Method for calculating a transition from a boolean masking to an arithmetic masking

A method for intrusion-resistant re-masking of a value x to be kept secret from a first masking to a second masking, by carrying out a plurality of successive calculation steps, wherein the secret value x:

• exists in the first masking, before the execution of the plurality of calculation arithmetic steps, as a first representation xs masked with a first mask s according to a Boolean masking rule xs=x XOR s mod 2n, where 2n is the modulus of the first masking rule, where n is an integer, and
• in the second masking, after the execution of the plurality of consecutive calculation steps, exists as a second representation xr masked according to an arithmetic masking rule with a second mask r,
• wherein:
• xr=(x+r) mod (2m*p) or xr=(x−r) mod (2m*p), where (2m*p) is the modulus of the second masking rule and m is an integer greater than or equal to zero, where p has at least one prime divisor unequal to 2;
• and
• during the re-masking, at least one arithmetic calculation step is carried out, in which a carry c1 is generated over 2n, the carry c1 being protected against intrusion attacks by masking or balancing the carry c1 by means of a random information item pm, and in a subsequent calculation step in which the carry c1 is intended for use, the masked carry C_pm or the balanced car-ry C is used instead of the carry.