Methods for protecting substitution operation using substitution table against a side-channel analysis

A circuit, comprising:

• a memory and a processor configured to:
• execute a substitution operation in which an output data is selected in an original substitution table, the substitution operation being included in an cryptographic operation for encrypting or decrypting an input data, the input data of the substitution operation being based on the input data of the cryptographic operation, the substitution operation being performed using a new masked substitution table obtained from the original substitution table, the input data being combined by Exclusive OR (XOR) operations with a new value of a first mask parameter, and the output data being combined by the XOR operations with a new value of a second mask parameter,
• generate the new masked substitution table from a previous masked substitution table by:
• selecting a first input mask and a second input mask;
• computing the new value of the first mask parameter by applying the XOR operations to a previous value of the first mask parameter and to the first input mask;
• computing the new value of the second mask parameter by applying XOR operations to a previous value of the second mask parameter and to the second input mask;
• selecting each value in the previous masked substitution table obtained from the original substitution table;
• and for each selected value:
• computing a masked value by applying the XOR operations to the selected value and to the second input mask,
• computing a masked index by applying the XOR operations to the first mask and to an original index, and
• storing in the memory the masked value in the new masked substitution table, the selected value being selected at the original index and the masked value being stored at the masked index, or the selected value being selected at the masked index and the masked value being stored at the original index.

A non-transitory computer readable medium carrying one or more sequences of instructions, which when executed by one or more processors, cause the one or more processors to:

• execute a substitution operation in which an output data is selected in an original substitution table, the substitution operation being included in an cryptographic operation for encrypting or decrypting an input data, the input data of the substitution operation being based on the input data of the cryptographic operation, the substitution operation being performed using a new masked substitution table obtained from the original substitution table to perform the substitution operation, the input data being combined by Exclusive OR (XOR) operations with a new value of a first mask parameter, and the output data being combined by the XOR operations with a new value of a second mask parameter, the new masked substitution table being obtained from a previous masked substitution table by:
• selecting a first input mask and a second input mask;
• computing the new value of the first mask parameter by applying the XOR operations to a previous value of the first mask parameter and to the first input mask;
• computing the new value of the second mask parameter by applying the XOR operations to a previous value of the second mask parameter and to the second input mask;
• selecting each value in the previous masked substitution table obtained from the original substitution table;
• and
• for each selected value:
• computing a masked value by applying the XOR operations to the selected new value and to the second input mask,
• computing a masked index by applying the XOR operations to the first mask and to an original index, and
• storing the masked value in the new masked substitution table, the selected value being selected at the original index and the masked value being stored at the masked index, or the selected value being selected at the masked index and the masked value being stored at the original index.