Device and method to compute a block cipher
AssigneeKoninklijke Philips N.V.
InventorsRONALD RIETMAN, MAARTEN PETER BODLAENDER, SEBASTIAAN JACOBUS ANTONIUS DE HOOGH
Life of this patent
Estimating the term…
Abstract
Some embodiments are directed to a cryptographic device (100) arranged to compute a block cipher on an input message (110). The device computes a plurality of intermediate block cipher results by computing and re-computing a first intermediate block cipher result (151) of the plurality of intermediate block cipher results by applying the plurality of block cipher rounds sequentially to the input message followed by one or more additional block cipher rounds. A plurality of averaging functions are applied to the plurality of intermediate block cipher results, the results of which are added, after which the inverse of the one or more additional block cipher rounds is applied.
Claims12
A cryptographic device arranged to compute a block cipher on an input message, the block cipher comprising a plurality block cipher rounds (R0, . . . , R9), the device comprising
- an input interface configured to receive an input message,
- a processor circuit configured to
- compute a plurality of intermediate block cipher results by
- computing a first intermediate block cipher result of the plurality of intermediate block cipher results by applying the plurality of block cipher rounds (R0, . . . , R9) sequentially to the input message followed by one or more additional block cipher rounds (R10;
- R10, . . . , R12), and
- computing further intermediate block cipher results of the plurality of intermediate block cipher results by re-computing at least one of the final block cipher rounds of the plurality block cipher rounds (R7, R8, R9) followed by the one or more additional block cipher rounds (R10;
- R10 . . . , R12),
- apply a plurality of averaging functions (T0, T1) to the plurality of intermediate block cipher results, the plurality of averaging functions having been selected so that their function-sum equals the identity function,
- add the results of the plurality of averaging functions, and
- apply the inverse of the one or more additional block cipher rounds, a block cipher result being obtained from the result of said inverse.
A cryptographic method arranged to compute a block cipher on an input message, the block cipher comprising a plurality block cipher rounds (R0, . . . , R9), the method comprising
- receiving an input message,
- computing a plurality of intermediate block cipher results by
- computing a first intermediate block cipher result of the plurality of intermediate block cipher results by applying the plurality of block cipher rounds (R0, . . . , R9) sequentially to the input message followed by one or more additional block cipher rounds (R10;
- R10, . . . , R12), and
- computing further intermediate block cipher results of the plurality of intermediate block cipher results by re-computing at least one of the final block cipher rounds of the plurality block cipher rounds (R7, R8, R9) followed by the one or more additional block cipher rounds (R10;
- R10, . . . , R12),
- apply a plurality of averaging functions (T0, T1) to the plurality of intermediate block cipher results, the plurality of averaging functions having been selected so that their function-sum equals the identity function,
- add the results of the plurality of averaging functions, and
- apply the inverse of the one or more additional block cipher rounds, a block cipher result being obtained from the result of said inverse.
Dependencies are inferred from the claim text.