A cryptographic device arranged to compute a block cipher on an input message, the block cipher comprising a plurality block cipher rounds ( R 0,...,, R 9), the device comprising - an input interface configured to receive an input message, - a processor circuit configured to - compute a plurality of intermediate block cipher results by - computing a first intermediate block cipher result of the plurality of intermediate block cipher results by applying the plurality of block cipher rounds ( R 0,,..., R 9) sequentially to the input message followed by one or more additional block cipher rounds ( R 10; R 10,..., R 12), and - computing further intermediate block cipher results (152, 153) of the plurality of intermediate block cipher results by re-computing at least one of the final block cipher rounds of the plurality block cipher rounds ( R 7, R 8, R 9) followed by the one or more additional block cipher rounds ( R 10; R 10,,..., R 12), - apply a plurality of averaging functions ( T 0, T 1) to the plurality of intermediate block cipher results, the plurality of averaging functions having been selected so that their function-sum equals the identity function, - add the results of the plurality of averaging functions, and - apply the inverse of the one or more additional block cipher rounds, a block cipher result being obtained from the result of said inverse. - an input interface configured to receive an input message, - a processor circuit configured to - compute a plurality of intermediate block cipher results by - computing a first intermediate block cipher result of the plurality of intermediate block cipher results by applying the plurality of block cipher rounds ( R 0,,..., R 9) sequentially to the input message followed by one or more additional block cipher rounds ( R 10; R 10,..., R 12), and - computing further intermediate block cipher results (152, 153) of the plurality of intermediate block cipher results by re-computing at least one of the final block cipher rounds of the plurality block cipher rounds ( R 7, R 8, R 9) followed by the one or more additional block cipher rounds ( R 10; R 10,,..., R 12), - apply a plurality of averaging functions ( T 0, T 1) to the plurality of intermediate block cipher results, the plurality of averaging functions having been selected so that their function-sum equals the identity function, - add the results of the plurality of averaging functions, and - apply the inverse of the one or more additional block cipher rounds, a block cipher result being obtained from the result of said inverse. - compute a plurality of intermediate block cipher results by - computing a first intermediate block cipher result of the plurality of intermediate block cipher results by applying the plurality of block cipher rounds ( R 0,,..., R 9) sequentially to the input message followed by one or more additional block cipher rounds ( R 10; R 10,..., R 12), and - computing further intermediate block cipher results (152, 153) of the plurality of intermediate block cipher results by re-computing at least one of the final block cipher rounds of the plurality block cipher rounds ( R 7, R 8, R 9) followed by the one or more additional block cipher rounds ( R 10; R 10,,..., R 12), - computing a first intermediate block cipher result of the plurality of intermediate block cipher results by applying the plurality of block cipher rounds ( R 0,,..., R 9) sequentially to the input message followed by one or more additional block cipher rounds ( R 10; R 10,..., R 12), and - computing further intermediate block cipher results (152, 153) of the plurality of intermediate block cipher results by re-computing at least one of the final block cipher rounds of the plurality block cipher rounds ( R 7, R 8, R 9) followed by the one or more additional block cipher rounds ( R 10; R 10,,..., R 12), - apply a plurality of averaging functions ( T 0, T 1) to the plurality of intermediate block cipher results, the plurality of averaging functions having been selected so that their function-sum equals the identity function, - add the results of the plurality of averaging functions, and - apply the inverse of the one or more additional block cipher rounds, a block cipher result being obtained from the result of said inverse.