RU2295199C1 - Method for generation of encryption/decryption key - Google Patents

Abstract

FIELD: cryptography, possible use as separate element during construction of symmetric cryptographic systems, meant for transferring encrypted speech, sound, television and other messages.

SUBSTANCE: for realization of method at transferring side of communication guiding a random series is generated in form of three blocks X₁,X₂,X₃ with lengths of k₁,k₂,k₃ respectively. Series is transferred with errors via communication channel (Y₁,Y₂,Y₃ - received blocks). Blocks of checking symbols C₁ and C₂ are formed for blocks X₁ and X₂. Message S_C1+C2 is formed by concatenating blocks C₁ and C₂. Authenticator w for received message is formed, using a checking code and block Y₃. Blocks of checking symbols C₁ and C₂ are selected from received message S_C1+C2. from blocks Y₁, Y₂ received in advance via communication channel with errors and blocks of checking symbols C₁ and C₂ decoded blocks

. Encryption/decryption keys are generated at receiving and transferring communication guiding sides by hashing block X₁ at transferring communication guiding side and decoded block

at receiving communication guiding side.

EFFECT: decreased time consumed by generation of encryption/decryption key, increased resistance of generated encryption/decryption key to discrediting by a violator.

6 cl, 37 dwg

Description

The invention relates to the field of cryptography, in particular to the formation of an encryption / decryption key (CLSD), and can be used as a separate element in the construction of symmetric cryptographic systems designed to transmit encrypted speech, sound, television and other messages.

The proposed method for generating CDS can be used in cryptographic systems if there is no or loss of crypto connection (Crypto connection is the presence of the same CSD between the legitimate parties) between the legitimate parties in the direction of communication (legitimate parties of the National Assembly - that is, authorized participants in the exchange of information) (NS) or establishment cryptocurrencies between new legitimate parties of the National Assembly (ZSNS) when the violator conducts the interception, modification and substitution of information transmitted through open communication channels.

There is a known method for the formation of CLSD described in the book of W. Diffie "The First Ten Years of Public Key Cryptography", TIIER, 1988, v. 76, No. 5, pp. 57-58. The known method consists in the preliminary distribution between the legal parties of the direction of communication of the numbers α and β, where α is a prime number and 1≤β≤α-1. The transmitting side of the NS (PerSNS) and the receiving side of the NS (PrSNS), independently from each other, choose random numbers X _A and X _B, respectively, which are kept secret and then form numbers based on X _A , α, β on PersNS and X _B , α, β on PrSNS. ZSNS exchange the received numbers on communication channels without errors. After receiving the numbers of correspondents, the legal parties convert the received numbers using their secret numbers into a single CLSD. The method allows you to encrypt information during each communication session on new CLSD (that is, excludes the storage of key information on media) and relatively quickly form CLDS using one unprotected communication channel.

However, the known method has low resistance to CLSD to compromise (Resistance to CLSD to compromise is the ability of the cryptographic system to resist attempts by an intruder to obtain CLSD, which is generated and used by the legitimate parties of the National Assembly, when the intruder uses information about CLSD obtained from interception, theft and loss of media, disclosure , analysis, etc.), the operation time of the CL is limited by the duration of one communication session or part thereof, an incorrect distribution of the numbers α and β leads to impossible ti KlShD formation.

There is also a known method for generating CLD using a quantum communication channel [US Patent No. 5515438, H 04 L 9/00 of 05/07/96], which allows the automatic formation of CLD without additional measures for sending (delivering) a preliminary sequence. The known method consists in using the uncertainty principle of quantum physics and generates a CDS by means of photon transmission through a quantum channel. The method provides receiving CWSD with high resistance to compromise, provides guaranteed control of the presence and degree of interception of CWSD.

However, the implementation of the known method requires high-precision equipment, which leads to the high cost of its implementation. In addition, CLSh by this method can be formed using fiber-optic communication lines of limited length, which significantly limits the scope of its application in practice.

Closest to the technical nature of the claimed method for the formation of CLSD is the method of forming CLSD based on the information difference [RF Patent No. 2183051, H 04 L 9/00 of 05/27/02].

The prototype method consists in generating an initial sequence (IP), encoding it, extracting a block of check symbols from the encoded source sequence, transmitting it over the communication channel without errors and generating a decoded sequence, and the encryption / decryption key is formed from the original and decoded sequences.

To form the IP L times, where L> 10 ⁴ is the selected primary length of the initial sequence, a noisy block of binary symbols is formed on the transmitting side of the communication direction. A noisy block of binary symbols is transmitted over the communication channel with errors to the receiving side of the communication direction. A random bit is generated at the receiving side of the communication direction. A codeword is formed from a random bit. A noisy codeword (CKS) is generated by bitwise summation modulo 2 of the received noisy binary symbol block and the generated codeword. A noisy codeword is transmitted over the reverse communication channel without error to the transmitting side of the communication direction. On the transmitting side of the communication direction, a received codeword is formed from a noisy codeword by bitwise summing modulo 2 of a noisy binary symbol block and a noisy codeword. The received bit and the confirmation bit F are formed from the received codeword. The confirmation bit is transmitted on the forward channel without errors to the receiving side of the communication direction. When the confirmation bit F is equal to zero, the generated random bit and the received bit are erased respectively on the receiving and transmitting sides of the communication direction. When the confirmation bit F is equal to one, the generated random bit and the received bit are stored respectively on the receiving and transmitting sides of the communication direction as i elements, where i = 1, 2, 3, ..., LU, the initial and preliminary sequences, where U is the number of erased characters in the formation of the initial and preliminary sequences. The decoded sequence on the transmitting side of the communication direction is formed from a preliminary sequence. After the initial and decoded sequences are generated, the hashing function of the sequences is formed on the transmitting side of the communication direction. The sequence hashing function is transmitted over the forward communication channel without errors to the receiving side of the communication direction. The encryption / decryption keys on the receiving and transmitting sides of the communication direction are generated by hashing the original and decoded sequences using the sequence hashing function generated on the transmitting side of the communication direction. Then, on the receiving side of the communication direction, the original sequence is erased. On the transmitting side of the communication direction, the decoded and preliminary sequences are erased. The initial sequence on the receiving side of the communication direction is encoded by a linear block systematic binary noise-immunity (N, K) code, the generating matrix of which has dimension K × N, with N> K. When encoding the original sequence, it is preliminarily divided into Y subblocks of length K of binary symbols, where Y = (LU) / K. Then, sequentially, starting from the 1st to the Yth of each j-th subunit, where j = 1, 2, 3, ..., Y, form the j-th code block with a length of N binary characters by multiplying the j-th subunit on the generating matrix. From the j-th code block, the j-th sub-block of check symbols with a length of N-K binary characters is extracted. The j-th sub-block of check symbols is stored as the j-th sub-block of the block of check symbols of the encoded source sequence. The sizes K and N of the generating matrix of a linear block systematic binary noise-immunity (N, K) code are chosen K = 2 ^m -1-m and N = 2 ^m -1, where m≥3. When generating a noisy binary symbol block (BAC) on the transmitting side of the communication direction, every ith bit of the noisy binary symbol block, where i = 1, 2, 3, ..., M + 1, is randomly generated, where M≥1. To generate a codeword, the generated random bit is repeated M times, where M≥1. The received bit is assigned the value of the first bit of the received codeword. To form a confirmation bit F, the first bit of the received codeword is compared with the subsequent M bits of the received codeword. Then, if there are M matches of the first bit of the received codeword with M bits of the received codeword, the confirmation bit F is assigned a value of one. If there is at least one mismatch of the first bit of the received codeword with M bits of the received codeword, the confirmation bit F is assigned a value of zero. To form a decoded sequence on the transmitting side of the communication direction, the preliminary sequence is decoded by a linear block systematic binary noise-resistant (N, K) code, the verification matrix of which has the dimension (N-K) × N, with N> K. When forming the decoded sequence, the preliminary sequence and the block of check symbols of the encoded source sequence are divided into Y corresponding pairs of decoded sub-blocks and sub-blocks of check symbols, where Y = (LU) / K. The lengths of the decoded subblocks and subblocks of the check symbols are selected equal to K and N-K binary symbols, respectively. Then, Y received code blocks with a length of N binary symbols are formed by concatenating to the jth decoded subunit of the jth subunit of verification symbols to the right, where j = 1, 2, 3, ..., Y. Then, sequentially, starting from the 1st to Yth, calculate the jth syndrome S of length N- K binary characters by multiplying the jth received code block by the transposed check matrix. According to the obtained jth syndrome S, errors in the jth decoded subunit are corrected. Then, the jth decoded subblock is stored as the jth subblock of the decoded sequence. Select the sizes K and N of the verification matrix of the linear block systematic binary noise-immunity (N, K) code K = 2 ^m -1-m and N = 2 ^m -1, where m≥3. The hashing function of the sequences on the transmitting side of the communication direction is formed in the form of a binary matrix G of dimension (LU) × T, where T≥64 is the length of the generated encryption / decryption key. Each of the elements of the binary matrix G is randomly generated. The sequence hashing function is transmitted sequentially, starting from the 1st through the (LU) th row of the binary matrix G. When generating the encryption / decryption key, the binary matrix G and the initial sequence are divided into W of the corresponding pairs of P × T dimension submatrices on the receiving side of the communication direction where P = (LU) / W, and subblocks of the original sequence of length B of binary characters. When generating the encryption / decryption key previously on the transmitting side of the communication direction, the binary matrix G and the decoded sequence are divided into W of the corresponding pairs of submatrices of dimension P × T, where P = (LU) / W, and subblocks of the decoded sequence of length B of binary symbols. Then, starting from the 1st to the Wth, the zth primary key of length T of binary symbols is calculated, where z = 1, 2, 3, ..., W, by multiplying the zth subblock of the original sequence by the zth submatrix With _z on the receiving side of the communication direction and the zth subblock of the decoded sequence on the zth submatrix G _z on the transmitting side of the communication direction. An encryption / decryption key is formed by bitwise summing modulo two W primary keys on the receiving and transmitting sides of the communication direction.

The disadvantage of the prototype of the claimed method is the long time for the formation of CLSD, which is explained by the need to transfer the hashing function over the communication channel without errors. The known method has a relatively high probability of imposing false messages by the intruder, which is explained by the use of an additional authentication procedure. Error-free channels used in the prototype method are considered protected by authentication methods of received messages (Message authentication - authentication process (lack of falsification or distortion) of arbitrary messages received from a communication channel.), Which requires the presence of authentication keys from correspondents before the implementation of the method the formation of CLS. For this reason, correspondents who do not have authentication keys cannot form a CLS, which provides resistance to compromise, due to the high probability of the intruder imposing false messages.

The purpose of the claimed technical solution is to develop a method for generating CLSD, which reduces the time required for the formation of CLSD, and increases the resistance of the formed CLSD to compromise by the intruder.

, где l - длина формируемого ключа шифрования/дешифрования, (N, К) и (N_a, K_a) - предварительно заданные на передающей и приемной сторонах направления связи линейные блоковые систематические двоичные помехоустойчивые коды, порождающие матрицы которых имеют соответственно размерности К×N и К_a×N_a, причем N>К и N_a>К_а. Передают по каналу связи с ошибками три блока Х₁, Х₂, Х₃, которые принимают на приемной стороне направления связи в виде блоков Y₁, Y₂, Y₃. Формируют на передающей стороне направления связи для первого Х₁ и второго X₂ блоков блоки проверочных символов С₁ и С₂ с длинами r₁ и r₂ соответственно, где

и

. Затем формируют сообщение

длиной (r₁+r₂) путем конкатенации блоков проверочных символов C₁ и С₂. После чего формируют аутентификатор w для сообщения

. Передают сообщение

и его аутентификатор w по каналу связи без ошибок на приемную сторону направления связи. На приемной стороне направления связи формируют аутентификатор w' для принятого сообщения. А также формируют вектор V путем суммирования по модулю два принятого w и сформированного w' аутентификаторов. Вычисляют вес w(V) вектора V путем подсчета его ненулевых элементов и сравнивают полученный вес w(V) с предварительно заданным пороговым значением веса w(V)_пор. При w(V)>w(V)_пор процесс формирования ключа шифрования/дешифрования прерывают, а при w(V)<w(V)_пор на приемной стороне направления связи из принятого сообщения

выделяют блоки проверочных символов С₁ и С₂, путем разбиения принятого сообщения

на две равные части. На приемной стороне направления связи из ранее принятых по каналу связи с ошибками блоков Y₁, Y₂ и блоков проверочных символов C₁ и С₂ формируют декодированные блоки

После чего формируют ключи шифрования/дешифрования на приемной и передающей сторонах направления связи путем хэширования блока X₁ на передающей стороне направления связи и декодированного блока

на приемной стороне направления связи.This goal is achieved by the fact that in the known method of generating CLSD, which consists in generating a random sequence on the transmitting side of the communication direction, transmitting it via the communication channel with errors to the receiving side of the communication direction, forming a block of check symbols for the generated random sequence, transmitting it through the communication channel without errors to the receiving side of the communication direction, where a decoded sequence is formed, and from random and decoded sequences form spanner encryption / decryption random sequence on the transmission side communication direction is formed as three blocks X _1, X _2, X _3, with lengths k _1, k _2, k _3, respectively. Moreover, k ₁ > l, k ₁ = k ₂ ,

, where l is the length of the generated encryption / decryption key, (N, K) and (N _a , K _a ) are linear block systematic binary noise-resistant codes pre-defined on the transmitting and receiving sides of the communication direction, the generating matrices of which have corresponding dimensions K × N and K _a × N _a , with N> K and N _a > K _a . Three blocks X ₁ , X ₂ , X ₃ , which are received on the receiving side of the communication direction in the form of blocks Y ₁ , Y ₂ , Y ₃ , are transmitted over the communication channel with errors. Forms on the transmitting side of the communication direction for the first X ₁ and second X ₂ blocks are blocks of check symbols C ₁ and C ₂ with lengths r ₁ and r _2, respectively, where

and

. Then form a message

length (r ₁ + r ₂ ) by concatenating blocks of check symbols C ₁ and C ₂ . Then form the authenticator w for the message

. Send message

and its authenticator w over the communication channel without errors to the receiving side of the communication direction. At the receiving side of the communication direction, an authenticator w ′ is formed for the received message. And also form a vector V by summing modulo two received w and formed w 'authenticators. The weight w (V) of the vector V is calculated by counting its nonzero elements and the resulting weight w (V) is compared with a predetermined threshold weight value w (V) of the _pores . When w (V)> w (V) _then the encryption / decryption key generation process is interrupted, and when w (V) <w (V) _then on the receiving side of the communication direction from the received message

blocks of check symbols C ₁ and C ₂ are allocated by splitting the received message

into two equal parts. On the receiving side of the communication direction from the previously received through the communication channel with errors blocks Y ₁ , Y ₂ and blocks of check symbols C ₁ and C ₂ form decoded blocks

After that, encryption / decryption keys are formed on the receiving and transmitting sides of the communication direction by hashing the block X ₁ on the transmitting side of the communication direction and the decoded block

on the receiving side of the communication direction.

For the formation of ₁ block length r parity block ₁ X ₁ X ₁ encoding unit systematic linear block error-correcting binary (N, K) code. Why divide the block X ₁ into T ₁ = k ₁ / K sub-blocks of K characters in each. Form from each i-th subblock, where i = 1, 2, ..., T ₁ , the i-th code subblock is N characters long by multiplying the i-th subblock by a linear block systematic binary noise-tolerant linear matrix matrix K × N (N , K) code. Then, the i-th sub-block of check symbols of length (N-K) characters is extracted from the i-th code sub-block. The set of T ₁ sub-blocks of check characters forms a block of check characters C ₁ for block X ₁ .

To form the parity block length C ₂ r ₂ for the block X _2, X ₂ encode unit systematic linear block error-correcting binary (N, K) code. Why divide the block X ₂ into T ₂ = k ₂ / K sub-blocks of K characters in each. Form from each i-th subblock, where i = 1, 2, ..., T ₂ , the i-th code subblock is N characters long by multiplying the i-th subblock by a generating block matrix of dimension K × N of a linear block systematic binary noise-tolerant (N , K) code. Then, the i-th sub-block of check symbols of length (N-K) characters is extracted from the i-th code sub-block. The set of T ₂ sub-blocks of check symbols forms a block of check characters C ₂ for block X ₂ .

, кодируют сообщение

линейным блоковым систематическим двоичным помехоустойчивым (N_a, К_а) кодом. Для чего разделяют сообщение

на T_а=(r₁+r₂)/К_а блоков по К_a символов в каждом. Формируют из каждого j-го блока, где j=1, 2,..., T_а, j-й кодовый блок длиной N_a символов, перемножением j-го блока на порождающую матрицу размерности К_a×N_a линейного блокового систематического двоичного помехоустойчивого (N_a, К_a) кода. Формируют кодовое слово для сообщения

, в виде последовательности, состоящей из T_а кодовых блоков. Затем преобразуют кодовое слово для сообщения

путем замены в нем символов "0" на "01", а символов "1" на "10". Присваивают каждому символу преобразованного кодового слова и соответствующему символу блока X₃ порядковые номера s, где s=1, 2,..., 2N_aT_a. Запоминают s-й символ блока X₃, если в преобразованном кодовом слове, s-й символ равен 1. Последовательность запомненных символов блока Х₃ образует аутентификатор w.To form messages on the transmitting side of the authenticator w

encode message

linear block systematic binary noise-immunity (N _a , K _a ) code. Why share the message

on T _a = (r ₁ + r ₂ ) / K _a blocks of K _a characters in each. Form from each j-th block, where j = 1, 2, ..., T _a , the j-th code block of length N _a characters, by multiplying the j-th block by the generating matrix of dimension K _a × N _a linear block systematic binary noise-resistant (N _a , K _a ) code. Form a code word for the message

, in the form of a sequence consisting of T _a code blocks. The codeword for the message is then converted.

by replacing the characters "0" with "01" in it, and the characters "1" with "10". Each symbol of the transformed codeword and the corresponding symbol of block X _{3 are} assigned serial numbers s, where s = 1, 2, ..., 2N _a T _a . The s-th character of block X _{3 is} remembered if the s-th character is equal to 1 in the transformed codeword. The sequence of stored characters of block X ₃ forms the authenticator w.

из принятого блока Y₁ и блока проверочных символов С₁ декодируют принятый блок Y₁ линейным блоковым систематическим двоичным помехоустойчивым (N, К) кодом. Для чего разделяют принятый блок Y₁ и блок проверочных символов С₁ на T₁ соответствующих пар декодируемых и проверочных подблоков, где Т₁=k₁/K. Длины декодируемых подблоков и проверочных подблоков выбирают равными соответственно К и (N-К) двоичных символов. Формируют Т₁ принятых кодовых подблоков длиной N двоичных символов путем конкатенации справа к t-му декодируемому подблоку t-го проверочного подблока, где t=1, 2, 3,..., Т₁. Вычисляют последовательно, начиная с t-го до T₁-го, t-й синдром S длины (N-К) двоичных символов перемножением t-го принятого кодового подблока на транспонированную проверочную матрицу. Исправляют по полученному t-му синдрому S ошибки в t-м декодируемом подблоке. Запоминают t-й декодируемый подблок в качестве t-го подблока декодированного блока

.For forming on the receiving side of the communication direction of the decoded block

from the received block Y ₁ and the block of check symbols C ₁ decode the received block Y ₁ linear block systematic binary noise-resistant (N, K) code. For this, the received block Y ₁ and the block of check symbols C ₁ to T ₁ are divided into corresponding pairs of decoded and check subblocks, where T ₁ = k ₁ / K. The lengths of decoded subblocks and test subblocks are chosen equal to K and (N-K) binary symbols, respectively. Form T ₁ received code subblocks of length N binary characters by concatenating to the right of the t-th decoded sub-block of the t-th verification sub-block, where t = 1, 2, 3, ..., T ₁ . Sequentially, starting from the t-th to T- ₁ , t-th syndrome S of the length (N-K) of binary symbols is calculated by multiplying the t-th received code sub-block by the transposed check matrix. According to the received t-th syndrome S errors are corrected in the t-th decoded subunit. Remember the t-th decoded sub-block as the t-th sub-block of the decoded block

.

После чего из полученных после перемножения последовательностей выделяют l младших разрядов.To generate the encryption / decryption key by hashing on the transmitting side of the communication direction, the blocks X ₁ and X _{2 are} multiplied. At the receiving side, decoded blocks are multiplied.

Then, from the sequences obtained after multiplication, l lower digits are distinguished.

The indicated new set of essential features enables authentication of transmitted messages over open communication channels, based on a randomly generated block X ₃ and a corresponding block Y ₃ received over the channel with errors, which will increase the resistance of the generated CDS to compromise with respect to the intruder. And reducing the time of formation of CLSD by applying a new class of hash functions and transmitting them through channels with errors.

The analysis of the prior art made it possible to establish that analogues that are characterized by a combination of features identical to all the features of the claimed solution are absent, which indicates the compliance of the claimed method with the condition of patentability "novelty".

Search results for known solutions in this and related fields of technology in order to identify features that match the distinctive features of the prototype of the claimed method showed that they do not follow explicitly from the prior art. The prior art also did not reveal the popularity of the impact provided by the essential features of the claimed invention transformations to achieve the specified technical result. Therefore, the claimed invention meets the condition of patentability "inventive step".

The claimed method is illustrated by figures, which show:

- figure 1 is a generalized structural diagram of the NS used in the claimed method;

- figure 2 is a timing chart of the generated random sequence in the form of blocks X ₁ , X ₂ , X ₃ ;

- figure 3 is a timing chart of the vector of errors in the communication channel with errors;

- in figure 4 is a timing diagram of a random sequence received over the channel with errors in the form of blocks Y ₁ , Y ₂ , Y ₃ ;

- figure 5 is a view of the generating matrix of a linear block systematic binary noise-immune (N, K) code;

- figure 6 is a timing chart of the generated block X ₁ , divided into T ₁ sub-blocks of K characters;

- figure 7 is a timing chart of the selected i-th subunit of block X ₁ ;

- figure 8 is a timing diagram of the formation of the i-th code block of length N binary characters;

- figure 9 is a timing diagram of the allocation of the i-th subunit of test characters with a length of N-K binary characters;

- figure 10 is a timing diagram of the formation of a block of check symbols C ₁ ;

- figure 11 is a timing chart of the generated block of check symbols With ₂ ;

;- figure 12 is a timing diagram of the formation of the message

;

- figure 13 is a view of the generating matrix of a linear block systematic binary noise-immune (N _a , K _a ) code;

, разделенного на Т_a блоков по К_а символов;- figure 14 is a timing chart of the generated message

divided into T _a blocks by K _a characters;

;- figure 15 is a timing chart of the selected j-th block of the message

;

- figure 16 is a timing diagram of the formation of the j-th code block of length N _a binary characters;

, разделенного на T_a блоков по N_a символов;- figure 17 is a timing chart of the generated codeword for the message

divided into T _a blocks of N _a characters;

- figure 18 is a timing chart of the generated codeword for the message;

- figure 19 is a timing diagram of the formation of the converted codeword;

- figure 20 is a timing chart of the formed block X ₃ ,

- figure 21 is a timing diagram of the formation of the authenticator w;

;- figure 22 is a timing diagram of concatenation on the right of the authenticator w to the message

;

и его аутентификатора w;- figure 23 is a timing chart received at PRSNS messages

and its authenticator w;

- figure 24 is a timing diagram of the generated codeword for the message;

- figure 25 is a timing chart of a received block Y ₃ ;

- figure 26 is a timing diagram of the formation of the authenticator w ';

- figure 27 is a timing diagram of the formation of the vector V;

;- figure 28 is a timing chart of the allocation of blocks of check characters With ₁ and C ₂ from the message

;

- in Fig. 29 is a timing chart of a block of check symbols C ₁ divided into T ₁ subblocks of check symbols of length N-K binary characters, and the allocation of the t-th sub block of check symbols from it;

- figure 30 is a timing chart of a received channel with errors Y ₁ , divided into T ₁ decoded subunits of K characters, and the allocation of the t-th decoded subunit from it;

- figure 31 is a timing diagram of the concatenation on the right of the t-th decoded subunit and the t-th subunit of check symbols;

- figure 32 is a timing diagram of the calculation of the t-th syndrome S of length N-K binary characters;

- figure 33 is a timing chart of the error correction in the t-th decoded subunit according to the received t-th syndrome S;

- figure 34 is a timing diagram of the formation of a decoded sequence of T ₁ decoded subunits;

- figure 35 is a timing chart of the generated block X ₁ ;

- figure 36 is a timing chart of the generated block X ₂ ;

- figure 37 is a timing diagram of the formation of CLSD K _a .

On the presented figures, the letter "A" denotes the actions that occur on the transmitting side of the NS, the letter "B" - on the receiving side of the NS. In the figures, the hatched pulse represents the binary symbol "1", and not the hatched pulse represents the binary symbol "0". The signs “+” and “×” denote addition and multiplication in the Galois field GF (2). Upper letter indices indicate the length of the sequence (block), lower letter indices indicate the number of the element in the sequence (block).

The implementation of the claimed method is as follows. Modern cryptosystems are constructed on the basis of the Kirkhoff principle, described, for example, in the book of D. Messi, "Introduction to Modern Cryptology", TIIER, v. 76, No. 5, May 1988, p.24, according to which the complete knowledge of the violator includes, in addition to, information obtained by interception, complete information about the algorithm for the interaction of the legitimate parties of the National Assembly and the process of formation of CLS. The formation of a common CLSD can be divided into three main stages. The first stage is to ensure the presence of pre-formed correlated sequences of binary symbols for the legitimate parties of the National Assembly, as source material for the formation of CLSD. It is assumed that the violator has its own pre-formed correlated sequence (PSCP), correlated with the PSCP of the legitimate parties of the National Assembly. The second stage is designed to ensure the formation of CLS with high reliability. The formation of CLS with high reliability is achieved by eliminating (correcting) inconsistent characters (errors) in the PSKP of one legitimate NS side (PSKP on PRSNS) relative to PSKP of the other legitimate side NS (PSKP on PRSNS), when using ZSNS additional information on PSKP (PSKP on PRSNS) transmitted over the communication channel without errors. It is assumed that the intruder uses additional information to eliminate inconsistencies in the PSCP-ts of the ZSNS to eliminate inconsistencies in his PSCP-ts with the sequences of the ZSNS. The third stage is designed to ensure the formation of CLS with a low level of information on the CLS by the offender by compressing the identical sequences of the legitimate sides of the NS that were received by the ZSNS after the second stage. It is assumed that the attacker knows the sequence compression algorithm that is used by the MSS. The storage by legal parties of the NS at the first stage of the PSKP-tei leads to a decrease in the resistance of the generated CDS to compromise, because it is possible for an intruder to obtain information about PSCP at least one of the legitimate parties of the National Assembly as a result of theft of information carriers, unauthorized access, disclosure of information, etc. This requires measures to ensure reliable storage of complete information about PSCP-ts ZSNS. On the other hand, when legitimate parties perform actions of the second and third stage NS to obtain CLSD on the same short sequences isolated from the SSPS of the ZSNS, the likelihood of reliable knowledge by the violator of the formed CLSD increases. This, also, leads to a decrease in the resistance of the generated CDS to compromise. In addition, when the legitimate parties of the National Assembly take actions to exchange information through open communication channels, the violator can impose his CLSD (or part of CLSD) on the CSNS, which leads to a decrease in the resistance of the generated CLSD to compromise. Therefore, for the formation of CLSD, it is necessary to exclude the storage of PSCP-tei from the MSS by simultaneously generating them using the MSS of the communication channel with errors (the possibility of generating the MSC is based on the independence of errors arising in the communication channel with errors of the legitimate sides of the NS and errors arising in the interception channel intruder), to form a CWD by hashing the obtained identical sequences of full length.

In the claimed method of generating an encryption / decryption key to ensure increased resistance of the generated CDS to compromise, the following sequence of actions is implemented.

The intruder has his own interception channel, with the help of which he receives information about the transmitted blocks X ₁ , X ₂ , X ₃ through the communication channel with errors of the legitimate parties of the National Assembly (see figure 1). In order to form a CLD with high resistance to compromise, it is necessary to create conditions under which the reception quality in the communication channel with errors of the legitimate sides of the NS (i.e., the main channel) will exceed the reception quality in the interception channel, i.e. it is necessary to create conditions under which the main channel will have an advantage (better reception quality) with respect to the interception channel. Ways to create such conditions are not included in the area considered by the proposed method. Known methods for improving the quality of transmission in the main channel compared to the quality of the interception channel are described, for example, in the work of V. Korzhik, V. Yakovlev, A. Sinyuk, “Protocol for generating a key with interference”. Information Security Problems, Computer Systems, No. 1, St. Petersburg: St. Petersburg State Technical University, 2000, p. 52-63.

On the PerSNS form a joint venture in the form of three blocks X ₁ , X ₂ , X ₃ (see figure 2). Known methods for generating random numbers are described, for example, in the book of D. Knut, "The Art of Computer Programming", M., Mir, 1977, v.2, p.22. Blocks X ₁ , X ₂ , X ₃ are transmitted over the communication channel with errors to the receiving side of the communication direction (PrSNS). The timing diagram of the error vector in the error communication channel is shown in Figure 3. The term "error vector" refers to the bitwise difference between the transmitted and received blocks of binary symbols, as described, for example, in the book by A. Zyuko, D. Klovsky, M. Nazarov, L. Fink, "Theory of signal transmission", M., Radio and communications, 1986, p. 93. Blocks Y ₁ , Y ₂ , Y ₃ received over the channel with errors are shown in Figure 4. Known methods for transmitting sequences over communication channels with errors are described, for example, in the book by A. Zyuko, D. Klovsky, M. Nazarov, L. Fink, "The theory of signal transmission", M., Radio and communications, 1986, p. 11.

Mismatching characters remain between the generated blocks X ₁ , X ₂ on the PerSNS and the received blocks Y ₁ , Y ₂ on the PRSNS, which does not allow the ZSNS to proceed with the direct formation of CLSD. Elimination of these discrepancies can be implemented through the use of error-correcting coding. However, the known error-correcting codes make it possible to encode sequences of significantly shorter length than block lengths equal to k ₁ , k ₂ binary symbols. For this, sequential coding is used, i.e. if the lengths of the blocks X ₁ , X ₂ are large, for example, 10 ⁵ -10 ⁷ binary characters, they are divided respectively into T ₁ , T ₂ sub-blocks of K characters in length (see Fig. 6), where

Тогда вероятность ошибочного декодирования блоков Y₁ и Y₂ может быть определена по формуламEach sub-block of length K symbols is encoded by a linear block systematic binary noise-immunity (N, K) code, where K is the length of the block of information symbols of the code and N is the length of the code block (see Fig. 7). Linear binary code is a code that is built on the basis of the use of linear operations in the GF (2) field, as described, for example, in the book of R. Bleikhut, "Theory and Practice of Error Control Codes", M., Mir, 1986, p. 61. The term "block code" refers to a code in which actions are performed on blocks of characters, as described, for example, in the book of R. Bleikhut, "Theory and Practice of Error Control Codes", M., Mir, 1986, p. 13. A systematic code is one in which the code word begins with information symbols, the remaining symbols of the code word are verification symbols for information symbols, as described, for example, in the book by R. Bleikhut, "Theory and Practice of Error Control Codes", M., Mir, 1986, p. 66. Then, the generated subblocks of check symbols with a length of N - K binary characters (see Fig. 8) are combined into single blocks of check characters C ₁ and C _2, respectively, with lengths T ₁ (N-K) and T ₂ (N-K) of binary characters (see figure 10). When transmitting blocks of check symbols to the PRSNS and using them to eliminate discrepancies in blocks Y ₁ and Y _2, then decoded blocks are received with respect to blocks X ₁ and X ₂

Then the probability of erroneous decoding of blocks Y ₁ and Y ₂ can be determined by the formulas

where P _e is the probability of erroneous decoding of a sub-block of length K of binary characters, determined as described, for example, in Korjik V., Moralis-Luna G., Balakirsky V. "Privacy amplification theorem for noisy main channel". Lecture notes in computer science, 2001, No. 2200, pp. 18-26. If the information part of a code word with a length of K characters is transmitted via DSC with an error probability p _m , and the verification part with a length of N-K characters is transmitted through a noiseless channel, then the average probability of error in an ensemble of (N, K) codes can be estimated from above by a modified Gallager boundary

Where

- Gallagher function for DSC with error probability p _m ,

code speed.

As error-correcting codes, a wide class of Bowes-Chowdhury-Hockingham codes, Hamming, Reed-Mahler, Reed-Solomon codes and other linear block codes characterized by their parameters N, K can be used. Transmission of blocks of check symbols C ₁ and C ₂ on the reverse channel Communication without errors enables the intruder to obtain additional information about CLSD by intercepting blocks of check symbols C ₁ and C ₂ . Using them, the intruder also corrects part of the discrepancies in his version of the intercepted blocks of the joint venture with respect to blocks X ₁ and X ₂ .

The coding of block X ₁ at PersNS is as follows. Previously, block X _{1 is} divided into T ₁ subblocks of length K of binary symbols, where T ₁ = k ₁ / K, as shown in Fig.6. Known methods of dividing a sequence into blocks of fixed length are described, for example, in the book by V. Vasiliev, V. Sviridenko, “Communication Systems”, M., Higher School, 1987, p. 208. Consistently, starting from the 1st to T _1st , each i-th sub-block of block X ₁ , where i = 1, 2, 3, ..., T ₁ , is encoded by a linear block systematic binary noise-immunity (N, K) code (see Fig.7). The generating code matrix has dimension K × N, and N> K. The sizes K and N of the generating matrix of the linear block systematic binary noise-immunity (N, K) code are chosen K = 2 ^m -1-m and N = 2 ^m -1, where m≥3, as described, for example, in the book of R. Bleikhut, "Theory and practice of error control codes," M., Mir, 1986, p. 71. To encode a block X _1, each i-th subblock of length K of binary symbols is multiplied by a generating code matrix and an i-th code block of length N of binary symbols is obtained, as shown in FIG. Known methods for error-correcting coding of symbol blocks are described, for example, in the book of R. Bleikhut, "Theory and Practice of Error Control Codes", M., Mir, 1986, p. 63. From the i-th code block, the i-th sub-block of check symbols with the length of N-K binary characters is isolated (see Fig. 9). Known methods for allocating fixed-length blocks are described, for example, in the book by V. Vasiliev, V. Sviridenko, “Communication Systems”, M., Higher School, 1987, p. 208. The i-th sub-block of check symbols is stored as the i-th sub-block of the block of check symbols of the encoded block X ₁ . The timing diagram of the formation of a block of check symbols C _{1 of the} encoded block X _{1 is} shown in Figure 10. Known methods for storing a sequence of bits are described, for example, in the book by L. Maltsev, E. Flomberg, V. Yampolsky, "Fundamentals of Digital Technology", M., Radio and Communications, 1986, p. 38. Likewise, a linear block systematic binary error-correcting (N, K) code is encoded into a block X ₂ at PerSNS, dividing it into T ₂ subblocks of length K of binary symbols, where T ₂ = k ₂ / K. Known methods of dividing a sequence into blocks of fixed length are described, for example, in the book by V. Vasiliev, V. Sviridenko, “Communication Systems”, M., Higher School, 1987, p. 208. The timing diagram of the generated block of check symbols With ₂ encoded block X ₂ shown in figure 11.

путем конкатенации блоков проверочных символов С₁ и С₂ (см. фиг.12). Затем разделяют сформированное сообщение

на T_a блоков длиной по К_а символов (см. фиг.14), гдеThe intruder can substitute or simulate messages transmitted on the communication channel without errors in order to form a CLSD common with one or both correspondents. Therefore, the information transmitted by correspondents over the communication channel without errors must be authenticated. To achieve this goal, a message is generated at PersNS

by concatenating blocks of check symbols C ₁ and C ₂ (see FIG. 12). The generated message is then split.

on T _a blocks with a length of K _a characters (see Fig. 14), where

(см. фиг.17).Each block with a length of K _a symbols is encoded by a linear block systematic binary error-correcting (N _a , K _a ) code, where K _a is the length of the block of information symbols of the code and N _a is the length of the code block (see Fig. 15). The generated code blocks (see Fig. 16) form a code word for the message

(see Fig. 17).

на ПерСНС заключается в следующем. Предварительно сообщение

разделяют на Т_а блоков длиной К_а двоичных символов, где Т_а=(N-К)(Т₁+Т₂)/K_a, как показано на фиг.14. Известные способы разбиения последовательности на блоки фиксированной длины описаны, например, в книге В.Васильев, В.Свириденко, "Системы связи", М., Высшая школа, 1987, стр.208. Последовательно, начиная с 1-го до Т_а-го, каждый j-й блок сообщения

, где j=1, 2, 3,..., Т_а, кодируют линейным блоковым систематическим двоичным помехоустойчивым (N_a, К_a) кодом (см. фиг.15). Порождающая матрица кода имеет размерность К_а×N_a, причем N_a>К_a. Размеры К_а и N_a порождающей матрицы линейного блочного систематического двоичного помехоустойчивого (N_a, К_a) кода выбирают К_а=2^m-1-m и N_a=2^m-1, где m≥3, как описано, например, в книге Р.Блейхут, "Теория и практика кодов, контролирующих ошибки", M., Мир, 1986, стр.71. Для кодирования сообщения

, каждый j-й блок длиной К_а двоичных символов перемножают на порождающую матрицу кода и получают j-й кодовый блок длиной N_a двоичных символов, как показано на фиг.16. Известные способы помехоустойчивого кодирования блоков символов описаны, например, в книге Р.Блейхут, "Теория и практика кодов, контролирующих ошибки", M., Мир, 1986, стр.63. Запоминают j-й кодовый блок в качестве j-го блока кодового слова для сообщения

. Временная диаграмма формирования кодового слова для сообщения

показана на фигуре 17. Известные способы хранения последовательности бит описаны, например, в книге Л.Мальцев, Э.Фломберг, В.Ямпольский, "Основы цифровой техники", M., Радио и связь, 1986, стр.38. Затем преобразуют сформированное кодовое слово для сообщения

путем замены в нем символов "0" на "01", а символов "1" на "10" (см. фиг.19). Каждому символу преобразованного кодового слова присваивают порядковый номер s, где s=1, 2,..., N_aT_a. Аналогичным образом каждому символу блока X₃ присваивают порядковый номер s, где, s=1, 2,..., N_aT_a. Запоминают s-й символ блока Х₃, если в преобразованном кодовом слове на s-м месте стоит символ "1". Аутентификатор w образуют как последовательность сохраненных символов блока X₃ (см. фиг.21). Далее сообщение

и его аутентификатор w передают по открытому каналу связи без ошибок на ПрСНС (см. фиг.22).Message Encoding

on PersNS is as follows. Pre message

divided into T _a blocks of length K _{a of} binary characters, where T _a = (N-K) (T ₁ + T ₂ ) / K _a , as shown in FIG. Known methods of dividing a sequence into blocks of fixed length are described, for example, in the book by V. Vasiliev, V. Sviridenko, “Communication Systems”, M., Higher School, 1987, p. 208. Sequentially from the 1st to the T-th _and each j-th message block

, where j = 1, 2, 3, ..., T _a , is encoded by a linear block systematic binary noise-immunity (N _a , K _a ) code (see Fig. 15). The generating matrix of the code has the dimension K _a × N _a , and N _a > K _a . The sizes K _a and N _{a of the} generating matrix of the linear block systematic binary noise-immunity (N _a , K _a ) code are chosen to K _a = 2 ^m -1-m and N _a = 2 ^m -1, where m≥3, as described, for example, in the book of R. Bleikhut, "Theory and Practice of Error Control Codes," M., Mir, 1986, p. 71. To encode a message

, each j-th block of length K _{a of} binary symbols is multiplied by the generating matrix of the code, and the j-th code block of length N _{a of} binary symbols is obtained, as shown in FIG. Known methods for error-correcting coding of symbol blocks are described, for example, in the book of R. Bleikhut, "Theory and Practice of Error Control Codes", M., Mir, 1986, p. 63. The jth code block is stored as the jth codeword block for the message

. Timing diagram for generating a code word for a message

shown in figure 17. Known methods for storing a sequence of bits are described, for example, in the book of L. Maltsev, E. Flomberg, V. Yampolsky, "Fundamentals of digital technology", M., Radio and communications, 1986, p. 38. The generated codeword for the message is then converted.

by replacing the characters "0" with "01" in it, and the characters "1" with "10" (see Fig. 19). Each symbol of the transformed codeword is assigned a sequence number s, where s = 1, 2, ..., N _a T _a . Similarly, each symbol of block X _{3 is} assigned a sequence number s, where, s = 1, 2, ..., N _a T _a . Remember the s-th character of block X ₃ , if the symbol "1" is in the s-th place in the converted codeword. The authenticator w is formed as a sequence of stored characters of block X ₃ (see FIG. 21). Next message

and its authenticator w is transmitted over the open communication channel without errors to the PRNS (see Fig. 22).

, где υ_i∈(0, 1), а блок Х₃ в виде вектора

, где x_i∈(0, 1). Тогда аутентификатор

, в котором для всех j<n_a, w_ij=x_j, если υ_ij=1, в противном случае w_ij не формируется.For example, the transformed codeword for the message is represented as a vector

, where υ _i ∈ (0, 1), and block X ₃ in the form of a vector

, where x _i ∈ (0, 1). Then authenticator

, in which for all j <n _a , w _ij = x _j , if υ _ij = 1, otherwise w _{ij is} not formed.

и его аутентификатор w (см. фиг.23), формируют аутентификатор w'. Для чего формируют кодовое слово для принятого сообщения

, используя линейный блоковый систематический двоичный помехоустойчивый (N_a, K_а) код. Преобразуют сформированное кодовое слово для сообщения

путем замены в нем символов "0" на "01", а символов "1" на "10". Каждому символу преобразованного кодового слова присваивают порядковый номер s, где s=1, 2,..., 2N_aT_a. Аналогичным образом каждому символу блока Y₃ присваивают порядковый номер s, где s=1, 2,..., 2N_aT_a. Запоминают s-й символ блока Y₃, если в преобразованном кодовом слове на s-м месте стоит символ "1". Аутентификатор w' образуют как последовательность сохраненных символов блока Y₃ (см. фиг.26).At PRSN, receiving a message

and its authenticator w (see FIG. 23), form the authenticator w '. Why form the code word for the received message

using a linear block systematic binary noise-immunity (N _a , K _a ) code. Convert generated codeword for message

by replacing the characters "0" with "01" in it, and the characters "1" with "10". Each symbol of the transformed codeword is assigned a sequence number s, where s = 1, 2, ..., 2N _a T _a . Similarly, each symbol of block Y _{3 is} assigned a sequence number s, where s = 1, 2, ..., 2N _a T _a . The s-th character of block Y _{3 is} remembered if the symbol "1" is in the s-th place in the converted codeword. The authenticator w 'is formed as a sequence of stored characters of block Y ₃ (see Fig. 26).

считается подлинным, если больше, сообщение

отвергается как ложное.To verify the authenticity of the received message, a vector V is formed on the PRNS by summing modulo two (as described, for example, in the book by W. Peterson, E. Weldon, "Codes Correcting Errors", M .: Mir, 1976. 34 pp.) received w and generated w 'authenticators (see FIG. 27). The weight w (V) of the generated vector V is calculated, as, for example, described in the book by Mc-Williams F., Sloane N., "Theory of error-correcting codes", M., Communication, 1979, 19 pp. Then, the obtained weight value w (V) is compared with a predetermined threshold value w (V) of _pores . If the weight w (V) is equal to or less than the threshold value w (V) _then the message

deemed genuine if greater

rejected as false.

The authentication procedure described was first proposed by Maurer U., "Information-theoretically secure secret-key agreement by NOT authenticated public discussion", Advances in Cryptology - EUROCRYPT 97, Berlin, Germany: Springer-Verlag, 1997, vol. 1233, pp .209-225, and was called authenticating error-correcting codes (AP code).

The main characteristics of the AP code are:

R _lo - the probability of false rejection of the transmitted message when the intruder did not interfere in the transmission process.

P _n - the probability of successfully imposing a false message.

и ложному

сообщениям.The resistance to the imposition of false messages depends on the so-called asymmetric code distance d ₀₁ , which is determined by the number of transitions from 0 to 1 between code words corresponding to true

and false

to messages.

If the (n _a , k _a ) - code has a constant weight τ and an asymmetric code distance d ₀₁ , then the characteristics of the AP code are determined by the relations (see Korjik V., Bakin M. "Information theoretically secure keyless authentication", IEEE on Information Theory Symposium 2000, Sorrento, Italy, July):

In the above described method of constructing an AP-code (encoding messages linear block systematic binary error-correcting (N _a, K _a) code and replacing it characters "0" to "01" and the symbols "1" to "10") an asymmetrical code distance d ₀₁ coincides with the minimum distance of the code d, which can be found, for example, using the Warsaw-Hilbert boundary, as described in the book by Mc Williams F., Sloane N. "Theory of error correction codes", M .: Communication, 1979 , 539 p.

where g (p) = - plog (p) - (1-p) log (1-p) is the entropy function.

.The weight τ of all converted codewords is constant and equal to the length of the codeword for the message

.

на ПрСНС выделяют блоки проверочных символов C₁ и C₂, путем разбиения принятого сообщения

на две равные части (см. фиг.28). Затем, используя полученные блоки проверочных символов С₁ и С₂, производят исправление ошибок в принятых ранее по каналу с ошибками блоков Y₁, Y₂ путем их декодирования. Процедуру декодирования осуществляют следующим образом.When authenticating a message

blocks of check symbols C ₁ and C ₂ are allocated to the PRSNS by splitting the received message

into two equal parts (see Fig. 28). Then, using the obtained blocks of check symbols C ₁ and C ₂ , error correction is made in the previously received error channel Y ₁ , Y ₂ by decoding them on the channel. The decoding procedure is as follows.

как показано на фиг.34. Известные способы хранения последовательности бит описаны, например, в книге Л.Мальцев, Э.Фломберг, В.Ямпольский, "Основы цифровой техники", M., Радио и связь, 1986, стр.38. Аналогичным образом производят исправления ошибок в блоке Y₂ и получают декодированный блок

Block Y ₁ and block of check symbols C ₁ are divided into T ₁ corresponding pairs of decoded subblocks (see Fig. 30) and subblocks of check symbols (see Fig. 29), where T ₁ = k ₁ / K. The lengths of the decoded subblocks and subblocks of the check symbols are selected equal to K and N-K binary symbols, respectively. Known methods of dividing a sequence into blocks of fixed length are described, for example, in the book by V. Vasiliev, V. Sviridenko, “Communication Systems”, M., Higher School, 1987, p. 208. Form T ₁ received code blocks with a length of N binary symbols by concatenating to the right of the t-th decoded sub-block of the t-th sub-block of check symbols, where t = 1, 2, 3, ..., T ₁ , as shown in Fig. 31. Each of the T ₁ received code blocks is decoded by a linear block systematic binary noise-immunity (N, K) code (see FIG. 31). The verification matrix of the code has the dimension (N-K) × N, and N> K. Choose the sizes K and N of the verification matrix of the linear block systematic binary noise-immunity (N, K) code K = 2 ^m -1-m and N = 2 ^m -1, where m≥3, as described, for example, in the book of R. Bleikhut, "Theory and practice of error control codes," M., Mir, 1986, p. 71. Consistently, starting from the 1st to the Tth _1st , the t-th syndrome S of length N-K of binary symbols is calculated by multiplying the t-th received code block by the transposed check matrix. The timing diagram for calculating the t-th syndrome S of length N-K binary characters is shown in figure 32. Based on the obtained t-th syndrome S, errors are corrected in the t-th decoded sub-block (see Fig. 33). Known methods for syndromic decoding of symbol blocks are described, for example, in the book of R. Bleikhut, "Theory and Practice of Error Control Codes," M., Mir, 1986, p. 70. Then, the t-th decoded sub-block is stored as the t-th sub-block of the decoded block

as shown in FIG. Known methods for storing a sequence of bits are described, for example, in the book of L. Maltsev, E. Flomberg, V. Yampolsky, "Fundamentals of Digital Technology", M., Radio and Communications, 1986, p. 38. In the same way, error correction is performed in block Y ₂ and a decoded block is obtained.

и выделить блоки проверочных символов С₁ и С₂. Используя их, он исправляет часть несовпадений в своей версии перехваченных блоков случайной последовательности. Это обстоятельство ЗСНС учитывают при формировании из блока Х₁ и декодированного блока

КлШД.An intruder can also intercept a message

and highlight the blocks of check characters C ₁ and C ₂ . Using them, he corrects part of the discrepancies in his version of the intercepted blocks of a random sequence. This circumstance ZSNS take into account when forming from the block X ₁ and the decoded block

CLSD.

основанный на универсальном хешировании, как описано, например, в книге Bennett С., Brassard G., Crepeau С., Maurer U. "Generalized privacy amplification", IEEE Trans. on IT, vol.41, no.6, pp.1915-1923, 1995, стр.1920. Сущность метода "усиления секретности" заключается в следующем. На ПерСНС выбирают в качестве функции хеширования блок Х₂, а на ПрСНС декодированный блок

Затем хешируют блок Х₁ на ПерСНС и декодированный блок

на ПрСНС. Результатом хеширования будет сформированный КлШД ЗСНС.С вероятностью, близкой к единице и равной 1-P_ε, происходит событие, при котором информация (информация Шеннона) нарушителя о КлШД не превысит определенной малой величины I₀ и с малой вероятностью сбоя P_ε возможно событие, при котором информация нарушителя о КлШД будет более I₀. При хешировании блока Х₁ (блок Х₁ длиной k₁ двоичных символов) отображается в последовательность К_а длиной l двоичных символов формируемого КлШД на ПерСНС. Аналогично, при хешировании декодированный блок

(декодированный блок

длиной k₁ двоичных символов) отображается в последовательность К_b длиной l двоичных символов формируемого КлШД на ПрСНС. Функция хеширования последовательностей должна удовлетворять ряду требований, как описано, например, в книге Ю.Романец, П.Тимофеев, В.Шаньгин, "Защита информации в компьютерных системах и сетях", М., Радио и связь, 1999, с.156:ZSNS should create KShShD with a small amount of information of the violator about KShShD. To ensure a small amount of information on the CLS offender in the proposed method of forming CLSD using the method of "secrecy" block X ₁ and the decoded block

based on universal hashing, as described, for example, in Bennett C., Brassard G., Crepeau C., Maurer U. "Generalized privacy amplification", IEEE Trans. on IT, vol. 41, no.6, pp. 1915-1923, 1995, p. 1920. The essence of the method of "enhancing secrecy" is as follows. On PersNS, block X _{2 is} selected as a hash function, and on PRNS, a decoded block

Then hashed block X ₁ on PersNS and the decoded block

on PRSNS. The result of the hashing will be the generated CLSD of the SNSS. With a probability close to unity and equal to 1-P _ε , an event occurs in which the information (Shannon information) of the intruder about the CLSD does not exceed a certain small value of I ₀ and an event is possible with a low probability of failure P _ε , at which the information on the CLS violator will be more than I ₀ . When hashing a block X ₁ (a block X ₁ with a length of k ₁ binary characters), it is mapped into a sequence K _{and a} length l of binary characters of the generated CWSD on PersNS. Similarly, when hashed, the decoded block

(decoded block

length k ₁ binary symbols) is mapped to a sequence K _{b of} length l binary symbols of the generated CLSD on the PRSN. The function of hashing sequences must satisfy a number of requirements, as described, for example, in the book by Yu. Romanets, P. Timofeev, V. Shangin, "Information Security in Computer Systems and Networks", M., Radio and Communications, 1999, p.156:

- the hash function must be sensitive to all kinds of changes in the sequence, such as inserts, outliers, permutations, etc .;

- the hash function must have the property of irreversibility, i.e. the task of selecting another sequence that possesses the required value of the hash function must be computationally insoluble;

is the probability of collision, i.e. the probability of an event in which the values of the hash function of two different sequences coincide should be negligible.

In addition, the hash function must belong to a universal set of hash functions. A universal set of hash functions is defined as follows. Let n and r be two positive integers, with n> r. The set of functions G ₂ that map the set of binary sequences of length n to the set of binary sequences of length r is called universal if, for any different sequences x ₁ and x ₂ from the set of binary sequences of length n, the probability (collision) that the value of the hash function is from x ₁ equal to the value of the hash function from x ₂ (g (x ₁ ) = g (x ₂ )), not more than 2 ^-r , with a random choice of the hash function g, in accordance with an equally probable distribution, from G ₂ , as described, for example, in Carter J., Wegman M., "Universa l classes of hash functions ". Journal of Computer and System Sciences, 1979, Vol. 18, pp. 143-154, p. 145. All linear functions that map the set of binary sequences of length n to the set of binary sequences of length r belong to the universal set, as described, for example, in Carter J., Wegman M., "Universal classes of hash functions". Journal of Computer and System Sciences, 1979, Vol. 18, pp. 143-154, p. 150.

на ПрСНС количество информации Шеннона, получаемое нарушителем о КлШД, сформированном ЗСНС, не больше (как показано в работе Яковлев В., Коржик В., Бакаев M. "Протоколы формирования ключа с использованием открытых каналов связи с шумом в условиях активного перехвата. Часть 1. Постановка задачи, основные процедуры, протокол Маурера-Вольфа", Проблемы информационной безопасности. Компьютерные системы. №3 СПб.: СПбГТУ, 2004, с.80), чемThe hashing of block X ₁ can be accomplished by multiplying the binary number represented by block X ₁ by the binary number represented by block X ₂ and extracting l lower order bits from the resulting product (see FIG. 37). After the formation of the CSNS CLSD by hashing the block X ₁ on the PerSNS and the decoded block

at the PRSNS, the amount of Shannon information received by the intruder about the CLS generated by the ZSNS is no more (as shown by Yakovlev V., Korzhik V., Bakaev M. "Key generation protocols using open communication channels with noise under conditions of active interception. Part 1 . Problem statement, basic procedures, Maurer-Wolf protocol, "Information Security Problems. Computer Systems. No. 3 SPb .: SPbSTU, 2004, p. 80), than

The Renyi information t is determined through the expression for the Renyi entropy per symbol (the Renyi entropy per symbol depends on the probability of an error per bit p _w in the interception channel), which characterizes the intruder’s uncertainty about CLW, if the intruder knows the information obtained using the interception channel, full information about the algorithm for the interaction of the legitimate parties of the National Assembly and their actions for the formation of CLS, as described, for example, in the book Bennett S., Brassard G., Crepeau S., Maurer U. "Generalized privacy amplification", IEEE Trans. on IT. vol.41. no.6. pp. 1915-1923, 1995, p. 1919. Renyi entropy is equal to

Then the Renyi information t obtained by the intruder when intercepting a block X _{1 of} length k ₁ characters is determined by the expression

The amount of Shannon’s information received by the intruder about the CLSD generated by the CCSS when using the CCSC method of “secrecy enhancement” may be greater than the restriction I ₀ (defined in (12)) with a low probability of failure.

The intruder still has the opportunity to obtain complete information about the CLSD of the ZSNS as a result of the theft of information carriers about blocks X ₁ , X ₂ , X _{3 of} unauthorized access to information about blocks X ₁ , X ₂ , X ₃ (blocks Y ₁ , Y ₂ , Y ₃ ) , disclosure of information about blocks X ₁ , X ₂ , X ₃ (blocks Y ₁ , Y ₂ , Y ₃ ), etc., at least one of the legal parties of the National Assembly. To exclude this possibility, the intruder of the ZSNS after the formation of the CDS erases the blocks X ₁ , X ₂ , X ₃ () on the transmitting side of the communication direction and blocks Y ₁ , Y ₂ , Y ₃ , on the receiving side of the communication direction. The actions for transmitting and receiving sequences over the communication channel with errors, the forward and reverse communication channels are synchronized without errors. Known methods of synchronization are described, for example, in the book of E. Martynov, "Synchronization in transmission systems of discrete messages", M., Communication, 1972, p.186.

Claims (6)

1. A method of generating an encryption / decryption key, which consists in generating a random sequence on the transmitting side of the communication direction, transmitting it through the communication channel with errors to the receiving side of the communication direction, forming a block of check symbols for the generated random sequence, transmitting it on the communication channel without errors to the receiving side of the communication direction, where the decoded sequence is formed, and the encryption / decryption key is formed from random and decoded sequences lanternity, characterized in that a random sequence on the transmitting side of the communication direction is formed in the form of three blocks X ₁ , X ₂ , X ₃ with lengths k ₁ , k ₂ , k _3, respectively, and k ₁ > l, k ₁ = k ₂ ,

, where l is the length of the generated encryption / decryption key, (N, K) and (N _a , K _a ) are linear block systematic binary noise-resistant codes pre-defined on the transmitting and receiving sides of the communication direction, the generating matrices of which have K × N dimensions, respectively and K _a × N _a , where N> K and N _a > K _a , and transmit through the communication channel with errors three blocks X ₁ , X ₂ , X ₃ , which receive on the receiving side of the communication direction in the form of blocks Y ₁ , Y ₂ , Y ₃ , form, on the transmitting side, communication directions for the first X ₁ and second X ₂ blocks, blocks of wire the wildcards C ₁ and C ₂ with lengths r ₁ and r ₂ respectively, where

and

then form a message

length (r ₁ + r ₂ ) by concatenating blocks of check characters C ₁ and C ₂ , after which form the authenticator w for the message

send message

and its authenticator w through the communication channel without errors to the receiving side of the communication direction, where the authenticator w 'is formed for the received message, and also the vector V is formed by modulo summation of the two received w and generated w' authenticators, the weight w (V) of the vector V is calculated by counting its nonzero elements and comparing the obtained weight w (V) with a predefined threshold value of the weight w (V) _then and when w (V)> w (V) _{then the} process of generating the encryption / decryption key is interrupted, and when w (V) <w (F) _then on the receiving side of the communication direction from received message

blocks of check symbols C ₁ and C ₂ are allocated by splitting the received message

into two equal parts, on the receiving side of the communication direction from the previously received through the communication channel with errors blocks Y ₁ , Y ₂ and blocks of check symbols C ₁ and C ₂ form decoded blocks

then form encryption / decryption keys on the receiving and transmitting sides of the communication direction by hashing the block X ₁ on the transmitting side of the communication direction and the decoded block

on the receiving side of the communication direction. 2. A method according to claim 1, characterized in that for the formation of the block C ₁ parity symbols of length r ₁ for the block X _1, X ₁ encoding unit systematic linear block error-correcting binary (N, K) code, which is separated block X ₁ T ₁ = k ₁ / K sub-blocks of K characters in each, are formed from each i-th sub-block, where i = 1, 2, ..., T ₁ , the i-th code sub-block is N characters long by multiplying the i-th sub-block to the generating matrix of dimension K × N of a linear block systematic binary noise-resistant (N, K) code, then the i-th sub-block is extracted from the i-th code sub-block approx parity length (NK) symbol, and the set of T ₁ subblocks parity check symbols forming the block unit for X _1. 3. The method according to claim 1, characterized in that to form a block of check symbols With _{2 of} length r ₂ for block X ₂ encode block X ₂ linear block systematic binary noise-resistant (N, K) code, for which the block X _{2 is} divided by T ₂ = k ₂ / K sub-blocks of K characters in each, are formed from each i-th sub-block, where i = 1, 2, ..., T ₂ , the i-th code sub-block is N characters long by multiplying the i-th sub-block by a generating matrix of dimension K × N of a linear block systematic binary noise-tolerant (N, K) code, then the i-th sub-block is extracted from the i-th code subunit a block of check characters of length (NK) characters, and a combination of T ₂ sub-blocks of check characters forms a block of check characters for block X ₂ . 4. The method according to claim 1, characterized in that for forming on the transmitting side of the authenticator w messages

encode message

linear block systematic binary noise-immunity (N _a , K _a ) code, for which the message is divided

on T _a = (r ₁ + r ₂ ) / K _a blocks of K _and characters in each, are formed from each j-th block, where j = 1, 2, ..., T _a , the j-th code block with length N _a symbols, by multiplying the j-th block by a generating matrix of dimension K _a × N _{a of a} linear block systematic binary noise-resistant (N _a , К _a ) code, a code word is generated for the message

, in the form of a sequence consisting of T _a code blocks, then the code word for the message is converted

by replacing the characters "0" with "01" in it, and the characters "1" with "10", assign each character of the transformed codeword and the corresponding character of block X ₃ serial numbers s, where s = 1, 2 ..., 2N _a T _a , remember the s-th character of block X ₃ , if 1 is in the transformed codeword at the s-th place, the sequence of memorized block characters forms the authenticator w. 5. The method according to claim 1, characterized in that for forming on the receiving side of the communication direction of the decoded block

from the received block Y ₁ and the block C ₁ parity decoding a received block of Y ₁ linear block systematic binary error-correcting (N, K) code, which divide the received block Y ₁ and block parity C ₁ symbols at T ₁ corresponding pairs decoded and parity subblocks where T ₁ = k ₁ / K, the lengths of the decoded subblocks and the verification subblocks are chosen equal to K and (NK) binary symbols, respectively, and T ₁ received code subblocks of length N binary symbols are formed by concatenating to the right of the tth decoded subblock of the tth verification subblock, where t = 1, 2, 3, ..., T ₁ , are calculated sequentially, starting from the 1st to T _1st , t-th syndrome S of length (NK) of binary symbols by multiplying the t-th received code subblock to the transposed check matrix, correct errors obtained in the t-th syndrome S in the t-th decoded sub-block, remember the t-th decoded sub-block as the t-th sub-block of the decoded block. 6. The method according to claim 1, characterized in that in order to generate an encryption / decryption key by hashing on the transmitting side of the communication direction, the blocks X ₁ and X _{2 are} multiplied, and on the receiving side, the decoded blocks are multiplied

after which l lower digits are isolated from the sequences obtained after multiplication.

Images