Encryption and decryption engines with hybrid masking to prevent side channel attacks

A system on a chip (SoC) comprising:

• a security processor comprising first processing circuitry configured to:
• form a Boolean mask,
• perform a shift operation on the Boolean mask to obtain a shifted-row Boolean mask, and
• add the shifted-row Boolean mask to input data to form Boolean-masked input data;
• and
• an encryption engine comprising second processing circuitry configured to:
• apply a shift rows operation to the Boolean-masked input data to form byte-aligned Boolean-masked input data,
• apply a product of the Boolean mask and a multiplicative mask to the byte-aligned Boolean-masked input data to form multiplicatively masked input data,
• perform a byte substitution operation on the multiplicatively masked input data at least in part by applying a product of the Boolean mask and an inverse of the multiplicative mask to the multiplicatively masked input data to form Boolean-masked intermediate data, and
• apply mix columns logic to the Boolean-masked intermediate data to form byte-shifted Boolean-masked cipher text.

An artificial reality system comprising:

• a security processor configured to:
• form a Boolean mask,
• perform a shift operation on the Boolean mask to obtain a shifted-row Boolean mask, and
• add the shifted-row Boolean mask to cipher text to form Boolean-masked cipher text;
• and
• a decryption engine configured to:
• apply a shift rows operation to the Boolean-masked cipher text to form byte-aligned Boolean-masked cipher text,
• apply a product of the Boolean mask and a multiplicative mask to the byte-aligned Boolean-masked cipher text to form multiplicatively masked cipher text,
• perform an inverse byte substitution operation on the multiplicatively masked cipher text at least in part by applying a product of the Boolean mask and an inverse of the multiplicative mask to the multiplicatively masked cipher text to form Boolean-masked intermediate data, and
• apply mix columns logic to the Boolean-masked intermediate data to form byte-shifted Boolean-masked output data;
• and
• a head-mounted device (HMD) configured to output artificial reality content including unmasked decrypted data formed from the byte-shifted Boolean-masked output data.

An artificial reality system comprising:

• a peripheral device configured to receive input data;
• a security processor configured to:
• form a Boolean mask,
• perform a shift operation on the Boolean mask to obtain a shifted-row Boolean mask, and
• add the shifted-row Boolean mask to the input data to form Boolean-masked input data;
• and
• an encryption engine configured to:
• apply a shift rows operation to the Boolean-masked input data to form byte-aligned Boolean-masked input data,
• apply a product of the Boolean mask and a multiplicative mask to the byte-aligned Boolean-masked input data to form multiplicatively masked input data,
• perform a byte substitution operation on the multiplicatively masked input data at least in part by applying a product of the Boolean mask and an inverse of the multiplicative mask to the multiplicatively masked input data to form Boolean-masked intermediate data, and
• apply mix columns logic to the Boolean-masked intermediate data to form byte-shifted Boolean-masked cipher text.