Protecting block cipher computation operations from external monitoring attacks

An apparatus for implementing a block cipher in a manner resistant to external monitoring attacks, comprising:

• a first register configured to store a first pre-computed mask value represented by a combination of a first random value and a second random value;
• a second register configured to store an output mask value, wherein the output mask value is an inverse permutation function of the first random value;
• a third register configured to store a second pre-computed mask value represented by a combination the first pre-computed mask value and a permutation function of the output mask value;
• a fourth register configured to store an input mask value, wherein the input mask value is a combination of an expansion function of a key mask value and the first random value;
• a permutation circuit configured to produce a round state of a cryptographic operation of the block cipher by permuting an input data block;
• a masking circuit configured to produce a masked round state by masking the round state using the first pre-computed mask value;
• a non-linear transformation circuit configured to apply the expansion function to a first portion of the masked round state, perform a non-linear transformation of a combination of a masked key with an output of the expansion function applied to the first portion of the masked round state, and apply the permutation function to an output of the non-linear transformation thus producing a modified first portion of the masked round state, wherein the non-linear transformation is defined using the input mask value stored in the fourth register and the output mask value stored in the second register;
• two round feedback circuits configured to:
• produce a swapped masked round state by swapping the modified first portion of the masked round state with a second portion of the masked round state,
• produce a new masked round state by combining the swapped masked round state with the first pre-computed mask value stored in the first register and the second pre-computed mask value stored in the third register;
• and
• an output register configured to store a result of the cryptographic operation, wherein the result of the cryptographic operation comprises the new masked round state.