Method for protecting substitution operation against side-channel analysis

A circuit, comprising

• a memory and a processor configured to:
• apply a cryptographic operation to all data in an input set including data obtained by applying Exclusive OR (XOR) operations to an input data and to all first mask parameters in a first mask set including mask words forming the first mask parameters, each first mask parameter in the first mask set including at least one of the mask words in the first mask set, the mask words in the first mask set having a same size and forming at least one first word subset including a single word from each first mask parameter of the first mask set and a same number of occurrences of all possible values of the mask words in the first mask set;
• and
• provide as an output of the cryptographic operation, an output set including all data resulting from an application of the cryptographic operation to all of the data in the input set, an output data of the cryptographic operation applied to the input data being obtained by applying XOR operations to any one of the data in the output set and to a respective second mask parameter in a second mask set including mask words forming the second mask parameters, each second mask parameter in the second mask set including at least one of the mask words in the second mask set, the mask words in the second mask set having a same size and forming at least one second word subset including a single word from each second mask parameter of the second mask set and a same number of occurrences of all possible values of the mask words in the second mask set.

A non-transitory computer-readable storage device including code portions which, when carried out by a computer, configure the computer to carry out one or more instructions and cause one or more processors to:

• apply a cryptographic operation to all data in an input set including data obtained by applying Exclusive OR (XOR) operations to an input data and to all first mask parameters in a first mask set including mask words forming the first mask parameters, each first mask parameter in the first mask set including at least one of the mask words in the first mask set, the mask words in the first mask set having a same size and forming at least one first word subset including a single word from each first mask parameter of the first mask set and a same number of occurrences of all possible values of the mask words in the first mask set;
• and
• provide as an output of the cryptographic operation, an output set including all data resulting from an application of the cryptographic operation to all of the data in the input set, an output data of the cryptographic operation applied to the input data being obtained by applying XOR operations to any one of the data in the output set and to a respective second mask parameter in a second mask set including mask words forming the second mask parameters, each second mask parameter in the second mask set including at least one of the mask words in the second mask set, the mask words in the second mask set having a same size and forming at least one second word subset including a single word from each second mask parameter of the second mask set and a same number of occurrences of all possible values of the mask words in the second mask set.