Patent ID: 8306218

Claim:
A method of protecting a cryptographic process within an electronic device including a hardware controller and associated memory storing a secret key, the method comprising: a first masking stage comprising a first masking step to mask input data; a second masking stage defined by a plurality of computation rounds being successively performed by the hardware controller downstream from the first masking step to produce masked output data based on the masked input data and the secret key, with the masked input data from the first masking step being used so that intermediate data associated with each computation round is masked, and with data being manipulated by the second masking stage within each computation round also being masked, each computation round comprising a second masking step to mask a result of a previous computation round, a substitution step to substitute the masked result of the previous computation round by using a masked non linear operator (SBOX′), and a second unmasking step to unmask a result of the substitution step; the first masking stage comprising a first unmasking step performed after a last computation round in the second masking stage to unmask the masked output data therefrom; and a third masking step performed before a first computation round to produce the masked non linear operator (SBOX′) in the substitution step, with the masked non linear operator SBOX′ produced by the third masking step verifying the following relation, for each data (A): SBOX ′( A@X 3 )= SBOX ( A )# X 2 , where X 2 is a second masking parameter, X 3 is a third masking parameter, SBOX is a non linear operator, “ # ” is a second mixing operator and “ @ ” is a third mixing operator.