Irdeto B.v.

Tingting Lin

A method of performing a cryptographic process in a secured manner, wherein the cryptographic process generates output data based on input data, the generating of the output data involving generating a value y based on an amount of data x, the value y representing a combination, according to a linear transformation L, of respective outputs from a plurality of S-boxes S(n=0, . . . , N−1) for integer N>1, wherein each S-box S(n=0, . . . , N−1) implements a respective function Hthat is either (a) the composition of a respective first function Fand a respective linear or affine second function Gso that H=G∘F, or (b) the composition of a respective first function F, a respective linear or affine second function Gand a respective third function Wso that H=G∘F∘W, wherein the method comprises: performing a first processing stage and a second processing stage to generate the value y based on the amount of data x, wherein: the first processing stage uses a plurality of first lookup tables to generate respective outputs, each output being based on at least part of the amount of data x, wherein, for each S-box S(n=0, . . . , N−1), the respective first function Fis implemented by a corresponding first lookup table; and the second processing stage combines outputs from a plurality of second lookup tables to generate the value y, wherein the input to each second lookup table is formed from the output of a plurality of the first lookup tables, and wherein the set of second lookup tables is based on the second functions G(n=0, . . . , N−1) and the linear transformation L.

Secured performance of a cryptographic process

A method for performing an elliptic curve cryptographic process to generate output data based on input data, the elliptic curve cryptographic process based on an elliptic curve over a finite field, wherein the generation of the output data comprises generating, based on a predetermined point V of the elliptic curve and a positive R-bit integer k, a first point of the elliptic curve that is based, at least in part, on the point kV of the elliptic curve, wherein k=Σ2band, for each r=0, 1, . . . , R−1, bis the bit value of k at bit position r of k, wherein the method comprises: storing, according to a partition of the R bit positions for k into T groups of bit positions P(t=0, 1, . . . , T−1), a corresponding lookup table Lhaving, for each of the 2possible options for assigning to the |P| bit positions s∈Pa respective bit value x, a corresponding point of the elliptic curve that is based, at least in part, on the point (Σ2x)V of the elliptic curve; obtaining k; and determining the first point as Σl, where lis the point of the elliptic curve that corresponds, in lookup table L, to the option for assigning to the |P| bit positions s∈Pthe corresponding bit value b.

Growing community of inventors

Hoofddorp, Netherlands

Tingting Lin