| 摘要 |
<p>A pair of a pattern of a mask (a) and a mask pattern obtained by bit inversion of the mask is prepared for each round function (5) in a data scrambler (1). Every time encryption is to be performed, one mask pattern of the pair is randomly selected by a switch (SW12), and an exclusive OR (32a) of an input to an S-box (29) and the selected mask pattern is calculated. In addition, an exclusive OR (33a) of an output from the S-box (29) and bits of inverse permutation p<-1> of the mask (a) is calculated. The exclusive ORs (32a, 33a) are calculated in advance and stored as a table in the S-box (29). Furthermore, an exclusive OR (43a) of the output from each round function (5) and a mask (b) is calculated and concealed. The influence of the mask (b) is removed by calculating the exclusive OR with the mask (b) again on the next round. <IMAGE></p> |
