A pair of a pattern of a mask and a mask pattern obtained by bit inversion of
the
mask is prepared for each round function in a data scrambler. Every time encryption
is to be performed, one mask pattern of the pair is randomly selected by a switch,
and an exclusive OR of an input to an S-box and the selected mask pattern is calculated.
In addition, an exclusive OR of an output from the S-box and bits of inverse permutation
of the mask is calculated. The exclusive ORs are calculated in advance and stored
as a table in the S-box. Furthermore, an exclusive OR of the output from each round
function and a mask is calculated and concealed. The influence of the mask is removed
by calculating the exclusive OR with the mask again on the next round.