DATA PROCESSING DEVICE AND METHOD FOR EXECUTING A CRYPTOGRAM ALGORITHM

Abstract

According to various embodiments, a data processing device is described which includes a processing circuit designed to execute a cryptographic algorithm comprising processing in a sequence of rounds, wherein the processing circuit comprises a processing pipeline with a sequence of processing stages, each round comprising processing through the processing pipeline, wherein the processing circuit further comprises an input designed to receive a state to be processed, and an input circuit designed to input the state as a first input to the processing circuit for the first round of the sequence of rounds, wherein the processing circuit is designed to process the first input successively in the rounds, and wherein it is designed toto successively process the first input in each round through the processing stages of the sequence of processing stages, to successively process a second input in the rounds, wherein the processing circuit in each round processes the second input through a different processing stage than the first input, and during each round, one or more of the rounds uses a processing result of the second input from a processing stage of the round and / or a processing result of the second input from a processing stage of the previous round to introduce randomness for processing the first input in the round, and / or during each round, one or more of the rounds uses the processing result of the second input of the round for comparison with a processing result of the first input of the round.

Description

TECHNICAL AREA

[0001] The present disclosure relates to data processing equipment and methods for executing a cryptographic algorithm. BACKGROUND

[0002] In security-critical applications, computer chips, such as those on a smart card or in a vehicle's control unit, typically perform cryptographic operations for encryption, decryption, and authentication, processing data such as cryptographic keys that must be protected from attacker access. A common security mechanism is the masking of the data being processed. Specifically, for a non-linear operation on one or more numbers, such as multiplying two numbers, the numbers can be randomly divided into two (or even more) parts, and the operation can be performed using these parts to generate a result that is also represented by two or more parts. Dividing a number into parts can also be considered a form of number masking.Masking can protect against attacks such as side-channel attacks, logic attacks, and espionage attacks. Another type of attack is logic attacks, such as fault injection, where an attacker modifies data (especially intermediate data of a cryptographic operation, thus manipulating the cryptographic operation, for example, by using a laser) and observes how the results change with the altered data, thereby gaining information about the processing and, for example, cryptographic keys used in the processing. Protection against fault injection can be implemented by using redundant processing, where a processing operation is performed at least twice to generate multiple processing results, and the chip only proceeds with further processing if the processing results are identical.

[0003] While masking and redundant processing increase robustness against attacks, especially side-channel attacks and fault injection, their implementation requires chip area that may be unavailable for other functions, potentially leading to performance degradation. Therefore, approaches that enable implementation with the smallest possible chip area and / or minimal performance loss are desirable.

[0004] Publication EP 3 291 478 A1 describes an encryption module and a method for performing an encryption / decryption process. Two cryptographic operations are executed in parallel in several stages. The two cryptographic operations are performed in such a way that different rounds of the two cryptographic operations are carried out in parallel by the same instruction or the same state machine for the hardware implementation. This allows manipulations to be detected.

[0005] The publication PRASAD, Srinidhi Hari et al., “Efficient low-latency masking of ascon without fresh randomness”, 2023, https: / / eprint.iacr.org / 2023 / 1914, describes a low-latency second-order hardware implementation of Ascon that does not require fresh randomness.

[0006] Publication DE 10 2004 062 825 A1 describes a cryptographic unit comprising a first processing unit for determining an output signal based on the AES (Advanced Encryption Standard) algorithm and for determining a first comparison signal, a second processing unit for determining a second comparison signal, and a release unit for making the output signal available. The release unit is designed to implement a defense against external interception of the output signal if the first comparison signal is not in a predetermined relationship to the second comparison signal. The first comparison signal is determined differently from the second comparison signal, so that any errors introduced into the cryptographic unit can be detected very easily. SUMMARY

[0007] According to various embodiments, a data processing device is provided comprising a processing circuit designed to execute a cryptographic algorithm comprising processing in a sequence of rounds, wherein the processing circuit comprises a processing pipeline with a sequence of processing stages, each round comprising processing through the processing pipeline, wherein the processing circuit further comprises an input designed to receive a state to be processed, and an input circuit designed to input the state as a first input to the processing circuit for the first round of the sequence of rounds, wherein the processing circuit is designed to process the first input successively in the rounds, and wherein it is designed toto successively process the first input in each round through the processing stages of the sequence of processing stages, to successively process a second input in the rounds, wherein the processing circuit in each round processes the second input through a different processing stage than the first input, and during each round, one or more of the rounds uses a processing result of the second input from a processing stage of the round and / or a processing result of the second input from a processing stage of the previous round to introduce randomness for processing the first input in the round.

[0008] Experts will recognize additional features and advantages upon reading the following detailed description and examining the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The present disclosure is illustrated by way of example and without limitation in the figures of the accompanying drawings, in which the same reference symbols refer to similar or identical elements. The elements of the drawings are not necessarily to scale relative to one another. The features of the various illustrated examples may be combined, unless they are mutually exclusive. Fig. Figure 1 shows an example of a processing device. Fig. Figure 2 illustrates the Ascon encryption scheme. Fig. Figure 3 illustrates an Ascon S-Box. Fig. Figure 4 illustrates a second-order DOM (domain-oriented masking) indep multiplier. Fig. Figure 5 illustrates an Ascon round according to a first embodiment. Fig. Figure 6 illustrates an Ascon round according to a second embodiment. Fig. Figure 7 illustrates the use of inactive pipeline stages in the Ascon round implementation of Fig. 6 to generate a pseudorandom number. Fig. Figure 8 illustrates redundant processing for error detection. Fig. Figure 9 illustrates the use of inactive pipeline stages of the Ascon round implementation of Fig. 6 for redundant processing. Fig. Figure 10 illustrates the use of inactive pipeline stages in the Ascon round implementation of Fig. 6 for redundant processing, whereby one instance of the useful data to be processed is rotated. Fig. Figure 11 illustrates the use of inactive pipeline stages of the Ascon round implementation of Fig. 6 for redundant processing, as well as for generating randomness. Fig. Figure 12 shows a data processing device according to one embodiment. Fig. Figure 13 shows a flowchart illustrating a procedure for executing a cryptographic algorithm. DETAILED DESCRIPTION

[0010] The embodiments described herein can be implemented by a data processing device such as a personal computer, a microcontroller, a smart card (of any form factor), a secure microcontroller, a hardware trust anchor, an (embedded) secure element (ESE), a trusted platform module (TPM), or a hardware security module (HSM). The data processing device can also refer to a single chip, that is, an integrated circuit, which, for example, implements a system-on-a-chip (SoC).

[0011] Fig. Figure 1 shows an example of a processing device (for example, a safety controller) 100, which includes a CPU 101, one or more memory modules, such as RAM 102 and non-volatile memory 103 (NVM) or other memory modules (such as a ROM), a crypto module 104, an analog module 106, an input / output interface 107, and a hardware random number generator 112.

[0012] In this example, CPU 101 has access to at least one crypto module 104 via a common bus 105, to which each crypto module 104 is coupled. Each crypto module 104 can, in particular, contain one or more crypto cores to perform specific cryptographic operations. Examples of crypto cores are: - AES kernel 109, - SHA core 110, - ECC core 111, and - Ascon core 108.

[0013] The CPU 101, the hardware random number generator 112, the NVM 103, the crypto module 104, the RAM 102, and the input / output interface 107 are connected to the bus 105. The input / output interface 107 can have a connection 113 to other devices that may be similar to the processing device 100.

[0014] The analog module 106 is supplied with electrical energy via an electrical contact and / or an electromagnetic field. This energy is supplied to drive the circuitry of the processing device 100 and, in particular, enables the input / output interface to initiate and / or maintain connections to other devices via connection 113.

[0015] Bus 105 itself can be masked or blank. Instructions for carrying out the processing and algorithms described below can be stored in the NVM 103 and processed by the CPU 105. The processed data can be stored in the NVM 103 or in RAM 102. Supporting functions can be provided by the crypto modules 104 (for example, extending pseudorandom data). Random numbers are supplied by the hardware random number generator 112.

[0016] Instructions for executing the procedures described below can be stored in the crypto module 104, or they can be provided by the CPU 101 via the bus 105. The data can be stored locally in the crypto module 104. It is also possible to temporarily store the data in the RAM 102 or the NVM 103.

[0017] The processing and algorithms described below can be performed exclusively or at least partially on the Crypto Module 104 or on the CPU 101. A processing circuit (such as the Crypto Module 104 or the CPU 101) may or may not be equipped with hardware-based security features. Such hardware-based security features could be circuits that implement countermeasures against side-channel energy analysis or fault injection (for example, by using a laser) to prevent an attacker from obtaining information about secret data (such as cryptographic keys or secret user data). Such countermeasures can be implemented through the use of randomness, redundant hardware, or redundant processing.In general, the goal of countermeasures is to conceal the internally processed values ​​from an attacker who is able to observe the physical effect of processing such values.

[0018] For the following examples, it is assumed that the processing device 100 executes a cryptographic algorithm that involves multi-round processing. One example of this is Ascon. Ascon is a family of authenticated encryption and hashing schemes that all use the same 320-bit permutation, parameterized only by a different number of rounds.

[0019] Fig. Figure 2 illustrates the Ascon encryption scheme.

[0020] As can be seen, Ascon is based on a sponge construction and includes permutations 201, which involve a number of a or b permutation rounds p, that is, each permutation 201 can be described as p a or p bto be written.

[0021] Each permutation stage receives as input a 320-bit state S, which is divided into five 64-bit register words (also called state words) x i is divided up, that is to say S=x0‖x1‖x2‖x3‖x4

[0022] The permutations p a and p b Apply a round transformation p iteratively for a or b rounds. Each round consists of a round constant addition (p). C ), a substitution layer (p S ) and a linear diffusion layer (p L In constant addition, a round constant c is used. r The register word x2 of the state is XOR-combined (that is, combined with x2 according to an XOR operation). The specific value of the round constant depends on the round (that is, the round index i) of p. a and p b ab. The substitution layer p SThe only nonlinear component of the round transformation is the S-box. It updates the state S using a parallel application of 64 5-bit S-boxes. The S-box is constructed by applying a light linear transformation to the input and an affine layer to the output of the Keccak-χ map (i.e., SHA3). It operates on these five bits with the same bit position in the five state words.

[0023] Fig. Figure 3 illustrates the Ascon-S-Box 300.

[0024] As described above, it includes linear S-box layer 301, nonlinear Keccak-χ- Fig. and affine S-box layer 303. The S-box 300 has an algebraic degree of two, a linear and differential branching number of three, and can be efficiently implemented in hardware and software.

[0025] The linear diffusion layer p L works on each 64-bit register word x i , and applies the linear function Σi (x i ) on each register word. It rotates each register word x i to use fixed rotation constants and XOR-combine the results with the respective register word: x0=∑0(x0)=x0⊕(x0>>>19)⊕(x0>>>28) x1=∑1(x1)=x1⊕(x1>>>61)⊕(x1>>>39) x2=∑2(x2)=x2⊕(x2>>>1)⊕(x2>>>6) x3=∑3(x3)=x3⊕(x3>>>10)⊕(x3>>>17) x4=∑4(x4)=x4⊕(x4>>>7)⊕(x4>>>41)

[0026] According to various embodiments, the processing device 100 executes a cryptographic algorithm (for example, an Ascon scheme, that is, an encryption as in Fig. (2 illustrated) masked by. Masking is a countermeasure against side-channel attacks, particularly differential power analysis (DPA), where power consumption measurements are statistically analyzed. The idea behind masking is to make intermediate data independent of any sensitive information being processed. The most common masking schemes are Boolean masking and arithmetic masking. Boolean masking uses an XOR operation over a binary array, unlike arithmetic masking, which uses addition or multiplication in a modular ring.

[0027] Boolean masking can achieve d-order security by dividing the secret data into s = d + 1 parts using an XOR operation on a binary array. Ideally, each part is then processed individually across computations in a separate device (for example, processing device 100). The fundamental principle of domain-oriented masking (DOM) relies on shared domains. The goal here is to keep the parts of each domain separate from the parts of other domains. For example, a DOM implementation with d + 1 parts for each variable results in d + 1 domains and should provide d-order security.

[0028] There are two types of multipliers that use the DOM, known as DOM-indep and DOM-dep. The DOM-indep multiplier operates on independently shared inputs, which has the advantage of requiring less fresh randomness and resulting in a smaller size. The DOM-dep multiplier does not require independently shared inputs but is more expensive to implement.

[0029] Fig. Figure 4 illustrates the second-order DOM indep multiplier 400 (that is, providing second-order security), where the two operands X and Y are each divided into three parts: X=AX+BX+CX Y=AY+BY+CY

[0030] Accordingly, there are three domains A, B, and C, and the nine products for calculating X*Y (according to the nine possible pairs of a fraction of X and a fraction of Y) are performed by nine multipliers 401 to 409. Furthermore, there are three random values ​​Z0, Z1, and Z2, which (in different combinations) are added to the results of the multipliers 401 to 409 in domains A, B, and C by adders 410 to 415 for reuse (i.e., remasking).

[0031] The addition of the random values ​​Z0, Z1, and Z2 results in (three bits) randomness, which leads to "fresh random fractions" that help prevent glitches from crossing domains. To prevent information leakage due to glitches, the DOM indep multiplier also incorporates register level 416 (formed by several flip-flops).

[0032] In the present example from Ascon, the DOM indep multiplier 400 is used, for example, for multiplier (that is, AND gate) 304 of the Keccak-χ- Fig. This is used. Due to the register level 416, a register level is introduced into the Ascon round. It should be noted that multipliers (especially DOM-indep multipliers) of other orders can also be used.

[0033] Fig. Figure 5 illustrates an Ascon round according to a first embodiment.

[0034] As described above, the Ascon round includes linear S-box layer 501, Keccak-χ- Fig. , affine S-box layer 503 and linear diffusion layer 504 (the constant addition is not shown here for the sake of simplicity).

[0035] The Ascon round includes the first register stage 505 for storing the input in the respective round, and the second register stage 506 for the input of the Keccak-χ- Fig. , and third register level 507 at the end of the Keccak-χ- Fig. , which corresponds to register level 416 of the aforementioned DOM indep multiplier 400.

[0036] The 508 input multiplexer (which can be considered an input circuit of the processing circuit formed by the processing pipeline) allows the result of one round to be passed to the next round, or, before the first cycle (for example, clock cycle) of the first round, the input of the state to be permuted.

[0037] Since each register level (505, 506, 507) increases latency, it is desirable to keep the number of register levels as low as possible. In fact, it is possible to reduce the number of register states to two by appropriately transforming / preparing the input data, as shown in Fig. 6 illustrates.

[0038] Fig. Figure 6 illustrates an Ascon round according to a second embodiment.

[0039] Here, the sequence of linear S-box layer 601, Keccak-χ- Fig. , affine S-box layer 603 and linear diffusion layer 604 is modified, which allows the removal of the second register stage 506, leaving only an input register stage 605 and a DOM indep multiplier register stage 606.

[0040] As in Fig. 5 enables input multiplexer 607 to forward the result of one round to the next round, or, before the first cycle of the first round, to input the state to be permuted.

[0041] So, in the implementation of Fig. 5. Each round, a processing pipeline of three processing stages (also called pipeline stages) is used: Stage 1: Processing of the linear S-box layer 501 Stage 2: Processing the Keccak-χ- Fig. Stage 3: Processing of the affine S-box layer 503 and processing of the linear diffusion layer 504

[0042] During the implementation of Fig. Each round has a processing pipeline of two processing stages: Stage 1: Processing the Keccak-χ- Fig. Stage 2: Processing of the affine S-box layer 603, processing of the linear diffusion layer 604 and processing of the linear S-box layer 601

[0043] Accordingly, as in Fig. 5 and Fig. Figure 6 illustrates that useful data (i.e., a given state being processed in the respective round) is processed in three cycles or two cycles, where a cycle (for example, a clock cycle) is the time during which the processing of a processing stage is carried out.

[0044] Masking requires randomness. For example, using the DOM indep multiplier of 400 necessitates the random values ​​Z0, Z1, and Z2 in each round. To generate this randomness (i.e., provide random numbers), a dedicated random number generator such as the hardware random number generator 112 can be used, but this results in a significant performance decrease and / or a larger chip area.

[0045] Therefore, according to various embodiments, unused (i.e., inactive) pipeline stages in a masked implementation of a cryptographic algorithm are used as a pseudorandom number generator (PRNG). This is demonstrated below for the Ascon round implementation of Fig. 6 is described with two cycles per round, but can be analogously applied to rounds with more cycles (such as the Ascon round implementation of Fig. 5) or on rounds any other cryptographic algorithm that has multiple cycles and is implemented in a masked manner, such as SHA3 (secure hash algorithm 3) and AES (advanced encryption standard).

[0046] Fig. Figure 7 illustrates the use of inactive pipeline stages in the Ascon round implementation of Fig. 6 to generate a pseudorandom number.

[0047] As explained above, each round has two cycles. For the following explanation, it is assumed that cycle 1 is the first cycle of the first round, cycle 2 is the second cycle of the first round, cycle 3 is the first cycle of the second round, and so on.

[0048] To generate random numbers, an initial random number is introduced via the input multiplexer 607 before cycle 1, and is processed by the first processing stage in a "cycle 0" using the Keccak-χ- Fig. processed. This initial random number can be seen as a starting value, and since it is only needed once for the entire permutation (that is, for all a or b rounds), it can be generated with minimal additional implementation effort.

[0049] For cycle 1, the state to be processed is introduced via the input multiplexer 607. This is then processed in cycle 1 by the Keccak χ- Fig. processed as usual, however, the result of cycle 0, that is, the random number as it results from the processing of the initial random number by the Keccak χ- Fig. This results in the required randomness for the masked implementation of the χ-map, that is, for the random values ​​Z0, Z1, and Z2. For example, parts of the processing result from cycle 0 can be used for Z0, Z1, and Z2. Furthermore, in cycle 1, the random number is further processed by the second processing stage (that is, by the affine S-box layer 603, the linear diffusion layer 604, and the linear S-box layer 601).

[0050] The processing then continues in the usual way, except that one processing stage, which is not currently processing the useful data (i.e., the state), processes the random number. For example, the second processing stage in cycle 2 processes the useful data, while the first processing stage processes the random number that is the result of the stage 2 processing of the random number from cycle 1.

[0051] In other words, each processing stage alternately processes the useful data (i.e., the state to be permuted) and the random number, so that both the useful data and the random number traverse the entire permutation (i.e., all rounds). Each time the useful data is processed by the first processing stage (i.e., in an odd-numbered cycle), the current version of the random number is used to provide the required randomness. Thus, a masked implementation can be realized with minimal additional implementation overhead in terms of chip area and performance.

[0052] Masking can protect against side-channel attacks. Another type of attack is fault injection, where an attacker alters the computational and / or intermediate data (for example, by using a laser) and observes how the results change with the altered data, thereby gaining information about the processing and, for example, cryptographic keys used in the processing. Protection against fault injection can be implemented by using redundant processing.

[0053] Fig. Figure 8 illustrates redundant processing for error detection (especially errors introduced by fault attacks).

[0054] In redundant processing, input 801 is processed by (at least) two processing blocks 802, which perform the same processing. The results 803 of the two processing blocks 802 are then compared by comparator 804. If they are the same (or, depending on the use case, sufficiently close), they are output as a (single) processing result. If they are not the same, the comparator outputs alarm signal 805, i.e., triggers an alarm (for example, the processing of the respective chip is stopped, thus preventing an attacker from obtaining information about differences that arise during further processing caused by an injected error). For a successful error attack, an attacker would now have to introduce the same error in both processing blocks 802, which is much more difficult than introducing a single error.

[0055] In the present use case, the input 801 is a state, for example the state at the beginning of the permutation (that is, before the first round), or the state after one or more rounds (that is, the input into a specific round after one or more rounds have already been executed).

[0056] Performing redundant processing increases the required chip area, as processing blocks had to be implemented multiple times.

[0057] Therefore, according to various embodiments, unused (i.e., inactive) pipeline stages are used for redundant processing (i.e., for a second version of the useful data); that is, the processing blocks 802 are both implemented by the pipeline stages by using them alternately. This is illustrated below for the Ascon round implementation of Fig. 6 is described with two cycles per round, but can be analogously applied to rounds with more cycles (such as the Ascon round implementation of Fig. 5) or any other cryptographic algorithm that has multiple cycles can be applied to rounds.

[0058] Fig. Figure 9 illustrates the use of inactive pipeline stages of the Ascon round implementation of Fig. 6 for redundant processing.

[0059] As explained above, each round has two cycles. For the following explanation, it is assumed that cycle 1 is the first cycle of the first round, cycle 2 is the second cycle of the first round, cycle 3 is the first cycle of the second round, and so on.

[0060] For redundant processing, two instances of the state to be processed, designated as Data0 and Data, are processed in parallel in the different pipeline stages.

[0061] For cycle 1, the first instance of the state to be processed (Data0) is introduced via input multiplexer 607. This is then processed as usual in cycle 1 by the first processing stage, and then as usual in cycle 2 by the second processing stage.

[0062] However, for cycle 2, the second instance, the state to be processed (Data1) is processed by the first processing stage.

[0063] For cycle 3, the result of the stage 2 processing of data0 (from cycle 2) is returned to the first processing stage via the input multiplexer 607 and processed (further) by the first processing stage, while the result of the stage 1 processing of data (from cycle 2) is processed (further) by the second processing stage.

[0064] Thus, processing continues in the usual manner, with each processing stage alternately processing the first instance and the second instance of the useful data (in each cycle, that is, it is never inactive).

[0065] In other words, each processing stage alternately processes the useful data (that is, the state to be permuted), so that both instances go through the entire permutation (that is, all rounds).

[0066] At one point in the processing, the processing results of the two instances are compared by a comparator (for example, comparator 804). The comparator must store the Data0 processing result requests for one cycle until it receives the corresponding Data1 processing result. This can occur at the end of the permutation, but also during processing, for example, after a certain number of rounds.

[0067] By using the processing stages to process both instances of the data, redundant processing can be achieved with minimal additional implementation effort in terms of chip area and very low latency increase (only one cycle).

[0068] It should be noted that the approach of Fig. 9 only provides redundancy in the temporal domain, since if an attacker arrives and injects the same error in two consecutive cycles, the two instances will have the error at the same position, which cannot be detected by the comparator.

[0069] In order to achieve spatial redundancy, one of the instances is rotated according to various embodiments.

[0070] Fig. Figure 10 illustrates the use of inactive pipeline stages in the Ascon round implementation of Fig. 6 for redundant processing, whereby one instance of the useful data to be processed is rotated.

[0071] The approach is based on the following: Fig. The approach described in section 9 is similar, however, the second instance of the useful data (Data1) is now rotated relative to the other instance by a predetermined number of bits, in this example 17 bits. Other numbers are possible, but a number that is coprime to the state length (or at least the word length) may be preferred.

[0072] This approach utilizes (internal) rotational symmetry present in Ascon and can be used for other algorithms with rotational symmetry, which are very common in cryptography, to enable efficient implementations.

[0073] The comparator compensates for the rotation (for example, by reversing the processing of the Data1 processing result by the predetermined number of times) and then performs the comparison.

[0074] With the approach of Fig. 10. The comparator can detect an injected error even if an attacker injects the same error in two consecutive cycles, because the processing results of the two instances of useful data have the error at different positions. Multi-bit errors (laser spots) cancel each other out only with a low probability.

[0075] It should be noted that the processing for the rotated data instance may need to be slightly adjusted so that the processing results of the two instances are the same (assuming no errors occur). In particular, in the case of Ascon, a rounding constant c must also be specified. rThey need to be rotated to perform the correct round processing. In fact, round constants are typically used to break symmetries, for example in Ascon, SHA3, and AES. Nevertheless, only minor hardware changes are needed to implement the approach of Fig. 10 to implement (for example, to rotate the round constants to achieve the same processing for the two instances).

[0076] It should also be noted that the redundant processing approach of Fig. 9 or Fig. 10 with the approach of Fig. The 7 methods for generating random numbers can be combined to reduce the cost of generating randomness. For example, random portions of the second data instance can be used as randomness for data0, and vice versa.

[0077] Fig. Figure 11 illustrates the use of inactive pipeline stages of the Ascon round implementation of Fig. 6 for redundant processing, as well as for generating randomness.

[0078] As with reference to Fig. As explained in section 7, an initial random number is introduced via the input multiplexer 607 before cycle 1, and is processed by the first processing stage in a “cycle 0” using the Keccak-χ- Fig. processed. This initial random number can be seen as a starting value, and since it is only needed once for the entire permutation (that is, for all a or b rounds), it can be generated with minimal additional implementation effort.

[0079] The result of cycle 0 processing is then expressed as randomness (for example, as Z). i) for processing the first instance of useful data, Data0, in the first processing stage (cycle 1). For processing the second instance of useful data, Data, in cycle 2, the result of processing Data0 in cycle 1 is used for randomness (for example, for Z). i ). Similarly, in all subsequent rounds, the processing result of Data0 (first processing stage) is used as a random number (for example, Z). i ) for data, used, and vice versa.

[0080] In summary, according to various embodiments, a data processing device as described in Fig. 12 illustrated examples provided.

[0081] Fig. Figure 12 shows data processing device 1200 according to one embodiment.

[0082] The data processing device comprises processing circuit 1201, which is designed to execute a cryptographic algorithm that involves processing in a sequence of rounds. The processing circuit includes processing pipeline 1202 with a sequence of processing stages 1203, each round comprising processing through the processing pipeline 1202. Processing stages are, for example, processing blocks separated by registers, that is, by storage elements (typically flip-flops).

[0083] The processing circuit 1201 further comprises input 1204, which is designed to receive a state to be processed, and input circuit 1205, which is designed to input the state as a first input into the processing circuit for the first round of the sequence of rounds.

[0084] The 1201 processing circuit is designed to perform the following: • Processing the first input successively in the rounds, being designed to process the first input successively in each round through the processing stages 1203 of the sequence of processing stages 1203, • Processing a second input successively in the rounds, wherein the processing circuit 1201 processes the second input in each round through a different processing stage 1203 than the first input; and • Use, during each round of one or more of the rounds, a processing result of the second input of a processing stage of the round and / or a processing result of the second input of a processing stage of the preceding round (that is, a round that directly precedes the round in the sequence of rounds) to introduce randomness for a processing of the first input in the round (the processing stage of the round or the preceding round can, for example, be a processing stage after the processing stage into which randomness is introduced in the sequence of processing stages - for example, a result generated by the second processing stage can be used as randomness for the first processing stage)

[0085] Optionally, the procedure also includes: using, during each round of one or more of the rounds, the processing result of the second input of the round for a comparison with a processing result of the first input of the round.

[0086] In other words, according to various embodiments, second input data is processed in rounds along with useful data, using the second input processing stages that are not currently occupied by the first data (for example, in the case of two states, each processing stage alternately processes the first and second inputs). Results from the processing of the second input are used to introduce randomness (to protect against side-channel attacks). They can also be used as a comparison result with a result from the processing of the first input (for redundant processing, for example, to protect against fault injection attacks or to increase security).

[0087] According to various embodiments, a method as described in Fig. 13 illustrated.

[0088] Fig. Figure 13 shows flowchart 1300, which illustrates a method for executing a cryptographic algorithm according to one embodiment. The cryptographic algorithm comprises processing in a sequence of rounds, each round comprising processing through a processing pipeline with a sequence of processing stages.

[0089] At 1301, a state is received that is to be processed.

[0090] At 1302, the state is entered as the first input of the first round of the sequence of rounds.

[0091] In 1303, the first input is processed successively in the rounds (that is, sequentially through the rounds, first through the first round, then the result of the first round through the second round, etc.), whereby the first input is successively processed in each round through the processing stages of the sequence of processing stages (that is, sequentially through the processing stages, meaning it goes through the sequence of processing stages), and a second input is successively processed in the rounds, whereby in each round the second input is processed by a different processing stage than the first input.

[0092] During each round of one or more of the rounds, a processing result of the second input of a processing stage of the round or of a processing stage of the previous round is used to introduce randomness for processing the first input in the round, and optionally, a processing result of the second input of the round is also used for comparison with a processing result of the first input of the round.

[0093] The procedure of Fig. 13. This can be performed by one or more data processing devices (for example, computers or microcontrollers) with one or more data processing units. The term "data processing unit" can be understood as any type of entity that enables the processing of data or signals. For example, the data or signals can be handled according to at least one (that is, one or more) specific functions performed by the data processing unit. A data processing unit can include or be formed by an analog circuit, a digital circuit, a logic circuit, a microprocessor, a microcontroller, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a field-programmable gate array (FPGA), or any combination thereof.Any other means for implementing the respective functions described in more detail herein may also be understood as including a data processing unit or a logic circuit. One or more of the procedural steps described in more detail herein may be executed (for example, implemented) by a data processing unit through one or more specific functions performed by the data processing unit.

[0094] Some or all of the components of the data processing device, which refer to Fig. 12 described, that is, the processing circuit 1201, the processing pipeline 1202, the processing stages 1203 and / or the input circuit 1204, can be implemented as hardware circuits, that is, as logic gates and storage elements (for example, flip-flops) that are connected to perform the various functions (that is, without the need to program them). The following are several examples:

[0095] Example 1 is a data processing device, as described with reference to Fig. 12 described.

[0096] Example 2 is the data processing device of Example 1, wherein the processing circuit is designed to use the processing result of the second input of the processing stage of the round, or the processing result of the second input of the processing stage of the previous round, for remasking an intermediate result of the processing of the first input (that is, using the processing result of the second input to introduce randomness to the processing of the first input includes using the processing result of the second input for remasking an intermediate result of the processing of the first input).

[0097] Example 3 is the data processing device of Example 1 or 2, wherein the processing circuit is designed to use the processing result of the second input of the processing stage of the round or the processing result of the second input of the processing stage of the previous round as a randomness for the implementation of a masked AND gate.

[0098] Example 4 is the data processing device of one of Examples 1 to 3, wherein the second input is a random value (in case the processing result of the second input is used in a processing stage of the round or in a processing stage of the previous round to introduce randomness to the processing of the first input in the round).

[0099] Example 5 is the data processing device from one of Examples 1 to 3, where the second input is the state to be processed (this can be done for both cases: to introduce randomness, and to use the processing result of the second input for comparison).

[0100] Example 6 is the data processing device from one of Examples 1 to 3, wherein the second input is a permuted (for example, rotated) version of the state to be processed (this can be done for both cases: to introduce randomness, and to use the processing result of the second input for comparison; the processing circuit or the input circuit can be designed to perform the rotation).

[0101] Example 7 is the data processing device of Example 6, wherein the processing circuit is designed to adapt the processing of the second input to compensate for the permutation of the second input with respect to the first input (for example, to permute a constant that is added in the same way).

[0102] Example 8 is the data processing device of Example 6 or 7, wherein the second input is rotated by a predetermined number of bits with respect to the state to be processed, and the adjustment of the round involves rotating a constant which is added in the processing by the round by the predetermined number of bits.

[0103] Example 9 is the data processing device of any of Examples 1 to 8, wherein the processing circuit is designed to use the processing result of the second input of the round for comparison with the processing result of the first input of the round, and to issue an alarm if there is a mismatch between the processing result of the second input of the round and the processing result of the first input of the round.

[0104] Example 10 is the data processing device of one of Examples 1 to 9, where the sequence of rounds implements a (cryptographic) permutation (of its input).

[0105] Example 11 is the data processing device from one of Examples 1 to 10, where the cryptographic algorithm is a hashing, encryption, or decryption algorithm.

[0106] Example 12 is a procedure for executing a cryptographic algorithm, as described with reference to Fig. 13 described.

[0107] The examples described herein provide efficient approaches to increasing the security of processing secret data such as cryptographic keys, in particular to protect against side-channel attacks and fault injection attacks.

[0108] Although specific examples have been illustrated and described herein, those skilled in the art will recognize that a multitude of alternative and / or equivalent implementations can replace the specific embodiments shown and described without departing from the scope of the present invention. This application is intended to cover any adaptations or variations of the specific examples discussed herein. Therefore, this invention is to be limited only by the claims and their equivalents.

[0109] It should be noted that the methods and devices, including their preferred embodiments, as set forth in this document, can be used independently or in combination with the other methods and devices disclosed herein. Furthermore, features described in connection with a device can also be applied to a corresponding method, and vice versa. Moreover, all aspects of the methods and devices described in this document can be combined in any way. In particular, the features of the claims, embodiments, and examples can be combined in any way.

[0110] It should be noted that the description and drawings merely illustrate the principles of the proposed methods and systems. Those skilled in the art are capable of implementing various arrangements which, although not explicitly described or shown herein, embody the principles of the invention and are contained within its spirit and scope. Furthermore, all examples and embodiments set forth in this document are expressly intended, in principle, to serve only as illustrations to facilitate the reader's understanding of the principles of the proposed methods and systems. Moreover, all statements herein that provide principles, aspects, and embodiments of the invention, as well as specific examples thereof, are intended to include their equivalents.

Claims

[1] Data processing equipment (100, 1200) comprising the following: a processing circuit (1201) designed to execute a cryptographic algorithm comprising processing in a sequence of rounds, wherein the processing circuit (1201) comprises a processing pipeline (1202) with a sequence of processing stages (1203), each round comprising processing through the processing pipeline (1202); wherein the processing circuit (1201) further comprises the following: an input (1204) designed to receive a state to be processed, and an input circuit (1205) designed to input the state as a first input to the processing circuit (1201) for the first round of the sequence of rounds; wherein the processing circuit (1201) is designed to: Processing the first input successively in the rounds, being designed to process the first input successively in each round through the processing stages (1203) of the sequence of processing stages (1203); Processing a second input successively in the rounds, wherein the processing circuit (1201) processes the second input in each round through a different processing stage (1203) than the first input; and Use, during each round of one or more of the rounds, a processing result of the second input of a processing stage (1203) of the round and / or a processing result of the second input of a processing stage (1203) of the previous round to introduce randomness for a processing of the first input in the round;. [2] Data processing device (100, 1200) according to claim 1, wherein the processing circuit (1201) is designed to use the processing result of the second input of the processing stage (1203) of the round or the processing result of the second input of the processing stage (1203) of the previous round for a re-masking of an intermediate result of the processing of the first input. [3] Data processing device (100, 1200) according to claim 1 or 2, wherein the processing circuit (1201) is designed to use the processing result of the second input of the processing stage (1203) of the round or the processing result of the second input of the processing stage (1203) of the previous round as a randomness for the implementation of a masked AND gate. [4] Data processing device (100, 1200) according to one of claims 1 to 3, wherein the second input is a random value. [5] Data processing device (100, 1200) according to one of claims 1 to 3, wherein the second input is the state to be processed. [6] Data processing device (100, 1200) according to one of claims 1 to 3, wherein the second input is a permuted version of the state to be processed. [7] Data processing device (100, 1200) according to claim 6, wherein the processing circuit (1201) is designed to adapt the processing of the second input in order to compensate for the permutation of the second input with respect to the first input. [8] Data processing device (100, 1200) according to claim 6 or 7, wherein the second input is rotated by a predetermined number of bits with respect to the state to be processed, and adjustment of the rotation is carried out by rotating a constant by the predetermined number of bits and adding the constant. [9] Data processing device (100, 1200) according to any one of claims 1 to 8, comprising using, during each round of one or more of the rounds, the processing result of the second input of the round for a comparison with a processing result of the first input of the round. [10] Data processing device according to claim 9, wherein the processing circuit is designed to output an alarm if there is a mismatch between the processing result of the second input of the round and the processing result of the first input of the round. [11] Data processing device (100, 1200) according to any one of claims 1 to 10, wherein the sequence of rounds implements a permutation. [12] Data processing device (100, 1200) according to any one of claims 1 to 11, wherein the cryptographic algorithm is a hashing, encryption or decryption algorithm. [13] Method for executing a cryptographic algorithm comprising processing in a sequence of rounds, wherein each round comprises processing through a processing pipeline (1202) with a sequence of processing stages (1203), the method comprising: Receiving a state that is to be processed; Entering the state as the first input in the first round of the sequence of rounds; Processing the first input successively in the rounds, wherein the first input in each round is successively processed by the processing stages (1203) of the sequence of processing stages (1203); Processing a second input successively in the rounds, wherein in each round the second input is processed by a different processing stage (1203) than the first input; and wherein during each round of one or more of the rounds a processing result of the second input of a processing stage (1203) of the round and / or a processing stage (1203) of the previous round is used to introduce randomness for processing the first input in the round.

Images