Abstract: A processing circuit comprises a first multiplier configured to determine three shares of the product of the first operand with a blinding value by multiplying each share of the first operand with each share of the blinding value according to a first split of the blinding value into three first shares. The processing circuit further comprises one or more first adders configured to determine, for each share of the second operand, the sum of the share of the second operand with a respective corresponding second share of the blinding value according to a second split of the blinding value into three second shares, wherein the first and second splits of the blinding value are different. The processing circuit is configured to determine shares of the product of the first operand with the second operand from the results of the first multiplier and the one or more first adders.

Abstract: A method for executing a program on a data processing device, the method comprising storing multiple program instructions and data to be processed by a processor of the data processing device in one or more memories of the data processing device; receiving, from an external data processing device, a reference value for a check of the multiple program instructions; computing a check value from the multiple program instructions for the check by way of the data processing device when the program instructions are loaded from the one or more memories into an instruction buffer memory of the data processing device or by way of read access to the instruction buffer memory after the program instructions have been loaded into the instruction buffer memory from the one or more memories; and executing at least some of the program instructions if the check value matches the received reference value.

Abstract: A data processing device may include a processor, configured to combine a first data word and a second data word of a plurality of secret data words by storing, for each of the first data word and the second data word, for an Exclusive-Or sharing of the data word into multiple partial representatives, for at least one of the partial representatives, a transformed version of the partial representative in a processor register, and, if the combination of the data words requires a partial representative of the first data word to be combined with a partial representative of the second data word that is stored in a processor register after having been transformed, combining the partial representative of the first data word with the partial representative of the second data word with a processor operation that takes into consideration that the partial representative of the second data word has been transformed.

Abstract: A circuit includes a data input that is configured to receive a data word, the data word including at least one operand which is rotated by a number of bits given by a rotation parameter, a first control input that is configured to receive the rotation parameter, a second control input that is configured to receive an indication of an operation to be performed, a first subcircuit that is configured to generate an operation- and rotation-dependent bit mask from the rotation parameter and the indication of the operation to be performed, a second subcircuit which is configured to process the at least one operand as a function of the bit mask and the operation to be performed, wherein the operand and the operation result generated by the processing remain in the rotated state, and a data output which is configured to output the operation result.

Abstract: A method is proposed for copying a source array into a target array, wherein both the source array and the target array have at least two elements, wherein each element has a value, in which the elements of the source array are copied into the target array in the sequence of a random permutation, wherein, after a step of copying an element of the source array into the target array, the source array, the target array or the source array and the target array are rotated. A device is also indicated accordingly.

Abstract: A circuit includes a data input that is configured to receive a data word, the data word including at least one operand which is rotated by a number of bits given by a rotation parameter, a first control input that is configured to receive the rotation parameter, a second control input that is configured to receive an indication of an operation to be performed, a first subcircuit that is configured to generate an operation- and rotation-dependent bit mask from the rotation parameter and the indication of the operation to be performed, a second subcircuit which is configured to process the at least one operand as a function of the bit mask and the operation to be performed, wherein the operand and the operation result generated by the processing remain in the rotated state, and a data output which is configured to output the operation result.

Abstract: According to one example embodiment, a data processing device is described, having a processing circuit which processes a data block cryptographically iteratively, starting from the received version of the data block, via a plurality of processed versions of the data block through to an output version of the data block in a plurality of successive rounds by means of an S-box. The S-box has a plurality of layers, in each case having a majority gate and an Exclusive-OR gate.

Abstract: A data processing device may include a processor, configured to combine a first data word and a second data word of a plurality of secret data words by storing, for each of the first data word and the second data word, for an Exclusive-Or sharing of the data word into multiple partial representatives, for at least one of the partial representatives, a transformed version of the partial representative in a processor register, and, if the combination of the data words requires a partial representative of the first data word to be combined with a partial representative of the second data word that is stored in a processor register after having been transformed, combining the partial representative of the first data word with the partial representative of the second data word with a processor operation that takes into consideration that the partial representative of the second data word has been transformed.

Abstract: A method is proposed for copying a source array into a target array, wherein both the source array and the target array have at least two elements, wherein each element has a value, in which the elements of the source array are copied into the target array in the sequence of a random permutation, wherein, after a step of copying an element of the source array into the target array, the source array, the target array or the source array and the target array are rotated. A device is also indicated accordingly.