Execution unit for calculations with masked data

Patent metadata

Field	Value
Publication number	US-11190337-B2
Application number	US-201916431775-A
Country	US
Kind code	B2
Filing date	Jun 5, 2019
Priority date	Jun 6, 2018
Publication date	Nov 30, 2021
Grant date	Nov 30, 2021

Abstract

According to one embodiment, an execution unit is described, which includes a mask generation circuit configured to generate a mask by multiplying a mask generation vector by blocks of codewords of a plurality of cyclic codes, a masking circuit configured to mask data to be processed by means of the mask, and an arithmetic logic unit configured to process the masked data by means of additions and rotations.

First claim

What is claimed is:

1. An execution unit, comprising:
a mask generation circuit configured to generate a mask by multiplying a mask generation vector by blocks of codewords of a plurality of cyclic codes,
a masking circuit configured to generate, using the mask, masked shares of data to be processed, and
an arithmetic logic unit configured to process the masked data by means of additions and rotations;
wherein the data comprise a first operand and a second operand and the arithmetic logic unit is configured to multiply the first operand and the second operand;
wherein the execution unit further comprises a masked selection circuit which, for the purposes of realizing the multiplication, carries out a masked AND operation on the first operand or the second operand;
wherein the masked selection circuit is configured to refresh the masking of the data to be processed during the masked AND operation.

2. The execution unit of claim 1 ,
wherein the arithmetic logic unit comprises an accumulation shift register for processing the masked data.

3. The execution unit of claim 1 ,
wherein the data comprise a first operand and a second operand and the arithmetic logic unit is configured to rotate the first and the second operand, to add the first and the second operand, or both.

4. The execution unit of claim 1 ,
wherein the multiplication is a multiplication over a finite field GF(2 n ).

5. The execution unit of claim 1 ,
wherein each block of codewords consists of the codewords of one of a plurality of non-systematic cyclic codes.

6. The execution unit of claim 1 , further comprising:
a correction circuit configured to correct errors arising from the inhomogeneity between the blocks of codewords.

7. The execution unit of claim 6 ,
wherein the correction circuit is configured to correct the errors arising from the transition positions between the blocks of codewords.

8. The execution unit of claim 6 ,
wherein the correction circuit is configured to correct the lack of homomorphism of the masking in respect of the shift of data that arises from the transition positions between the blocks of codewords.

9. The execution unit of claim 1 ,
wherein all codes have the same codeword length and the codeword length equals the length of the mask generation vector.

10. The execution unit of claim 1 ,
wherein the execution unit is configured to process the data for the purposes of carrying out a cryptographic operation.

11. The execution unit of claim 1 ,
wherein the data represent at least one of a signature, a cryptographic key, data to be encrypted or data to be decrypted.

12. The execution unit of claim 1 ,
wherein the mask generation vector is a randomly generated vector.

13. The execution unit of claim 1 ,
wherein the plurality of cyclic codes are different.

14. A method for calculating with masked data, the method comprising:
generating a mask by multiplying a mask generation vector by blocks of codewords of a plurality of cyclic codes,
generating, using the mask, masked share of data to be processed, and
processing the masked data by means of additions and rotations;
wherein the data comprise a first operand and a second operand;
further comprising multiplying the first operand and the second operand;
carrying out a masked AND operation on the first operand or the second operand the purposes of realizing the multiplication; and
refreshing the masking of the data to be processed during the masked AND operation.

Assignees

• Infineon Technologies Ag

Inventors

• Meyer Bernd
• Poeppelmann Thomas

Classifications

• H04L2209/046

  of operations, operands or results of the operations · CPC title

• H04L2209/04

  Masking or blinding · CPC title

• H04L2209/34

  Encoding or coding, e.g. Huffman coding or error correction · CPC title

• G06F7/724

  Finite field arithmetic (for error detection or correction in general H03M13/00, in computers G06F11/10) · CPC title

• G06F7/523

  Multiplying only · CPC title