0103] Figure 3 The structural schematic diagram of the md calculation circuit of the embodiments of the present application is shown;

[0104] Figure 4 The structural schematic diagram of the inverse circuit of the embodiments of the present application is shown;

[0105] Figure 5 The structural schematic diagram of the K calculation circuit of the embodiments of the present application is shown;

[0106] Figure 6A The structural schematic diagram of the mal' calculation circuit of the embodiments of the present application is shown;

[0107] Figure 6B A schematic diagram of the structure of a mal' calculation circuit according to another embodiment of this application is shown;

[0108] Figure 7 A schematic diagram of the demasking operation circuit according to an embodiment of this application is shown;

[0109] Figure 8 A schematic diagram of the structure of the P-computing circuit according to an embodiment of this application is shown;

[0110] Figure 9 A schematic diagram of the structure of the G computing circuit according to an embodiment of this application is shown;

[0111] Figure 10 A schematic diagram of the R calculation circuit according to an embodiment of this application is shown;

[0112] Figure 11 A schematic diagram of the S-computing circuit according to an embodiment of this application is shown;

[0113] Figure 12 A schematic diagram of the Q-computing circuit according to an embodiment of this application is shown;

[0114] Figure 13 A schematic diagram of an S-box circuit according to an embodiment of this application is shown. Detailed Implementation

[0115] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0116] Figure 1 A schematic diagram of a masked S-box circuit according to an embodiment of this application is shown.

[0117] like Figure 1 As shown, the masked S-box circuit includes: an obfuscation circuit, a standard S-box circuit, and a demasking operation circuit. The input data of the masked S-box circuit includes two parts: data a and mask data M, and the output data also includes two parts: Sbox(a+M) and demasking data f(a,M).

[0118] The obfuscation circuit receives data 'a' and mask data 'M', performs an obfuscation operation on 'a' and 'M', and outputs masked data 'ma'. The obfuscation circuit uses the mask data 'M' to mask data 'a'. Specifically, the obfuscation circuit is a logic XOR operation circuit that performs an XOR operation on data 'a' and mask data 'M' to achieve the masking of data 'a' using the mask data 'M'.

[0119] In some optional embodiments, the mask data M is a random number. In other optional embodiments, the mask data is the XOR result of a random number and the unmasking data f(a, M) output by the unmasking operation circuit in the previous round. For example, the calculation process of the S-box in the SMS4 encryption algorithm has 32 rounds, a random number is input in each round and unmasking data is calculated, and the random number input in each round is random. The XOR result of the unmasking data f(a, M) output in the previous round and the random number M input in the next round is used as the mask data input in the next round. For example, the mask data input in the S-box with mask in the embodiment can be a random number or the XOR result of a random number and the unmasking data output by the unmasking operation circuit in the previous round.

[0120] The standard S-box circuit is coupled with the confusion circuit. The standard S-box circuit receives the mask data ma output by the confusion circuit, processes the mask data ma, and outputs Sbox(a+M).

[0121] The unmasking operation circuit is coupled with the standard S-box circuit. The unmasking operation circuit receives the mask data M as input, and performs operation on the mask data M and the intermediate data of the standard S-box circuit, and outputs the unmasking data f(a, M). The unmasking data f(a, M) and Sbox(a+M) perform the same confusion operation as the operation performed by the confusion circuit, and the output data of the data a obtained by the standard S-box operation can be obtained. For example, the output data of the data a obtained by the standard S-box operation is Sbox(a), the confusion circuit performs XOR operation on the data a and the mask data M, and the XOR operation Sbox(a+M)⊕f(a, M) on f(a, M) and Sbox(a+M) obtains the output data Sbox(a) corresponding to the data a.

[0122] The S-box circuit with mask in the embodiment of the application realizes the masking of the data a by the confusion of the data a and the mask data M by the confusion circuit, calculates the masking data Sbox(a+M) output by the confusion circuit by the standard S-box circuit, performs the unmasking operation on the mask data M by the unmasking operation circuit, and outputs the unmasking data f(a, M). The same confusion operation as the confusion circuit on the masking data Sbox(a+M) and the unmasking data f(a, M) can obtain Sbox(a). The S-box circuit with mask realizes the masking of the input data and the output data by the mask data, and has the ability to resist power analysis attacks.

[0123] The S-box circuit with mask of the embodiment of the present application can not only realize the function of masking data a, but also realize the function of not masking data a, for example, directly outputting Sbox(a) without mask. In order to output Sbox(a) without mask, the mask data M of the input circuit can be all-zero data, for example, 8-bit random number of 0 (00000000).

[0124] In the optional embodiment of the present application, the bit number of data a and mask data M input into the S-box circuit with mask is the same, and the bit number of Sbox(a+M) and f(a, M) output by the S-box circuit with mask is also the same as that of data a and mask data M. For example, data a and mask data M are 8-bit, 16-bit or 32-bit, and Sbox(a+M) and f(a, M) output by the S-box circuit with mask are 8-bit, 16-bit or 32-bit. The S-box circuit with mask of the embodiment of the present application is described below by taking 8-bit data a and mask data M as an example.

[0125] Figure 2 The structure diagram of the standard S-box circuit in the S-box circuit with mask of the embodiment of the present application is shown.

[0126] As shown in Figure 2 , the standard S-box circuit includes an H1 isomorphic mapping circuit, an md calculation circuit, an inverse calculation circuit, an mal' calculation circuit, an mah' calculation circuit and an H2 isomorphic mapping circuit.

[0127] The H1 isomorphic mapping circuit receives the masking data ma output by the confusion circuit, performs isomorphic mapping on ma, and outputs data_0 and data_1. In the embodiment, the H1 isomorphic mapping circuit maps the masking data ma in the GF(2^8) field to data_0 in the GF(2^4) field and data_1 in the GF(2^4) field.

[0128] The md calculation circuit receives data_0 and data_1 output by the H1 isomorphic mapping circuit, and also receives the externally input v, calculates data_0, data_1 and v, and outputs D7. The md calculation circuit calculates data_0, data_1 and v according to formula (1):

[0129] D7= (data_1) 2 *v+( data_0+ data_1 )* data_0 (1)

[0130] v represents externally input data, for example, v can be data pre-stored in a memory. Since data_0 and data_1 are 4-bit data, v is also 4-bit data, and as an example, v can be binary 1001.

[0131] According to the formula (1), md needs to be calculated by 3 multiplications and 2 additions. As an example, the md calculation circuit includes 2 adders and 3 multipliers, wherein the md calculation circuit performs logical operations in the GF(2^4) field.

[0132] Figure 3 A structure diagram of an md calculation circuit provided by an embodiment of the present application is shown. As shown in the figure, Figure 3 The md calculation circuit includes an adder E1, an adder E2, a multiplier F1, a multiplier F2, and a multiplier F3.

[0133] The input port of the adder E1 receives data_0 and data_1 output by the H1 isomorphism mapping circuit, and the output port of the adder E1 is coupled to the input port of the multiplier F1. The adder E1 performs an addition operation in the GF(2^4) field on data_0 and data_1, and outputs D4, wherein D4=data_0+data_1.

[0134] The input port of the multiplier F1 receives data_0 and D4, and the output port of the multiplier F1 is coupled to the input port of the adder E2. The multiplier F1 performs a multiplication operation in the GF(2^4) field on data_0 and D4, and outputs D5, wherein D5=data_0*(data_0+data_1).

[0135] Both input ports of the multiplier F2 receive data_1, and the output port of the multiplier F2 is coupled to the input port of the multiplier F3. The multiplier F2 performs a multiplication operation in the GF(2^4) field on data_1, and outputs D3, wherein D3=data_1*data_1.

[0136] The input port of the multiplier F3 receives D3 and an externally input v, and the output port of the multiplier F3 is coupled to the input port of the adder E2. The multiplier F3 performs a multiplication operation in the GF(2^4) field on D3 and v, and outputs D6, wherein D6=(data_1) 2 *v.

[0137] The input port of the adder E2 is coupled to the output ports of the multiplier F1 and the multiplier F3, and the output port of the adder E2 is the output of the md calculation circuit, which is coupled to the input port of the inverse circuit. The adder E2 performs an addition operation in the GF(2^4) field on D5 and D6, and outputs D7.

[0138] The inverse circuit receives D7 output by the md calculation circuit, performs an inverse operation on D7, and outputs D16.

[0139] In an optional embodiment, the inverse circuit maps the data D7 output by the md circuit in the GF(2^4) field isomorphically to the data in the GF(2^2) field to perform an inverse operation, and then inversely isomorphically maps the inverse operation result to the GF(2^4) data.

[0140] Figure 4 A structure diagram of the inverse circuit in the masked S-box circuit of the embodiment of the application is shown. As shown in Figure 4 The inverse circuit includes an H5 isomorphic mapping circuit, a K calculation circuit, and an H6 isomorphic mapping circuit.

[0141] The H5 isomorphic mapping circuit receives the D7 in the GF(2^4) field output by the md calculation circuit, isomorphically maps the D7, and outputs the data_2 in the GF(2^2) field and the data_3 in the GF(2^2) field.

[0142] The K calculation circuit receives the data_2 and the data_3 output by the H5 isomorphic mapping circuit and the externally input data w, calculates the data_2, the data_3, and the externally input data w, and outputs the D14 and the D15.

[0143] Wherein, w represents the externally input data, for example, w can be the data pre-stored in the memory. Since w is the data in the GF(2^2) field, w contains 2 bits, and as an example, w can be binary 10.

[0144] Figure 5 A structure diagram of a K calculation circuit of the embodiment of the application is shown. As shown in Figure 5 The K calculation circuit includes an adder E3, an adder E4, a multiplier F4, a multiplier F5, a multiplier F6, a multiplier F7, a multiplier F8, and a multiplier F9.

[0145] The input port of the adder E3 receives the data_2 and the data_3, and the output port of the adder E3 is coupled to the input port of the multiplier F4 and the input port of the multiplier F9. The adder E3 performs the addition operation in the GF(2^2) field on the data_2 and the data_3, and outputs the D8, wherein D8=data_2+data_3.

[0146] The input port of the multiplier F4 receives the data_2 and the D8, and the output port of the multiplier F4 is coupled to the input port of the adder E4. The multiplier F4 performs the multiplication operation in the GF(2^2) field on the data_2 and the D8, and outputs the D9; wherein D9=data_2*(data_2+data_3).

[0147] Both input ports of multiplier F5 receive data_3, and the output port of multiplier F5 is coupled to an input port of multiplier F6. Multiplier F5 performs a multiplication operation on data_3 in the GF(2^2) field, and outputs D10; where D10 = data_3*data_3.

[0148] The input port of multiplier F6 receives D10 and w, and the output port of multiplier F6 is coupled to an input port of adder E4. Multiplier F6 performs a multiplication operation on D10 and w in the GF(2^2) field, and outputs D11; where D11 = D10*w = (data_3) 2 *w.

[0149] The input port of adder E4 receives D9 and D11, and the output port of adder E4 is coupled to an input port of multiplier F7. Adder E4 performs an addition operation on D9 and D11 in the GF(2^2) field, and outputs D12; where D12 = (data_2*(data_2+data_3)) + (data_3) 2 *w.

[0150] Both input ports of multiplier F7 are coupled to the output port of adder E4, and receive D12 outputted by adder E4, and the output port of multiplier F7 is coupled to an input port of multiplier F9 and an input port of multiplier F8. Multiplier F7 performs a multiplication operation on D12 in the GF(2^2) field, and outputs D13; where D13 = D12*D12.

[0151] The input port of multiplier F8 receives data_3 and D13, and the output port of multiplier F8 is coupled to an input port of H6 isomorphism circuit. Multiplier F9 performs a multiplication operation on data_3 and D13 in the GF(2^2) field, and outputs D15; where D15 = data_3*D13.

[0152] The input port of multiplier F9 receives D8 and D13, and the output port of multiplier F9 is coupled to an input port of H6 isomorphism circuit. Multiplier F8 performs a multiplication operation on D8 and D13 in the GF(2^2) field, and outputs D14; where D14 = D8*D13.

[0153] H6 isomorphism circuit receives D14 and D15, and performs inverse isomorphism on D14 and D15, and outputs D16 in the GF(2^4) field.

[0154] In an alternative embodiment, the inverse circuit can directly inverse D7 in the GF(2^4) field to obtain D16.

[0155] In an optional embodiment, the inverse circuit can also perform an inverse operation on the data D7 output by the md circuit in the GF(2^4) field and isomorphically map the inverse operation result to the GF(2) field, and then perform an inverse isomorphism mapping on the inverse operation result to obtain the GF(2^4) data. The inverse circuit maps D7 to the GF(2) field through the isomorphism mapping of GF(2^4) -> GF(2^2) -> GF(2) to obtain the data md' corresponding to D7 in the GF(2) field, performs an inverse operation on md' in the GF(2) field to obtain an inverse operation result, and then maps the inverse operation result in the GF(2) field to the GF(2^4) field through the inverse isomorphism mapping of GF(2) -> GF(2^2) -> GF(2^4) to obtain the inverse operation result D16 corresponding to D7.

[0156] As an example, the inverse circuit can be a lookup table circuit, which obtains the corresponding D16 of D7 through table lookup according to the input D7.

[0157] The mal' calculation circuit receives data_0 and data_1 output by the H1 isomorphism mapping circuit and D16 output by the inverse circuit, performs calculation on data_0, data_1 and D16, and outputs D17. In this case, the mal' calculation circuit performs calculation on data_0, data_1 and D16 according to formula (2):

[0158] D17 = (data_0 + data_1) * D16 (2)

[0159] To implement the calculation of formula (2), refer to Figure 2 The input port of the mal' calculation circuit is coupled with the output port of the H1 isomorphism mapping circuit to receive data_0 and data_1 output by the H1 isomorphism mapping circuit, and is coupled with the output port of the inverse circuit to receive D16 output by the inverse circuit. In this case, the mal' calculation circuit needs to calculate data_0 + data_1 and the product of data_0 + data_1 and D16.

[0160] Figure 6A A structure diagram of a mal' calculation circuit provided by an embodiment of the present application is shown.

[0161] As an example, as Figure 6AThe mal' calculation circuit includes an adder and a multiplier. The two input ports of the adder are coupled to the two output ports of the H1 isomorphic mapping circuit, respectively, and receive data_0 and data_1 output from the H1 isomorphic mapping circuit. The adder performs an addition operation on data_0 and data_1 to obtain data_0+data_1. The output port of the adder is coupled to the input port of the multiplier F10, and inputs data_0+data_1 into the multiplier F10. In addition, the input port of the multiplier F10 is also coupled to the output port of the H6 isomorphic mapping circuit, and obtains D16 from the H6 isomorphic mapping circuit. The multiplier F10 performs a multiplication operation on D4 and D16 in the GF(2^4) domain and outputs D17.

[0162] See Figure 3 As shown, in the md calculation circuit, the adder E1 outputs D4 = data_0 + data_1, meaning that adder E1 has already calculated the value of data_0 + data_1. The input port of the mal' calculation circuit can be directly coupled to the output of adder E1, and the mal' calculation circuit directly receives the output data_0 + data_1 from adder E1. In this case, the mal' calculation circuit does not need to calculate data_0 + data_1 again, but only needs to calculate the product of data_0 + data_1 and D16.

[0163] Figure 6B A schematic diagram of another mal' calculation circuit provided in an embodiment of this application is shown.

[0164] For example, such as Figure 6B As shown, the mal' calculation circuit includes a multiplier F10. The input port of multiplier F10 is coupled to the output port of adder E1 and the output port of H6 isomorphic mapping circuit. It obtains data_0 + data_1 from adder E1 and D16 from H6 isomorphic mapping circuit. Multiplier F10 performs multiplication on D4 and D16 in the GF(2^4) domain, outputting D17. In addition, the output port of multiplier F10 is coupled to the input port of H2 isomorphic mapping circuit, sending D17 output by multiplier F10 to H2 isomorphic mapping circuit.

[0165] The mah' calculation circuit receives data_1 from the H1 isomorphic mapping circuit and D16 from the inversion circuit, performs calculations on data_1 and D16, and outputs D18. Specifically, the mah' calculation circuit calculates data_1 and D16 according to equation (3):

[0166] D18 = data_1 * D16 (3)

[0167] As can be seen from formula (3), the mah' calculation circuit needs to perform one multiplication operation to calculate D18. As an example, the mah' calculation circuit includes a multiplier F11, an input port of the multiplier F11 receives data_1, an input port of the multiplier F11 is also coupled to an output port of the H6 isomorphic mapping circuit, the multiplier F11 performs multiplication operation on data_1 and D16 in the GF(2^4) field, and outputs D18. An output port of the multiplier F11 is coupled to an input port of the H2 isomorphic mapping circuit, and sends D18 to the H2 isomorphic mapping circuit.

[0168] The two input ports of the H2 isomorphic mapping circuit are respectively coupled to output ports of the mal' calculation circuit and the mah' calculation circuit, receive D17 output by the mal' calculation circuit and D18 output by the mah' calculation circuit, perform inverse isomorphic mapping on D17 and D18 in the GF(2^4) field, and output Sbox(a+M) in the GF(2^8) field.

[0169] The standard Sbox circuit in the Sbox circuit with mask in the embodiment of the application is isomorphic mapped through GF(2^8)->GF(2^4)->GF(2^2)->GF(2^4)->GF(2^8), and converts the masking data ma in the GF(2^8) field into calculation in the GF(2^2) field. Compared with isomorphic mapping through GF(2^8)->GF(2^4)->GF(2^2)->GF(2)->GF(2^2)->GF(2^4)->GF(2^8), the time delay can be effectively reduced, and the hardware area can be reduced.

[0170] For the Sbox circuit, the characteristics of the input can be derived according to the output, for example, the data a of the input can be derived according to Sbox(a). In the embodiment of the application, the mask data is introduced into the input of the standard Sbox circuit, so that the output data of the standard Sbox circuit carries the mask data. Since the mask data is a random number, the data a of the input of the standard Sbox cannot be derived according to the output data. Therefore, the unmasking operation circuit is introduced in the embodiment of the application. In order to unmask the Sbox(a+M) with mask data, for example, to restore Sbox(a) from the Sbox(a+M) with mask data, the unmasking operation circuit calculates the unmasking data f(a, M) according to the mask data M.

[0171] The output of the unmasking operation circuit is f(a, M) = Sbox(a+M) + Sbox(a), and f(a, M) is data in the GF(2^8) field. Let two data isomorphic mapped to the GF(2^4) field be P and Q, and Sbox(a+M) + Sbox(a) = P + Qx.

[0172] According to Figure 1 and Figure 2The circuit structure shown can know that:

[0173] Sbox(a+M)=f(data_0,data_1,D16),D16=(D7) -1 =((data_1) 2 *v+(data_0+data_1)*

[0174] data_0) -1

[0175] Sbox(m)=f(mask_0,mask_1,d -1 ),d -1 =((mask_1) 2 *v+(mask_0+mask_1)*mask_0) -1

[0176] Therefore, P=fp(mask_0,mask_1,data_0,data_1,D16) and Q=fq(mask_0,mask_1,data_0,data_1,D16) can be solved, wherein fp() and fq() are calculations in the GF(2^4) field, mask_1 and mask_0 are obtained from M by isomorphic mapping from GF(2^8) to GF(2^4), and data_0, data_1 and D16 are obtained from the standard S-box circuit of the application. Therefore, the unmasking operation circuit needs to isomorphically map the mask data M to data in the GF(2^4) field, and then set the P calculation circuit and the Q calculation circuit according to fp() and fq(). The output data of the P calculation circuit and the output data of the Q calculation circuit are data in the GF(2^4) field, and therefore the output data of the P calculation circuit and the output data of the Q calculation circuit need to be inversely isomorphically mapped to f(a,M) in the GF(2^8) field.

[0177] As shown in Figure 7 , the unmasking operation circuit includes an H3 isomorphic mapping circuit, a P calculation circuit, a Q calculation circuit and an H4 isomorphic mapping circuit.

[0178] The H3 isomorphic mapping circuit receives mask data M in the GF(2^8) field, isomorphically maps M, and outputs two data mask_0 and mask_1 in the GF(2^4) field. The circuit structure of the H3 isomorphic mapping circuit can be the same as that of the H1 isomorphic mapping circuit, and the mask data M in the GF(2^8) field is mapped to mask_0 and mask_1 in the GF(2^4) field.

[0179] The P calculation circuit receives mask_0, data_0, data_1, D16 and u, performs calculation on mask_0, data_0, data_1, D16 and u, and outputs M35. U represents externally input data, for example, u can be data pre-stored in a memory. The input and output of the P calculation circuit and the Q calculation circuit are all data in the GF(2^4) field, so mask_0, data_0, data_1, D16 and u are all data composed of 4 bits. Here, u is the same as v. As an example, v can be binary 1001, and u is also binary 1001.

[0180] The Q calculation circuit receives mask_1, data_0, data_1, D16 and u, performs calculation on mask_1, data_0, data_1, D16 and u, and outputs M36.

[0181] Two input ports of the H4 isomorphic mapping circuit are coupled with the P calculation circuit and the Q calculation circuit respectively, receive M35 output by the P calculation circuit and M36 output by the Q calculation circuit, perform inverse isomorphic mapping on M35 and M36, and output f(a, M). The H4 isomorphic mapping circuit has the same circuit structure as the H2 isomorphic mapping circuit, and maps M35 and M36 in the GF(2^4) field to f(a, M) in the GF(2^8) field.

[0182] Since the output f(a, M) of the unmasking operation circuit is Sbox(a+M)+Sbox(a), the output result is related to not only the mask data M but also the input data a. The unmasking operation circuit inputs the mask data M, in order to introduce a in the output, referring to Figure 7 , the input of the P calculation circuit and the Q calculation circuit in the unmasking operation circuit includes not only mask_0 and mask_1 output by the H3 isomorphic mapping circuit and u input externally, but also intermediate data data_0, data_1 and D16 from the standard S-box circuit.

[0183] Optionally, the P calculation circuit and the Q calculation circuit can directly perform logical operation in the GF(2^4) field without isomorphic mapping and inverse isomorphic mapping; or the input data can be mapped to the GF(2^2) field or the GF(2) field through isomorphic mapping to perform logical operation, and then the operation result in the GF(2^2) field or the GF(2) field is mapped to the GF(2^4) field through inverse isomorphic mapping.

[0184] The following is a brief description of the circuit structure and operation of the P-computation circuit and the Q-computation circuit over the isomorphic mapping GF(2^2) domain. Specifically, how the P-computation circuit and the Q-computation circuit receive mask_0, mask_1, data_0, data_1, and D16, and how they perform calculations based on mask_0, mask_1, data_0, data_1, and D16, is explained below.

[0185] Figure 8 A schematic diagram of a P-computing circuit according to an embodiment of this application is shown. Figure 8 As shown, the P calculation circuit includes a G calculation circuit, an H7 isomorphic mapping circuit, an R calculation circuit, an H8 isomorphic mapping circuit, and an S calculation circuit.

[0186] The input ports of the G calculation circuit are respectively connected to the output ports of the H3 isomorphic mapping circuit, the H1 isomorphic mapping circuit, and the adder E1 in the md calculation circuit (e.g., Figure 2 (As shown) Coupling and external input coupling are used to obtain mask_0 and mask_1 from the H3 isomorphic mapping circuit, data_0 from the H1 isomorphic mapping circuit, D4 from the adder E1, and u from the external source. The computation is performed on mask_0, mask_1, data_0, D4, and u in the GF(2^4) domain, outputting M9. Here, M9 is the data in the GF(2^4) domain.

[0187] Optionally, the input port of the G calculation circuit is not coupled to the output port of the adder E1 in the md calculation circuit of the S-box standard circuit, but only to the output port of the H1 isomorphic mapping circuit of the S-box standard circuit, from which data_0 and data_1 (not labeled in the figure) are obtained. The calculations on mask_0, mask_1, data_0, data_1, and u are performed in the GF(2^4) domain, outputting M9.

[0188] The H7 isomorphic mapping circuit receives M9, performs isomorphic mapping on M9 in the GF(2^4) domain, and outputs two data masks, mask_2 and mask_3, in the GF(2^2) domain.

[0189] The input port of the R calculation circuit is coupled with the output port of the H7 isomorphic mapping circuit, the output port of the adder E3 and the output port of the multiplier F7 in the standard S box circuit and the H5 isomorphic mapping circuit and the inverse circuit, to obtain mask_2 and mask_3 from the H7 isomorphic mapping circuit, D8 from the adder E3, data_2 and data_3 from the H5 isomorphic mapping circuit, and D13 from the multiplier F7 to obtain z from the outside. The mask_2, mask_3, D8, z, data_2, data_3 and D13 are calculated in the GF (2 2) field, and M26 and M27 are output. Z represents the data input from the outside, for example, z can be the data pre-stored in the memory. Since the R calculation circuit calculates in the GF (2 2) field, z is data composed of 2 bits, and z is the same as w. As an example, w can be binary 1001, and z is also binary 1001.

[0190] The input port of the H8 isomorphic mapping circuit is coupled with the output port of the R calculation circuit, receives M26 and M27, inversely isomorphically maps M26 and M27, and outputs M28. Two data M26 and M27 in the GF (2 2) field are inversely isomorphically mapped, and data M28 in the GF (2 4) field is output.

[0191] The input port of the S calculation circuit is coupled with the output port of the H8 isomorphic mapping circuit, the output port of the H7 isomorphic mapping circuit, the output port of the H1 isomorphic mapping circuit and the output port of the inverse circuit, so that M28 is received from the H8 isomorphic mapping circuit, mask_3 is received from the H7 isomorphic mapping circuit, data_1 is received from the H1 isomorphic mapping circuit, and D16 is received from the inverse circuit. M28, data_1, mask_3 and D16 are received, calculated and outputted, and M35 is outputted.

[0192] Figure 9 A structure schematic diagram of a G calculation circuit in an embodiment of the application is shown. As shown in the figure, Figure 9 The G calculation circuit includes an adder E5, an adder E6, an adder E7, an adder E8, a multiplier F12, a multiplier F13, a multiplier F14, a multiplier F15 and a multiplier F16.

[0193] The input port of the adder E5 receives mask_0 and mask_1, performs a GF (2 4) field addition operation on mask_0 and mask_1, and outputs M1. The output port of the adder E5 is coupled with the input port of the adder F13 and the input port of the adder F15; wherein M1 = mask_0 + mask_1.

[0194] The two input ports of the multiplier F12 receive mask_1, and the multiplication operation of mask_1 in the GF(2 4) field is performed to output M2, and the output port of the multiplier F12 is coupled to the input port of the adder F16; wherein M2 = mask_1 * mask_1.

[0195] The input port of the multiplier F13 receives data_0 and M1, and the multiplication operation of data_0 and M1 in the GF(2 4) field is performed to output M3, and the output port of the multiplier F13 is coupled to the input port of the adder E6; wherein M3 = data_0 * M1.

[0196] The input port of the multiplier F14 receives D4 and mask_0, and the multiplication operation of D4 and mask_0 in the GF(2 4) field is performed to output M4, and the output port of the multiplier F14 is coupled to the input port of the adder E6; wherein M4 = D4 * mask_0.

[0197] The input port of the multiplier F15 receives M1 and mask_0, and the multiplication operation of M1 and mask_0 in the GF(2 4) field is performed to output M5, and the output port of the multiplier F15 is coupled to the input port of the adder E7; wherein M5 = M1 * mask_0.

[0198] The input port of the multiplier F16 receives M2 and u, and the multiplication operation of M2 and u in the GF(2 4) field is performed to output M6, and the output port of the multiplier F16 is coupled to the input port of the adder E7; wherein M6 = M2 * u.

[0199] The input interface of the adder E6 receives M3 and M4, and the addition operation of M3 and M4 in the GF(2 4) field is performed to output M7, and the output port of the adder E6 is coupled to the input port of the adder E8; wherein M7 = M3 + M4.

[0200] The input interface of the adder E7 receives M5 and M6, and the addition operation of M5 and M6 in the GF(2 4) field is performed to output M8, and the output port of the adder E7 is coupled to the input port of the adder E8; wherein M8 = M5 + M6.

[0201] The input interface of the adder E8 receives M7 and M8, and the addition operation of M7 and M8 in the GF(2 4) field is performed to output M9, and the output port of the adder E8 is coupled to the input port of the isomorphic mapping circuit H7; wherein M9 = M7 + M8.

[0202] Figure 10 The structure schematic diagram of the R calculation circuit of the embodiment of the application is shown. Figure 10As shown, the R calculation circuit includes: adder E9, adder E10, adder E11, adder E12, adder E13, adder E14, multiplier F17, multiplier F18, multiplier F19, multiplier F20, multiplier F21, multiplier F22, multiplier F23, multiplier F24, multiplier F25, multiplier F26, multiplier F27 and multiplier F28.

[0203] The input port of the adder E9 receives mask_2 and mask_3, performs an addition operation in the GF(2^2) field on mask_2 and mask_3, outputs M10, and the output port of the adder E9 is coupled to the input port of the multiplier F20, the input port of the multiplier F21, the input port of the multiplier F26 and the input port of the multiplier F28; wherein M10 = mask_2 * mask_3.

[0204] Both input ports of the multiplier F17 receive mask_3, perform a multiplication operation in the GF(2^2) field on mask_3, output M11, and the output port of the multiplier F17 is coupled to the input port of the multiplier F18; wherein M11 = mask_3 * mask_3.

[0205] The input port of the multiplier F18 receives M11 and z, performs a multiplication operation in the GF(2^2) field on M11 and z, outputs M12, and the output port of the multiplier F18 is coupled to the input port of the adder E10; wherein M12 = M11 * z.

[0206] The input port of the multiplier F19 receives D8 and mask_2, performs a multiplication operation in the GF(2^2) field on D8 and mask_2, outputs M13, and the output port of the multiplier F19 is coupled to the input port of the adder E11; wherein M13 = D8 * mask_2.

[0207] The input port of the multiplier F20 receives M10 and data_2, performs a multiplication operation in the GF(2^2) field on M10 and data_2, outputs M14, and the output port of the multiplier F20 is coupled to the input port of the adder E11; wherein M14 = M10 * data_2.

[0208] The input port of the multiplier F21 receives M10 and mask_2, performs a multiplication operation in the GF(2^2) field on M10 and mask_2, outputs M15, and the output port of the multiplier F21 is coupled to the input port of the adder E10; wherein M15 = M10 * mask_2.

[0209] The input port of the adder E10 receives M12 and M15, performs addition operation in GF(2^2) field on M12 and M15, outputs M16, and the output port of the adder E10 is coupled to the input port of the adder E12; wherein M16=M12+M15.

[0210] The input port of the adder E11 receives M13 and M14, performs addition operation in GF(2^2) field on M13 and M14, outputs M17, and the output port of the adder E11 is coupled to the input port of the adder E12; wherein M17=M13+M14.

[0211] The input port of the adder E12 receives M16 and M17, performs addition operation in GF(2^2) field on M16 and M17, outputs M18, and the output port of the adder E12 is coupled to the input port of the multiplier F22; wherein M18=M16+M17.

[0212] The input port of the multiplier F22 receives M18, performs multiplication operation in GF(2^2) field on M18, outputs M19, and the output port of the multiplier F22 is coupled to the input port of the multiplier F23, the input port of the multiplier F24, the input port of the multiplier F27 and the input port of the multiplier F28; wherein M19=M18*M18.

[0213] The input port of the multiplier F23 receives M19 and data_3, performs multiplication operation in GF(2^2) field on M19 and data_3, outputs M20, and the output port of the multiplier F23 is coupled to the input port of the adder E14; wherein M20=M19*data_3.

[0214] The input port of the multiplier F24 receives M19 and mask_3, performs multiplication operation in GF(2^2) field on M19 and mask_3, outputs M21, and the output port of the multiplier F24 is coupled to the input port of the adder E14; wherein M21=M19*mask_3.

[0215] The input port of the multiplier F25 receives D13 and mask_3, performs multiplication operation in GF(2^2) field on D13 and mask_3, outputs M22, and the input port of the multiplier F25 also receives mask_3, and the input port of the multiplier F25 is coupled to the input port of the adder E14; wherein M22=D13*mask_3.

[0216] The input port of the multiplier F26 receives D13 and M10, performs multiplication operation in GF(2^2) field on D13 and M10, outputs M23, and the output port of the multiplier F26 is coupled to the input port of the adder E13; wherein M23=D13*M10.

[0217] The input port of the multiplier F27 receives D8 and M19, performs multiplication operation in GF(2^2) domain on D8 and M19, outputs M24, and the output port of the multiplier F27 is coupled with the input port of the adder E13; wherein M24=D8*M19.

[0218] The input port of the multiplier F28 receives M19 and M10, performs multiplication operation in GF(2^2) domain on M19 and M10, outputs M25, and the output port of the multiplier F28 is coupled with the input port of the adder E13; wherein M25=M19*M10.

[0219] The input port of the adder E13 receives M23, M24 and M25, performs addition operation in GF(2^2) domain on M23, M24 and M25, outputs M26, and the output port of the adder E13 is coupled with the input port of the H8 isomorphism mapping circuit; wherein M26=M23+M24+M25.

[0220] The input port of the adder E14 receives M20, M21 and M22, performs addition operation in GF(2^2) domain on M20, M21 and M22, outputs M27, and the output port of the adder E14 is coupled with the input port of the H8 isomorphism mapping circuit; wherein M27=M20+M21+M22.

[0221] Figure 11 A structure schematic diagram of an S calculation circuit is shown in the embodiment of the present application. As shown in the figure, Figure 11 The S calculation circuit comprises a multiplier F29, a multiplier F30, a multiplier F31 and an adder E15.

[0222] The input port of the multiplier F29 is coupled with the output port of the H8 isomorphism mapping circuit, receives M28 output by the H8 isomorphism mapping circuit, the input port of the multiplier F29 also receives data_1, performs multiplication operation in GF(2^4) domain on data_1 and M28, outputs M29, and the output port of the multiplier F29 is coupled with the input port of the adder E15; wherein M29=data_1*M28.

[0223] The input port of the multiplier F30 receives mask_3 and M28, performs multiplication operation in GF(2^4) domain on mask_3 and M28, outputs M30, and the output port of the multiplier F30 is coupled with the input port of the adder E15; wherein M30=mask_3*M28.

[0224] The input port of the multiplier F31 receives mask_3 and D16, and performs multiplication operation on mask_3 and D16 in the GF(2 4) field to output M31, and the output port of the multiplier F31 is coupled to the input port of the adder E15; wherein M31 = mask_3 * D16.

[0225] The input port of the adder E15 receives M29, M30 and M31, and performs addition operation on M29, M30 and M31 in the GF(2 4) field to output M35, and the output port of the adder E15 is coupled to the input port of the H4 isomorphism mapping circuit; wherein M35 = M29 + M30 + M31.

[0226] Figure 12 A structure schematic diagram of a Q calculation circuit is shown in the embodiment of the present application. As shown in the figure, Figure 12 The Q calculation circuit includes a multiplier F32, a multiplier F33, a multiplier F34 and an adder E16.

[0227] The input port of the multiplier F32 is coupled to the output port of the adder E1 in the md calculation circuit of the standard S-box circuit and the output port of the H8 isomorphism mapping circuit, receives D4 output by the adder E1 and M28 output by the H8 isomorphism mapping circuit, performs multiplication operation on D4 and M28 in the GF(2 4) field to output M32, and the output port of the multiplier F32 is coupled to the input port of the adder E16; wherein M32 = D4 * M28.

[0228] The input port of the multiplier F33 is coupled to the output port of the H8 isomorphism mapping circuit and the output port of the adder E5, receives M28 output by the H8 isomorphism mapping circuit and M1 output by the adder E5, performs multiplication operation on M28 and M1 in the GF(2 4) field to output M33, and the output port of the multiplier F33 is coupled to the input port of the adder E16; wherein M33 = M28 * M1.

[0229] The input port of the multiplier F34 is coupled to the output port of the adder E5 and the output port of the H6 isomorphism mapping circuit, receives M1 output by the adder E5 and D16 output by the H6 isomorphism mapping circuit, performs multiplication operation on M1 and D16 in the GF(2 4) field to output M34, and the output port of the multiplier F34 is coupled to the input port of the adder E16; wherein M34 = M1 * D16.

[0230] The adder E16 performs addition operation on M32, M33 and M34 in the GF(2 4) field to output M36, and the output port of the adder E16 is coupled to the input port of the H4 isomorphism mapping circuit; wherein M36 = M32 + M33 + M34.

[0231] It should be understood that the calculation process of the unmasking operation circuit in the embodiments of the present application can be similar to that of the standard S-box circuit, or can be different from that of the standard S-box circuit. For example, the calculation of the standard S-box circuit can be converted from GF(2 8) to GF(2 4), GF(2 2) or GF(2), when the standard S-box circuit is converted to GF(2 2) or GF(2), the unmasking operation circuit can be converted to GF(2 2) or GF(2), or can not be converted to GF(2 2) or GF(2), such as the unmasking operation circuit is converted to GF(2 4).

[0232] In Figures 1-11 In the circuit structure schematic diagram shown, The addition operation described above represents a GF field addition operation, and the GF field addition operation performs XOR operation on input data bit by bit, for example, out = in1 ^ in2, or out = in1 ^ in2 ^ in3, wherein out represents output data of the GF field addition operation, and in1, in2 and in3 respectively represent three input data of the GF field addition operation.

[0233] The multiplication operation described above represents a GF field multiplication operation. The multiplication operation in the GF(2 4) field is as follows:

[0234] out[3] = (in0[3] & in1[0]) ^ (in0[2] & in1[1]) ^ (in0[1] & in1[2]) ^ (comb1 & in1[3])

[0235] out[2] = (in0[2] & in1[0]) ^ (in0[1] & in1[1]) ^ (comb1 & in1[2]) ^ (comb2 & in1[3])

[0236] out[1] = (in0[1] & in1[0]) ^ (comb1 & in1[1]) ^ (comb2 & in1[2]) ^ (comb3 & in1[3])

[0237] out[0] = (in0[0] & in1[0]) ^ (in0[3] & in1[1]) ^ (in0[2] & in1[2]) ^ (in0[1] & in1[3])

[0238] comb1 = in0[0] ^ in0[3]

[0239] comb2 = in0[2] ^ in0[3]

[0240] comb3 = in0[1] ^ in0[2]

[0241] wherein out[0], out[1], out[2] and out[3] represent the first to fourth bits of the output data of the multiplication operation in the GF(2^4) field. in0[0], in0[1], in0[2] and in0[3] represent the first to fourth bits of one input data participating in the multiplication operation in the GF(2^4) field, and in1[0], in1[1], in1[2] and in1[3] represent the first to fourth bits of another input data participating in the multiplication operation in the GF(2^4) field.

[0242] The multiplication operation in the GF(2^4) field is shown as follows:

[0243] out[1] = (in1[1] & in1[0] & in0[0])

[0244] |(in1[1]&~in1[0]&in0[1]&~in0[0])

[0245] |(in1[1]&~in1[0]&~in0[1]&in0[0])

[0246] |(~in1[1]&in1[0]&in0[1])

[0247] out[0] = (~in1[1] & in1[0] & in0[0])

[0248] |(in1[1]&~in1[0]&in0[1])

[0249] |(in1[1]&in1[0]&~in0[1]&in0[0])

[0250] |(in1[1]&in1[0]&in0[1]&~in0[0])

[0251] wherein out[0] and out[1] represent the first and second bits of the output data of the multiplication operation in the GF(2^2) field. in0[0] and in0[1] represent the first and second bits of one input data participating in the multiplication operation in the GF(2^2) field, and in1[0] and in1[1] represent the first and second bits of another input data participating in the multiplication operation in the GF(2^2) field.

[0252] The embodiments of the present application further provide a device, comprising the apparatus as described above. Figures 1-11The illustrated S-box circuit receives data 'a' and masked data 'M' as inputs, and outputs masked data 'Sbox(a+M)' and demasked data 'f(a,M)'. Using the demasked data 'f(a,M)', Sbox(a) can be recovered from the standard S-box circuit output 'Sbox(a+M)'. For example, f(a,M) = Sbox(a+M) + Sbox(a), and Sbox(a) is obtained by XORing the demasked data 'f(a,M)' with Sbox(a+M).

[0253] Figure 13 A schematic diagram of an S-cell circuit according to an embodiment of this application is shown. This S-cell circuit can be understood as... Figure 1 Another embodiment of the standard S-box circuit in the masked S-box circuit shown is an S-box circuit that receives data a in the GF(2^8) domain and masked data M in the GF(2^8) domain as inputs and outputs masked data Sbox(a+M) in the GF(2^8) domain.

[0254] like Figure 13 As shown, the S-box circuit includes a confusion adder, an H1 isomorphic mapping circuit, an md calculation circuit, an inversion circuit, a mal' calculation circuit, a mah' calculation circuit, and an H2 isomorphic mapping circuit. The confusion adder can be used as... Figure 1 In one specific implementation of the obfuscation circuit shown, the obfuscation adder receives data a and mask data M, performs a logical XOR operation on data a and mask data M, and outputs data ma as mask data.

[0255] As an example Figure 13 The H1 isomorphic mapping circuit, md calculation circuit, inversion circuit, mal' calculation circuit, mah' calculation circuit, and H2 isomorphic mapping circuit shown are related to... Figure 2 The standard S-box circuit shown has the same structure for the H1 isomorphic mapping circuit, the md calculation circuit, the inversion circuit, the mal' calculation circuit, the mah' calculation circuit, and the H2 isomorphic mapping circuit, and will not be described again here.

[0256] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application. Clearly, those skilled in the art can make various alterations and variations to this application without departing from its spirit and scope. Thus, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A masked S-box circuit, characterized by, The application relates to a masked S-box circuit, and belongs to the field of information security. The masked S-box circuit comprises an obfuscation circuit, a standard S-box circuit and an unmasking operation circuit. The standard S-box circuit receives the masked data and processes the masked data to output the second data. The unmasking operation circuit is coupled with the standard S-box circuit, receives the mask data as input, and performs operation on the mask data and intermediate data of the standard S-box circuit to output the unmasking data. The same obfuscation operation is performed on the unmasking data and the second data to obtain output data of the standard S-box operation on the first data. The standard S-box circuit comprises a first isomorphic mapping circuit, a first calculation circuit, an inverse circuit, a second calculation circuit, a third calculation circuit and a second isomorphic mapping circuit. The first isomorphic mapping circuit receives the masked data, performs isomorphic mapping on the masked data, and outputs third data and fourth data.

2. The masked S-box circuit of claim 1, wherein, The first calculation circuit receives the third data, the fourth data and fifth data, performs calculation on the third data, the fourth data and the fifth data, and outputs sixth data. The inverse circuit receives the sixth data, performs multiplication inverse operation on the sixth data, and outputs seventh data. The second calculation circuit receives the third data, the fourth data and the seventh data, performs calculation on the third data, the fourth data and the seventh data, and outputs eighth data. The third calculation circuit receives the fourth data and the seventh data, performs calculation on the fourth data and the seventh data, and outputs ninth data. The second isomorphic mapping circuit receives the eighth data and the ninth data, performs inverse isomorphic mapping on the eighth data and the ninth data, and outputs the second data. The first calculation circuit comprises a first adder, a second adder, a first multiplier, a second multiplier and a third multiplier. The input port of the first adder receives the third data and the fourth data, and the output port of the first adder is coupled with the input port of the first multiplier.

3. The masked S-box circuit of claim 2, wherein, The input port of the first multiplier also receives the third data, and the output port of the first multiplier is coupled with the input port of the second adder. Both input ports of the second multiplier receive the fourth data, and the output port of the second multiplier is coupled with the input port of the third multiplier. The input port of the third multiplier also receives the fifth data, and the output port of the third multiplier is coupled with the input port of the second adder. The second adder outputs the sixth data. The inverse circuit comprises a third isomorphic mapping circuit, a fourth calculation circuit and a fourth isomorphic mapping circuit. The third isomorphic mapping circuit receives the sixth data output by the first calculation circuit, performs isomorphic mapping on the sixth data, and outputs tenth data and eleventh data.

4. The masked S-box circuit of claim 2 or 3, wherein, The fourth calculation circuit receives the tenth data and the eleventh data, performs calculation on the tenth data and the eleventh data, and outputs twelfth data. The fourth isomorphic mapping circuit receives the twelfth data and the seventh data, performs inverse isomorphic mapping on the twelfth data and the seventh data, and outputs the unmasking data. The fourth calculation circuit receives the tenth data, the eleventh data and the twelfth data, performs calculation on the tenth data, the eleventh data and the twelfth data, and outputs thirteenth data and fourteenth data; The fourth isomorphism mapping circuit receives the thirteenth data and the fourteenth data, performs inverse isomorphism mapping on the thirteenth data and the fourteenth data, and outputs the seventh data.

5. The masked S-box circuit of claim 2 or 3, wherein, The de-masking operation circuit comprises a fifth isomorphism mapping circuit, a fifth calculation circuit, a sixth calculation circuit and a sixth isomorphism mapping circuit; The fifth isomorphism mapping circuit receives the mask data, performs isomorphism mapping on the mask data, and outputs fifteenth data and sixteenth data; The fifth calculation circuit receives the third data, the fourth data, the seventh data, the fifteenth data and seventeenth data, performs calculation on the third data, the fourth data, the seventh data, the fifteenth data and the seventeenth data, and outputs eighteenth data; The sixth calculation circuit receives the third data, the fourth data, the seventh data, the sixteenth data and the seventeenth data, performs calculation on the third data, the fourth data, the seventh data, the sixteenth data and the seventeenth data, and outputs nineteenth data; The sixth isomorphism mapping circuit receives the eighteenth data and the nineteenth data, performs inverse isomorphism mapping on the eighteenth data and the nineteenth data, and outputs the de-mask data.

6. The masked S-box circuit of claim 5, wherein, The fifth calculation circuit comprises a seventh calculation circuit, a seventh isomorphism mapping circuit, an eighth calculation circuit, an eighth isomorphism mapping circuit and a ninth calculation circuit; The seventh calculation circuit performs calculation on the third data, the fifteenth data, the sixteenth data, the seventeenth data and twentieth data output by a first adder, and outputs twenty-first data; The seventh isomorphism mapping circuit receives the twenty-first data, performs isomorphism mapping on the twenty-first data, and outputs twenty-second data and twenty-third data; The eighth calculation circuit receives the tenth data, the eleventh data, the twelfth data, the twenty-second data, the twenty-third data, twenty-fourth data and twenty-fifth data from the fourth calculation circuit, performs calculation on the tenth data, the eleventh data, the twelfth data, the twenty-second data, the twenty-third data, the twenty-fourth data and the twenty-fifth data, and outputs twenty-sixth data and twenty-seventh data; The eighth isomorphism mapping circuit receives the twenty-sixth data and the twenty-seventh data, performs inverse isomorphism mapping on the twenty-sixth data and the twenty-seventh data, and outputs twenty-eighth data; The ninth calculation circuit receives the fourth data, the seventh data, the twenty-third data and the twenty-eighth data, performs calculation on the fourth data, the seventh data, the twenty-third data and the twenty-eighth data, and outputs the eighteenth data.

7. The masked S-box circuit of claim 6, wherein, The seventh computing circuit includes a third adder, a fourth adder, a fifth adder, a sixth adder, a fourth multiplier, a fifth multiplier, a sixth multiplier, a seventh multiplier, and an eighth multiplier; An input port of the third adder receives the fifteenth data and the sixteenth data, and an output port of the third adder is coupled to an input port of the fifth multiplier and an input port of the seventh multiplier; Both input ports of the fourth multiplier receive the sixteenth data, and an output port of the fourth multiplier is coupled to an input port of the eighth multiplier; An input port of the fifth multiplier further receives the third data, and an output port of the fifth multiplier is coupled to an input port of the fourth adder; An input port of the sixth multiplier is coupled to an output port of the first adder, an input port of the sixth multiplier further receives the fifteenth data, and an output port of the sixth multiplier is coupled to an input port of the fourth adder; An input port of the seventh multiplier further receives the fifteenth data, and an output port of the seventh multiplier is coupled to an input port of the fifth adder; An input port of the eighth multiplier further receives the seventeenth data, and an output port of the eighth multiplier is coupled to an input port of the fifth adder; An output port of the fourth adder is coupled to an input port of the sixth adder; An output port of the fifth adder is coupled to an input port of the sixth adder; An output port of the sixth adder is coupled to an input port of the seventh isomorphic mapping circuit.

8. The masked S-box circuit of claim 7, wherein, The eighth computing circuit includes a seventh adder, an eighth adder, a ninth adder, a tenth adder, an eleventh adder, a twelfth adder, a ninth multiplier, a tenth multiplier, an eleventh multiplier, a twelfth multiplier, a thirteenth multiplier, a fourteenth multiplier, a fifteenth multiplier, a sixteenth multiplier, a seventeenth multiplier, an eighteenth multiplier, a nineteenth multiplier, and a twentieth multiplier; An input port of the seventh adder receives the twenty-second data and the twenty-third data, and an output port of the seventh adder is coupled to an input port of the twelfth multiplier, an input port of the thirteenth multiplier, an input port of the eighteenth multiplier, and an input port of the twentieth multiplier; Both input ports of the ninth multiplier receive the twenty-third data, and an output port of the ninth multiplier is coupled to an input port of the tenth multiplier; An input port of the tenth multiplier further receives the twelfth data, and an output port of the tenth multiplier is coupled to an input port of the eighth adder; An input port of the eleventh multiplier is coupled to an output port of the third adder, an input port of the eleventh multiplier further receives the twenty-second data, and an output port of the eleventh multiplier is coupled to an input port of the ninth adder; An input port of the twelfth multiplier receives the tenth data, and an output port of the twelfth multiplier is coupled to an input port of the ninth adder; An input port of the thirteenth multiplier also receives the twenty-second data, and an output port of the thirteenth multiplier is coupled to an input port of the eighth adder; An output port of the eighth adder is coupled to an input port of the tenth adder; An output port of the ninth adder is coupled to an input port of the tenth adder; An output port of the tenth adder is coupled to an input port of the fourteenth multiplier; Both input ports of the fourteenth multiplier are coupled to an output port of the tenth adder, and an output port of the fourteenth multiplier is coupled to an input port of the fifteenth multiplier, an input port of the sixteenth multiplier, an input port of the nineteenth multiplier and an input port of the twentieth multiplier; An input port of the fifteenth multiplier also receives the eleventh data, and an output port of the fifteenth multiplier is coupled to an input port of the twelfth adder; An input port of the sixteenth multiplier also receives the twenty-third data, and an output port of the sixteenth multiplier is coupled to an input port of the twelfth adder; An input port of the seventeenth multiplier is coupled to an output port of the seventh multiplier, an input port of the seventeenth multiplier also receives the twenty-third data, and an output port of the seventeenth multiplier is coupled to an input port of the twelfth adder; An input port of the eighteenth multiplier is coupled to an output port of the seventh multiplier, and an output port of the eighteenth multiplier is coupled to an input port of the eleventh adder; An input port of the nineteenth multiplier is coupled to an output port of the third adder, and an output port of the nineteenth multiplier is coupled to an input port of the eleventh adder; An output port of the twentieth multiplier is coupled to an input port of the eleventh adder; The eleventh adder outputs the twenty-sixth data; The twelfth adder outputs the twenty-seventh data.

9. The masked S-box circuit of any of claims 6-8, wherein, The ninth calculation circuit comprises a twenty-first multiplier, a twenty-second multiplier, a twenty-third multiplier and a thirteenth adder; An input port of the twenty-first multiplier is coupled to an output port of the eighth isomapping circuit, an input port of the twenty-first multiplier also receives the fourth data, and an output port of the twenty-first multiplier is coupled to an input port of the thirteenth adder; An input port of the twenty-second multiplier is coupled to an output port of the eighth isomapping circuit, an input port of the twenty-second multiplier also receives the twenty-third data, and an output port of the twenty-second multiplier is coupled to an input port of the thirteenth adder; An input port of the twenty-third multiplier receives the twenty-third data and the seventh data, and an output port of the twenty-third multiplier is coupled to an input port of the thirteenth adder; An output port of the thirteenth adder is coupled to an input port of a fourth isomapping circuit, and outputs the eighteenth data.

10. The masked S-box circuit of claim 7 or 8, wherein, The sixth calculation circuit comprises a twenty-fourth multiplier, a twenty-fifth multiplier, a twenty-sixth multiplier and a fourteenth adder; An input port of the twenty-fourth multiplier is coupled to an output port of the first adder and an output port of the eighth isomorphic mapping circuit, and an output port of the twenty-fourth multiplier is coupled to an input port of the fourteenth adder; An input port of the twenty-fifth multiplier is coupled to an output port of the eighth isomorphic mapping circuit and an output port of the third adder, and an output port of the twenty-fifth multiplier is coupled to an input port of the fourteenth adder; An input port of the twenty-sixth multiplier is coupled to an output port of the third adder and an output port of the sixth isomorphic mapping circuit, and an output port of the twenty-sixth multiplier is coupled to an input port of the fourteenth adder; An output port of the fourteenth adder is coupled to an input port of a fourth isomorphic mapping circuit, and outputs the nineteenth data.

Images