Secured performance of a cryptographic process

Abstract

A method of performing a cryptographic process in a secured manner, wherein the cryptographic process generates output data based on input data, the generating of the output data involving generating a value y based on an amount of data x, the value y representing a combination, according to a linear transformation L, of respective outputs from a plurality of S-boxes S(n=0, . . . , N−1) for integer N>1, wherein each S-box S(n=0, . . . , N−1) implements a respective function Hthat is either (a) the composition of a respective first function Fand a respective linear or affine second function Gso that H=G∘F, or (b) the composition of a respective first function F, a respective linear or affine second function Gand a respective third function Wso that H=G∘F∘W, wherein the method comprises: performing a first processing stage and a second processing stage to generate the value y based on the amount of data x, wherein: the first processing stage uses a plurality of first lookup tables to generate respective outputs, each output being based on at least part of the amount of data x, wherein, for each S-box S(n=0, . . . , N−1), the respective first function Fis implemented by a corresponding first lookup table; and the second processing stage combines outputs from a plurality of second lookup tables to generate the value y, wherein the input to each second lookup table is formed from the output of a plurality of the first lookup tables, and wherein the set of second lookup tables is based on the second functions G(n=0, . . . , N−1) and the linear transformation L.