| 摘要 |
The invention relates to a processor device on which an implementation of a cryptographic algorithm masked as a white box with a functionf, is carried out. The implementation comprises an implemented calculation step S, via which input values x are applied to output values s = S[x], and the calculation step T', masked as a white box by means of an invertible function f, is masked. A combination (f = (c1, c2,... )*A) of an affine mapping A having an input width BA and a number of one or more invertible applications c1, c2,... each having an input width Bc1, Bc2,... is defined as a mapping f, wherein BA = Bc1 + Bc2 +.... The application f generates overall output values w. From the output values a of the affine mapping A, a plurality of amounts Mxi, i = 1,2,... = Mx11, Mx12,... Mx21, Mx22,..., are formed. From output values W of the invertible mapping c1, c2, the amounts Lxi, i = 1,2,... = Lx11, Lx12,... Lx21, Lx22,... are formed. Also, other amounts M1 = {Mx11, Mx21, Mx31...}, M2 = {Mx12, Mx22, Mx32...}... and L1 = {Lx11, Lx21, Lx31...}, L2 = {Lx12, Lx22, Lx32...}... are formed. The one or more invertible mappings c1, c2... are selected or formed in such a way that the amounts M1, M2... are applied to the amounts L1, L2. |
