Platform neutral data encryption standard (DES) cryptographic operation

Patent metadata

Field	Value
Publication number	US-11700111-B2
Application number	US-202016909530-A
Country	US
Kind code	B2
Filing date	Jun 23, 2020
Priority date	Jun 26, 2019
Publication date	Jul 11, 2023
Grant date	Jul 11, 2023

Abstract

Systems and methods for protecting block cipher computation operations from external monitoring attacks. An example apparatus for implementing a block cipher may comprise a memory device to store instructions for computing a block cipher; and a processing device coupled to the memory device. The processing device performs a Data Encryption Standard (DES) cryptographic operation with multiple rounds of a Feistel structure, each round including a substitution function and a transformation function that combines an expansion function and a permutation function into a single operation. The transformation function transforms a first input portion of an internal state of the respective round and a second input portion of the internal state into a first output portion and a second output portion of data. The second output portion is equal to the first input portion and the first output portion is dependent on a combined permutation output from the transformation function.

First claim

What is claimed is:

1. A computing device comprising:
a memory device to store instructions for computing a block cipher; and
a processing device coupled to the memory device, wherein the instructions, when executed by the processing device, perform a Data Encryption Standard (DES) cryptographic operation comprising a plurality of rounds of a Feistel structure, each of the plurality of rounds comprising a substitution function and a transformation function that combines an expansion function and a permutation function into a single operation, wherein the transformation function transforms a first input portion of an internal state of the respective round and a second input portion of the internal state into a first output portion and a second output portion of data, wherein the second output portion is equal to the first input portion and the first output portion is dependent on a combined permutation output from the transformation function, wherein the transformation function uses look-up tables, wherein values of the look-up tables are masked with random values, and wherein the random values are such that an output mask of each of the plurality of rounds is the same as an input mask of each of the plurality of rounds.

2. The computing device of claim 1 , wherein the first input portion is a first 48-bit input word and the second input portion is a second 48-bit input word, wherein the first output portion is a first 48-bit output word and the second output portion is a second 48-bit output word.

3. The computing device of claim 2 , wherein the look-up tables comprises eight look-up tables of eight 6-bit words, and wherein the single operation is a single look-up operation.

4. The computing device of claim 3 , wherein the eight look-up tables are loaded into a cache of the processing device prior to a first round of the plurality of rounds.

5. The computing device of claim 3 , wherein the eight look-up tables are stored in non-volatile memory and loaded into a cache of the processing device prior to a first round of the plurality of rounds.

6. The computing device of claim 3 , wherein values of the eight look-up tables are masked by performing an exclusive-OR (XOR) operation with each value and a 48-bit random value.

7. The computing device of claim 3 , wherein the combined permutation output from the transformation function is an exclusive-OR (XOR) sum of an output of the eight look-up tables.

8. The computing device of claim 2 , wherein each of the plurality of rounds further comprises an expansion function to modify an internal state of the DES cryptographic operation from two 32-bit words to the first 48-bit input word and the second 48-bit input word, and wherein the first 48-bit input word and the second 48-bit input word are each masked with a 48-bit random value.

9. The computing device of claim 1 , wherein each of the plurality of rounds further comprises an XOR function that receives the first input portion and a secret key and outputs a first output value to the substitution function.

10. The computing device of claim 1 , wherein each of the plurality of rounds further comprises:
a first XOR function that receives the first input portion and a secret key and outputs a first output value; and
a second XOR function that receives the first output value and a masked key and outputs a second output value to the substitution function, wherein the secret key is masked with a mask to obtain a masked key, and wherein the masked key and the mask generate subkeys independently from the transformation function.

11. The computing device of claim 10 , wherein the look-up tables comprises eight look-up tables to store the subkeys, wherein the eight look-up tables are stored in a non-volatile memory and loaded into a cache of the processing device prior to a first round of the plurality of rounds.

12. The computing device of claim 1 , wherein each of the plurality of rounds further comprises:
a first expansion function that receives a first portion of an input value and expands the first portion into the first input portion; and
a second expansion function that receives a second portion of the input value and expands the second portion into the second input portion, wherein the input value is a 64-bit value, and wherein the first input portion is a 48-bit word and the second input portion is a 48-bit word.

13. A method comprising:
receiving, by a processing device, an input value; and
performing, by the processing device, a Data Encryption Standard (DES) cryptographic operation comprising a plurality of rounds of a Feistel structure, wherein each of the plurality of rounds, comprises:
performing a substitution function on a first input portion of an internal state of the respective round; and
performing a transformation function on the first input portion into a first output portion, wherein the transformation function combines an expansion function and a permutation function into a single operation, wherein the first output portion is dependent on a combined permutation output from the transformation function, wherein a second input portion of the internal state and a second output portion of data is equal to a second input portion of the internal state of the respective round, wherein performing the transformation function on the first input portion comprises performing a look-up operation in look-up tables, wherein values of the look-up tables are masked with random values, and wherein the random values are such that an output mask of each of the plurality of rounds is the same as an input mask of each of the plurality of rounds.

14. The method of claim 13 , wherein the input value is 64-bits, wherein each of the plurality of rounds further comprises:
expanding a first portion of the input value into the first input portion, wherein the first portion of the input value is 32-bits and the first input portion is 48-bits;
expanding a second portion of the input value into the second input portion, wherein the second portion of the input value is 32-bits and the second input portion is 48-bits;
performing a first exclusive-OR (XOR) operation on the first input portion and a secret key to obtain a first value that is input into the substitution function, wherein an output of the substitution function is input into the transformation function; and
performing a second XOR operation on an output of the transformation function and the second input portion to obtain the first output portion.

15. The method of claim 14 , wherein the look-up tables comprises eight look-up tables of eight 6-bit words, wherein performing the look-up operation comprises performing a single look-up operation in the eight look-up tables of the eight 6-bit words, and wherein the method further comprises loading the eight look-up tables into a cache prior to a first round of the plurality of rounds.

16. The method of claim 13 , wherein each of the plurality of rounds further comprises performing an XOR operation with the first input portion and a secret key to obtain a first output value that is input into the substitution function.

17. The method of claim 13 , wherein each of the plurality of rounds further comprises:
performing a first XOR operation with the first input portion and a secret key to obtain a first output value; and
performing a second XOR operation with the first output value and a masked key to obtain a second output value that is input into the substitution function.

18. An integrated circuit comprising:
a cache to store a look-up tables for a transformation functio

Assignees

• Cryptography Res Inc

Inventors

• Tunstall Michael

Classifications

• H04L2209/043

  of tables, e.g. lookup, substitution or mapping · CPC title

• G06F21/755

  with measures against power attack · CPC title

• H04L2209/24

  Key scheduling, i.e. generating round keys or sub-keys for block encryption · CPC title

• H04L9/0631

  Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms · CPC title

• H04L9/003 Primary

  for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA] · CPC title