Substitution table masking for cryptographic processes

A computing device-implemented method for executing a round of a substitution table-based cryptographic operation applying n input components of length equal to the length of entries of n substitution tables to produce a round output, the n substitution tables generated in the round by successively applying entry-wise rotations of an initial substitution table, the method comprising

• a processor of the computing device:
• storing in a memory of the computing device a set of n masked substitution tables, each ith one of the n masked substitution tables corresponding to an ith one of the n input components, each entry of each one of the n masked substitution tables comprising corresponding entry from one of the n substitution tables masked, via a bitwise logical inequality operation, with a first mask of the same length as the substitution table entries, the first mask comprising n first mask components of equal length, and wherein a result of a bitwise logical inequality operation combining the n first mask components equals zero,
• such that each entry of each one of the set of n masked substitution tables is stored as a unique one of n arrangements of the n masked substitution table entry components of a corresponding entry of the substitution table thus masked, such that in the n arrangements each of the n masked substitution table entry components occurs in each of n positions exactly once, and such that an ith one of the n arrangements corresponds to an ith one of the n input components;
• and
• for each ith one of the n input components, obtaining the interim masked substitution table value corresponding to the ith input component from the ith one of the set of n masked substitution tables.

A computing device-implemented method for executing a round of a substitution table-based cryptographic operation applying n input components of length equal to the length of entries of n substitution tables to produce a round output, the method comprising

• a processor of the computing device:
• for each input component of the n input components, obtaining a masked substitution table value corresponding to that input component from a corresponding entry in a respective one of n masked substitution tables;
• to generate n interim masked substitution tale outputs, wherein the n masked substitution tables each comprise a unique one of the n substitution tables masked, via a bitwise logical inequality operation, with a unique one of n masks, the n masks being defined as having a unique combination of the n first mask components, such that the result of a bitwise logical inequality operation combining the n masks equals zero;
• and,
• combining the n interim masked substitution table outputs to produce the round output.

A non-transitory computer readable medium storing computer readable instructions executable by a processor of a computing device for causing said computing device to:

• store a set of n masked substitution tables, each ith one of the n masked substitution tables corresponding to an ith one of n input components of equal length, each entry of each one of the n masked substitution tables comprising a plurality of n masked substitution table entry components of equal length, each of said n masked substitution table entry components comprising a corresponding entry from a substitution table comprising a set of entries each of length equal to the length of each of the n input components, the substitution table being masked, via a bitwise logical inequality operation, with a first mask of the same length as each substitution table entry, the first mask comprising a plurality of first mask components of equal length such that a result of a bitwise logical inequality operation on the first mask components equals zero,
• such that each entry of each one of the set of n masked substitution tables is stored as a unique one of n arrangements of the n masked substitution table entry components of a corresponding entry of the substitution table thus masked, such that in the n arrangements each of the n masked substitution table entry components occurs in each of n positions exactly once, and such that an ith one of the n arrangements corresponds to an ith one of the n input components;
• and
• for each ith one of the n input components, obtaining an interim masked substitution table value corresponding to the ith input component from the ith one of the set of n masked substitution tables.

A computing device comprising:

• a memory for storing a set of n masked substitution tables, each ith one of the n masked substitution tables corresponding to an ith one of n input components of equal length, each entry of each one of the n masked substitution tables comprising a plurality of n masked substitution table entry components of equal length, each of said n masked substitution table entry components comprising a corresponding entry from a substitution table comprising a set of entries each of length equal to the length of each of the n input components, the substitution table being masked, via a bitwise logical inequality operation, with a first mask of the same length as each substitution table entry, the first mask comprising a plurality of first mask components of equal length such that a result of a bitwise logical inequality operation on the first mask components equals zero,
• such that each entry of each one of the set of n masked substitution tables is stored as a unique one of n arrangements of the n masked substitution table entry components of a corresponding entry of the substitution table thus masked, such that in the n arrangements each of the n masked substitution table entry components occurs in each of n positions exactly once, and such that an ith one of the n arrangements corresponds to an ith one of the n input components;
• and
• a processor configured, for each ith one of the n input components, to obtain an interim masked substitution table value corresponding to the ith input component from the ith one of the set of n masked substitution tables.