Hardened White Box Implementation

A processor device having an executable white-box-masked implementation of a cryptographic algorithm implemented thereon, which is configured to generate an output text from an input text while employing a secret key K, wherein the implementation comprises an implemented computation step S by which input values x are mapped to output values s=S[x], and which is masked to a white-box-masked computation step T′ by means of an invertible function f, by which output values w of f are formed, wherein

• a) as a mapping f, a combination (f=(c1, c2, . . . )*A) is provided of an affine mapping A having an entry width BA and a number of one or several invertible mappings c1, c2, . . . having an entry width Bc1, Bc2, . . . respectively, wherein BA=Bc1+Bc2+ . . . , wherein through the mapping f output values w are generated;
• b) the affine mapping A is configured to be applied to output values s of the computation step S and additionally to one or several obfuscation values y which are statistically independent of the output values s of the computation step S, according to a=A(S[x], y)=A(s, y);
• c) the one or several invertible mappings c1, c2, . . . are configured to map output values a of the affine mapping A to output values w of the mapping f, according to w=(c1, c2, . . . )(A (s,y));
• d) the affine mapping A is constructed by a construction method coordinated with the invertible mappings c1, c2, . . . , wherein:
• d1) the output values a of the affine mapping A are represented as a concatenation of output-value parts a=a1|a2 . . . and the output values w of the mapping f are represented as a concatenation of output-value parts w=w1|w2 . . . , wherein output-value parts a1, a2, . . . and w1, w2, . . . respectively have the same entry width Bc1, Bc2, . . . as the invertible mappings c1, c2, . . . ;
• d2) an input value x=xi is set;
• and
• d3) the affine mapping A is selected or formed such that—for fixed input value xi—by applying A on s=S [xi] with all possible obfuscation values y, all possible output-value parts a1 or/and all possible output-value parts
• a2, . . . of the affine mapping A are generated, namely for at least one individual output-value part a1, a2, . . . or for each individual output-value part a1, a2, . . . .