EP0981223A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Encryption/decryption apparatus
Assignee: Toshiba Corp
•
Filing: 1999-08-19
•
Granted: —
•
Expires: 2019-08-19
Abstract
Abstract A pair of a pattern of a mask ( a ) and a mask pattern obtained by bit inversion of the mask is prepared for each round function (5) in a data scrambler (1). Every time encryption is to be performed, one mask pattern of the pair is randomly selected by a switch (SW12), and an exclusive OR (32a) of an input to an S-box (29) and the selected mask pattern is calculated. In addition, an exclusive OR (33a) of an output from the S-box (29) and bits of inverse permutation p -1 of the mask ( a ) is calculated. The exclusive ORs (32a, 33a) are calculated in advance and stored as a table in the S-box (29). Furthermore, an exclusive OR (43a) of the output from each round function (5) and a mask ( b ) is calculated and concealed. The influence of the mask ( b ) is removed by calculating the exclusive OR with the mask ( b ) again on the next round.
Inventors
- 👤 Shinichi IPD Kabushiki Kaisha Toshiba Kawamura
- 👤 Fumihiko IPD Kabushiki Kaisha Toshiba Sano
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-28 19:23
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/06; H04L9/0618; H04L9/0625; H04L9/002; H04L9/003; G; G06; G06F; G06F2207/00; G06F2207/72; G06F2207/7219; H04L2209/00; H04L2209/04; H04L2209/046; H04L2209/24
Claims Analysis
Total Claims: 50
Claim 1
Independent Claim
114 words
An encryption apparatus for converting a
plaintext block into a ciphertext block depending on
supplied key information, characterized by comprising: means (SW1, SW2) for randomly selecting one
pattern of each of pairs ai, ai (where i is a positive
integer not less than one) of one or a plurality of
predetermined mask patterns and mask patterns obtained
by bit inversion of the predetermined mask patterns
every time encryption is performed; means (43a, 44a, 42a) for masking bits dependent
on a plaintext within said apparatus with the mask
patterns selected by said selection means; and means (42b, 43b, 44b) for removing an influence of
the mask a from a ciphertext before the ciphertext is
output.
Claim 2
Dependent Claim
112 words
An encryption apparatus for converting a
plaintext block into a ciphertext block depending on
supplied key information, characterized by comprising: means (SW1, SW2) for randomly selecting one
pattern of each of pairs ai, ai (where i is a positive
integer not less than one) of one or a plurality of
predetermined mask patterns and mask patterns obtained
by bit inversion of the predetermined mask patterns
every time encryption is performed; means (33a, 33b) for masking intermediate bit data
within said apparatus with the mask patterns selected
by said selection means; and means (32a, 33b) for removing an influence of the
mask a from the intermediate bit data masked by said
masking means.
Claim 3
Dependent Claim
133 words
An encryption apparatus for converting a
plaintext block into a ciphertext block depending on
supplied key information, characterized by comprising: data translation means (17, 35) for performing
data translation to intermediate data within said
apparatus; means (SW13, SW23) for randomly selecting one
pattern of each of pairs ai, ai (where i is a positive
integer not less than one) of one or a plurality of
predetermined mask patterns and mask patterns obtained
by bit inversion of the predetermined mask patterns
every time encryption is performed; means (33a, 33b) for masking an input to said data
translation means with the mask patterns selected by
said selection means; and means (24, 25) for removing an influence of the
mask a from an output from said data translation means
which is masked by said masking means.
Claim 4
Dependent Claim
74 words
An apparatus according to claim 1, characterized
in that said means (43a, 44a, 42a) for masking the
bits dependent on the plaintext within said apparatus
with the selected mask patterns and said means (42b,
43b, 44b) for removing the influence of the mask a from the ciphertext comprise one of an exclusive OR,
addition or subtraction with respect to a modulus w ,
and multiplication or division with respect to the
modulus w .
Claim 5
Dependent Claim
73 words
An apparatus according to claim 2, characterized
in that said means (33a, 33b) for masking the
intermediate bit data within said apparatus with the
selected mask patterns and said means (32a, 33b) for
removing the influence of the mask a from the masked
intermediate bit data comprise one of an exclusive OR,
addition or subtraction with respect to a modulus w ,
and multiplication or division with respect to the
modulus w .
Claim 6
Dependent Claim
86 words
An apparatus according to claim 3, characterized
in that said data translation means (17, 35), said
means (33a, 33b) for masking the input to said data
translation means (17, 35) with the selected mask
patterns, and said means (24, 25) for removing the
influence of the mask a from the masked output from
said data translation means (17, 35) comprise one of
an exclusive OR, addition or subtraction with respect
to a modulus w , and multiplication or division with
respect to the modulus w .
Claim 7
Dependent Claim
201 words
An apparatus according to claim 3, characterized
by further comprising: first storage means (34a) for storing, in the
form of a table, said means (SW13, SW23) for randomly
selecting one pattern of each of the pairs ai, ai (where i is a positive integer not less than one) of
one or the plurality of predetermined mask patterns and
the mask patterns obtained by bit inversion of the
predetermined mask patterns every time encryption is
performed, said means (33a) for masking the input to
said data translation means with the mask patterns ai,
and said means (24, 25) for removing the influence of
the masks ai from the masked output from said data
translation means; second storage means (34b) for storing, in the
form of a table, said means (33b) for masking the input
to said data translation means with mask patterns a ,
and said means (24, 25) for removing an influence of
the masks a from the masked output from said data
translation means; and masked data translation means (EEPROM, RAM, ROM)
for randomly selecting one of said first and second
storage means every time encryption is performed, and
performing the processing by said data translation
means for masked data.
Claim 8
Dependent Claim
47 words
An apparatus according to claim 1, characterized
in that the pair a, a of the mask patterns and
the mask patterns obtained by bit inversion comprises
a pair a, a of predetermined fixed mask patterns and
mask patterns obtained by bit inversion of the fixed
mask patterns.
Claim 9
Dependent Claim
29 words
An apparatus according to claim 1, characterized
in that the pair a, a of the mask patterns and
the mask patterns obtained by bit inversion are not
necessarily concealed.
Claim 10
Dependent Claim
44 words
An apparatus according to claim 1, characterized
in that a Hamming weight indicating the number of
bits "1s" of an n-bit long bit sequence x is defined
as H(x), and the Hamming weight H(a) of the mask a satisfies 0 < H(a) < n.
Claim 11
Dependent Claim
64 words
An apparatus according to claim 1, characterized
in that a Hamming weight indicating the number of
bits "1s" of an n-bit long bit sequence x is defined as
H(x), and an absolute value of a difference between the
Hamming weight H(a) of the mask a and a Hamming weight
H( a ) of bit inversion a of the mask a is less than n/2.
Claim 12
Dependent Claim
114 words
A decryption apparatus for converting a
ciphertext block into a plaintext block depending on
supplied key information, characterized by comprising: means (SW21, SW22) for randomly selecting one
pattern of each of pairs ai, ai (where i is a positive
integer not less than one) of one or a plurality of
predetermined mask patterns and mask patterns obtained
by bit inversion of the predetermined mask patterns
every time decryption is performed; means (43a, 44a, 42a) for masking bits dependent
on a ciphertext within said apparatus with the mask
patterns selected by said selection means; and means (42b, 43b, 44b) for removing an influence of
the mask a from a plaintext before the plaintext is
output.
Claim 13
Dependent Claim
112 words
A decryption apparatus for converting a
ciphertext block into a plaintext block depending on
supplied key information, characterized by comprising: means (SW1, SW2) for randomly selecting one
pattern of each of pairs ai, ai (where i is a positive
integer not less than one) of one or a plurality of
predetermined mask patterns and mask patterns obtained
by bit inversion of the predetermined mask patterns
every time decryption is performed; means (33a, 33b) for masking intermediate bit data
within said apparatus with the mask patterns selected
by said selection means; and means (32a, 33b) for removing an influence of the
mask a from the intermediate bit data masked by said
masking means.
Claim 14
Dependent Claim
133 words
A decryption apparatus for converting a
ciphertext block into a plaintext block depending on
supplied key information, characterized by comprising: data translation means (17, 35) for performing
data translation to intermediate data within said
apparatus; means (SW13, SW23) for randomly selecting one
pattern of each of pairs ai, ai (where i is a positive
integer not less than one) of one or a plurality of
predetermined mask patterns and mask patterns obtained
by bit inversion of the predetermined mask patterns
every time decryption is performed; means (33a, 33b) for masking an input to said data
translation means with the mask patterns selected by
said selection means; and means (24, 25) for removing an influence of the
mask a from an output from said data translation means
which is masked by said masking means.
Claim 15
Dependent Claim
73 words
An apparatus according to claim 12, characterized
in that said means (43a, 44a, 42a) for masking the
bits dependent on the plaintext within said apparatus
with the selected mask patterns and said means (24, 25)
for removing the influence of the mask a from the
ciphertext comprise one of an exclusive OR, addition or
subtraction with respect to a modulus w , and multiplication
or division with respect to the modulus w .
Claim 16
Dependent Claim
73 words
An apparatus according to claim 13, characterized
in that said means (33a, 33b) for masking the
intermediate bit data within said apparatus with the
selected mask patterns and said means (32a, 33b) for
removing the influence of the mask a from the masked
intermediate bit data comprise one of an exclusive OR,
addition or subtraction with respect to a modulus w ,
and multiplication or division with respect to the
modulus w .
Claim 17
Dependent Claim
84 words
An apparatus according to claim 15, characterized
in that said data translation means (17, 35), said
means (33a, 33b) for masking the input to said data
translation means (17, 35) with the selected mask
patterns, and said means (24, 25) for removing the
influence of the mask a from the masked output from
said data translation means comprise one of an
exclusive OR, addition or subtraction with respect to
a modulus w , and multiplication or division with
respect to the modulus w .
Claim 18
Dependent Claim
199 words
An apparatus according to claim 14, characterized
by further comprising: first storage means (34a) for storing, in the
form of a table, said means (SW13, SW23) for randomly
selecting one pattern of each of the pairs ai, ai (where i is a positive integer not less than one) of
one or the plurality of predetermined mask patterns
and the mask patterns obtained by bit inversion of the
predetermined mask patterns every time decryption is
performed, said means (33a, 33b) for masking the input
to said data translation means with the mask patterns
ai, and means (24, 25) for removing the influence of
the masks ai from the masked output from said data
translation means; second storage means (34b) for storing, in the
form of a table, means (33b) for masking the input to
said data translation means with mask patterns a , and
means (24, 25) for removing an influence of the masks a from the masked output from said data translation
means; and masked data translation means (EEPROM, RAM, ROM)
for randomly selecting one of said first and second
storage means every time decryption is performed, and
performing the processing by said data translation
means for masked data.
Claim 19
Dependent Claim
47 words
An apparatus according to claim 12, characterized
in that the pair a, a of the mask patterns and the
mask patterns obtained by bit inversion comprises a
pair a, a of predetermined fixed mask patterns and mask
patterns obtained by bit inversion of the fixed mask
patterns.
Claim 20
Dependent Claim
29 words
An apparatus according to claim 13, characterized
in that the pair ai, ai of the mask patterns and
the mask patterns obtained by bit inversion are not
necessarily concealed.
Claim 21
Dependent Claim
44 words
An apparatus according to claim 12, characterized
in that a Hamming weight indicating the number of
bits "1s" of an n-bit long bit sequence x is defined
as H(x), and the Hamming weight H(a) of the mask a satisfies 0 < H(a) < n.
Claim 22
Dependent Claim
64 words
An apparatus according to claim 12, characterized
in that a Hamming weight indicating the number of
bits "1s" of an n-bit long bit sequence x is defined as
H(x), and an absolute value of a difference between the
Hamming weight H(a) of the mask a and a Hamming weight
H( a ) of bit inversion a of the mask a is less than n/2.
Claim 23
Dependent Claim
104 words
An encryption method of converting a plaintext
block into a ciphertext block depending on supplied key
information, characterized by comprising the steps of: (U2, U3, U4) randomly selecting one pattern of
each of pairs ai, ai (where i is a positive integer not
less than one) of one or a plurality of predetermined
mask patterns and mask patterns obtained by bit
inversion of the predetermined mask patterns every time
encryption is performed; (U5) masking bits dependent on a plaintext within
the method with the selected mask patterns; and (U11) removing an influence of the mask a from
a ciphertext before the ciphertext is output.
Claim 24
Dependent Claim
100 words
An encryption method of converting a plaintext
block into a ciphertext block depending on supplied key
information, characterized by comprising the steps of: (W2, W3, W4) randomly selecting one pattern of
each of pairs ai, ai (where i is a positive integer not
less than one) of one or a plurality of predetermined
mask patterns and mask patterns obtained by bit
inversion of the predetermined mask patterns every time
encryption is performed; (W5) masking intermediate bit data within the
method with the selected mask patterns; and (W11) removing an influence of the mask a from the
masked intermediate bit data.
Claim 25
Dependent Claim
114 words
An encryption method of converting a plaintext
block into a ciphertext block depending on supplied key
information, characterized by comprising the steps of: (V7) performing data translation to intermediate
data within the method; (V8, V9, V10) randomly selecting one pattern of
each of pairs ai, ai (where i is a positive integer not
less than one) of one or a plurality of predetermined
mask patterns and mask patterns obtained by bit
inversion of the predetermined mask patterns every time
encryption is performed; (V11) masking an input to the data translation
step with the selected mask patterns; and (V5) removing an influence of the mask a from
a masked output from the data translation step.
Claim 26
Dependent Claim
68 words
A method according to claim 23, characterized
in that the step of masking the bits dependent on the
plaintext within the method with the selected mask
patterns and the step of removing the influence of the
mask a from the ciphertext comprise one of an exclusive
OR, addition or subtraction with respect to a modulus w ,
and multiplication or division with respect to the
modulus w .
Claim 27
Dependent Claim
69 words
A method according to claim 24, characterized
in that the step of masking the intermediate bit data
within the method with the selected mask patterns and
the step of removing the influence of the mask a from
the masked intermediate bit data comprise one of an
exclusive OR, addition or subtraction with respect to
a modulus w , and multiplication or division with
respect to the modulus w .
Claim 28
Dependent Claim
76 words
A method according to claim 25, characterized
in that the data translation step, the step of masking
the input to the data translation step with the
selected mask patterns, and the step of removing the
influence of the mask a from the masked output from the
data translation step comprise one of an exclusive OR,
addition or subtraction with respect to a modulus w ,
and multiplication or division with respect to the
modulus w .
Claim 29
Dependent Claim
177 words
A method according to claim 25, characterized
by further comprising the steps of: storing, in the form of a table, the step of
randomly selecting one pattern of each of the pairs
ai, ai (where i is a positive integer not less than
one) of one or the plurality of predetermined mask
patterns and the mask patterns obtained by bit
inversion of the predetermined mask patterns every time
encryption is performed, the step of masking the input
to said data translation step with the mask patterns ai,
and the step of removing the influence of the masks ai
from the masked output from the data translation step; storing, in the form of a table, the step of
masking the input to said data translation step with
mask patterns a , and step of removing an influence
of the masks a from the masked output from the data
translation step; and randomly selecting one of the first and second
storage steps every time encryption is performed, and
performing the processing in the data translation step
for masked data.
Claim 30
Dependent Claim
47 words
A method according to claim 23, characterized
in that the pair a, a of the mask patterns and the mask
patterns obtained by bit inversion comprises a pair
a, a of predetermined fixed mask patterns and mask
patterns obtained by bit inversion of the fixed mask
patterns.
Claim 31
Dependent Claim
29 words
A method according to claim 23, characterized
in that the pair a, a of the mask patterns and the mask
patterns obtained by bit inversion are not necessarily
concealed.
Claim 32
Dependent Claim
44 words
A method according to claim 23, characterized
in that a Hamming weight indicating the number of bits
"1s" of an n-bit long bit sequence x is defined as H(x),
and the Hamming weight H(a) of the mask a satisfies 0 <
H(a) < n.
Claim 33
Dependent Claim
64 words
A method according to claim 23, characterized
in that a Hamming weight indicating the number of bits
"1s" of an n-bit long bit sequence x is defined as H(x),
and an absolute value of a difference between the
Hamming weight H(a) of the mask a and a Hamming weight
H( a ) of bit inversion a of the mask a is less than n/2.
Claim 34
Dependent Claim
104 words
A decryption method of converting a ciphertext
block into a plaintext block depending on supplied key
information, characterized by comprising the steps of: (U2, U3, U4) randomly selecting one pattern of
each of pairs ai, ai (where i is a positive integer not
less than one) of one or a plurality of predetermined
mask patterns and mask patterns obtained by bit
inversion of the predetermined mask patterns every time
decryption is performed; (U5) masking bits dependent on a ciphertext within
the method with the selected mask patterns; and (U11) removing an influence of the mask a from
a plaintext before the plaintext is output.
Claim 35
Dependent Claim
100 words
A decryption method of converting a ciphertext
block into a plaintext block depending on supplied key
information, characterized by comprising the steps of: (W2, W3, W4) randomly selecting one pattern of
each of pairs ai, ai (where i is a positive integer not
less than one) of one or a plurality of predetermined
mask patterns and mask patterns obtained by bit
inversion of the predetermined mask patterns every time
decryption is performed; (W5) masking intermediate bit data within the
method with the selected mask patterns; and (W11) removing an influence of the mask a from the
masked intermediate bit data.
Claim 36
Dependent Claim
114 words
A decryption method of converting a ciphertext
block into a plaintext block depending on supplied key
information, characterized by comprising the steps of: (V7) performing data translation to intermediate
data within the method; (V8, V9, V10) randomly selecting one pattern of
each of pairs ai, ai (where i is a positive integer not
less than one) of one or a plurality of predetermined
mask patterns and mask patterns obtained by bit
inversion of the predetermined mask patterns every time
decryption is performed; (V11) masking an input to the data translation
step with the selected mask patterns; and (V5) removing an influence of the mask a from
a masked output from the data translation step.
Claim 37
Dependent Claim
68 words
A method according to claim 34, characterized
in that the step of masking the bits dependent on the
ciphertext within the method with the selected mask
patterns and the step of removing the influence of the
mask a from the plaintext comprise one of an exclusive
OR, addition or subtraction with respect to a modulus w ,
and multiplication or division with respect to the
modulus w .
Claim 38
Dependent Claim
69 words
A method according to claim 35, characterized
in that the step of masking the intermediate bit data
within the method with the selected mask patterns and
the step of removing the influence of the mask a from
the masked intermediate bit data comprise one of
an exclusive OR, addition or subtraction with respect
to a modulus w , and multiplication or division with
respect to the modulus w .
Claim 39
Dependent Claim
76 words
A method according to claim 36, characterized
in that the data translation step, the step of masking
the input to the data translation step with the
selected mask patterns, and the step of removing the
influence of the mask a from the masked output from the
data translation step comprise one of an exclusive OR,
addition or subtraction with respect to a modulus w ,
and multiplication or division with respect to the
modulus w .
Claim 40
Dependent Claim
177 words
A method according to claim 36, characterized
by further comprising the steps of: storing, in the form of a table, the step of
randomly selecting one pattern of each of the pairs
ai, ai (where i is a positive integer not less than
one) of one or the plurality of predetermined mask
patterns and the mask patterns obtained by bit
inversion of the predetermined mask patterns every time
decryption is performed, the step of masking the input
to said data translation step with the mask patterns ai,
and the step of removing the influence of the masks ai
from the masked output from the data translation step; storing, in the form of a table, the step of
masking the input to said data translation step with
mask patterns a , and step of removing an influence of
the masks a from the masked output from the data
translation step; and randomly selecting one of the first and second
storage steps every time decryption is performed, and
performing the processing in the data translation step
for masked data.
Claim 41
Dependent Claim
47 words
A method according to claim 34, characterized
in that the pair a, a of the mask patterns and the mask
patterns obtained by bit inversion comprises a pair
a, a of predetermined fixed mask patterns and mask
patterns obtained by bit inversion of the fixed mask
patterns.
Claim 42
Dependent Claim
29 words
A method according to claim 34, characterized
in that the pair a, a of the mask patterns and the mask
patterns obtained by bit inversion are not necessarily
concealed.
Claim 43
Dependent Claim
44 words
A method according to claim 34, characterized
in that a Hamming weight indicating the number of bits
"1s" of an n-bit long bit sequence x is defined as H(x),
and the Hamming weight H(a) of the mask a satisfies 0 <
H(a) < n.
Claim 44
Dependent Claim
64 words
A method according to claim 34, characterized
in that a Hamming weight indicating the number of bits
"1s" of an n-bit long bit sequence x is defined as H(x),
and an absolute value of a difference between the
Hamming weight H(a) of the mask a and a Hamming weight
H( a ) of bit inversion a of the mask a is less than n/2.
Claim 45
Dependent Claim
138 words
A computer-usable program storage medium (205,
207, 209) storing computer-readable program code means
for converting a plaintext block into a ciphertext
block depending on supplied key information, characterized
by comprising: computer-readable program code means (U2, U3, U4)
for causing a computer to randomly select one pattern
of each of pairs ai, ai (where i is a positive integer
not less than one) of one or a plurality of predetermined
mask patterns and mask patterns obtained by bit
inversion of the predetermined mask patterns every time
encryption is performed; computer-readable program code means (U5) for
causing said computer to mask bits dependent on a
plaintext within the method with the selected mask
patterns; and computer-readable program code means (U11) for
causing said computer to remove an influence of the
mask a from a ciphertext before the ciphertext is
output.
Claim 46
Dependent Claim
123 words
An encryption apparatus for converting a
plaintext block into a ciphertext block depending on
supplied key information, characterized by comprising: means (SW31) for randomly selecting one pattern of
each of pairs ai, ai (where i is a positive integer not
less than one) of one or a plurality of predetermined
mask patterns and mask patterns obtained by bit
inversion of the predetermined mask patterns every time
encryption is performed; means (122) for masking bits dependent on a key
within said apparatus with the mask patterns selected
by said selection means; data translation means (132) for converting
intermediate data within said apparatus with the key;
and means (133) for removing an influence of the mask a from an output from said data translation means.
Claim 47
Dependent Claim
47 words
An apparatus according to claim 46, characterized
in that the pair a, a of the mask patterns and the
mask patterns obtained by bit inversion comprises a
pair a, a of predetermined fixed mask patterns and mask
patterns obtained by bit inversion of the fixed mask
patterns.
Claim 48
Dependent Claim
29 words
An apparatus according to claim 46, characterized
in that the pair a, a of the mask patterns and
the mask patterns obtained by bit inversion are not
necessarily concealed.
Claim 49
Dependent Claim
44 words
An apparatus according to claim 46, characterized
in that a Hamming weight indicating the number
of bits "1s" of an n-bit long bit sequence x is defined
as H(x), and the Hamming weight H(a) of the mask a satisfies 0 < H(a) < n.
Claim 50
Dependent Claim
64 words
An apparatus according to claim 46, characterized
in that a Hamming weight indicating the number of
bits "1s" of an n-bit long bit sequence x is defined as
H(x), and an absolute value of a difference between the
Hamming weight H(a) of the mask a and a Hamming weight
H( a ) of bit inversion a of the mask a is less than n/2.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.