# US 2014/0153725 A1 · Low-power encryption apparatus and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0153725 A1
- Document ID: US20140153725A1
- Status: Published application
- Kind: A1
- Application number: 13/930,860
- Filed: 2013-06-28
- Published: 2014-06-05
- Earliest claimed: 2012-11-30
- Assignees: Electronics and Telecommunications Research Institute
- Applicants: Electronics and Telecommunications Research Institute
- Inventors: Jun-Ki KANG; Sang-Han LEE; Bong-Soo LEE; Seok RYU; Jung-Chul AHN; Jung-Gil PARK
- Web page: https://patentgrep.com/patent/US20140153725A1

## CPC

- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00)
- H04L 9/003: {for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]}
- H04L 2209/04: Masking or blinding
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY

## Abstract

A low-power encryption apparatus and method are provided. The low-power encryption apparatus includes a mask value generation unit, a mask value application unit, a round key application unit, a mask operation unit, a shift operation unit, and a shift operation correction unit. The mask value generation unit generates a mask value M having the same bit length as input round function values. The mask value application unit generates first masking round function values by applying the mask value M. The round key application unit generates second masking round function values by applying round key values. The mask operation unit generates third masking round function values by performing a mask addition operation. The shill operation unit generates fourth masking round function values by performing a circular shift operation. The shift operation correction unit generates output round function values by performing an operation using the mask value M.

## Claims

### Claim 1

A low-power encryption apparatus comprising:
a mask value generation unit configured to generate a mask value M having a bit length identical to that of input round function values;
a mask value application unit configured to generate first masking round function values by applying the mask value M to each of the input round function values;
a round key application unit configured to generate second masking round function values by applying round key values to the first round function values;
a mask operation unit configured to generate third masking round function values by performing a mask addition operation on the second masking round function values;
a shift operation unit configured to generate fourth masking round function values by performing a circular shift operation on the third masking round function values; and
a shift operation correction unit configured to generate output round function values by performing an operation using the mask value M on the fourth masking round function values.

### Claim 2 (depends on 1)

The low-power encryption apparatus of claim 1, wherein the input round function values are an input round function value Xi[0], an input round function value Xi[1], an input round function value Xi[2], and an input round function value Xi[3].

### Claim 3 (depends on 2)

The low-power encryption apparatus of claim 2, wherein the mask value application unit:
generates a first masking round function value Xi—1[0] from the input round function value Xi[0] and the mask value M based on an equation “Xi—1[0]=Xi[0]⊕M”;
generates a first masking round function value Xi—1[1] from the input round function value Xi[1] and the mask value M based on an equation “Xi—1[1]=Xi[1]⊕M”;
generates a first masking round function value Xi—1[2] from the input round function value Xi[2] and the mask value M based on an equation “Xi—1[2]=Xi[2]⊕M”; and
generates a first masking round function value Xi—1[3] from the input round function value Xi[3] and the mask value M based on an equation “Xi—1[3]=Xi[3]⊕M”;
wherein ⊕ is an exclusive OR (XOR) operator.

### Claim 4 (depends on 3)

The low-power encryption apparatus of claim 3, wherein the round key values are a round key value RKi[0], a round key value RKi[1], a round key value RKi[2], a round key value RKi[3], a round key value RKi[4], and a round key value RKi[5].

### Claim 5 (depends on 4)

The low-power encryption apparatus of claim 4, wherein the round key application unit:
generates a second masking round function value Xi—2[0] from the first masking round function value Xi—1[0] and the round key value RKi[0] based on an equation “Xi—2[0]=Xi—1[0]⊕RKi[0]”;
generates a second masking round function value Xi—2—1[1] from the first masking round function value Xi—1[1] and the round key value RKi[1] based on an equation “Xi—2—1[1]=Xi—1[1]⊕RKi[1]”;
generates a second masking round function value Xi—2—2[1] from the first masking round function value Xi—1[1] and the round key value RKi[2] based on an equation “Xi—2—2[1]=Xi—1[1]⊕RKi[2]”;
generates a second masking round function value Xi—2—1[2] from the first masking round function value Xi—1[2] and the round key value RKi[3] based on an equation “Xi—2—1[2]=Xi—1[2]⊕RKi[3]”;
generates a second masking round function value Xi—2—2[2] from the first masking round function value Xi—1[2] and the round key value RKi[4] based on an equation “Xi—2—2[2]=Xi—1[2]⊕RKi[4]”; and
generates a second masking round function value Xi—2[3] from the first masking round function value Xi—1[3] and the round key value RKi[5] based on an equation “Xi—2[3]=Xi—1[3]⊕RKi[5].”

### Claim 6 (depends on 5)

The low-power encryption apparatus of claim 5, wherein the mask operation unit:
generates a third masking round function value Xi—3[1] performing the mask addition operation, satisfying an equation “(A⊕M)⊙(B⊕M)=(A+B)⊕M,” on the second masking round function value Xi—2[0] and the second masking round function value Xi—2—1[1];
generates a third masking round function value Xi—3[2] by performing the mask addition operation on the second masking round function value Xi—2—2[2] and the second masking round function value Xi—2—2[2] ; and
generates a third masking round function value Xi—3[3] by performing the mask addition operation on the second masking round function value Xi—2—2[2] and the second masking round function value Xi—2[3];
wherein ⊙ is a mask addition operator, and each of A⊕M and B⊕M is a second masking round function value to which the mask value M has been applied.

### Claim 7 (depends on 6)

The low-power encryption apparatus of claim 6, wherein the shift operation unit:
generates a fourth masking round function value Xi—4[1] from the third masking round function value Xi—3[1] based on an equation “Xi—4[1]=ROL9(Xi—3[1])”;
generates a fourth masking round function value Xi—4[2] from the third masking round function value Xi—3[2] based on an equation “Xi—4[2]=ROR5(Xi—3[2])”; and
generates a fourth masking round function value Xi—4[3] from the third masking round function value Xi—3[3] based on an equation “Xi—4[3]=ROR3(Xi—3[3])”;
wherein ROLa(x) is a function that circularly shifts “x” to a left by “a” bits and then outputs a result, and RORa(x) is a function that circularly shifts “x” to a right by “a” bits and then outputs a result.

### Claim 8 (depends on 7)

The low-power encryption apparatus of claim 7, wherein the shift operation correction unit:
generates an output round function value Xi+1[0] from the fourth masking round function value Xi—4[1] and the mask value M based on an equation “Xi+1[0]=X1—4[1]⊕{M⊕ROL9(M)}”,
generates an output round function value Xi+1[1] from the fourth masking round function value Xi—4[2] and the mask value M based on an equation “Xi+1[1]=Xi—4[2]⊕{M⊕ROR5(M)}”;
generates an output round function value Xi+1[2] from the fourth masking round function value Xi—4[3] and the mask value M based on an equation “Xi+1[2]=Xi—4[3]⊕{M⊕ROR3(M)}”; and
generates an output round function value Xi+1[3] from the first masking round function value Xi—1[0] based on an equation “Xi+1[3]=Xi—1[0].”

### Claim 9

A low-power encryption method comprising:
generating a mask value M having a hit length identical to that of input round function values;
generating first masking round function values by applying the mask value M to each of the input round function values;
generating second masking round function values by applying round key values to the first round function values;
generating third masking round function values by performing a mask addition operation on the second masking round function values;
generating fourth masking round function values by performing a circular shift operation on the third masking round function values; and
generating output round function values by performing an operation using the mask value M on the fourth masking round function values.

### Claim 10 (depends on 9)

The low-power encryption method of claim 9, wherein the input round function values are an input round function value Xi[0], an input round function value Xi[1], an input round function value Xi[2], and an input round function value Xi[3].

### Claim 11 (depends on 10)

The low-power encryption method of claim 10, wherein generating the first masking round function values includes:
generating a first masking round function value Xi—1[0] from the input round function value Xi[0] and the mask value M based on an equation “Xi—1[0]=Xi[0]⊕M”;
generating a first masking round function value Xi—1[1] from the input round function value Xi[1] and the mask value M based on an equation “Xi—1[1]=Xi[1]⊕M”;
generating a first masking round function value Xi—1[2] from the input round function value Xi[2] and the mask value M based on an equation “Xi—1[2]=Xi[2]⊕M”; and
generating a first masking round function value Xi—1[3] from the input round function value Xi[3] and the mask value M based on an equation “Xi—1[3]=Xi[3]⊕M”;
wherein ⊕ is an XOR operator.

### Claim 12 (depends on 11)

The low-power encryption method of claim 11, wherein the round key values are a round key value RKi[0], a round key value RKi[1], a round key value RKi[2], a round key value RKi[3], a round key value RKi[4], and a round key value RKi[5].

### Claim 13 (depends on 12)

The low-power encryption method of claim 12, wherein generating the second masking round function values includes:
generating a second masking round function value Xi—2[0] from the first masking round function value Xi—1[0] and the round key value RKi[0] based on an equation “Xi—2[0]=Xi—1[0]⊕RKi[0]”;
generating a second masking round function value Xi—2—1[1] from the first masking round function value Xi—1[1] and the round key value RKi[1] based on an equation “Xi—2—1[1]=Xi—1[1]⊕RKi[1]”;
generating a second masking round function value Xi—2—2[1] from the first masking round function value Xi—1[1] and the round key value RKi[2] based on an equation “Xi—2—2[1]=Xi—1[1]⊕RKi[2]”;
generating a second masking round function value Xi—2—2[2] from the first masking round function value Xi—1[2] and the round key value RKi[3] based on an equation “Xi—2—1[2]=Xi—1[2]⊕RKi[3]”;
generating a second masking round function value Xi—2—2[2] from the first masking round function value Xi—1[2] and the round key value RKi[4] based on an equation “Xi—2—2[2]=Xi—1[2]⊕RKi[4]”; and
generating a second masking round function value Xi—2[3] from the first masking round function value Xi—1[3] and the round key value RKi[5] based on an equation “Xi—2[3]=Xi—1[3]⊕RKi[5].”

### Claim 14 (depends on 13)

The low-power encryption method of claim 13, wherein generating the third masking round function values includes:
generating a third masking round function value Xi—3[1] by performing the mask addition operation, satisfying an equation “(A⊕M)⊙(B⊕M)=(A+B)⊕M,” on the second masking round function value Xi—2[0] and the second masking round function value Xi—2—1[1];
generating a third masking round function value Xi—3[2] by performing the mask addition operation on the second masking round function value Xi—2—2[1] and the second masking round function value Xi—2—1[2]; and
generating a third masking round function value Xi—3[3] by performing the mask addition operation on the second masking round function value Xi—2—2[2] and the second masking round function value Xi—2[3];
wherein ⊙ is a mask addition operator, and each of A⊕M and B⊕M is a second masking round function value to which the mask value M has been applied.

### Claim 15 (depends on 14)

The low-power encryption method of claim 14, wherein generating the fourth masking round function values includes:
generating a fourth masking round function value Xi—4[1] from the third masking round function value Xi—3[1] based on an equation “Xi—4[1]=ROL9(Xi—3[1])”;
generating a fourth masking round function value Xi—4[2] from the third masking round function value Xi—3[2] based on an equation “Xi—4[2]=ROR5(Xi—3[2])”; and
generating a fourth masking round function value Xi—4[3] from the third masking round function value Xi—3[3] based on an equation “Xi—4[3]=ROR3(Xi—3[3])”;
wherein ROLa(x) is a function that circularly shifts “x” to a left by “a” bits and then outputs a result, and RORa(x) is a function that circularly shifts “x” to a right by “a” bits and then outputs a result.

### Claim 16 (depends on 15)

The low-power encryption method of claim 15, wherein generating the output round function values includes:
generating an output round function value Xi+1[0] from the fourth masking round function value Xi—4[1] and the mask value M based on an equation “Xi+1[0]=Xi—4[1]⊕{M⊕ROL9(M)}”;
generating an output round function value Xi+1[1] from the fourth masking round function value Xi—4[2] and the mask value M based on an equation “Xi+1[1]=Xi—4[2]⊕{M⊕ROR5(M)}”;
generating an output round function value Xi+1[2] from the fourth masking round function value Xi—4[3] and the mask value M based on an equation “Xi+1[2]=Xi—4[3]⊕{M⊕ROR3(M)}”; and
generating an output round function value Xi+1[3] from the first masking round function value Xi—1[0] based on an equation “Xi+1[3]=Xi—1[0].”