Encryption/description method protected against side-channel attacks

A non-transitory computer-readable medium comprising code instructions for causing a computer to perform a method for encrypting or decrypting a data block from a secret key, wherein the method comprises steps of:

• generating a first round key kr dependent on the secret key,
• selecting each of a first mask (−br) and a second mask (−br+1) in a set consisting of a mask of bits all at one and a mask of all zero bits,
• calculating a first masked key kr′ from the first round key kr and the first mask (−br) as follows:
• kr′=kr⊕(−br)
• wherein ⊕ is an exclusive disjunction,
• executing a first encryption round applied to two first data dependent on the data block,
• by means of the first masked round key kr′ so as to produce two second data Lrbr, Rrbr,
• after producing the first masked key kr′, generating a second round key kr+1 dependent on the secret key,
• calculating a second masked key kr+1′ from the second round key kr+1 and the second mask (−br+1) as follows:
• kr+1′=kr+1⊕(−br+1)
• calculating two third data Lrbr+1, Rrbr+1 as follows
• Rrbr+1=Rrbr⊕(−br−1)⊕(−br)
• Lrbr+1=Lrbr⊕(−br−1)⊕(−br)
• executing a second encryption round following the first encryption round, wherein the second encryption round is applied to the two third data Lrbr+1, Rrbr+1 by means of the second masked round key kr+1′.

A device for encryption or decryption of an input data block from a secret key, the device comprising at least one processor configured to:

• generate a first round key kr dependent on the secret key,
• select each of a first mask (−br) and a second mask (−br+1) in a set consisting of a mask of bits all at one and a mask of all zero bits,
• calculate a first masked key kr′ from the first round key kr and the first mask (−br) as follows:
• kr′=kr⊕(−br)
• wherein ⊕ is a XOR operator,
• execute an encryption round applied to two first data dependent on the input data block, by means of the first masked round key kr′ so as to produce two second data Lrbr, Rrbr,
• after producing the first masked key kr′, generate a second round key kr+1 dependent on the secret key,
• calculate a second masked key kr+1′ from the second round key kr+1 and the second mask (−br+1) as follows:
• k′r+1=kr+1⊕(−br+1)
• calculate two third data Lrbr+1, Rrbr+1 as follows
• Rrbr+1=Rrbr⊕(−br−1)⊕(−br)
• Lrbr+1=Lrbr⊕(−br−1)⊕(−br)
• execute a following encryption round applied to the two third data Lrbr+1, Rrbr+1 by means of the second masked round key (kr+1′) so as to produce two fourth data, generate an output data block dependent on the two fourth data, and store the output data block in a memory.