Microprocessor equipped with an arithmetic and logic unit and with a hardware security module

A microprocessor comprising:

• an arithmetic and logic unit with a hardware security module;
• and
• a plurality of registers, wherein:
• a) the arithmetic and logic unit is capable of executing an arithmetic instruction, comprising an opcode and one or more operands, that, when executed by the arithmetic and logic unit of the microprocessor, causes the arithmetic and logic unit to perform a mathematical operation D1*D2* . . . *Dn and store the result of the mathematical operation in a register Rres-p among the plurality of registers, where:
• the subscript n is equal to the number of data items Di processed by the arithmetic instruction, the subscript n being greater than or equal to one,
• D1 to Dn are data items that are stored in registers R1 to Rn among the plurality of registers, respectively, of the microprocessor, the size, in terms of the number of bits, of each of these data items D;
• being equal to 24, where d is an integer greater than two,
• the registers R1 to Rn are the registers denoted by the operands of the arithmetic instruction,
• the symbol “*” is the arithmetic operation denoted by the opcode of the arithmetic instruction,
• b) the microprocessor is configured to perform the following operations:
• 1) For each data item Di, the hardware security module performs computation of a code Ci using a relationship Ci=Qα(Di) and association of the computed code Ci with the data item Di, the function Q& being a pre-programmed function configured by a secret key α that is pre-stored in the microprocessor and known only to the microprocessor,
• 2) Each time an instruction for loading a data item Di into a register Ri of the microprocessor is executed by the arithmetic and logic unit, the loaded data item Di is stored in the register Ri and the code Ci associated therewith is stored in the same register Ri or in a register associated with the register Ri, then
• 3) Execution, by the arithmetic and logic unit, of the arithmetic instruction and storage of the result Dres-p of this execution in the register Rres-p, and computation, by the hardware security module, of a code Cres-t using the codes C1, C2, . . . , Cn and without using the result Dres-p, then
• 4) Checking, by the hardware security module, that the code Cres-t corresponds to a code Cres-p obtained from the result Dres-p and triggering of the signalling of an execution fault if the code Cres-t does not correspond to the code Cres-p and, otherwise, suppressing this signalling,
• wherein the function Qα is defined by the following relationship:
• Qα(Di)=P o Fα(Di), where P is a predetermined function and Fα is a function defined by the following relationship:
• Fα(Di)=E0 o . . . o Eq o . . . o ENbE-1(Di), where each function Eq is a stage of transpositions and the index q is an order number between zero and NbE-1, where NbE is a whole number greater than one and less than or equal to d, each stage Eq of transpositions being defined by the following relationship:
• Eq (x)=Tαm,q o . . . o Tαj,q o . . . o Tα1,q o Tα0,q(x), where:
• x is a variable whose size, in terms of the number of bits, is equal to the size of the data item Di,
• Tαj,q is a transposition, configured by the parameter αj,q, that permutes two blocks of bits B2j+1,q and B2j,q of the variable x when the parameter αj,q is equal to a first value and that does not permute these two blocks of bits when the parameter αj,q is equal to a second value, the transposition Tαj,q being distinguished from all of the other transpositions of the function Fα by the fact that it is the only one that permutes the two blocks B2j+1,q and B2j,q when the parameter αj,q is equal to the first value, the blocks B2j+1,q and B2j,q of all of the transpositions Tαj,q of the stage Eq being different from one another and not overlapping in such a way that all of the transpositions Tαj,q of the stage Eq can be executed in parallel,
• “j” is an order number identifying the transposition Tαj,q among the other transpositions of the stage Eq,
• the symbol “o” denotes the function-composition operation,
• the concatenation of the bits of all of the parameters αj,q of all of the stages Eq is equal to the value of the secret key α, and
• for all of the stages Eq for which q is less than NbE-1 and for all of the transpositions Tαj,q of this stage, the blocks B2j+1,q and B2j,q are placed within one and the same block of greater size permuted by a transposition of the higher stage Eq+1 when the parameter of the transposition of the higher stage Eq+1 is equal to the first value.