Protection of a cipher algorithm

A device, comprising:

• hardware data processing circuitry;
• and
• software data processing circuitry coupled to the hardware data processing circuitry, wherein the device, in operation:
• executes a plurality of rounds of a symmetrical data cipher algorithm;
• and
• protects the execution of the plurality of rounds of the symmetrical data cipher algorithm against attacks during the execution of the plurality of rounds, wherein the protecting includes:
• executing data masking and unmasking operations using the hardware data processing circuitry;
• executing linear operations applied to data using the software data processing circuitry;
• executing linear operations applied to masks using the hardware data processing circuitry;
• and
• executing non-linear operations applied to data during rounds of the plurality of rounds using one of the hardware data processing circuitry or the software data processing circuitry, wherein each non-linear operation of the non-linear operations applied to data during a current round of the plurality of rounds is preceded in the current round by a mask refreshment operation implemented using one or more lookup tables.

A system, comprising:

• an application processor;
• and
• cryptographic circuitry coupled to the application processor and including hardware processing circuitry and software processing circuitry, wherein the cryptographic circuitry, in operation:
• executes a plurality of rounds of a symmetrical data cipher algorithm;
• and
• protects the execution of the plurality of rounds of the symmetrical data cipher algorithm against software attacks during the execution of the plurality of rounds, wherein the protecting includes:
• executing data masking and unmasking operations using the hardware processing circuitry;
• executing linear operations applied to data using the software processing circuitry;
• executing linear operations applied to masks using the hardware processing circuitry;
• and
• executing non-linear operations applied to data during rounds of the plurality of rounds using one of the hardware processing circuitry or the software processing circuitry, wherein each non-linear operation of the non-linear operations applied to data during a current round of the plurality of rounds is preceded in the current round by a mask refreshment operation implemented using one or more lookup tables.