EP2885875A1

EP2885875A1 - Method for encoding data on a chip card by means of constant-weight codes

Info

Publication number: EP2885875A1
Application number: EP14701692.7A
Authority: EP
Inventors: Julien Bringer; Victor SERVANT
Original assignee: Morpho SA
Current assignee: Idemia Identity and Security France SAS
Priority date: 2013-02-27
Filing date: 2014-01-17
Publication date: 2015-06-24
Also published as: WO2014131546A1; US20160012255A1; US9886597B2

Abstract

The invention relates to a data-processing method that includes encoding a plurality of data of n bits into code words having a predefined constant Hamming weight, characterized in that said method also includes using (4000) encryption operations or arithmetic operations on the resulting code word(s) and also in that encoding each datum includes: decomposing (100) the datum into a plurality of m bit sequences to be encoded, m strictly being less than n; encoding (300) each bit sequence into a partial code word, each having a predefined Hamming weight, such that the sum of the Hamming weights of the partial code words are equal to the Hamming weights of the code word; and concatenating (300) the partial code words such as to produce the code word corresponding to the datum. The invention also relates to a data transmission method and to an electronic circuit configured to implement said methods.

Description

METHOD OF ENCODING DATA ON A CHIP CARD BY

CONSTANT WEIGHT CODES

FIELD OF THE INVENTION

The field of the invention is that of the encoding of data in smart cards, to secure their subsequent use, particularly in cryptography applications.

STATE OF THE ART

Many electronic components, such as for example smart cards, implement calculation or comparison operations on secret data. Some applications of these operations are for example banking applications, applications for mobile telephony, etc.

Operations on the secret data can be attacked to determine said secret data.

Some of these attacks, known as "sides channels" in English or attacks on hidden channels, consist in studying the physical behavior of the electronic component, in particular in terms of electromagnetic leakage, or in terms of variations in electrical consumption, or time of reply.

Other attacks, referred to as "fault injection" attacks, have also been developed, which consist in the corruption of certain data used during a calculation implemented by the electronic component to obtain the secret data. These attacks include, for example, the bombardment of the electronic component by laser or light, the generation of parasitic electromagnetic fields, the injection of voltage peaks into the power supply of the component, etc.

To counter these types of attacks, it has been proposed to add to the secret data a random value, thus decorrelating the used data from their original value. This method is however not fully effective because it is possible, from the observation of several successive calculations, to find the original secret data. Another proposal consisted of the encoding of the secret data with so-called "constant weight" codes, that is to say codes associating with each datum a code word having a predetermined constant Hamming weight. The Hamming weight of a series of bits is the number of 1-bit bits in the series.

Thanks to this encoding, all the data used have the same Hamming weight, which also makes it possible to make the power consumption of the electronic component constant while using the data (the electrical consumption of the component depends in fact on the Hamming weight of the data used). The component is protected from hidden channel attacks.

In addition, it is possible to detect a fault injection attack if an encoded data has a Hamming weight different from the predetermined Hamming weight.

However, the encoding by constant weight codes does not currently make it possible to implement data operations encoded in a low-memory electronic component such as a smart card.

For example, we know an encoding called Dual Rail, which consists in encoding a 0 by the combination 1 -0 and a 1 by the combination 0-1. This method therefore doubles the size of the encoded bit sequence with respect to the initial data, and the implementation of operations on these encoded data is not possible on a smart card because it requires too much memory.

Similarly, patent FR2855286 discloses a method of transmitting data encoded using constant weight codes, but this method does not allow the implementation of operations on the encoded data, because these operations would still require too much data. memory as the memory available in a smart card.

PRESENTATION OF THE INVENTION

The object of the invention is to overcome the drawbacks of the prior art mentioned above, by proposing a data encoding method limiting the size of the obtained code words in order to allow the subsequent implementation of calculations based on said data. codewords on an electronic component of the smart card type. The invention also aims to provide a data encoding method for resisting concealed channel type attacks or for detecting fault injection attacks. In this regard, the subject of the invention is a data processing method comprising the encoding of a plurality of n-bit data into code words having a predefined constant Hamming weight,

the method being characterized in that it further comprises the implementation of encryption operations or arithmetic operations on the obtained code word or words, and in that the encoding of each data item comprises:

decomposing the data into a plurality of m sequences of bits to be encoded, m being strictly less than n,

encoding each bit sequence into a partial codeword each having a predefined Hamming weight so that the sum of the Hamming weights of the partial codewords is equal to the Hamming weight of the code word, and

concatenating the partial code words to obtain the code word corresponding to the data item. Advantageously, but optionally, the treatment method according to the invention may further comprise at least one of the following characteristics: the size of the codeword obtained is strictly less than 2n bits.

the size n of the data is a power of 2 bits.

the size of the bit sequences is a power of 2 bits.

the data comprises 4 bits, each data being decomposed into a 3-bit sequence, and a one-bit sequence, the first sequence being coded into a 5-bit partial codeword and a Hamming weight equal to 2 or 3, and the remaining bit is encoded into a 2-bit size partial codeword and a Hamming weight equal to 1.

the data comprises 8 bits, the method comprising the decomposition of each data into two 4-bit sequences, the two 4-bit sequences being coded in two partial code words of 6 bits and a weight of

Hamming equal to 3. The encoding is implemented by a first processing unit, the method further comprises transmitting to the second processing unit at least one code word obtained from the or the data, and the encryption operations or the arithmetic operations are carried out on said at least one code word by the second processing unit, the method furthermore comprises verifying, by the second processing unit, the value of the Hamming weight of the received codeword, the implementation of the arithmetic operations or the encryption operations is performed on at least one code word, and outputs the coded result of the operation applied to the data item corresponding to the code word.

the arithmetic operations or the encryption operations comprise linear operations applied to at least one code word, and the implementation of a linear operation comprises:

the generation of at least one table taking as input at least one partial code word, and producing as output the result of the operation applied to the partial code word (s),

o the decomposition of each codeword on which the operation is implemented in partial code words, and

o the calculation of the operation by applying the partial code words to the tables, and the concatenation of the results obtained,

the arithmetic operations or the encryption operations are non-linear, and the implementation of a non-linear operation comprises:

the generation of at least one table taking as input at least one partial code word of at least one code word, and outputting the coded result of the operation applied to at least one complete piece of data from which they are drawn; partial code words,

o the calculation of the operation by applying the partial code words to the tables.

the cryptographic operations or arithmetic operations of the cryptographic algorithm processing steps, the calculation algorithms of hash functions, or integrity calculation algorithms adapted to receive said code words as input.

The invention also relates to an electronic circuit comprising:

an encoding module comprising a processing unit adapted to encode n-bit data into code words having a predefined constant Hamming weight and to implement on said code words encryption operations or arithmetic operations by the implementation of the treatment method described above.

Advantageously, but optionally, the electronic circuit according to the invention may further include the following features: the encoding module further comprises data transmission means, and the circuit further comprises:

a decoding module comprising a processing unit adapted to decode a code word transmitted by the first module, and

an error signal generating module adapted to generate an error signal when the Hamming weight of a code word transmitted by the first module is different from a predefined Hamming weight.

The invention finally relates to a smart card comprising such an electronic circuit.

The proposed processing method includes encoding data into code words of sufficiently small size that algorithms can be implemented on said code words, even in low memory computing units such as smart cards.

In addition, the use of constant weight codes makes it possible to secure the data against hidden channel attacks such as attacks named SPA, DPA, MIA, CPA, ASCA, because the power consumption of the smart card is the same for all the data used.

In addition, the use of constant weight codes makes it possible to detect certain fault injection attacks such as laser pulse attacks. DESCRIPTION OF THE FIGURES

Other features, objects and advantages of the present invention will appear on reading the detailed description which follows, with reference to the appended figures, given by way of non-limiting examples and in which:

FIG. 1 schematically represents an example of an electronic component processing one or more secret data,

Figure 2 shows the main steps of an embodiment of an encoding method.

Figure 3 shows an example of implementation of the encoding method.

Figure 4 shows the main steps of an exemplary implementation of a data processing method.

DETAILED DESCRIPTION OF AT LEAST ONE MODE OF IMPLEMENTATION

Data encoding computer unit

Referring to Figure 1, there is shown an example of a computer unit that can encode data, including secret data and perform operations from said data. This computer unit is advantageously a smart card 1, which comprises an electronic circuit comprising an encoding module 10 and a decoding module 20. Alternatively, the encoding module and the decoding module can belong to two separate computer units connected. between her to authorize a data communication.

The encoding module 10 is advantageously integrated with a processor of the smart card, and the decoding module can be integrated with a peripheral such as a memory or a coprocessor of the smart card.

The encoding module 10 comprises data transmission means, for example a data communication bus 1 1, and a processing unit 12, adapted to implement encryption and encryption operations on data, said unit being advantageously an arithmetic and logical unit (ALU). An arithmetic and logic unit is an integrated circuit in a processor allowing the implementation of calculations on the data. The module 20 comprises data receiving means 21 such as a data receiving bus, as well as a processing unit 22, configured to decode data received from the encoding module, the unit being advantageously an arithmetic and logical unit. 22.

Data encoding method

With reference to FIG. 2, the processing unit 12 of the encoding module 10 is adapted to encode a plurality of data, in particular secret data, so that these data are not obtained during their use by an attack. by hidden channels.

For a data D of size equal to n bits, where n is a power of 2, the encoding method 1000 comprises a step 100 of splitting the data into several sequences of bits of size less than n, advantageously in m sequences of bits di, ..., d _m , m being strictly less than n. There is therefore at least one sequence of bits comprising at least two bits. This decomposition of the data is a partition, that is to say that no bit of the data is present in two sequences of bits.

This decomposition makes it possible to reduce the size of each bit sequence for the subsequent calculation of binary operations with two operands, such as for example the exclusive or.

The bit sequences obtained have a size equal to a power of two bits. This makes it possible to obtain a good compromise between the fault detection capability and the memory occupied by the method. For example, in Figure 3, there is shown a data D of a length of n = 8 bits, divided into two bit sequences di, d ₂ of 4 bits each.

In another example, a data length of n = 4 bits is split into two sequences of 2 bits each.

During a step 200, the processing unit encodes the data by means of a constant weight code to obtain a corresponding code word M, having a constant and determined Hamming weight ω. In the following, we denote by x, y-code the function that transforms a data into a Hamming weight data "x" on "y" bits. The picture set of

also note "x _\ , y _\ - x ₂ , y ₂ - code" the coding of a first part of a data by an x, y - code and its second part by an x ₂ , y ₂

The image set of this function therefore contains () x () elements.

According to the preceding notation, the processing unit implements, to carry out the encoding of the data, an encoding of the type x ₀ , y ₀ - x _\ , y _\ ^x m _> ym - code, where m> 0 is the number of bits in which the data has been decomposed. In other words, the processing unit encodes in step 200, by means of a constant weight coding, each bit sequence di, ..., d _m of the data to form a word of partial code corresponding mi, ... m _m .

Returning to the example of FIG. 3, the bit sequences di, d ₂ are each encoded by means of a 3.6-code to obtain respective code words mi, m ₂ .

The code word M corresponding to the total datum D is the concatenation of the partial code words mi, ... m _m! performed by the processing unit during a step 300.

Very advantageously, the sum of y _m, that is to say, the lengths (in bits) of the partial codewords, corresponding to the total bit length of the received codeword, is strictly less than 2n. This makes it possible to obtain a code word that is more accurate than in particular in the Dual Rail process, which makes it easier to implement in a low-memory computer system such as a smart card.

Examples of preferred codes for the implementation of the method are also given; in the case where the size of the data D to be encoded is 4 bits, a 3.5-1, 2-code or a 2.5-1, 2-code, permutation of the first and second codes is preferably used. close, that is to say that the data D is decomposed into a sequence of 3 bits, then a bit. The first sequence being encoded into a 5-bit size partial codeword and a Hamming weight of 2 or 3, and the remaining bit being encoded into a 2-bit size partial codeword and a Hamming weight equal to 1 . In the case where the size of the data D to be encoded is 8 bits, a 3.6-3.6-code is preferably used, the data D is decomposed into two 4-bit bit sequences, each coded as one 6-bit partial code word and Hamming weight equal to 3, as in the example of Figure 3.

Data processing method

The data encoding method 1000 described above allows the secure transmission of secret data from one module to another, for their subsequent use, for example during encryption operations.

It also allows the implementation of encryption operations and / or arithmetic operations on the encoded data by processing units with low computing capacity such as smart cards.

FIG. 4 shows a data processing method comprising the encoding, the transmission and the subsequent exploitation of the transmitted data.

In the example of a smart card comprising an encoding module 10 and a decoding module 20 as illustrated in FIG. 1, a first data transmission step comprising encoding 1000 of said data by the processing unit 12 encoding module 20.

During a step 2000, the data communication bus 11 transfers to the reception bus 21 of the decoding module 20 the code words obtained by the encoding of the data.

Advantageously, the smart card may also include an error signal generating module 30, which may be integrated with or connected to the decoding module (as illustrated in FIG. 1). Advantageously, but optionally, this module 30 verifies during a step 3000 that the Hamming weight of the codewords transmitted by the encoding module is equal to the constant Hamming weight ω which is agreed before the implementation of the method. of transmission.

If the Hamming weight of a code word differs from the Hamming weight ω, or if the received code word does not conform to the expected word (although having the Hamming weight ω) the module 30 detects a signal of error during a step 3100. The step of checking the Hamming weight makes it possible in particular to detect an attack by fault injection, which would have the effect of modifying the Hamming weight of the transmitted data.

If the Hamming weight is within the expected weight, the processing unit

22 decodes the codewords and / or exploits them to implement an encryption operation or an arithmetic operation, for example of Boolean type, during a step 4000.

The results of the arithmetic or encryption operations applied to the uncoded data can be obtained from the code words generated from said data, as described hereinafter.

Alternatively, the decoding and / or exploitation 4000 of the code words to implement an encryption operation is performed without first checking the accuracy of the codewords.

Alternatively, the encryption operations 4000 and / or the arithmetic operations can be performed by the first processing unit without or before a data transmission step 2000 to the second processing unit is implemented.

For example, an encryption operation may be a step of a cryptographic algorithm such as AES (for "Advanced Encryption Standard" or "Advanced Encryption Standard") or LED, an algorithm for calculating a function such as for example SHA-1, SHA-2 or the future SHA-3, or an integrity calculation algorithm such as cyclic redundancy check (known by the acronym "CRC") or the LRC ( acronym of

"Longitudinal redundancy check"), such an algorithm having been previously adapted to receive as input the codewords obtained by the method described above.

Several types of adaptations can be made depending on the nature of the operations implemented in the algorithms.

In many algorithms, arithmetic operations are pre computed as tables or truth tables.

In the case where the encryption functions are non-linear functions, the adaptation of the function to the codewords consists in taking up the pre-calculated tables and adapting them to the calculation by taking as inputs and outputs the values corresponding to the codewords. on which the calculation is made. In other words, at least one table is generated having as inputs the partial codewords on the basis of which the calculation or the complete code word is performed, and outputting the coded result of the operation applied to the non-coded complete data, which is the concatenation of the bit sequences from which the partial codewords are derived . The operation is therefore applied to all the partial codewords.

For example, A is a datum comprising the concatenation of two sequences of bits of ₀ , ai of respective sizes L ₀ and Li. B is a datum comprising the concatenation of two sequences of bits b ₀ , b ₁ , of respective sizes L ₀ and Li.

We denote A = ai || a ₀ , and B = bi || b ₀ , where "|| Is the concatenation symbol.

Let K _{0 be} a code taking L ₀ input bits outputting a codeword of size lk ₀ bits, and Ki a code taking L-ι bits as input, and outputting a codeword of size lk-ι bits .

We notice || K ₀ (a ₀ ), and CW (B) = K i (bi) || K ₀ (b ₀ ), which are of size Iko + lki bits.

A first example of calculating a nonlinear operation is given for a single operand function. By calling this function "NLF", one pre-calculates a table T_NLF giving:

T_NLF [CW (A)] = CW (NLF (A)).

In other words, T_NLF is a table taking as input a complete code word CW (A) and outputting the codeword obtained by an identical encoding of the image of A by the NLF function.

A second example is given for the computation of a function with two operands, for example the addition modulo 2 ^{L0 + L1} .

We generate three tables defined as follows:

- ADD-K ₀ [K ₀ (a), K ₀ (b)] = K ₀ [(a + b) modulo 2 ^L0 ]

This table takes as inputs two data coded by K ₀ , and outputs the remainder of the Euclidean division of the sum of the two data by 2 ^L0 , encoded by K ₀ .

REM-K ₀ [K ₀ (a), K ₀ (b)] = K, [(a + b) / 2 ^L0 ] This table takes as input two data coded by K ₀ , and produces the quotient of the Euclidean division of the sum of the two data by 2 ^L0 , coded by

- ADD-Ki [Ki (a) H Ki (b)] = Ki [(a + b) modulo 2 ^L1 ]

This table takes as input two data encoded by K1, and produces the rest of the Euclidean division of the sum of the two data by 2 ^L1 , encoded by K1.

We will now describe obtaining CW (A + B modulo 2 ^{L0 + L1} ) starting from CW (A) and CW (B).

CW (A + B modulo 2 ^{L0 + L1} ) is the encoding of A + B modulo 2 ^{L0 + L1} . By repeating the same notations as before:

A + B = ai || a ₀ + bi || b ₀ = (ai + bi). 2 ^L0 + a ₀ + b ₀

That we can note: X. 2 ^{L0 + L1} + Y. 2 ^L0 + R ₀ , hence A + B mod 2 ^{L0 + L1} : Y. 2 ^L0 + R ₀ .

Or :

R ₀ is the result of a ₀ + b ₀ modulo 2 ^L0 , that is the remainder of the Euclidean division of a ₀ + b ₀ by 2 ^L0

X is the quotient of the Euclidean division of a + b by 2 ^{L0 + L1}

Y is the result of a + b modulo 2 ^{L0 + L1} , that is to say the rest of the Euclidean division of a + b by 2 ^{L0 +} L1, which decomposes into C ₀ + Ri, where C ₀ is the quotient of the Euclidean division of a-i + bi by 2 ^L1 , and R-ι is the retention of the addition to ₀ + b ₀ modulo 2 ^L0 .

CW (A + B modulo 2 ^{L0 + L1} ) is therefore equal to K ₁ (Y) + K ₀ (R ₀ ). To obtain it from CW (A) and CW (B), one calculates, with the tables introduced above:

Ko (Ro) = ADD-K ₀ [KB (a ₀ ), b ")]

Ki (Co) = REM-K ₀ [K ₀ (a ₀ ), K ₀ (b ₀ )]

K ₁ (R ₁ ) = ADD-K ₁ [K ₁ (a ₁ ), K, (b)]

We then have CW ((A + B) modulo 2 ^{L0 + L1} ) = K ₁ (Y) || K ₀ (R ₀ ).

In the case where the encryption functions are linear functions, this adaptation step for the operation or the decoding of the codewords can for This can be done by decomposing the code word M into the partial code words mi,. . . , m _m that compose it, and performing the operation on each of the partial codewords before concatenating the results obtained.

In the case of a multi-operand function, each code word on which the operation is implemented is decomposed into its partial code words, and the operation is applied separately to the corresponding partial code words of each code word.

For example, the implementation of an "exclusive" (XOR) type operation on two coded data includes the implementation of "or exclusive" operations on each partial code word.

With the same notation as above, XOR-K ₀ denotes the function or exclusive applied to two concatenated data, encoded by K ₀ , and which returns their XOR in representation coded by K ₀ . Likewise with XOR- ^ which applies to data coded by Ki and returns their XOR in representation coded by Ki.

XOR-K ₀ [KB (a), K ₀ (b)] = K ₀ [a XOR b]

The result of A XOR B in coded form is thus calculated as follows:

R ₀ = XOR-KB [KB (a "), KB (b")]

Ri = XOR-Ki [Ki (a1), Ki (bi)]

R is of the same form as CW (A) and CW (B), that is to say the concatenation of two codewords coded respectively by Ki and K ₀ .

In the present case, the pre-calculated tables have sizes adapted to those of the partial codewords used for the arithmetic operations. By way of nonlimiting example, for code words M of type 2.5-1, 3-2, 5-code, on which it is desired to carry out an "exclusive" operation, two tables of type "A" are precalculated. XOR B ", one for A and B of Hamming weights

2 on a size of 5 bits, and one for A and B of Hamming weight 1 on a size of

3 bits.

In the same way, if the processing unit wants to decode the code words, it separates each code word M into the partial code words m, m _m , and implements on each partial code word a decoding corresponding to the encoding implemented to obtain them. The decoding algorithm depends of course on the encoding algorithm used beforehand. By way of non-limiting examples, other possibilities of encoding and decoding are described below in the context of the method described above.

According to a first example, it is sought to encode data of a starting set E containing the integers from 0 to 15, that is to say the binary integers represented on 4 bits.

The set of words of weight 3 among 6 bits is chosen as the arrival code, which is the following: {7, 1 1, 13, 14, 19, 21, 22, 25, 26, 28, 35, 37, 38, 41, 42, 44, 49, 50, 52, 56). This set has 20 elements; it is therefore adapted to encode the set E which contains 16. We denote by J the set of the first 16 elements of the preceding code. In binary J = [1 1 1, 101 1, 1 101, 1 1 10, 1001 1, 10101, 101 10.1 1001, 1 1010, 1 100, 10001 1, 100101, 1001 10, 101001, 101010, 101 100].

At the element E [a] ("a-th" element of E) is associated the element J [a].

If the table J is kept in memory, then we obtain the coding process, which is a simple access to a table. A word "a" is coded by accessing in memory the value J [a].

To decode, we create the table K, of size 2 ⁶ elements (= 64), which at the location J [i], i ranging from 0 to 15, will take the value of i.

We then have K [J [i]] = i, so the decoding of the code word of "i" makes it possible to obtain "i" itself.

The table K is then written [X, X, X, X, X, X, X, O, X, X, X, 1, X, 2, 3, X, X, X, X, 4,

X, 5, 6, X, X, 7, 8, X, 9, X, X, X, X, X, X, 10, X, 1, 12, X, X, 13, 14, X, 15 , X, X, X, X, X, X, X, X, X, X, X, X, X, X, X, X, X, X, X], where X is a value that is not in the starting set E.

For an 8-bit word M that it is desired to code, this word is split into two sequences of 4 bits each, each encoded on 6 bits as described above, then the partial codewords obtained are concatenated.

For operations on the codeword, a table is prepared which receives the partial codewords as input and outputs the result of the operation applied to the concatenation of the partial codewords.

Other possibilities of encoding and decoding data applicable in the context of the present invention are known and within the scope of the skilled person.

Claims

1. A data processing method comprising encoding a plurality of n-bit data (D) into code words (M) having a predefined constant Hamming weight,

the method being characterized in that it further comprises the implementation (4000) of encryption operations or arithmetic operations on the obtained code word or words, and in that the encoding of each data item (D ) includes:

decomposing (100) the data into a plurality of m bit sequences (di, ..., d _m ) to be encoded, m being strictly less than n,

encoding (300) each bit sequence into a partial code word each having a predefined Hamming weight, so that the sum of the Hamming weights of the partial code words (mi, ..., m _m ) is equal the Hamming weight of the codeword (M), and

the concatenation (300) of the partial code words (mi, ..., m _m ) to obtain the code word (M) corresponding to the data item (D).

2. Processing method according to claim 1, wherein the size of the codeword obtained is strictly less than 2n bits.

3. Processing method according to one of claims 1 or 2, wherein the size n data (D) is a power of 2 bits.

4. Processing method according to one of the preceding claims, wherein the size of the bit sequences (di, ..., d _m ) is a power of 2 bits.

5. Processing method according to one of the preceding claims, wherein the data (D) comprises 4 bits, each data being decomposed into a sequence of 3 bits, and a sequence of one bit, the first sequence being coded in one partial code word of size 5 bits and Hamming weight equal to 2 or 3, and the remaining bit being coded in a partial code word of size 2 bits and Hamming weight equal to 1.

6. Processing method according to one of claims 1 to 4, wherein the data comprises 8 bits, the method comprising the decomposition of each data into two 4-bit sequences, the two 4-bit sequences being coded in two words of 6-bit partial code and Hamming weight equal to 3.

Data processing method according to one of the preceding claims, the encoding (1000) being implemented by the first processing unit (12), the method further comprising transmitting (2000) to the second processing unit (12). processing (22) at least one code word (M) obtained from the data or data (D) and the encryption operations or the arithmetic operations being implemented on said at least one codeword (M) by the second processing unit (22).

The data processing method according to the preceding claim, further comprising verifying (3000), by the second processing unit (22), the value of the Hamming weight of the received code word.

9. Data processing method according to one of the preceding claims, wherein the implementation of arithmetic operations or encryption operations is performed on at least one code word, and output the coded result of the operation. applied to the data corresponding to the code word.

Data processing method according to one of the preceding claims, wherein the arithmetic operations or the encryption operations comprise linear operations applied to at least one code word, and the implementation of a linear operation comprises:

generating at least one table taking as input at least one partial code word, and outputting the result of the operation applied to the partial code word (s),

decomposing each codeword on which the operation is implemented into partial code words, and

calculating the operation by applying the partial codewords to the tables, and concatenating the results obtained.

1 1. Data processing method according to one of Claims 1 to 9, in which the arithmetic operations or the encryption operations are non-linear, and the implementation of a non-linear operation comprises:

generating at least one table taking as input at least one partial codeword of at least one codeword, and outputting the coded result of the operation applied to at least one complete data from which the words are derived partial codes,

calculating the operation by applying the partial codewords to the tables.

Data processing method according to one of the preceding claims, in which the encryption operations or the arithmetic operations are cryptographic algorithm processing steps, hashing function calculation algorithms, or algorithms of algorithms. Integrity calculation adapted to receive as input said code words.

An electronic circuit comprising an encoder module (10) having a processing unit (12) adapted to encode n-bit data into code words having a predefined constant Hamming weight and to implement on said code of the encryption operations or arithmetic operations by the implementation of the method according to one of claims 1 to 12.

An electronic circuit according to claim 13, wherein the encoding module (10) further comprises data transmission means (1 1), and the circuit further comprises:

a decoding module (20) comprising a processing unit (22) adapted to decode a code word transmitted by the first module, and an error signal generating module (30) adapted to generate an error signal when the Hamming weight of a code word transmitted by the first module is different from a predefined Hamming weight.

15. Smart card (1) comprising an electronic circuit according to one of claims 13 or 14.