Method secured against side-channel attacks performing an arithmetic operation of a cryptographic algorithm mixing Boolean and arithmetic operations

A non-transitory computer readable medium storing executable computer code that when executed by a cryptographic device (101) comprising a processing system (201) having at least one hardware processor performs an operation that has a first value (x) and a second value (y) as operands, wherein computing steps performed by said hardware processor being a mix of Boolean and arithmetic operations between said first value (x) and said second value (y) are performed without directly operating on the first value (x) and the second value (y) and therefore not being susceptible to revealing information concerning the first value (x) or the second value (y), instructions causing the hardware processor to perform the steps:

• obtaining (S1) a first masked value (x′), a second masked value (y′), a first Boolean mask (rx), a second Boolean mask (ry),
• said first masked value (x′) resulting from masking said first value (x) by said first Boolean mask (rx) by performing a Boolean exclusive OR (XOR) operation between said first value (x) and said first Boolean mask (rx),
• and said second masked value (y′) resulting from masking said second value (y) by said second Boolean mask (ry) by performing a Boolean exclusive OR (XOR) operation between said second value (y) and said second Boolean mask (ry),
• performing (S2) in any order a plurality of computing steps combining values among said first masked value (x′), said second masked value (y′), said first Boolean mask (rx) and said second Boolean mask (ry) to obtain a boolean masked result equal to the result of the arithmetic operation having said first value (x) and said second value (y) as operands, masked by a third boolean mask (rx xor ry) resulting from performing said Boolean exclusive OR (XOR) operation between said first Boolean mask (rx) and said second Boolean mask (ry) ((x+y) xor (rx xor ry)),
• wherein said computing steps comprise a constant number of elementary operations whatever the bit-size of said first and second values,
• outputting (S3) said boolean masked result of the arithmetic operation between said first value (x) and said second value (y).

Cryptographic device (101) comprising:

• a processing system (201) having at least one hardware processor configured to perform an operation that has a first value (x) and a second value (y) as operands, wherein computing steps performed by said hardware processor being a mix of Boolean and arithmetic operations between said first value (x) and said second value (y) are performed without directly operating on the first value (x) and the second value (y) and therefore not being susceptible to revealing information concerning the first value (x) or the second value (y), wherein the hardware processor is configured to perform the steps of:
• obtaining (S1) a first masked value (x′), a second masked value (y′), a first Boolean mask (rx), a second Boolean mask (ry),
• said first masked value (x′) resulting from masking said first value (x) by said first Boolean mask (rx) by performing a Boolean exclusive OR (XOR) operation between said first value (x) and said first Boolean mask (rx),
• and said second masked value (y′) resulting from masking said second value (y) by said second Boolean mask (ry) by performing a Boolean exclusive OR (XOR) operation between said second value (y) and said second Boolean mask (ry),
• performing (S2) in any order a plurality of computing steps combining values among said first masked value (x′), said second masked value (y′), said first Boolean mask (rx) and said second Boolean mask (ry) to obtain a boolean masked result equal to the result of the arithmetic operation having said first value (x) and said second value (y) as operands, masked by a third boolean mask (rx xor ry) resulting from performing said Boolean exclusive OR (XOR) operation between said first Boolean mask (rx) and said second Boolean mask (ry) ((x+y) xor (rx xor ry)),
• wherein said computing steps comprise a constant number of elementary operations whatever the bit-size of said first and second values,
• outputting (S3) said boolean masked result of the arithmetic operation between said first value (x) and said second value (y);
• and
• at least one memory (203, 204, 205) for storing the first and second masked values and the results of the calculations performed during the different computing steps.