Apparatus and method for converting input bit sequences

Patent metadata

Field	Value
Publication number	US-11495144-B2
Application number	US-201916425535-A
Country	US
Kind code	B2
Filing date	May 29, 2019
Priority date	Jun 5, 2018
Publication date	Nov 8, 2022
Grant date	Nov 8, 2022

Abstract

A cryptographical apparatus for converting input bit sequences, whose overflow-free arithmetic addition results in a secret, into output bit sequences whose logic XORing results in the secret. The apparatus comprises a data interface for providing a first input bit sequence and a second input bit sequence and a processing circuit configured to a) gate the first input bit sequence and the second input bit sequence to obtain a logic result indicating overflow bit positions at which both the first input bit sequence and the second input bit sequence have a value of one; and to b) change the first and/or second input bit sequence at at least one overflow bit position. The processing circuit is configured to repeatedly perform steps a) and b) by using the respectively changed input bit sequences, until the logic result indicates no further overflow bit position and the output bit sequences are obtained.

First claim

What is claimed is:

1. A cryptographical apparatus for converting input bit sequences, whose overflow-free arithmetic addition results in a secret, into output bit sequences whose logical XORing results in the secret, the cryptographical apparatus comprising:
a data interface for providing at least a first input bit sequence and a second input bit sequence;
a processing circuit configured to
a) gate the first input bit sequence and the second input bit sequence so as to obtain a logic result indicating each overflow bit position at which both the first input bit sequence and the second input bit sequence have a value of one; and to
b) change the first input bit sequence and/or the second input bit sequence at at least one overflow bit position;
wherein the processing circuit is configured to repeatedly perform steps a) and b) by using the respectively changed input bit sequences, until the logic result indicates no further overflow bit position and the output bit sequences are obtained.

2. The cryptographical apparatus of claim 1 , in which the processing circuit is configured to change the first input bit sequence and/or the second input bit sequence at the at least one overflow bit position such that an XOR logic result of the output bit sequences corresponds to an arithmetic addition result of the input bit sequences mod 2n, where n is the number of bits of the first input bit sequence and of the second input bit sequence.

3. The cryptographical apparatus of claim 1 , which is formed as a security controller.

4. The cryptographical apparatus of claim 1 , in which the processing circuit is configured to change the first input bit sequence and/or the second input bit sequence at the at least one overflow bit position by increasing the value represented by the input bit sequence.

5. The cryptographical apparatus of claim 1 , wherein the processing circuit is configured to gate at least a third input bit sequence with the first input bit sequence and the second input bit sequence in order to obtain the logic result.

6. The cryptographical apparatus of claim 5 , in which the processing circuit is configured to generate the third input bit sequence as a random number.

7. The cryptographical apparatus of claim 1 , in which the processing circuit is configured to change the first input bit sequence and/or the second input bit sequence at the at least one overflow bit position by calculating a correction bit sequence based on the logic result and adding either the first input bit sequence or the second input bit sequence to the correction bit sequence.

8. The cryptographical apparatus of claim 7 , in which the processing circuit is configured to calculate the correction bit sequence based on the rule
2*(AND∧ m ),

where AND is a logic bit sequence representing the logic result, and where m is a bit mask, based on which, starting from the overflow position, more significant bits of the logic bit sequence are ignored.

9. The cryptographical apparatus of claim 1 , in which the data interface is configured to provide at least a first, second, third and fourth input bit sequence;
wherein the processing circuit is configured to
a) gate the first to fourth input bit sequences in a first manner in order to obtain a first logic result, and to gate the first to fourth input bit sequences in a second manner in order to obtain a second logic result, and to
b) change at least one of the first and second input bit sequences by using the first logic result and/or at least one of the first and second input bit sequences by using the second logic result.

10. The cryptographical apparatus of claim 1 , in which the processing circuit is configured to change the first input bit sequence and the second input bit sequence at the at least one overflow bit position by calculating a correction bit sequence based on the logic result, adding the correction bit sequence to one of the first and second input bit sequences and subtracting said correction bit sequence from the other input bit sequence or adding it to an inverse correction bit sequence.

11. The cryptographical apparatus of claim 10 , in which the processing circuit is configured to obtain the output bit sequences such that an arithmetic addition result from input values represented by the input bit sequences and an arithmetic addition result from output values represented by the output bit sequences are the same.

12. The cryptographical apparatus of claim 1 , in which the processing circuit is configured to obtain the logic result based on a bit-by-bit ANDing of the first input bit sequence and the second input bit sequence, wherein the logic result indicates the at least one overflow position at bit positions that have a logic 1.

13. The cryptographical apparatus of claim 1 , in which the processing circuit is configured to repeatedly analyze the logic result starting from a least influential bit of the logic result through to a most influential bit and to increase a value represented by the first input bit sequence and to decrease a second value represented by the second input bit sequence if the logic result corresponds to a predefined value at the analyzed place, and to leave the first value and the second value unchanged if the logic result does not correspond to the predefined value at the analyzed place.

14. The cryptographical apparatus of claim 1 , in which the processing circuit is configured to decrease a value represented by the first input bit sequence in a first loop pass and to use the obtained bit sequence with the decreased value as an input bit sequence in a later second loop pass, wherein the processing circuit is configured to increase the decreased value in the second loop pass.

15. The cryptographical apparatus of claim 14 , in which the processing circuit is configured to infer from a random number whether the value represented by the first input bit sequence is decreased or increased during the second loop pass.

16. The cryptographical apparatus of claim 1 ,
wherein the logic result has a plurality of bits, wherein each bit of the logic result is uniquely associated with a bit of the first input bit sequence and a bit of the second input bit sequence;
wherein the processing circuit is configured to repeatedly perform steps a) and b) in order to repeatedly check the logic result, for each bit of the logic result, for the presence of an overflow bit position;
wherein the processing circuit is configured to randomize bits of the first input bit sequence and/or bits of the second input bit sequence, for which the logic result is already checked, by means of XORing with a random number.

17. The cryptographical apparatus of claim 1 ,
wherein the logic result has a plurality of bits, wherein each bit of the logic result is uniquely associated with a bit of the first input bit sequence and a bit of the second input bit sequence;
wherein the processing circuit is configured to repeatedly perform steps a) and b) in order to repeatedly check the logic result, for each bit of the logic result, for the presence of an overflow bit position;
wherein the processing circuit is configured to randomize bits of the first input bit sequence and/or bits of the second input bit sequence for which the logic result is unchecked by means of ANDing with a random number.

18. The cryptographical apparatus of claim 1 , in which the processing circuit is configured to obtain a first random bit sequence and a second random bit sequence, to embed the first input bit sequence into the first random bit sequence, to obtain an ext

Assignees

• Infineon Technologies Ag

Inventors

• Rau Markus
• Heiss Stefan

Classifications

• G06F7/38 Primary

  Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation · CPC title

• G06F21/725

  operating on a secure reference time value · CPC title

• G09C1/00 Primary

  Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) · CPC title

• H04L2209/046

  of operations, operands or results of the operations · CPC title

• H04L9/003

  for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA] · CPC title