Protection of a calculation against side-channel attacks

A method, comprising:

• executing a ciphering algorithm including executing looped operations on bits of a first quantity and on a first variable initialized by a second quantity;
• and
• protecting the ciphering algorithm, the protecting including, for each bit of the first quantity, updating a second variable maintained between two thresholds, the updating including adding a random number to a state of the bit of the first quantity, wherein, for each bit of the first quantity, the updating of the second variable includes:
• updating the second variable to a first update value obtained by adding the random number to a value of the second variable and subtracting the state of the bit if the first update value ranges between said two thresholds;
• and
• updating the second variable to a second update value obtained by subtracting the state of the bit from the random number if the first update value does not range between said two thresholds.

A method, comprising:

• executing a ciphering algorithm including executing looped operations on bits of a first quantity and on a first variable initialized by a second quantity;
• protecting the ciphering algorithm, the protecting including, for each bit of the first quantity, updating a second variable maintained between two thresholds, the updating including adding a random number to a state of the bit of the first quantity;
• and
• for each bit of the first quantity, updating the first variable with:
• a result of a first calculation taking into account the second quantity and the random number if the second variable, plus the random number and minus the state of the bit of the first quantity, ranges between said two thresholds;
• and
• a result of a second calculation taking into account the second quantity, the random number, and said second variable if the second variable, plus the random number and minus the state of the bit of the first quantity, does not range between said two thresholds.

A device, comprising:

• one or more memories;
• and
• cryptographic circuitry, which, in operation:
• executes a ciphering algorithm including executing looped operations on bits of a first quantity and on a first variable initialized by a second quantity;
• and
• protects execution of the ciphering algorithm, the protecting including, for each bit of the first quantity, maintaining a second variable between two thresholds during an execution of a looped operation, the maintaining including combining a random number and a state of the bit of the first quantity, wherein the second variable represents a drift introduced by the random number during executions of the looped operations, the first quantity is an encryption key and the cyphering algorithm encrypts the second quantity using the encryption key.

A device, comprising:

• one or more memories;
• and
• cryptographic circuitry, which, in operation:
• executes a ciphering algorithm including executing looped operations on bits of a first quantity and on a first variable initialized by a second quantity;
• and
• protects execution of the ciphering algorithm, the protecting including, for each bit of the first quantity, maintaining a second variable between two thresholds during an execution of a looped operation, the maintaining including combining a random number and a state of the bit of the first quantity, wherein, for each bit of the first quantity, the maintaining of the second variable includes:
• updating the second variable to a first update value obtained by adding the random number to a value of the second variable and subtracting the state of the bit of the first quantity when the first update value ranges between said two thresholds;
• and
• updating the second variable to a second update value obtained by subtracting the state of the bit of the first quantity from the random number when the first update value does not range between said two thresholds.

A device, comprising:

• one or more memories;
• and
• cryptographic circuitry, which, in operation:
• executes a ciphering algorithm including executing looped operations on bits of a first quantity and on a first variable initialized by a second quantity;
• and
• protects execution of the ciphering algorithm, the protecting including, for each bit of the first quantity, maintaining a second variable between two thresholds during an execution of a looped operation, the maintaining including combining a random number and a state of the bit of the first quantity, wherein the protecting includes, for each bit of the first quantity, updating the first variable with:
• a result of a first calculation taking into account the second quantity and the random number when the second variable, plus the random number and minus the state of the bit of the first quantity, ranges between said two thresholds;
• and
• a result of a second calculation taking into account the second quantity, the random number, and said second variable when the second variable, plus the random number and minus the state of the bit of the first quantity, does not range between said two thresholds.