WO2007012102A2

WO2007012102A2 - Method and circuit for carrying out calculation operations secure from bugging

Info

Publication number: WO2007012102A2
Application number: PCT/AT2006/000322
Authority: WO
Inventors: Thomas Popp; Stefan Mangard; Manfred Aigner
Original assignee: Technische Universität Graz; Forschungsholding Tu Graz Gmbh
Priority date: 2005-07-26
Filing date: 2006-07-26
Publication date: 2007-02-01
Also published as: WO2007012102A3; AT502230A2; DE112006002032A5; AT10303U1

Abstract

The invention relates to a method for carrying out a calculation operation in a digital circuit made up of single-stage logic elements. According to the invention, all single-stage logic elements (2) in the digital circuit (1) carry out a positive or negative monotone function, the digital circuit (1) is alternately switched to a charge phase and an analysis phase, during the charge phase given charge values are applied to the inputs of the digital circuit (3, 4, 5, 6), the inputs and outputs of the single-stage logic elements and therefore also the outputs from the digital circuit (7, 8) are set to given charge values, during the analytical phase, the N masked operands are applied in inverted form and the M masking parameters are applied in inverted form to the inputs of the digital circuit (3, 4, 5, 6), during the analytical phase the 2N operands and the 2 M masking parameters are connected and the logic function ensures for each single-stage logic element (2) during the analytical phase that all logic values occurring at the outputs from the single-stage logic elements are masked according to a masking method.

Description

Method and circuit for performing arithmetic operations

The invention relates to a method according to the preamble of claim 1. Furthermore, the invention relates to a digital circuit according to the preamble of claim 10.

From the patent DE 102 01 449 C1 an arithmetic unit or a method for carrying out an arithmetic operation with at least two operands are known, wherein the at least two operands are encrypted. The calculator includes an arithmetic logic unit having a first input for the first encrypted operand, a second input for the second encrypted operand, a third input for an encryption parameter, and an output for an encrypted result of the operation. The arithmetic logic unit combines the first input, the second input and the third input by means of arithmetic sub-operations, taking into account the manner in which the operands are encrypted, so that an encrypted result equal to a value obtained is obtained at the output would be if the first operand in the unencrypted state and the second operand in the unencrypted state of the arithmetic operation are subjected to and a result obtained is then encrypted, with no decryption of the operands is performed in the arithmetic logic unit. Due to this structure of the arithmetic-logical unit, so-called side channel attacks on the arithmetic-logical unit should be prevented.

However, it is from Mangard, Popp, Gammel, "Side-Channel Leakage of Masked CMOS Gates," Proceedings of the RSA Conference 2005 Cryptographers' Track (CT-RSA 2005, February 14-18, 2005, San Francisco, USA), Lecture Notes in Computer Science (LNCS), published Springer Verlag, 2005, that in such arithmetic units short-term glitches, so-called "glitches" occur, which still allow the implementation of side channel attacks anyway side channel attacks pose a significant security risk for arithmetic and computing processes in which confidential data are processed.

As a proposal for the protection of arithmetic units or arithmetic methods in addition to the technique described in the patent DE 102 01 449 C1 also so-called "dual-rail pre-charge" logic styles, such as the "Sense Amplifier Based Logic" or the "Wave Dynamic Digital In circuits based on these logic styles, all connection lines are duplicated and precharged to defined values every clock cycle electrical properties are balanced. The balancing of the lines is technically very complex and the effort is constantly increasing by the use of ever smaller semiconductor technologies. Furthermore, the problems of not masking intermediate results as well as the solution of these problems by masking on different logic levels up to the masking of single-level logic elements are well known.

The aim of the invention is to provide a method or a circuit which offers the highest security against side channel attacks and at the same time can be easily implemented. These objects are achieved in a method with the recited in claim 1

Characteristics achieved. In a circuit according to the invention, these objects are achieved by the features of claim 10.

The present invention is based on the fact that all data values occurring in a method according to the invention or in a circuit according to the invention are masked. By masking a data value is meant an arithmetic operation in which the data value is associated with one or more random values such that the result of the arithmetic operation, i. the masked data value is statistically independent of the original data value. In practice, a bitwise XOR combination of random values and the data value to be masked is usually used to mask a data value.

By masking all data values occurring in a method or a circuit, all occurring physical side channel information is made largely statistically independent of the unmasked data values. Thus, the highest security is guaranteed against side channel attacks. In previously known methods and circuits, the masking as

Use protection against side channel attacks, not all occurring data values are sufficiently masked to ensure a high level of security against side channel attacks. For example, data values which are statistically dependent on the corresponding unmasked data values occur in arithmetic-logic units according to the patent DE 102 01 449 C1. This dependency in turn allows the execution of side channel attacks. Furthermore, in such arithmetic-logic units, the "glitches" mentioned at the outset also occur, which likewise increase susceptibility to side-channel attacks.

In the present invention, all data values occurring at the inputs and outputs of the logic elements are consistently masked. On the one hand, this is achieved by completely preventing "glitches" in the process or in the circuit and, on the other hand, by the fact that they are at the level of one-stage Logic elements and not masked at the level of arithmetic logic units. Single-level logic elements are the smallest possible parts of a circuit that can compute a logical output data value based on input data values and a logical function. The invention differs not only by the application of the dual-rail

Principle significantly from the known masking methods of single-stage logic elements. It is particularly advantageous that the output values of all single-level logic elements that occur in the masked circuit are statistically independent of the unmasked input values. From WO 2003/060672 A1 it is known logical function blocks, such as

Example AND gate to replace with masked function blocks. Both the inputs and the outputs of these masked function blocks are masked. However, as far as the intermediate results in the masked function blocks used are concerned, it is only required that no unmasked intermediate results occur. However, this requirement is not sufficient to ensure protection against electricity consumption attacks. This protection is only guaranteed if all intermediate results that occur at the outputs of the one-level logic elements in the masked function blocks are statistically independent of the unmasked input data. With an implementation of a method according to the invention or a circuit according to the invention, there are no technical requirements that are difficult to implement. In particular, no balanced connection lines are required. In the following, the effects for the individual features of claim 1 and the effects for the individual subclaims will now be discussed in detail.

Masking data values provides effective protection against side channel attacks when, in fact, every data value occurring in a digital circuit is masked. In general, however, "glitches" occur in a digital circuit, which makes the fulfillment of this condition technically very complicated.The reason for this is that it is already relatively complicated to determine which data values as a result of "glitches "will occur in a digital circuit. The more complex it is then additionally to ensure that each of these occurring data values will always be properly masked. To completely save this effort, inventive

Processes executed in this way or circuits according to the invention constructed in such a way that "glitches" can not even occur at all In practice, this means that all data lines are doubled compared to a conventional CMOS circuit, so instead of a line, there is a line pair for coding a data bit These are the so-called precharge phase and the so-called evaluation phase Typically, the switching between these two phases is triggered by a control or clock signal.

During the precharge phase, all inputs and outputs of the one-level logic elements that make up the digital circuit are set to predetermined precharge values. In other words, disengaged, this means that the entire circuit is set to the same state in each precharge phase. In this state, previously defined preload values are present at all inputs and outputs of single-level logic elements. It is important to note that all inputs of each individual logic element must be set to the same pre-load value. There is therefore no logic element in the digital circuit at whose inputs in the precharge phase different values are applied. As a result, as will be explained in more detail later, no "glitches" occur in the digital circuit.

During the evaluation phase, an arithmetic operation is performed by the digital circuit. This arithmetic operation is completely masked and executed in "dual-rail" encoding, which means that in addition to masked operands and corresponding masking parameters, the masked operands and masking parameters are also passed in inverted form to the digital circuit and masks a masked result in inverted form These masked results correspond to those results that would be obtained if the given arithmetic operation had been performed unmasked with unmasked operands and if the results had subsequently been masked.

In addition to the masked execution of the calculation rule in "dual-rail" coding, an essential feature of methods and circuits according to the invention is that during the evaluation phase all data values at the outputs of each individual single-level logic element of the digital circuit are masked according to a respective masking method During the evaluation phase in the digital circuit, only data values which are masked according to a masking method are ensured, ensuring that all data values occurring in the digital circuit are statistically independent of the corresponding unmasked values in a conventional CMOS circuit essential prerequisite for achieving a high level of security against side channel attacks.

The characteristic of masking the output of each individual single-level logic element according to a masking method is achieved by selecting the logic functions of the single single-level logic elements and the interconnection of these logic elements based on truth tables in the design of a digital circuit. When selecting the logic functions of the single-level basic elements, it must also be ensured that these functions are positive or negative monotone. The monotonicity of the logic functions and the requirement that during the precharge phase, the inputs of each single-level logic element are set to the same Vorladewert and cause the transition of the circuit from the precharge phase in the evaluation phase all outputs of each single-level logic element change its value at most once , In other words, this means that no glitches occur during the transition from the pre-charge phase to the evaluation phase.

The same applies to the transition of the digital circuit from the evaluation phase back to the pre-charge phase. During this transition, the outputs of exactly those one-level logic elements switch back to their defined precharge value, which previously changed their value during the transition into the evaluation phase. In circuits and methods according to the invention, "glitches" do not occur at any time, even if it is also ensured at the same time that no "glitches" occur at the inputs of the digital circuit. This basic requirement can be met, for example, by setting the inputs of the digital circuit by flip-flops or by a further circuit according to the invention.

The prevention of "glitches" and the masking of the outputs of all single-stage logic elements in methods and circuits according to the invention lead to a very high security against side channel attacks The physical side channel information obtained by changing the data values during a transition from a pre-charge phase to an evaluation phase a transition from one evaluation phase into one

Precharge occur, are largely independent of those by the masking

Data values that would occur in corresponding unmasked CMOS circuits.

In sub-claim 3 is given as a masking method, the bitwise XOR linking masked operand and the masking parameters. Using this masking method, it is ensured that no data values are available during the masked calculation of a calculation rule according to the invention which have a statistical dependence on those which would occur in a corresponding unmasked CMOS circuit.

In the subclaims 7 and 8, two methods are given, as can be switched back and forth between pre-charge phase and evaluation. In the method described in dependent claim 7, an additional control signal is used for this purpose. This has the advantage that all single-stage logic elements can be put into the pre-charge phase at the same time. On the other hand, this also results in the disadvantage that a very high power consumption then occurs in the circuit at this time. An alternative method is described in subclaim 8. At this

Method, the logic function of the single-level logic elements is selected so that the single-level logic elements are placed in the pre-charge phase by pre-charging values are applied to their inputs. Thus, no additional control signal is required for this method and it does not occur as high currents as in the method according to dependent claim 7. A disadvantage of this method, however, is that not all logic elements can be placed in the precharge phase at the same time. It is thus necessary that the pre-charge phase lasts at least as long as the evaluation phase.

As stated in dependent claim 9, a balancing of pairs of lines with respect to their electrical properties is not necessary. As a result, an implementation of a circuit according to the invention or a method according to the invention is technically much simpler than the implementation of circuits based on the "dual-rail pre-charge" logic styles "Sense Amplifier Based Logic" and "Wave Dynamic Digital Logic".

The drawings show examples of digital circuits according to the invention. Show it:

FIG. 1 shows a schematic representation of a digital circuit according to the invention; FIG.

FIG. 2 shows an illustration of a digital circuit according to the invention which implements a logical AND operation as the arithmetic operation and in which a bitwise XOR combination with the masking parameter is used as the masking method for the operands or the result;

3 shows an illustration of a digital circuit according to the invention which implements a logical NAND operation as arithmetic operation and wherein a bitwise XOR connection with the masking parameter is used as the masking method for the operands or the result; 4 shows an illustration of a digital circuit according to the invention which implements a logical OR operation as arithmetic operation and wherein Masking method for the operands or the result of a bitwise XOR operation is used with the masking parameter;

5 shows an illustration of a digital circuit according to the invention which implements a logical NOR operation as an arithmetic operation and wherein a bitwise XOR combination with the masking parameter is used as the masking method for the operands or the result;

6 shows an illustration of a digital circuit according to the invention which implements a logical XOR operation as the arithmetic operation and wherein a bitwise XOR connection with the masking parameter is used as the masking method for the operands or the result;

7 shows an illustration of a digital circuit according to the invention which implements a logical XNOR operation as the arithmetic operation and wherein a bitwise XOR combination with the masking parameter is used as the masking method for the operands or the result; and FIG. 8 shows an illustration of a digital circuit according to the invention which performs a change of the mask of an operand as an arithmetic operation and wherein a bitwise XOR combination with the respective masking parameter is used as the masking method for the operand.

FIG. 1 shows a schematic representation of a digital circuit 1 according to the invention. A digital circuit according to the invention is constructed from one or more single-stage logic elements 2. Single-level logic elements are the smallest possible digital subcircuits that can calculate a logical output data value based on input data values and a logical function. In a digital circuit according to the invention, the single-stage logic elements used must each realize a positive or negative monotone, logical function.

A digital circuit according to the invention is alternately placed in one of the following two phases: in the precharge phase or in the evaluation phase. In the precharge phase, predischarge values are applied to the inputs 3, 4, 5 and 6 of the digital circuit. By an appropriate choice of the respective logic function of the single-stage logic elements, if necessary, taking into account one of the circuit additionally supplied control signal, it must be ensured that the outputs of the single-level logic elements and thus the outputs 7 and 8 of the digital circuit are set to predetermined Vorladewerte. In addition, care must be taken in a digital circuit according to the invention that the single-stage logic elements are interconnected in such a way that the inputs of a single-stage logic element are set to the same pre-charge value during the pre-charge phase become. Together with the above-mentioned requirement that single-stage logic elements only be able to realize monotonous functions, this condition with respect to the input values of the single-stage logic elements ensures that no "glitches" occur in a digital circuit according to the invention and thus also at their outputs , as already described, a susceptibility to side channel attacks.

In the evaluation phase following the precharging phase, the operands 3 and 4 of the digital circuit are applied with the operands masked according to the respective masking methods and the masking parameters and the inverted, masked operands. The masking parameters and the inverted masking parameters are applied to inputs 5 and 6. Subsequently, the masked and the inverted, masked results occur at the outputs of the circuit according to the invention. In the evaluation phase, it must be ensured that all logical data values occurring in the digital circuit are masked in accordance with a masking method and the corresponding masking parameters.

FIG. 2 shows the implementation of a digital circuit 1 according to the invention which performs an AND operation as arithmetic operation. In the present case, a masking method for the operands OP 1 and OP2 at the inputs of the circuit and also for the result RE at the outputs of the circuit a bitwise XOR operation with the masking parameter MA is used. Of course, other suitable masking techniques (e.g., XNOR linking) with one or more masking parameters (n) (e.g., a masking parameter for the operands, a masking parameter for the result) could also be used. The masked operands or the inverted, masked operands at the inputs and the masked result or the inverted, masked result at the outputs of the digital circuit are in the relationship described in equations (1) to (6).

OP7 _MA = OP? Θ MA {1)

ÖP / _MA = ÖP / Θ MA (2)

During the so-called evaluation phase are the masked operands, the inverted, masked operands, the masking parameter and the inverted

Masking parameters at the inputs of the digital circuit. The arithmetic operation to be performed is an AND operation, which on the one hand masks and on the other must be inverted and masked. The required results of this arithmetic operation are shown in equations (7) and (8).

The arithmetic operation must be carried out exclusively with masked data values in order to be protected against side channel attacks. For this purpose, one-level logic elements are used in the implementation, which realize the negative monotonous IMAJ (= inverted majority) logic function. The IMAJ logic function is defined as follows:

IMAJ (A, B, C) = A - B + A - C + B. C (9) The inverse logic function is called the majority function (MAJ). The initial value of the IMAJ logic element 10 now results in:

X10 _m = IMAJ (OPf _MA , OP2 _MA , MA) = OPf _MA . OP2 _{MA +} OP1 _m - MA ₊ OP2 _MA - MA = (OPV ® MA) • (OP2 θ MA) + (OPV θ MA) • MA + (OP2 θ MA) • MA =

(OPV • MA + OPV • MA) • (OP2 • MA + OP2 • MA) + (OP1 • MA + OPV • MA) • MA + (OP2 • MA + OP2 • MA) • MA =

OPV • OP2 • MA + OPV • OP2> MA + OPV • MA + OP2 • MA =

OPV • OP2 • MA + (OPV • OP2 + OPV + OP2) • MA =

OPV • OP2 • MA + OPV • OP2 • MA =

(OPV • OP2) φ MA =

OPV • OP2 Φ MA (VO)

It can be seen that this intermediate result is also properly masked.

The output value of the subsequent NOT logic element 11 is at the same time the masked result of the digital circuit according to the invention, which coincides with the desired masked result according to equation (7):

RE _MA = MAJ (OPV _MA , OP2 _MA , MA) = X70 _MA = OP1 - OP2 θ MA = (OPV • OP2) ® MA (VV) Further, the output value of the IMAJ logic element 12 is:

XV2 _MA = IMAJ (OPVMA, OP2 _MA , MA) = OPV _MA - OP ₂ ^ ₊ OPV _MA • MA + OP2 _MA . MA =

(PT φ MA) • (PT2 φ MA) + (OPV φ MA) • MA + (Ö ~ P2 φ MA) • MA =

(PTO • MA + OPV • MA) • (PT2 - MA + OP2 • MA) + (OPV - MA + OPV - MA) - ME + (PT2 • ME + OP2 - MA) - MA =

OPV • OP2 • MA + OPV • OP2 • MA + OPV • MA + OP2 • MA =

OPV ■ OP2 ■ MA + (OPV ■ OP2 + OPV + OP2) • MA =

OPV • OP2 • MA + OPV • OP2 • MA =

(OPV - OP2) Θ MA = (OPV • OP2) φ MA (12) It can be seen that this intermediate result is also properly masked. Of the Output value of the subsequent NOT logic element 13 is at the same time the inverted, masked result of the digital circuit according to the invention, which agrees with the desired masked result according to equation (8):

REMA = MAJ (OP-ZiViA, OP2MA, MA) = X72 _MA = (OPf • OP2) Θ MA = OPf • OP2 Θ MA (73) It should again be noted that all intermediate results occurring in the implementation of the digital circuit are only occur in accordance masked form, which side channel attacks are largely prevented. In the precharge phase alternating with the evaluation phase, predetermined precharge values are applied to the inputs of the digital circuit according to the invention (operands and masking parameters). Care must be taken that the inputs of a single-level logic element are set to the same pre-load value. This is one of the measures necessary to prevent the occurrence of "glitches." In the present case, this applies to the inputs of the two IMAJ logic elements 10 and 12. In particular, this condition is fulfilled when all the inputs of the digital circuit during the For the two NOT logic elements 11 and 13, the above condition is always met, since they have only one input It should be noted that if during the precharge phase the same precharge value 0 is applied to all inputs of the digital circuit At the outputs of the circuit, the precharge value 0 is also obtained The IMAJ logic function and the NOT logic function are both negative monotone logic functions Thus, the requirement for a digital circuit according to the invention is met which states that only single-level logic elements with positive or negative monotonic function may be used together with the For tion that the inputs of each one-stage logic element must be set to the same Vorladewert during the precharge phase, this condition ensures with respect to the logic functions used that no "glitches" occur in the digital circuit according to the invention. If no "glitches" occur at the transition from the precharging phase into the evaluation phase or conversely also at the inputs of the digital circuit, ie an input signal changes its value from the current value at most once, then in the digital circuit itself and thus at its Outputs also no "glitches" on. The results at the outputs of the circuit can thus in turn be used as input signals for other digital circuits according to the invention.

FIG. 3 shows the implementation of a digital circuit 1 according to the invention which performs a NAND operation as arithmetic operation. As a masking method for the

Operands OPf and OP2 at the inputs of the circuit and also for the result RE at the outputs of the circuit is again a bitwise XOR operation with the Masking parameter MA used. The masked operands or the inverted, masked operands at the inputs and the masked result or the inverted, masked result at the outputs of the digital circuit are in the relationship described in equations (1) to (6).

The arithmetic operation to be performed here is a NAND operation, which must be masked on the one hand and inverted and masked on the other hand. The required results of this arithmetic operation are shown in equations (14) and (15).

RE _MA = OP7 - OP2®MA (14)

REMA = (OP • OP2) Θ MA (15)

The implementation of the digital circuit in Fig. 3 is almost identical to the circuit shown in Fig. 2, only the two output signals for RE _MA and RE _M A are reversed. That is, in the evaluation phase, a value corresponding to equation (13) results for the masked result REMA of the digital circuit in FIG. 3:

RE _MA = MAJ (OP? MA.OP2MA, MA) = OP7 - OP2? MA (16)

The value agrees with the desired masked result according to equation (14). . For the inverted, masked result RE _MA of the digital circuit in Figure 3 results in a value according to equation (11): REMA = MAJ (OPf _MA, OP2 _MA, MA) = (OPV • OP2) MA φ (17)

The value agrees with the desired result according to equation (15).

Since the digital circuit in Fig. 3 has only been minimally changed compared to the circuit in Fig. 2, the considerations there regarding the masking of intermediate results, the precharge phase, the monotonic logic functions and the "glitches" in corresponding form apply here as well It should also be pointed out that if the same precharge value 0 is applied to all inputs of the digital circuit during the precharge phase, the precharge value 0 will also result at the outputs of the circuit.

FIG. 4 shows the implementation of a digital circuit 1 according to the invention which performs an OR operation as arithmetic operation. As a masking method for the operands OP1 and OP2 at the inputs of the circuit and also for the result RE at the outputs of the circuit, a bitwise XOR combination with the masking parameter MA is again used. The masked operands or the inverted, masked operands at the inputs and the masked result or the inverted, masked result at the outputs of the digital circuit are in the relationship described in equations (1) to (6). During the evaluation phase, the masked operands, the inverted masked operands, the masking parameter and the inverted masking parameter are applied to the inputs of the digital circuit. The arithmetic operation to be performed is an OR operation, which must be masked on the one hand and inverted and masked on the other. The required results of this arithmetic operation are shown in equations (18) and (19).

The arithmetic operation must be carried out exclusively with masked data values in order to be protected against side channel attacks. For this purpose, in the implementation once again single-stage logic elements are used, which realize the negative monotonous IMAJ (= inverted majority) logic function according to equation (9). The initial value of the IMAJ logic element 30 now results in:

^X30 MA = ^IMAJ ( ^OP W ^OP2 MA ' ^MA > ^{= OP7} MA - ^0P2 MA ^{+ 0P} W' ^{MA +} OP2 _MA ^' MA =

(OPV Θ MA) • (OP2 θ MA) + (OPV Φ MA) • MA + (OP2 Φ MA) • MA =

(OPf - MA + OP? ■ MA) • (OP2 - MA + ÖP2 • MA) + (OPV - MA + OP? • MA) - MA + (OP2 - MA + Ö ^~ P2 - MA) - MA =

OPV - OP2 • MA + OPV • OP2 • MA + OPV • MA + OP2 • MA = OPV + OP2 • MA + (OPV • OP2 + OPV + OP2) • MA =

OPV + OP2 • MA + (OPV + OP2) • MA =

(OPV + OP2) Θ MA =

OPV + OP2 Φ MA (20)

It can be seen that this intermediate result is also properly masked. The output value of the subsequent NOT logic element 31 is at the same time the masked result of the digital circuit according to the invention, which coincides with the desired masked result according to equation (18):

RE _MA = MAJ (OPV _MA , OP2 _MA , MA) = X30 _m = OPV + OP2 θ MA = (OPV + OP2) ® MA (21) Further, the output value of the IMAJ logic element 32 is: X32 _{m =} IMAJ (0RMA.0P2MA.MA) ₌ 0Py _MA - OP ₂ ^ + OPV ^ - MA ₊ OP ₂ ^ - MA = (OPV Θ MA) • (ÖP2 Θ MA) + (OPV Θ MA) • MA + (Ö ^~ P2 Θ MA) • MA =

(OPV • MA + OPf • MA) • (0P2 • MA + 0P2 • MA) + (OPf • MA + OPV ■ MA) ■ MA + (0P2 • MA + 0P2 • MA) • MA = OPV ■ PT2 • MA + O PV ■ OP 2 ■ MA + OP 1 • MA + OP 2 ■ MA =

OP- / + 0P2 • MA + (OPV • 0P2 + 0P1 + 0P2) • MA =

0P1 + 0P2 • MA + (OPV + 0P2) • MA =

0P1 + 0P2 θ MA =

(OPV + 0P2) θ MA (22)

It can be seen that this intermediate result is also properly masked. Of the

Output value of the subsequent NOT logic element 33 is at the same time the inverted, masked result of the digital circuit according to the invention, which coincides with the desired masked result according to equation (19):

REMA = MAJ (OPVMA ■ OP2MA, MA) = X32 _m = (OPV + 0P2) θ MA = OPV + 0P2 θ MA (23) It should be pointed out once again that all intermediate results occurring in the implementation of the digital circuit are only occur in accordance masked form, which side channel attacks are largely prevented. In the precharge phase alternating with the evaluation phase, predetermined precharge values are applied to the inputs of the digital circuit according to the invention (operands and masking parameters). Care must be taken that the inputs of a single-level logic element are set to the same pre-load value. As already described, this is one of the measures necessary to prevent the occurrence of glitches. In the present case, this applies in each case to the inputs of the two IMAJ logic elements 30 and 32. In particular, this condition is fulfilled when all inputs of the digital circuit are set to the same precharge value during the precharge phase. For the two NOT logic elements 31 and 33, the above condition is always met, since they have only one input. It should also be noted that if the same Vorladewert O is applied during the precharge phase to all inputs of the digital circuit, the Vorladewert O also results at the outputs of the circuit.

The IMAJ logic function and the NOT logic function are both negative monotone logic functions. Thus, the requirement for a digital circuit according to the invention is fulfilled, which states that only one-level logic elements with positive or negative monotonic function may be used. Together with the requirement that the inputs of each one-stage logic element must be set to the same precharge value during the precharge phase, this condition ensures with respect to the logic functions used that no If there are no "glitches" at the transition from the pre-charge phase to the evaluation phase, or vice versa, also at the inputs of the digital circuit, ie an input signal changes its value from the current value at most once, then in the digital circuit and thus at their outputs also no "glitches." The results at the outputs of the circuit can thus in turn be used as input signals for other digital circuits according to the invention.

FIG. 5 shows the implementation of a digital circuit 1 according to the invention which performs a NOR operation as arithmetic operation. As a masking method for the operands OP 7 and OP2 at the inputs of the circuit and also for the result RE at the outputs of the circuit, a bitwise XOR operation with the masking parameter MA is again used. The masked operands or the inverted, masked operands at the inputs and the masked result or the inverted, masked result at the outputs of the digital circuit are in the relationship described in equations (1) to (6).

The arithmetic operation to be performed here is a NOR operation, which must be masked on the one hand and inverted and masked on the other hand. The required results of this arithmetic operation are shown in equations (24) and (25).

RE _MA = OPf + OP2 θ MA (24)

REMA = (OP1 + OP2) θ MA (25) The implementation of the digital circuit in Fig. 5 is almost identical to that in Figs

Fig. 4 circuit shown, only the two output signals for RE _M A and RE M _A are reversed. That is to say, in the evaluation phase, the masked result RE _{MA of} the digital circuit in FIG. 5 results in a value corresponding to equation (23):

RE _MA = MAJ (OP7 _MA , OP2MA-MA) = OP1 + OP2 θ MA (26) The value agrees with the desired masked result according to equation (24).

For the inverted, masked result RE MA of the digital circuit in FIG. 5, a value corresponding to equation (21) results:

REMA = MAJ (OPf _MA, OP2 _MA, MA) = (OP1 + OP2) MA φ (27)

The value agrees with the desired result according to equation (25). Since the digital circuit in Fig. 5 has only been minimally changed compared to the circuit in Fig. 4, the considerations there regarding the masking of intermediate results, the precharge phase, the monotone logic functions and the "glitches" in corresponding form apply here as well It should be noted that if during the precharge phase to all inputs of the digital circuit of the equal precharge value 0 is applied, also results in the outputs of the circuit, the preload 0.

FIG. 6 shows the implementation of a digital circuit 1 according to the invention which performs an XOR operation as arithmetic operation. As a masking method for the operands OP 7 and OP2 at the inputs of the circuit and also for the result RE at the outputs of the circuit, a bitwise XOR operation with the masking parameter MA is again used. The masked operands or the inverted, masked operands at the inputs and the masked result or the inverted, masked result at the outputs of the digital circuit are in the relationship described in equations (1) to (6).

During the evaluation phase, the masked operands, the inverted masked operands, the masking parameter and the inverted masking parameter are applied to the inputs of the digital circuit. The arithmetic operation to be performed is an XOR operation which has to be masked on the one hand and inverted and masked on the other hand. The required results of this arithmetic operation are shown in equations (28) and (29).

The arithmetic operation must be carried out exclusively with masked data values in order to be protected against side channel attacks. In the implementation, digital circuits according to the invention of FIG. 3 are already used, which realize a masked NAND operation and an inverted, masked NAND operation according to equations (14) and (15). The output values of the masked NAND element 50 now result in:

X50 _m = X50 θ MA = OP1 ■ OP2®MA (30)

X5Ö _m = X5Ö ® MA = (OP? • ÖP2)? MA (31) It can be seen that these intermediate results are properly masked. The output values of the masked NAND element 51 result in:

X51 _m = X51 θ MA = OP1 ■ OP2 θ MA (32)

X5Ϊ _m = X5Ϊ θ MA = (ÖPΪ • OP2) θ MA (33)

It can be seen that these intermediate results are also properly masked. The output values of the subsequent masked NAND element 52 are at the same time the masked results of the digital circuit according to the invention: RE - _M MA _A = X50 ^■ X51 ® MA = OP1 • OP2 ■ OP1 ■ OP2 Θ MA =

(OP1 ■ OP2 + OP1 • OP2) θ MA = (OP1 ® OP2) θ MA (34)

REMA = (X50 • X51) ® MA = (OPf • OP2 • OPI ^■ OP2) © MA =

[(OP? + OP2)] (OP1 + Ö ^~ P2)] @ MA = (OP? • ÖP2 + OPf? 0P2)? MA = OP7? OP2? MA (35)

The masked results calculated by the digital circuit according to equations (34) and (35) are consistent with the desired masked results according to equations (28) and (29). It should be noted that here too all interim results occurring in the implementation of the digital circuit, including the intermediate results in the masked NAND elements 50, 51 and 52, occur only in a correspondingly masked form, whereby side channel attacks are largely prevented. The considerations regarding the digital circuits according to the invention in Fig. 2 to Fig. 5 with respect to the precharge phase, the monotonic logic functions and the "glitches" apply here as well the same precharge value 0 is applied to the digital circuit is set at the inputs of all single-level logic elements for each logic element of the same Vorladewerte and that also results in the outputs of the circuit, the preload value 0.

FIG. 7 shows the implementation of a digital circuit 1 according to the invention which performs an XNOR operation as arithmetic operation. As a masking method for the operands OP 1 and 0P2 at the inputs of the circuit and also for the result RE at the outputs of the circuit, a bitwise XOR operation with the masking parameter MA is again used. The masked operands or the inverted, masked operands at the inputs and the masked result or the inverted, masked result at the outputs of the digital circuit are in the relationship described in equations (1) to (6). The arithmetic operation to be performed here is an XNOR operation, which must be masked on the one hand and inverted and masked on the other hand. The required results of this arithmetic operation are shown in equations (36) and (37).

The implementation of the digital circuit in Fig. 7 is almost identical to the circuit shown in Fig. 6, except that the two output signals for RE _MA and RE _MA are reversed. That is to say, in the evaluation phase, the masked result REMA of the digital circuit in FIG. 7 results in a value according to equation (35): RE _MA = OP1 Θ OP2 Θ MA (38)

The value agrees with the desired masked result according to equation (36).

For the inverted, masked result RE _M A of the digital circuit in FIG. 7, a value corresponding to equation (34) results:

The value agrees with the desired result according to equation (37). Since the digital circuit in Fig. 7 has only been minimally changed compared with the circuit in Fig. 6, the considerations there regarding the masking of intermediate results, the precharge phase, the monotone logic functions and the "glitches" in corresponding form apply here as well It should also be pointed out that if the same precharge value 0 is applied to all inputs of the digital circuit during the precharge phase, the precharge value 0 will also result at the outputs of the circuit.

FIG. 8 shows the implementation of a digital circuit 1 according to the invention which performs a change of the mask of an operand as arithmetic operation. When

Masking method for the operand OP at the input or at the output of the digital

Circuit is a bitwise XOR relationship with the masking parameters MA7 or MA2 used. The masked operand and the inverted masked operand at the inputs and the masked operand and the inverted masked operand at the outputs of the digital circuit, respectively, are as in Equations (40) and

(41).

OP _MA? = OP θ MA1 (40)

^OP MA ₂ = OP θ MA ₂ (41)

During the evaluation phase, the masked operand, the inverted masked operand, a masking parameter corresponding to the XOR combination of MA- and MA2 and the inverted masking parameter are applied to the inputs of the digital circuit. The arithmetic operation to be performed is a change of the mask of the operand, which must be masked on the one hand and inverted and masked on the other hand. The required results of this arithmetic operation are shown in equations (42) and (43).

The arithmetic operation must be carried out exclusively with masked data values in order to be protected against side channel attacks. In the implementation, inter alia, a digital circuit according to the invention according to FIG. 3 is used, which realized a masked NAND operation and an inverted, masked NAND operation according to equations (14) and (15).

The output values of the NOR logic element 70 and the subsequent NOT logic element 71 now result in:

X70 _MAΪιMA2 = OP _MA , + MAV θ MA2 = (OP θ MAV) + (MAV Φ MA2) =

OP • MAV + OP ■ MAV + MAV • MA2 + MAV • MA2 (44)

X71 _mmA2 = X70 _mim2 = OP • MAV + OP • MAV + MAV • MA2 + MAV ^■ MA2 (45)

The output values of the NAND logic element 72 and the subsequent NOT logic element 73 result in:

X72 _{M / UMA2} = OPMAV ■ (MAV θ MA2) = (OP θ MAV) ■ (MAV φ MA2) =

(OP • MAV + OP • MAV) • (MAV • MA2 + MAV • MA2) =

OP • MÄ7- MA2 + OP - MAV - MAl? (46)

X73 _{MA? MA2} = X72 _MA _{,, MA2} = OP • MAV - MA2 + OP • MAV • MA2 (47)

The output values of the NAND logic element 74 and the subsequent NOT logic element 75 result in:

X74 _MA , _ιMA2 = OPMA? • MAV ® MA2 = (OP Φ MAV) • (MAV φ MA2) =

(OP ■ MAV + OP • MAV) • (MAV ■ MA2 + MAV • MA2) =

OP • MAV • MA2 + OP • MAV ■ MA2 (48)

X75 _MA7 , _MA2 = X7Λ _IAWA2 = OP ^■ MAV ^• MA2 + OP ^■ MAV ^• MA2 (49)

And the output values of the NOR logic element 76 and the subsequent NOT logic element 77 now result in:

X76 _{MM ιMA2} = 0P _MA , + (MAV Φ MA2) = (OP Φ MAV) + (MAV Φ MA2) =

OP ■ MAV + OP • MAV + MAV • MA2 + MAV • MA2 (50)

X77 _{MAy MA2} = X76 _{MA) MA2} = OP MAV + OP MAV + MAV MA2 + MAV MA2 (5V) The intermediate results X70 _M A7, MA2 to X77 _MA y, _MA2 are again properly masked since they are statistically independent of corresponding unmasked values. The output values of the subsequent masked NAND element 78 are at the same time the masked results of the digital circuit according to the invention: OP _MA2 = MAJ (X73 _MA _{,, MA2} , X77 _MA _{,, MA2} , MAf θ MA2) =

(OP • MAf • MA2 + OP • MAf • MA2) • (OP • MAf + OP • MAf + MAf • MA2 + MAf • MA2) + (OP • MAf • MA2 + OP • MAf • MÄ2) • (MAf • MÄ2 + MAf • MA2) + (OP-i ^ + Ö ^ -MAf + MAf-M ^ + MAE-MA2) - (MAE-MA2 + MAf-MA2) = Ö ^ -MÄTMA2 + OP-MAf-JV ^ + OP -MAf-MA2 + ÖP-MAf-MA2 =

OP • MA2 + OP • MA2 = OPθMA2 (52)

OPMA ₂ = MAJ (x7F _MArMA2, X75 _MA, _IMA2, MAf θ MA2) =

(OP-J ^ + Ö ^ - MAf + J ^ - Λ ^ + MAf - MA2) - (Ö ^ -i ^. MÄ2 + OP - MAf - MA2) +

(OP • MAf + OP • MAf + MAf • MA2 + MAf • MA2) • (MAf • MA2 + MAf • MA2) +

(OP ■ MAf • MA2 + OP • MAf • MA2) • (MAf • MA2 + MAf • MA2) =

OP -MAf -MA2 + OP - MAf - MA2 + OP - MAf -MA2 + OP -MAf -MA2 =

OP - MA2 + OP - MA2 = OP ® MA2 = OP Θ MA2 (53)

The masked results calculated by the digital circuit according to equations (52) and (53) are consistent with the desired masked results according to equations (42) and (43). It should be pointed out once again that all interim results occurring in the implementation of the digital circuit, including the intermediate results in the masked NAND element 78, only occur in a correspondingly masked form, as a result of which side channel attacks are largely prevented. In the precharge phase alternating with the evaluation phase, predetermined precharge values are applied to the inputs of the digital circuit according to the invention (operand and masking parameter). Care must be taken that the inputs of a single-level logic element are set to the same pre-load value. As already described, this is one of the measures necessary to prevent the occurrence of glitches. In the present case, this concerns the respective inputs of the two NOR logic elements 70 and 76, the inputs of the two NAND logic elements 72 and 74 and the inputs of the masked NAND element 78. In particular, this condition is fulfilled when all inputs of the digital circuit during the Precharge phase to the same precharge value. For the four NOT logic elements 71, 73, 75 and 77, the above condition is always met, since they have only one input. It should also be noted that if during the precharge phase to all inputs of the digital When the same precharge value 0 is applied, the precharge value 0 is also produced at the outputs of the circuit.

The NOR, the NAND and the NOT logic function are negative monotone logic functions. As can be seen in FIG. 3, this also applies to the logic functions in the NAND element 78. This satisfies the requirement for a digital circuit according to the invention, which states that only single-level logic elements with a positive or negative monotonic function may be used. Together with the requirement that the inputs of a single-level logic element each have to be set to the same precharge value during the precharge phase, this condition ensures that no "glitches" occur in the digital circuit according to the invention in the evaluation phase or vice versa also at the inputs of the digital circuit no "glitches", ie An input signal changes its value from the current value at most once, so no "glitches" occur in the digital circuit itself and thus at its outputs, and the results at the outputs of the circuit can again be used as inputs to other digital circuits according to the invention ,

Claims

claims:

Method for carrying out an arithmetic operation in a digital circuit constructed using single-level logic elements, wherein the operands masked with masking methods using masking parameters are linked to masked results in the course of the given arithmetic operation using these masking parameters, characterized

- That all single-stage logic elements (2) of the digital circuit (1) each realize a positive or negative monotone, logical function, - that the digital circuit (1) is alternately offset in time in a precharge phase and an evaluation phase,

in that predetermined pre-charging values are applied to the inputs of the digital circuit (3, 4, 5, 6) during the precharging phase,

during the precharging phase, each single-stage logic element (2) realizes its predetermined logical function in such a way that the outputs of the single-level logic elements and thus also the outputs of the digital circuit (7, 8) are set to predefined precharging values,

- That the single-stage logic elements (2) are interconnected in such a way that the inputs of the individual single-level logic elements are set to the same Vorladewert during the pre-charge phase,

in that, during the evaluation phase following the precharging phase, to the inputs of the digital circuit (3, 4, 5, 6) N masked operands according to the masking methods and the masking parameters, M masking parameters, the N masked operands in inverted form and the M masking parameters in inverted form to be created

in that, during the evaluation phase, the 2 N operands and the 2 M masking parameters, taking into account the masking methods and the masking parameters of the operands, are combined by means of logical functions realized by the one-stage logic elements (2) such that L masked results and the L masked ones Results in inverted form at the outputs of the digital circuit (7, 8) are obtained, which results are equal to the value that would be obtained if the operands were subjected to the predetermined arithmetic operation in the unmasked state and the results obtained were subsequently masked, that the logical function of each single-level logic element (2) and the interconnection of the single-level logic elements ensures that all are connected to the outputs of the single-level logic elements during the evaluation phase and thus also to the Outputs of the digital circuit (7, 8) are masked according to a masking method and the corresponding masking parameters, and

if necessary, the data values are linked during masking such that the masked data values are statistically independent of the original data value or that the output values of all single-stage logic elements which occur in the masked circuit are statistically independent of the unmasked input values.

2. Method according to claim 1, characterized in that in each precharge phase all logic values occurring at the inputs and outputs of the digital circuit (3, 4, 5, 6, 7, 8) are set to one and the same predetermined precharge value.

3. The method of claim 1 or 2, characterized in that as a masking method for each logic value occurring in the digital circuit one, in particular bitwise, logical operation, preferably XOR or XNOR operation between the respective unmasked logical value and one or more Masking parameter (s) is used.

4. The method according to any one of claims 1 to 3, characterized in that the digital circuit (1) a single masking parameter and this masking parameter in inverted form (M = 1) are supplied.

5. The method according to any one of claims 1 to 4, characterized in that by means of the digital circuit (1) a single masked result and the masked

Result can be calculated in inverted form (L = 1).

6. The method according to any one of claims 1 to 5, characterized in that the digital circuit (1) two masked operands and the two masked operands in inverted form (N = 2) are supplied.

7. The method according to any one of claims 1 to 6, characterized in that all single-level logic elements (2) each realize a logical function such that each one-stage logic element is placed in the precharge phase, when all inputs of the respective single-level logic element set to the predetermined Vorladewert and so that each one-level logic element is otherwise put into the evaluation phase, in particular if values other than the preload values are concerned.

8. The method according to any one of claims 1 to 6, characterized in that all single-level logic elements (2) each realize a logical function such that Each one-stage logic element is added to the digital circuit additionally supplied control signal either in the pre-charge phase or in the evaluation phase.

9. The method according to any one of claims 1 to 8, characterized in that between the single-stage logic elements (2) guided lines and to the digital circuit (1) directly connected lines (3, 4, 5, 6, 7, 8) are unbalanced with respect to their electrical properties.

10. Digital circuit, which is constructed with one-stage logic elements, for carrying out an arithmetic operation, with which the masked using masking parameters masked operands are linked using these masking parameters in the course of the given arithmetic operation to masked results, in particular for performing a method according to a of claims 1 to 9, characterized

- That all single-stage logic elements (2) of the digital circuit (1) each have a positive or negative monotone, logical function, - that the digital circuit (1) is alternately offset in time in a precharge phase and an evaluation phase,

- That the single-stage logic elements (2) are interconnected in such a way that in the precharging phase to the inputs of the digital circuit (3, 4, 5, 6) applied, predetermined Vorladewerten the inputs are each set a single-level logic element to the same Vorladewert and that the outputs of the single-stage logic elements are set to predefined preload values on the basis of their respective predetermined logical function, and thus that the outputs of the digital circuit (7, 8) are also set to predefined preload values,

in that the digital circuit (1) has N inputs for operands (3), M inputs masked according to the masking methods and the masking parameters, M inputs

Masking parameter (5), N inputs for the masked operands in inverted form (4) and M inputs for the masking parameters in inverted form (6), to which in the pre-charge following evaluation phase the corresponding signal values are applied, - that the digital circuit (1) L outputs for masked results (7) and L outputs for the masked results in inverted form (8), in which in the evaluation phase the by combining the 2 N operands and 2 M masking parameters taking into account the masking and masking parameters of logical functions realized by the one-level logic elements (2), L masked results obtained and the L masked results occur in an inverted form, these results being equal to the L Are values that would be obtained if the operands in the unmasked state were subjected to the given arithmetic operation and the results obtained were then masked and

- It is ensured by the logical function of each single-level logic element (2) and by the interconnection of the single-level logic elements that all occur during the evaluation phase at the outputs of the single-level logic elements and thus also at the outputs of the digital circuit (7, 8) logical values masked according to a masking method and the masking parameters.

11. Digital circuit according to claim 10, characterized in that in each precharge phase all logic values occurring at the inputs and outputs of the digital circuit (3, 4, 5, 6, 7, 8) are set to one and the same predetermined precharge value.

12. Digital circuit according to claim 10 or 11, characterized in that as a masking method for each in the digital circuit (1) occurring logic value, in particular bitwise, logical operation, preferably XOR or XNOR Verknüfung, between the respective unmasked logical Value and one or more masking parameter (s) is provided.

Digital circuit according to one of Claims 10 to 12, characterized in that the digital circuit (1) has a single input for a masking parameter (5) and a single input for the masking parameter in inverted form (6) (M = 1) ,

Digital circuit according to one of Claims 10 to 13, characterized in that the digital circuit (1) has a single output for a masked result (7) and a single output for the masked result in inverted form (8) (L = 1 ) having.

Digital circuit according to one of Claims 10 to 14, characterized in that the digital circuit (1) has two inputs for two masked operands (3) and two inputs for the two masked operands in inverted form (4) (N = 2). having.

16. Digital circuit according to one of claims 10 to 15, characterized in that each one-stage logic element (2) is offset according to its respective logical function in the precharge phase, when all inputs of this single-level logic element are set to the same predetermined Vorladewert and that each single-level logic element otherwise, in particular for requests of values other than the preload values, is put into the evaluation phase.

17. Digital circuit according to one of claims 10 to 15, characterized in that each one-stage logic elements (2) according to its respective logical function with one of the digital circuit additionally supplied control signal either in the precharge phase or in the evaluation phase is displaceable.

18. Digital circuit according to one of claims 10 to 17, characterized in that between the single-stage logic elements (2) guided lines and to the digital circuit (1) directly connected lines (3, 4, 5, 6, 7, 8 ) are unbalanced with respect to their electrical properties.

19. Digital circuit according to one of claims 10 to 18, characterized in that the individual one-stage logic elements (2) of the digital circuit (1) in CMOS

Technique are created.

20. Digital circuit according to one of claims 10 to 19, in which the predetermined arithmetic operation is a logical AND operation, characterized

- That for the creation of the digital circuit (1) a single-stage logic element with an inverted majority function IMAJ (10) for linking the first masked

Operands (OP? M _A ), the second masked operand (OP2MA) and the masking parameter (MA) are provided in order to obtain a first masked intermediate result,

that a single-stage logic element with an NOT function (11) is provided for negating the first masked intermediate result in order to obtain a masked result (REMA),

- that a one - level logic element with an inverted majority function IMAJ (12) for

Linking the first masked operand in inverted form (OP 1 MA) _{> of} the second masked operand in inverted form (OP2 _MA ) and the masking parameter in inverted form (MA) to obtain a second masked intermediate result, and

- That a one-level logic element is provided with an NOT function (13) for negating the second masked intermediate result to obtain the masked result in inverted form (RE _M A) ZU.

21. Digital circuit according to one of claims 10 to 19, in which the predetermined arithmetic operation is a logical NAND operation, characterized in that - for generating the digital circuit (1) a single-stage logic element with an inverted majority function IMAJ (20) for linking the first masked Operands (OP 1 _m ), the second masked operand (OP2 _MA ) and the masking parameter (MA) is provided in order to obtain a first masked intermediate result,

a single-stage logic element with an NOT function (21) for negating the first masked intermediate result is provided in order to obtain the masked result in inverted form (RE _M A),

- that a one - level logic element with an inverted majority function IMAJ (22) for

Linking the first masked operand in inverted form (OP 7 _MA ), the second masked operand in inverted form (OP2 MA) and the masking parameter in inverted form (MA) is provided to obtain a second masked intermediate result and

- That a one-stage logic element is provided with an NOT function (23) for negating the second masked intermediate result to get a masked result (REMA) ZU.

22. Digital circuit according to one of claims 10 to 19, in which the predetermined arithmetic operation is a logical OR operation, characterized

in that for generating the digital circuit (1) a single-stage logic element with an inverted majority function IMAJ (30) for linking the first masked operand (OP7 _MA ), the second masked operand (OP2 _M A) and the masking parameter in inverted form (MA) is provided to obtain a first masked intermediate result,

- That a one-level logic element is provided with an NOT function (31) for negating the first masked intermediate result to obtain a masked result (REM _A ), - that a single-stage logic element with an inverted majority function IMAJ (22) for

Linking the first masked operand in inverted form (OP7 MA). of the second masked operand in inverted form (OP2MA) ^ur) d of the

Masking parameter (MA) is provided to obtain a second masked intermediate result and - that a one-level logic element is provided with a NOT function (33) for negating the second masked intermediate result, to receive the masked result in inverted form (RE MA) ZU ,

23. A digital circuit according to any one of claims 10 to 19, wherein the predetermined arithmetic operation is a logical NOR operation, characterized in that - for generating the digital circuit (1) a single-level logic element with an inverted majority function IMAJ (40) for linking the first masked operand (OP7 _MA), the second masked operand (OP2MA) and the

Masking parameter in inverted form (MA) is provided in order to obtain a first masked intermediate result,

- it is provided that a single-stage logic element comprising a NOT function (41) for negating the first intermediate masked result obtained by the masked result in inverted form (RE ^MA),

- that a one - level logic element with an inverted majority function IMAJ (42) for

Linking the first masked operand in inverted form (OP 1 MA). of the second masked operand in inverted form (OP2MA) and the

Masking parameter (MA) is provided to obtain a second masked intermediate result and

- That a one-level logic element is provided with an NOT function (23) for negating the second masked intermediate result to obtain a masked result (RE _MA ) ZU.

24. Digital circuit according to one of claims 10 to 19, wherein the predetermined arithmetic operation is a logical XOR operation, characterized

- That for the creation of the digital circuit (1) a digital circuit (50) according to claim 21 for linking the first masked operand (OP7 _M A) _> the first masked operand in inverted form (OP 1 MA). of the second masked operand (OP2 _M A), the second masked operand in inverted form (OP2 MA). the masking parameter (MA) and the masking parameter in inverted form (MA) is provided in order to obtain a first masked intermediate result and the first masked intermediate result in inverted form,

- That a digital circuit (51) according to claim 21 for linking the first masked operand (OP ¹ ZMA). of the first masked operand in inverted form (OPf MA), the second masked operand (OP2 _MA ), the second masked one

Operands in inverted form (OP2 _M A). the masking parameter (MA) and the

Masking parameter in inverted form (MA) is provided to a second masked intermediate result and the second masked intermediate result in inverted form and

in that a digital circuit (52) according to claim 21 for linking the first masked intermediate result, the first masked intermediate result in inverted form, the second masked intermediate result, the second masked intermediate result in inverted form, the masking parameter (MA) and the

Masking parameter in inverted form (MA) is provided in order to obtain a masked result (RE _MA ) and the masked result in inverted form (RE MA).

Digital circuit according to one of Claims 10 to 19, in which the predetermined arithmetic operation is a logical XNOR operation, characterized

- that for the creation of the digital circuit (1) is a digital circuit (60) according to claim 21 for linking the first masked operand (OP7 _M _A)> of the first masked operand in inverted form (OP7 _MA)> the second masked operand (OP2MA) , the second masked operand in inverted form (OP 2 MA), the masking parameter (MA) and the masking parameter in inverted form (MA) is provided to obtain a first masked intermediate result and the first masked intermediate result in inverted form,

in that a digital circuit (61) according to claim 21 for linking the first masked operand (OP7 _MA ), the first masked operand in inverted form (OP1 MA), the second masked operand (OP2 _MA ), the second masked

Operands in inverted form (OP2 _MA ), the masking parameter (MA) and the

Masking parameter in inverted form (MA) is provided to obtain a second masked intermediate result and the second masked intermediate result in inverted form and - that a digital circuit (62) according to claim 21 for linking the first masked intermediate result, the first masked intermediate result in inverted Form, the second masked intermediate result, the second masked intermediate result in inverted form, the masking parameter (MA) and the

Masking parameter in inverted form (MA) is provided in order to obtain a masked result (RE _M A) and the masked result in inverted form (RE MA).

26. Digital circuit according to one of claims 10 to 19, in which the predetermined arithmetic operation is a change of the mask of an operand, characterized - That for the creation of the digital circuit (1) a single-stage logic element with a NOR function (70) and a downstream single-level logic element with an EMERGENCY function (71) for linking masked with the mask MA 7 operands (OP _MA i) and of the masking parameter in inverted form (MA7ΦMA2) can be used to obtain a first masked intermediate result,

- That a single-stage logic element with a NAND function (72) and a downstream single-level logic element with an EMERGENCY function (73) for linking masked with the mask MA 7 operands in inverted form (OP _MM ) and the

Masking parameter (MA7ΘMA2) is provided to obtain a second masked intermediate result,

- That a single-stage logic element with a NAND function (74) and a downstream single-level logic element with an EMERGENCY function (75) for linking masked with the mask MA 7 operands in inverted form (OP _MM ) and the

Masking parameter in inverted form (MA7ΘMA2) is provided to obtain a third intermediate masked result,

- That a one-level logic element with a NOR function (76) and a downstream single-level logic element with an NOT function (77) for linking the masked with the mask MA7 operand (OPM _AΪ ) and the masking parameter (MA7ΘMA2) is provided to a fourth masked intermediate result and - that a digital circuit (78) comprises a masked NAND according to claim 21 for combining the first masked intermediate result, the second masked intermediate result, the third masked intermediate result, the fourth masked intermediate result, the masking parameter (MA7ΘMA2) and the masking NAND

Masking parameter in inverted form (MA7ΘMA2) is provided in order to mask an operand (OP _MA2 ) masked with the mask MA2 and the mask masked with the mask MA2

To obtain operands in inverted form (OP _MA2 ).

Digital circuit according to one of Claims 10 to 26, characterized in that, during masking, the data values are linked in such a way that the masked data values are statistically independent of the original data value or that the output values of all single-level logic elements included in the masked circuit are statistically independent of the unmasked input values.