Table masking for resistance to power analysis attacks

A computing device-implemented method to resist power analysis attacks on a computing device by executing cryptographic steps based on a defined cryptographic process, the defined cryptographic process accepting an input, generating an output, and utilizing a plurality of originally-defined substitution tables, the method comprising a processor of the computing device, in communication with a memory, executing the cryptographic steps:

• a) individually generating a random value r[x] for each table address x,
• b) masking a value in each of the plurality of substitution tables, at each address x, with the random value r[x] generated for the address x to define the masked substitution tables,
• c) generating random values r1[x], . . . , rn−1[x] for each address x and defining mask tables M1, . . . , Mn−1 to store, at each address x therein, the respective random values r1[x], . . . , rn−1[x], and
• d) defining a mask table Mn by, for each address x in the mask table Mn, masking a fixed mask value m with the random value r[x] generated for the address x and with each of the random values r1[x], . . . , rn−1[x] stored at the address x in the respective mask tables M1, . . . , Mn−1.

A computing device-implemented method to resist power analysis attacks on a computing device by executing cryptographic steps based on a defined cryptographic process, the defined cryptographic process accepting an input, generating an output, and utilizing a plurality of originally-defined substitution tables, the method comprising a processor of the computing device, in communication with a memory, executing the cryptographic steps:

• i) defining a set of masked substitution tables and a set of corresponding mask tables by;
• (a) individually generating a random value r[x] for each table address x,
• (b) masking a value in each of the plurality of substitution tables, at each address x, with the random value r[x] generated for the address x to define the set of masked substitution tables corresponding to the plurality of substitution tables, and,
• (c) defining a corresponding mask table for the set of masked substitution tables such that a value at each address x in the corresponding mask table, when masked with the random value r[x] generated for the address x, is equal to a fixed mask value m,
• ii) carrying out a first cryptographic operation utilizing the set of masked substitution tables to obtain a first set of values,
• iii) carrying out second cryptographic operation utilizing the corresponding a mask table to obtain a second set of values, and,
• iv) combining the first set of values and the second set of values to provide the masked output value.

A computing-device program product for implementing a method to resist power analysis attacks on a computing device by executing cryptographic steps based on a defined cryptographic process, the defined cryptographic process accepting an input, generating an output, and utilizing a plurality of originally-defined substitution tables, the program product comprising program code embodied in a non-transitory program product storage media for execution by a processor of the device, the program code comprising:

• a) program code operative to generate a random value r[x] for each table address x,
• b) program code operative to define a plurality of masked substitution tables by masking a value in each substitution table, at each address x, with the random value r[x] generated for the address x,
• c) program code operative to generate random values r1[x], . . . , rn−1[x] for each address x and to define masked substitution tables M1, . . . , Mn−1 to store, at each address x, the respective random values r1[x], . . . , rn−1[x], and
• d) program code operative to define a mask table Mn having, for each address x, an entry rn[x] defined by masking a fixed mask value m with the random value r[x] generated for the address x and with each of the random values r1[x], . . . , rn−1[x] stored at the address x in the respective mask tables M1, . . . , Mn−1.

A computing-device program product for implementing a method to resist power analysis attacks on a computing device by executing cryptographic steps based on a defined cryptographic process, the defined cryptographic process accepting an input, generating an output, and utilizing a plurality of originally-defined substitution tables, the program product comprising program code embodied in a non-transitory program product storage media for execution by a processor of the device, the program code comprising program code operative to enable the processor to:

• generate a random value r[x] for each table address;
• define masked substitution tables by masking a value in each substitution table, at each address x, with the random value r[x] generated for the address x;
• define a corresponding mask table such that a value at each address x in the corresponding mask table, when masked with the random value r[x] generated for the address x, is equal to the fixed mask value m;
• and,
• carry out first cryptographic steps utilizing the masked substitution tables to obtain first values and carry out second cryptographic steps utilizing the corresponding mask table to obtain second values, the program code operative to combine the first values and the second values to provide the masked output value.

A computing device for implementing a method to resist power analysis attacks on the computing device by executing cryptographic steps based on a defined cryptographic process, the defined cryptographic process accepting an input, generating an output, and utilizing a plurality of originally-defined substitution tables, the computing device including a processor in communication with a memory for executing the cryptographic operation, the device operative to:

• generate random values,
• store in the memory the masked substitution table for each substitution table, the masked substitution table defined by the processor masking a value in each substitution table, at each address x, with a random value r[x] generated for the address x,
• store in the memory a plurality of corresponding mask tables M1, . . . , Mn−1, the plurality of corresponding mask tables M1, . . . , Mn−1 defined by the processor to store, at each address x therein, respective random values r1[x], . . . , rn−1[x] generated for address x,
• store in the memory a mask table Mn, the mask table Mn defined by the processor to store, for each address x, an entry rn[x] defined by masking a fixed mask value m with the random value r[x] generated for the address x and with each of the random values r1[x], . . . , rn−1[x] stored at the address x in the respective mask tables M1, . . . , Mn−1.

A computing device for implementing a method to resist power analysis attacks on the computing device by executing cryptographic steps based on a defined cryptographic process, the defined cryptographic process accepting an input, generating an output, and utilizing a plurality of originally-defined substitution tables, the computing device including a processor in communication with a memory for executing the cryptographic operation, the device operative to:

• generate random values,
• store in the memory the substitution tables, masked substitution tables and a mask table corresponding to the masked substitution tables;
• the processor defining the masked substitution tables by storing, at each address x in each of the masked substitution tables, the corresponding value from that address x masked with a random value r[x] generated for the address x,
• the processor defining the mask table such that each value at address x in the corresponding mask table, when masked with the value r[x] generated for the address x, is equal to the fixed mask value m, and
• the processor receiving the input value and carrying out a first set of cryptographic steps on the input value using the masked substitution tables to obtain first values, carrying out a second set of cryptographic steps on the input value using the corresponding mask table to obtain second values, and combining the first values and the second values to provide the masked output value.

A computing device for implementing a method to resist power analysis attacks on the computing device by executing cryptographic steps based on a defined cryptographic process, the defined cryptographic process accepting an input, generating an output, and utilizing a plurality of originally-defined substitution tables, the computing device including a processor in communication with a memory for executing the cryptographic operation, the device operative to:

• generate random values,
• store in the memory the substitution tables, masked substitution tables and a plurality of corresponding mask tables;
• the processor defining the masked substitution tables by storing, at each address x in each of the masked substitution tables, the corresponding value from each of the substitution tables masked with a generated random number generated for the address x,
• the processor defining the plurality of corresponding mask tables by, storing a plurality of corresponding mask tables M1, . . . , Mn−1, the plurality of corresponding mask tables M1, . . . , Mn−1 defined to store, at each address x therein, respective random values r1[x], . . . , rn−1[x] generated for address x, and storing a mask table Mn, the mask table Mn defined to store, at each address x, an entry rn[x] defined by masking a fixed mask value m with the random value r[x] generated for the corresponding address x and with each of the random values r1[x], . . . , rn−1[x] stored at the corresponding address x in the respective mask tables M1, . . . , Mn−1, and
• the processor receiving the input value and carrying out a first set of cryptographic steps on the input value using the masked substitution tables to obtain first values, carrying out a second set of cryptographic steps on the input value using the mask tables to obtain second values, and combining the first values and the second values to provide the masked output value.