# US 2013/0156180 A1 · Method And Device For Securing Block Ciphers Against Template Attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2013/0156180 A1
- Document ID: US20130156180A1
- Status: Published application
- Kind: A1
- Application number: 13/711,724
- Filed: 2012-12-12
- Published: 2013-06-20
- Earliest claimed: 2011-12-14
- Assignees: Siemens Aktiengesellschaft
- Inventors: Erwin Hess
- Web page: https://patentgrep.com/patent/US20130156180A1

## CPC

- G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00)
- H04L 9/003: {for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]}
- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 2209/08: Randomization, e.g. dummy operations or using noise
- G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for securing a block cipher F, encrypted with a working key K0, against template attacks is provided. A working permutation F(K0) fixed by the block cipher F and the working key K0, and a number N of dummy permutations G(K1), . . . , G(Kn) are provided. The N dummy permutations G(K1), . . . , G(Kn) are fixed by N dummy keys K1, . . . , Kn and the block cipher F or the inverse F−1 of the block cipher F. The working permutation F(K0) and the N dummy permutations G(K1), . . . , (G(Kn) are chained to form a chain H in such a way that the chain H and the working permutation F(K0) produce an identical image (H=F(K0)). A block cipher F, in which a fixed key K0 is used, is protected against template attacks as a result. A computer program product and a device for securing a block cipher F against template attacks are also proposed.

## Claims

### Claim 1

A method for securing a block cipher (F), encrypted with a working key (K0), against template attacks, the method comprising:
a) providing a working permutation (F(K0)) fixed by the block cipher (F) and the working key (K0),
b) providing a number N of dummy permutations (G(K1), . . . , (G(Kn)) that are fixed by N dummy keys (K1, . . . , Kn) and the block cipher (F) or an inverse (F−1) of the block cipher (F), and
c) chaining the working permutation (F(K0)) and the dummy permutations (G(K1), . . . , (G(Kn)) to form a chain such that the chain and the working permutation (F(K0)) produce an identical image.

### Claim 2 (depends on 1)

The method of claim 1, wherein the number N of dummy permutations (G(K1), . . . , (G(Kn)) is provided such that each chain of N dummy permutations (G(K1), . . . , G(Kn)) produces a pre-image set of the block cipher (F).

### Claim 3 (depends on 2)

The method of claim 2, wherein the chain of N dummy permutations is achieved by a first model having (g1 o g1−1) o (g2 o g2−1) o . . . o (gn o gn−1), where gi=G(Ki), wherein G designates the block cipher (F) or the inverse (F−1) of the block cipher, and wherein Ki, where iε[1, . . . , n], designates the N dummy keys (K1, . . . , Kn).

### Claim 4 (depends on 2)

The method of claim 2, wherein the chain of N dummy permutations is achieved by a second model having (g1 o g2 o . . . o gn) o (gn−1 o . . . o g2−1 o g1−1), where gi=G(Ki), wherein G designates the block cipher (F) or the inverse (F−1) of the block cipher, and wherein Ki, where iε[1, . . . , n], designates the N dummy keys (K1, . . . , Kn).

### Claim 5 (depends on 2)

The method of claim 2, wherein the chain of N dummy permutations is achieved by a third model having (g1 o g2 o g3−1) o (g3 o g2−1 o g1−) o (g4 o g5 o g6−1) o (g6 o g5−1 o g4−1) o . . . , where gi=G(Ki), wherein G designates the block cipher (F) or the inverse (F−1) of the block cipher, and wherein Ki, where i ε[1, . . . , n], designates the N dummy keys (K1, . . . , Kn).

### Claim 6 (depends on 5)

The method of claim 5, wherein an implementation of a triple DES encryption is secured using the third model.

### Claim 7 (depends on 1)

The method of claim 1, wherein the N dummy keys (K1, . . . , Kn) are permutated before each application of steps a) to c).

### Claim 8 (depends on 1)

The method of claim 1, wherein the N dummy keys (K1, . . . , Kn) are re-formed before each application of steps a) to c).

### Claim 9 (depends on 1)

The method of claim 1, wherein the working key (K0) is permanently allocated to the block cipher (F).

### Claim 10

A computer program product for securing a block cipher (F), encrypted with a working key (K0), against template attacks, the computer program product being embodied in non-transitory computer readable media and executable by a processor to: provide a working permutation (F(K0)) fixed by the block cipher (F) and the working key (Kd0),
provide a number N of dummy permutations (G(K1), . . . , (G(Kn)) that are fixed by N dummy keys (K1, . . . , Kn) and the block cipher (F) or an inverse (F−1) of the block cipher (F), and
chain the working permutation (F(K0)) and the dummy permutations (G(K1), . . . , (G(Kn)) to form a chain such that the chain and the working permutation (F(K0)) produce an identical image.

### Claim 11 (depends on 10)

The computer program product of claim 10, wherein the number N of dummy permutations (G(K1), . . . , (G (Kn)) is provided such that each chain of N dummy permutations (G(K1), . . . , G(Kn)) produces a pre-image set of the block cipher (F).

### Claim 12 (depends on 11)

The computer program product of claim 11, wherein the chain of N dummy permutations is achieved by a first model having (g1 o g1−1) o (g2 o g2−1) o . . . o (gn o gn−1), where gi=G(Ki), wherein G designates the block cipher (F) or the inverse (F−1) of the block cipher, and wherein Ki, where iε[1, . . . , n], designates the N dummy keys (K1, . . . , Kn).

### Claim 13 (depends on 11)

The computer program product of claim 11, wherein the chain of N dummy permutations is achieved by a second model having (g1 o g2 o . . . o gn) o (gn−1 o . . . o g2−1 o g1−1), where gi=G(Ki), wherein G designates the block cipher (F) or the inverse (F−1) of the block cipher, and wherein Ki, where iε[1, . . . , n], designates the N dummy keys (K1, . . . , Kn).

### Claim 14 (depends on 11)

The computer program product of claim 11, wherein the chain of N dummy permutations is achieved by a third model having (g2 o g2 o g3−1) o (g3 o g2−1 o g1−1) o (g4 o g5 o g6−1) o (g6 o g5−1 o g4−1) o . . . , where gi=G(Ki), wherein G designates the block cipher (F) or the inverse (F−1) of the block cipher, and wherein Ki, where iε[1, n], designates the N dummy keys (K1, . . . , Kn).

### Claim 15 (depends on 14)

The computer program product of claim 14, wherein an implementation of a triple DES encryption is secured using the third model.

### Claim 16 (depends on 10)

The computer program product of claim 10, wherein the N dummy keys (K1, . . . , Kn) are permutated before each application of steps a) to c).

### Claim 17 (depends on 10)

The computer program product of claim 10, wherein the N dummy keys (K1, . . . , Kn) are re-formed before each application of steps a) to c).

### Claim 18 (depends on 10)

The computer program product of claim 10, wherein the working key (K0) is permanently allocated to the block cipher (F).