BR112017010974B1 - BLOCK CRYPTOGRAPHIC METHOD FOR ENCRYPTION/DECRYPTION OF MESSAGES AND CRYPTOGRAPHIC DEVICES FOR IMPLEMENTING THIS METHOD - Google Patents

Abstract

BLOCK CRYPTOGRAPHIC METHOD FOR ENCRYPTION/DECRYPTION OF MESSAGES AND CRYPTOGRAPHIC DEVICES FOR IMPLEMENTING THIS METHOD. A block cipher method and apparatus utilizing round repetition to provide, from a plaintext message (10), a ciphertext message (50) and a global tag (52), is disclosed. The plain text message is converted into a plurality of plain text blocks (11) which are successively processed during one round to calculate: - a cryptogram (30) by encrypting input data (20) using a unique cryptographic key , said cryptogram comprising a first segment (31) and a second segment (32) - a ciphertext block (51) by performing a first operation (41) using, as operands: said first segment (31) , said current plain text block (11) and said second segment (32). In each subsequent round, said input data is determined again based on the current ciphertext block and the updated reproducible data. The ciphertext message is determined by concatenating the ciphertext blocks and the global tag by a second operation (42) using local authentication tags as operands.

Description

TECHNICAL FIELD

[001] The present invention relates to the field of message encryption, using a block cipher mode of operation for authenticated encryption (AE), and message decryption using the reverse mode of operation. More specifically, the present invention relates to Authenticated Cryptography schemes and, in particular, relates to an improvement of the so-called Cipher and Counter Feedback (CCFB) scheme. In a variant, the present invention also comprises an extension to Authenticated Encryption with Associated Data (AEAD) schemes, in particular, an improvement to a CCFB+H scheme. Finally, the present invention also relates to the reverse cryptographic operation using the same scheme.

BACKGROUND OF THE INVENTION

[002] When a confidential message needs to be sent from a first entity to a second, it is common to protect the privacy of the message and its integrity/authenticity. In the step, these two security objectives were treated separately, as it was considered that integrity protection, typically managed using message authentication codes (MACs) or digital signatures, was an objective that should be achieved by completely different means.

[003] After observing that implementing a confidentiality mode with a separate authenticity mode could be difficult or error-prone, it was suggested to feed modes of operation that combine both confidentiality and integrity/authenticity into a single cryptographic scheme. A mode of operation can be considered as a technique for enhancing the effect of a cryptographic algorithm, in particular any algorithm based on a symmetric encryption scheme. Authenticated Encryption (AE) schemes are designed to simultaneously protect the privacy and integrity/authenticity of processed messages in a single compact mode of operation. As an example, when a provider wants to send confidential information to a customer, data privacy is necessary to ensure that the information remains confidential. Furthermore, integrity and authenticity are additionally necessary to ensure that the entity that sent the information is truly the aforementioned provider and that the information was not modified during its transit.

[004] AE modes can be classified according to the number of passes over the data they require. Some AE modes only use one pass over the data, while other users use two passes. Single-pass modes provide authenticated encryption right after simple processing of a message. Two-pass modes process data in two phases (still using one key for both encryption and authentication).

[005] When a message is encrypted using such an “integrated” authenticated encryption scheme, the ciphertext can be sent along with additional information. This means that it is possible to attach a plain header to the encrypted message. Such a packet header (plaintext header linked to the plaintext message) needs to be authenticated along with the message, but does not need to be encrypted. In fact, typically in a network packet, the payload must be encrypted and authenticated, but the header must only be authenticated (that is, it must remain decrypted). The reason for this is that routers must be able to read packet headers in order to know how to forward them appropriately. Some modes of operation are specifically suited to efficiently authenticate the data associated with the ciphertext message. Such modes are called Authenticated Encryption with Associated Data (AEAD). They allow associated data to be included as input to your schemas.

[006] One of the disadvantages of the AE and AEAD schemes is that they are prone to first-order Differential Power Analysis (DPA) attacks. Power analysis is a form of side-channel attack (non-invasive attack) in which the attacker (hacker) studies the power consumption of a cryptographic device. Such a device may refer to a microprocessor card, a badge, a key, an integrated circuit chip on a printed circuit board, a security module within a descrambler module, or may be functions implemented only in software form. By studying a circuit's current and voltage input and output (or the device's timing, or even its electromagnetic emissions), it could be possible to discover secret information, such as cryptographic keys used during normal device operations. In fact, some operations require greater energy consumption. Thus, using a digital oscilloscope and a conventional personal computer, the analysis of variations and peaks can extract valuable information for the cryptanalyst.

[007] Simple Power Analysis (SPA) recovers secret keys through direct observation of a device's power consumption, whereas DPA attacks employ statistical techniques to extract secret key information from multiple power consumption measurements . DPA is an advanced form of power analysis that allows you to calculate intermediate values within cryptographic calculations by statically analyzing data collected from multiple cryptographic operations, typically from thousands of operations. DPA attacks have signal processing and error correction properties that are capable of extracting secrets from measurements containing too much noise to be analyzed using SPA. Using a DPA attack, a hacker can obtain secret keys by analyzing power consumption measurements from multiple cryptographic operations performed on a vulnerable cryptographic system.

[008] To counter such side channel attacks, countermeasures have been developed. Some of these countermeasures involve modifications of the cryptographic algorithm, for example, performing cryptographic operations on data that is related to the real value by mathematical relationship that survives the cryptographic operation. One approach involves blinding parameters to randomize data manipulated by the cryptographic system, while still producing the correct result. Unpredictable information is incorporated into intermediate values to reduce the correlation between power consumption measurements (side channels) and the original intermediate values. According to another approach, it is possible to mask the original signal by intentionally reducing the signal amplitude to reduce the signal-to-noise ratio (S/N). In a variant, one can also add amplitude or temporal noise to the power consumption measurements to decrease the S/N ratio. Other countermeasures may involve hardware modifications, for example, by varying a chip's internal clock frequency to desynchronize electrical signals, or may involve modifications of the cryptographic protocol, for example, by renewing and updating continuous storage of secrets during the lifetime of the cryptographic system.

[009] However, preventing PDA attacks is very challenging, as even small variations in power consumption can lead to weaknesses that can be exploited. Furthermore, there is generally no free access to such countermeasures due to the protection afforded by patents. Therefore, there is a need to offer a new AE scheme in order to at least partially overcome these disadvantages.

SUMMARY OF THE INVENTION

[010] Instead of offering new countermeasures to protect cryptographic systems from DPA attacks, the present invention suggests an improved mode of operation, still taking DPA attacks into account. For this purpose, the present invention refers to a mode of operation, based on the CCFB scheme, which is more suitable for mitigating DPA attacks. More particularly, the present invention suggests a block cipher method using round repetition to provide, from a plaintext message, a ciphertext message and a global token to authenticate said ciphertext message. The plain text message is converted (in particular by dividing it and padding it, if any) into a plurality of ordered plain text blocks, all having the same bit size. Each of these plain text blocks is successively processed in an orderly manner as a current plain text block during a round. The method comprises the following steps:

[011] - load first data into a record,

[012] - execute the round by carrying out the following steps:

[013] - a first step for reporting input data to a block cipher algorithm, such input data comprising register data and reproducible data, for example, counter data or any other reproducible data series,

[014] - a second step to calculate, within the block cipher algorithm, a cryptogram by encrypting the input data using a single cryptographic key, this cryptogram comprising a first segment and a second segment, the latter being defined as a local mark of authentication,

[015] - a third step to calculate a ciphertext block by performing a first operation using, as operands: the first segment, the current plaintext block, and the second segment,

[016] - provided that all aforementioned plaintext blocks have not been processed in such a round, reload the record with the last calculated ciphertext block and apply an update function, for example an increment function, to the reproducible data before carrying out a new round starting again in the said first stage,

[017] - determine the ciphertext message by concatenating the ciphertext blocks provided by all rounds in an ordered manner, preferably in the ordered manner mentioned above, then

[018] - reload the record with the last calculated ciphertext block and apply the update function to the reproducible data before performing only the first two steps of the round, then

[019] - calculate the global mark by a second operation using all local authentication marks calculated as operands.

[020] From the above method, it should be noted that the new mode of operation of the present invention is based on a Cipher and Counter Feedback (CCFB) scheme. In exact terms, the CCFB scheme is a two-pass AE scheme whose structure is quite similar to that of the one-pass solutions. The disclosed innovative method preferably adopts an unusual combination of two modes of operation, namely a counter mode (CTR) and a Cipher Feedback mode (CFB), to provide both encryption and authentication. According to this embodiment, a local authentication mark resulting from the calculation of the second segment of the cryptogram is not only used to calculate a global mark during the second pass, but is also advantageously used during the first pass to calculate each block of text. encrypted. Thus, it is proposed that improvements to the operation of secure computing systems, including but not limited to resistance to known attacks, can be achieved.

[021] Additional embodiments describe devices for implementing the methods mentioned above. Preferably, one of these devices is specifically dedicated to encrypting messages, while the other device is dedicated to the reverse process. Given that they comprise the same components, both of these devices are very similar and will be described in more detail in the following detailed description.

[022] The objective and advantages of the present invention are achieved thanks to the cryptographic method according to the subject matter of the independent method claims and thanks to the devices according to the subject matter of the other independent device claims.

[023] Other advantages and embodiments will be presented in the detailed description below.

BRIEF DESCRIPTION OF THE DRAWINGS

[024] The present invention will be better understood thanks to the attached figures, in which:

[025] Figure 1 schematically represents the process of converting a plain text message into a cipher text message,

[026] Figure 2 is a flowchart illustrating an illustrative embodiment of the cryptographic method of the present invention, more particularly the encryption phase,

[027] Figure 3 shows another embodiment according to a partial illustration of the method based on Fig. 2,

[028] Figure 4 is completely similar to Fig. 2, but refers to the decryption phase,

[029] Figure 5 shows an embodiment of a device for implementing any embodiment of the cryptographic method of the present invention, in particular for implementing any phase (encryption or decryption) of this method.

DETAILED DESCRIPTION

[030] Referring to Fig. 1, the latter schematically illustrates a plain text message (M) 10 processed by the present invention with additional input data 20, the main conversion steps of the plain text message 10 with said data input 20, and a ciphertext message (C) 50 generated from the process with additional data 52. Optionally, the plaintext message 10 may be provided with associated data (AD) 15 which may typically refer to a header of plain text message 10.

[031] According to a preferred embodiment, the aforementioned input data 20 comprises first data 21, for example, an initialization vector (IV), and reproducible data 22 that can be initialized (reset) to any standard value. Preferably, such reproducible data is counter data (CDt), namely, data such as a value provided by a counter. However, since there is no requirement to limit such data to data provided by an accountant in the strict sense, it refers to so-called reproducible data. The word “reproducible” excludes any random data unless it has been predefined before being used. Therefore, it should be understood that the reproducible data mentioned above refers to any data, such as a value that can be reproduced thanks to a reproducible process or function that can be considered as an update function or renewal function. For example, such a process or function may relate to a hash function or an increment or decrement function applied to an initial value. He/she may also refer to a predefined list or series of random or pseudo-random numbers obtained successively, in a certain order, as reproducible data. Ideally, all these numbers will be different to avoid repetition. In the present description, the expression "meter data" is used in accordance with a preferred embodiment, namely, as a non-limiting example. The additional data 52 relates to a brand, in particular, to a global brand (TG) that is determined from a plurality of local brands, as further explained hereinafter. The global tag 52 is used as an authentication data to authenticate the ciphertext message 50 at the end of the process.

[032] As illustrated in Figure 1, the plain text message 10 is converted into a plurality of plain text blocks (mi, m2, m3, ... mi). In this Figure, each of these plain text blocks is identified by the common reference numeral ii. The conversion process used to convert the plain text block message i0 into a plurality of plain text blocks ii is primarily intended to divide the plain text message i0 into blocks containing the same bit size. In the case where the plain text message i0 has a bit size that is not a multiple of the number of bits of the plain text blocks, the conversion process will additionally comprise a step to fill at least one of the two plain text blocks. endings (e.g., the last and/or first plaintext block) with at least one standard bit (e.g., with a zero bit). The purpose of the padding step is to provide the final block with the same bit size as the other blocks.

[033] Plaintext blocks ii need to be processed in a specific order, so that the same order can be applied during the reverse process for the purpose of decrypting the ciphertext message. Therefore, the plain text blocks ii are arranged in an orderly manner. Alternatively, each block is assigned an identifiable position in order to determine that specific order. Thanks to the order of these blocks, it will be possible to reconstruct the plaintext message 10 from the ciphertext message 50. Preferably, when the plaintext message 10 is divided into blocks 11, the latter are not mixed together, but the order in which they were divided is maintained. It is possible to maintain such an order, for example, by storing, in a register, both the contents of the block and its position within the message 10. In one variant, an index could be associated with the contents of each block, so that it may be possible to retrieve the appropriate position of any block mi, m2, m3, ... mi thanks to its index 1,2, 3, ... i.

[034] Then, each of these plain text blocks ii is processed successively, as the so-called current plain text block, in such an ordered manner during a round R of the method. At the end of each round, a ciphertext block 51 is obtained corresponding to the current plaintext block 11. For example, the plaintext block m1, illustrated in Fig. 1, gives the ciphertext block c1 in the output of the round.

[035] Each round also provides a tag, in particular, a local tag 32 in correspondence with the related ciphertext block 51 generated by the same round. The set of iterations that allow calculating the ciphertext blocks 51 constitutes a first pass of the method. In one embodiment, the second pass aims to determine the global mark 52 using all local marks 32 that have been calculated.

[036] The ciphertext message 50 is obtained by combining all the ciphertext blocks 51 together, in particular concatenating them to form a chain in accordance with the previously mentioned ordered manner, so as to maintain respective positions between the blocks 11 within the plaintext message 10 and the corresponding blocks 51 within the ciphertext message 50. Since the associated data 15 typically may be the header of the message 10, therefore, it remains plain and is merely appended to the message. ciphertext 50. At the end of the process, the ciphertext message 50, its associated data 15 (if any) and the global tag 52 together form three linked related entities.

[037] A preferred method implementing the present invention will now be explained in more detail thanks to Figure 2 which shows, through a plurality of iterations (ITi, IT2, IT3,....ITi), the actions and steps undertaken during the encryption phase. Each of these iterations provides a block of 5i ciphertext at the end of a set of steps and actions.

[038] The first action is to load first data 2i into a register 23. Preferably, and as illustrated in the embodiment depicted in Fig. 2, the first data 2i of the first ITi iteration is an IV initialization vector that can be generated by any random or pseudo-random generator. The next action intends to execute the method round by carrying out the following three main steps.

[039] The first step of the round is used to input input data 20 to a block cipher algorithm (E) 35. This algorithm is a generic block encryption scheme that may refer to DES, IDEA, AES or the any other block cipher algorithm. Input data 20 comprises data loaded into register 23, namely first data 2i and counter data (CDti) 22. Counter data 22 refers to a value provided by a counter (CTR) 25. This counter can be considered as an updater (i.e., a unit for updating), since it is updated, namely, incremented (or decremented) every time a new ITn iteration is performed. Therefore, each round starts with new counter data (CDti, CDt2, ... CDti, CDti+i). Counter data, therefore, is used as a so-called “nonce”, that is, as a “number used only once”. In fact, each value provided by the counter is unique in all processed blocks ii.

[040] During the second step of the round, a cryptogram 30 is calculated and then output from the block cipher algorithm 35 by encrypting the input data 20 using a single cryptographic key (K) 34. This cryptogram 30 comprises a first segment (S1) 31 and a second segment 32. The latter is defined as being an authentication tag (Tn), in particular as being the local tag that authenticates the first segment 31. Preferably, the local tag 32 is stored in a memory, until the global mark 52 has been calculated, or at least temporarily until an intermediate calculation is performed with the next local mark 32 of the next round, in which case the global mark is determined progressively during each iteration.

[041] The third step of the round is dedicated to calculating the ciphertext block 51 from the current plaintext block 1. To this end, the ciphertext block 51 is determined by performing a first operation 41 using, as operands : The first segment 31, the current plaintext block 11, and the local mark 32. Therefore, the ciphertext block 51 is the result of an operation performed on three data.

[042] Given that this first operation 41 uses three operands, it is therefore performed in two steps, namely, performing a first suboperation OP11 using a first operator, and then performing a second suboperation OP12 using a second operator. Typically, the two suboperations OP11, OP12 are logical operations (Boolean algebra), typically commutative operations. Still preferably, at least one of the operators is an exclusive OR operation (XOR operation).

[043] Furthermore, thanks to the commutative property of the XOR suboperations, it should be noted that the three operands can be processed in any order within the first operation 41. As illustrated in the example form in FIg. 1, the current plaintext block 11 is processed with the first segment 31 by the first suboperation OP11, and then the result of this first suboperation is processed with the local mark 32 by the second suboperation OP12. As a result, the second suboperation OP12 provides ciphertext block 51 and ends the first iteration IT1.

[044] Instead of using a Boolean operation, such as an XOR operation, it should be noted that the second suboperation OP12 could be based on any other function that is capable of mixing distributions of the two operands used as input, such that, when one of these two operands is unknown, it is not possible to calculate the other operand for a given cipher block 51 (that is, for a given output). However, the function must obviously remain reversible; otherwise, decryption would not be feasible. For example, if a modular addition is used as the operation during the encryption phase, then a modular subtraction is used instead of the modular addition during the decryption phase. Therefore, the operations performed during the decryption phase will be the reverse of those performed during the encryption phase.

[045] Although the XOR operation remains the most natural choice, it should be noted that modular addition or modular multiplication could also be used to perform such operations during the encryption phase if modular subtraction or, respectively, modular division is used for the decryption phase. However, such modular operations are less suitable as they may release information (e.g., the carry bit in modular addition) that could be used by other side-channel attacks.

[046] Provided that all plaintext blocks 11 have not been fully processed, record 23 is then reloaded with ciphertext block 51 (i.e., with the current - or last calculated - ciphertext block 51 as shows Fig. 2) and an update function, for example an increment function, is applied to the counter data 22 before performing a new round (that is, before starting again at the first step of the round mentioned above). Therefore, the first data 21 of the second IT2 iteration will correspond to the ciphertext block 51 issued from the first IT1 iteration, and the CDt2 counter data of the second iteration will correspond to the result of the increment function applied to the CDT1 counter data of the first IT1 iteration. In the present description, the expression “increment function” will be used as a preferred embodiment of the “update function”. Therefore, it must be understood that the “increment function” could be replaced by any “update function”. Similarly, the counter 25 mentioned in the present description could also be considered as an “update”, as already mentioned above.

[047] When all plaintext blocks 11 have been processed, register 23 is reloaded with the last calculated ciphertext block 51 and the counter increment function is applied to the (current) CDTi counter data, as for the previous iterations. However, only the first two steps of the round are then performed in order to obtain the cryptogram 30 from the input data 20 (i.e. from ci and CDti+1) which is processed within the block cipher algorithm 35 using cryptographic key 34. Therefore, these actions do not refer to a complete iteration (like those done previously), but instead should be considered to be a partial iteration. From this last cryptogram 30, the local mark (Ti+1) 32 is then used to calculate the global mark 52 by a second operation (OP2) 42 using all the calculated local marks, namely, all the local marks calculated since the first iteration IT1. It should be noted that only the local tag (second segment 32) of this partial iteration is used. Therefore, the determination of the first segment 31 remains optional, but is carried out implicitly through the calculation of the cryptogram 30 which is processed as a single piece of data.

[048] The result of the second operation (OP2) provides the global mark 52. This result is calculated in a similar way to determining the result of the first operation (OP1), namely, by a plurality of suboperations (OP21 to OP2i). Preferably, each suboperation uses, as operands, the local tag Tn of the related iteration ITn and the result of the previous suboperation determined in the previous iteration ITn-1. The nature (i.e., type) of the second operation OP2 is similar or identical to that of the first operation OP1. The same is true with respect to the order in which the operands are used to determine the global mark 52. Determining the global mark 52 from all local marks corresponds to the second pass of the mode of operation.

[049] The ciphertext message 50 is determined by combining (concatenating) all the ciphertext blocks 51 together, in a specific order that will be reused to recover the plaintext message 10 from the ciphertext message 50 during a reverse process that will be described here later. For example, such an order may be the same in which the plain text blocks 11 were processed. In one variant, an index could be assigned to each of the ciphertext blocks 51 in order to identify the order in which these blocks were processed.

[050] Advantageously, by performing the first operation OP1 using three operands instead of two, the ciphertext block 51 does not result from a single operation, but from two successive operations, namely, the first suboperation OP11 and the second suboperation OP12 . The first suboperation uses two of the three operands as inputs, and the second suboperation uses the third operand and the result of the first suboperation as inputs. An attacker who wants to perform DPA attacks on such a process by running the block cipher algorithm on many inputs (e.g., 100,000 times to observe 100,000 power traces) will not have access to the intermediate output determined based on the first two operands. Instead, it can only observe the output provided after the second OP12 suboperation. Consequently, he will first have to attack the second sub-operation before he can analyze the first sub-operation OP11. However, the second suboperation is based on two unknown values; both uniformly distributed and uncorrelated. As a result, DPA does not work, or at least it will be much more difficult to apply such an attack to the subject matter of the present invention than in one of the prior art processes.

[051] According to one embodiment, the method further comprises a preliminary step for restoring a common bit size between the first data 21 (i.e., data located within register 23) and the counter data 22. This preliminary step is performed in the case where the first data 21 and the counter data 22 do not have the same bit size. Preferably, this preliminary step is performed before reporting said input data 20 to the block cipher algorithm 35 or within the algorithm 35 itself. Preferably, the first segment 31 and the local mark 32 have the same bit size. . Otherwise, the method may additionally comprise an additional step (stuffing step) to restore the same bit size between these two segments. Still preferably, all of the first data 21 (e.g. IV), the counter data 22, the first segment 31 and the second segment 32 (place mark) have the same bit size, namely half the size of input data bit 20.

[052] According to an embodiment illustrated in Fig. 3, the first data 21 may be the result of an initial operation (OP0) 43 using associated plain text data (AD) 24 as an operand. As illustrated in example form in this Figure, an initialization vector IV may be used as a second operand of the initial operation 43. The associated data 24 typically may refer to a header of the plain text message 10. In this case, one should understand that the header (i.e. the associated data) is not processed in the same way as the message itself, but remains as an appendix to the message The nature of the initial OP0 operation is similar or identical to that of the first OP1 operation or the second OP2 operation. Typically, the associated data is added to the initialization vector.

[053] Referring to Fig. 4, it shows the decryption phase of the ciphertext message 50 obtained in accordance with the decryption phase illustrated in Fig. 2. Since the mode of operation for encryption of a text message plane 10 (Fig. 2) refers to a reversible encryption process, the decryption method illustrated in Fig. 4 is very similar to the encryption method in Fig. 2.

[054] More specifically, Fig. 4 depicts a block decryption method using repeat rounds to provide, from a ciphertext message 50, a plaintext message 10 and a global tag 52 to authenticate said message. plain text. The ciphertext message 50 being converted into a plurality of ordered ciphertext blocks 51; all of them having the same bit size (such an operation is not illustrated in Fig. 4, but is similar to that illustrated in Fig. 1). More particularly, this bit size is equal to that which was defined to obtain plaintext blocks 11 from the plaintext message 10 that was at the origin of this ciphertext message 50 during the encryption phase (Fig. 2). As explained in relation to the encryption phase, if any, a filling step could also be applied to the final blocks (first or last block, depending on the block that was filled during the related encryption phase). Each of the ciphertext blocks 51 is successively processed in an orderly manner as a current ciphertext block during one round. In particular, this ordered manner allows maintaining the respective positions between the blocks 11 within the plaintext message 10 and the corresponding blocks 51 within the ciphertext message 50.

[055] Generally speaking, the same actions as those performed during the encryption phase are performed, namely, loading first data 21 into register 23, and then running the round by carrying out the following steps:

[056] A step for reporting input data 20 to a block decryption algorithm 35, this input data comprising data loaded into register 23 and counter data 22.

[057] A second step to calculate, within the block decryption algorithm 35, a first output 30 by decrypting the input data 20 using the unique cryptographic key 34 (i.e., the same key K that was used for the decryption phase). cryptography). This first output 30 comprises a first segment 31 and a second segment 32, the latter being defined as an authentication local tag.

[058] A third step to calculate a plaintext block 11 by performing a first operation (OP1) uses, as operands: the first segment 31, the current ciphertext block 51 and the second segment 32 (i.e. the local tag provided by the current iteration). Therefore, plain text block 11 is the result of an operation performed on three pieces of data. Given that this first operation 41 uses three operands, it is therefore carried out in two steps as already explained in relation to the encryption phase.

[059] It should be noted that the operation (OP1) 41 performed during the decryption phase (Fig. 4) is the inverse of the operation (OP1) 41 performed during the encryption phase (Fig. 2). Furthermore, since each of these operations 41 comprises two successive sub-operations, namely the first OP11, and then OP12, it must be understood that the first sub-operation OP11 performed during the decryption phase corresponds to the inverse of the second sub-operation OP12 performed in the encryption phase. Similarly, the second OP12 suboperation performed during the decryption phase corresponds to the inverse of the OP11 suboperation performed first during the decryption phase.

[060] As long as all ciphertext blocks 51 have not been fully processed, the record is reloaded during a next iteration with the current ciphertext block 51 (i.e., with the last calculated ciphertext block 51, as shown Fig. 4), and an increment function is applied, by counter 25, increments the counter data of the previous iteration in order to obtain new counter data 22. This new counter data 22 will be used when executing the new round, in the current new iteration, by starting again with the first step of the present decryption method. In particular, the increment function is the same function as the one used during the encryption phase. Furthermore, the first counter data (CDt1) used as the initial value (i.e., by the first IT1' iteration) during the decryption phase is the same as that used as the initial value (by the first IT1 iteration) during the encryption phase. . For this reason, the first counter data (CDt1) of the encryption phase could be transmitted to the decryption device that is in charge of decrypting the ciphertext message 50. Typically, such counter data (CDt1) could be transmitted together with the ciphertext message 50, for example, in the (unencrypted) header of the ciphertext message 50. Furthermore, this counter data (CDt1) could also be stored within the encryption device, at least temporarily in the case where these data must be present to the decryption device for any reason (for example, for resynchronization purposes between the sender and receiver). The same is true with regard to the first data 21 (IV). According to another way, the initial counter data (CDt1) could also be set to a default value (for example, it could be set to 1) so that it does not need to be communicated. In fact, the same first data 21 needs to be loaded into the register during the first IT1 and IT1’ iterations. Therefore, the first data 21 (IV) could also be transmitted in the same way as for the first data, and could also be stored within the encryption device for the same reason or could be set to a default value without needing to be communicated. . In a variant, the first counter data (CDt1), the first data 21 (IV) and other data that may vary, such as the cryptographic key 34 (K) and/or the counter increment function 25, could be shared , at least once, between the encryption device and the decryption device during an initialization phase. Such an initialization phase could also be reproduced later, for example to restart the system or update it.

[061] The plain text message 10 is determined by combining (concatenating) the plain text blocks 11 obtained during all rounds in the same order, as mentioned above, so as to recover the plain text message that was originally used during the encryption phase to provide the ciphertext message 50.

[062] Then, record 23 is reloaded with the current ciphertext block 51 (that is, with the last ciphertext block 51 that was processed during the last ITi' iteration) and the increment function is applied one more time. time to the last counter data 22 before executing only the first two steps of the round (in a similar way to what was performed during the encryption phase when referring to partial iteration). From this last first output 30, the local mark (Ti+1) 32 is then used to calculate the global mark 52 (TG) by a second operation (OP2) 42 which uses all the calculated authentication local marks 32 as operands. As already explained with respect to the encryption phase, the global mark 52 resulting from the second operation OP2 is calculated in a similar way to determining the result of the first operation (OP1), namely, by a plurality of suboperations (OP21 to OP2i). The same type of operations and variants as those mentioned during the encryption phase can be applied during the decryption phase.

[063] Regardless of the encryption or decryption phase, it should be noted that the suboperations (OP21 to OP2i) are not necessarily calculated once all blocks 11, 51 have been processed. In fact, these suboperations could be calculated progressively, one by one during each iteration, by determining an intermediate result. This intermediate result could be stored in a memory until it is processed as an operant with the next local mark (second operand) provided by the next iteration (or partial iteration at the end of the process). The same principle could be applied to determine the message 10, 50, from the respective blocks 11, 51.

[064] Furthermore, due to the inverse property of algorithm 35, it should be noted that the block cipher algorithm mentioned in the encryption phase is the same as the block decryption algorithm of the decryption phase. Additionally, it should be noted that the result provided by algorithm 35 is defined as being the so-called “first output” 30 in the decryption phase. This terminology was chosen instead of the word cryptogram, as this output should instead be considered to be decrypted data (although, technically speaking, algorithm 35 does not make any distinction between the so-called first output and the so-called cryptogram).

[065] According to one embodiment, the block decryption method further comprises a preliminary step for restoring a common bit size between the first data 21 loaded into register 23 and the counter data 22. This preliminary step will be used in the case wherein the first data 21 and the counter data 22 do not have the same bit size. Such a preliminary step will be performed before reporting the input data 20 to the block cipher algorithm 35.

[066] As already mentioned with respect to the encryption phase, the first data 21 may be an IV initialization vector, in particular, a single block having the same bit size as that of the counter data 22.

[067] According to one embodiment and in a similar way to what is illustrated in FIg. 3, the first data 21 could be the result of an initial operation OP0 using associated plaintext data 24 as the operand. Preferably, this initial operation OP0 and the first and second operations OP1, OP2 are exclusive OR logical operations. However, as mentioned previously, other types of operations could also be used.

[068] Furthermore, it should be noted that the ciphertext message 50 of the present decryption method may be additionally associated with an authentication data (in particular, the global tag obtained during the encryption phase by a cipher method). related block). In such a case, the present decryption method could additionally comprise a step to verify whether this associated authentication data is identical to the global tag 52 determined by the second pass of the decryption method. If the global tag 52 is not identical to the authentication data associated with the ciphertext message 50, the latter will be declared not authentic.

[069] Although the encryption phase and the decryption phase have respectively been presented as an encryption method and as a decryption method, the present invention could also refer to a single method comprising both the encryption phase and the decryption phase. decryption.

[070] The invention also relates to a cryptographic device 60, 60' for implementing one of the methods or embodiments disclosed in the present description. Referring to Fig. 1, 2 and 5, the first cryptographic device 60 is dedicated to implementing a block cipher method using round repetition to provide, from a plaintext message 10, a ciphertext message 50 and a global tag 52 to authenticate the ciphertext message. To this end, the cryptographic device 60 comprises the following components:

[071] - a register 23, typically in the form of a memory (e.g., a memory cell), for receiving first data 21,

[072] - an updater 25 for updating reproducible data 22 according to an update function f; for example, may refer to a counter 25 to increment counter data 22 according to an increment function (f),

[073] - an interface 61 for receiving at least plain text message 10,

[074] - a conversion unit 62 for converting and preferably storing the plain text message 10 into a plurality of ordered plain text blocks 11 (mi, m2, ... mi), all having the same size of bits,

[075] - a processing unit 64 for successively processing each of the plaintext blocks 11 in an ordered manner as a current plaintext block during a round, the processing unit further comprising a cryptographic unit 65, hosting a block cipher 35 and a memory 66 comprising a single cryptographic key 34 (K).

[076] Each round comprises:

[077] - a first step for inserting (for example, through the processing unit 64 as shown in Fig. 5) input data 20 into the block cipher algorithm 35, this input data 20 comprising data 21 of register 23 and reproducible data (counter data 22),

[078] - a second step to calculate, within the block cipher algorithm 35, a cryptogram 30 by encrypting the input data 20 using the unique cryptographic key 34; the cryptogram 30 comprising a first segment 31 and a second segment 32, the latter being defined as a local authentication mark and being stored in a memory, for example in memory 66 which may be located inside or outside the processing unit 64,

[079] - a third step for calculating and storing, for example, in such memory 66, a ciphertext block 51 by performing a first OP1 operation using, as operands, the first segment 31, the current plaintext block 11 and the second segment 32 (i.e. the local brand).

[080] As long as all plaintext blocks 11 have not been fully processed, processing unit 64 is further configured to reload register 23 with the current ciphertext block 51 (i.e., the last calculated ciphertext block 51) and to increment the counter data 22 (i.e., to update the reproducible data) before performing a new round by starting again for the first step.

[081] The conversion unit 62 is further configured to determine the ciphertext message 50 by concatenating the ciphertext blocks 51 (ci, 02, ... hi) of all rounds in an ordered manner, in particular in the manner aforementioned ordering, so as to maintain the respective positions between the blocks 11 within the plaintext message 10 and the corresponding blocks 51 within the ciphertext message 50.

[082] Processing unit 64 is further configured to reload register 23 with the last calculated ciphertext block 51 and to apply the increment function (f) to counter data 22 in order to increment it before executing only the first two stages of the round. Then, the processing unit 64 is configured to calculate the global mark 52 by a second operation OP2 using, for example, from memory 66, all the calculated local authentication marks (32) as operands.

[083] Interface 61 (or any other interface) is further configured to generate ciphertext message 50 and global tag 52.

[084] The conversion operation performed by the conversion unit 62 may relate to dividing the plain text message 10 into blocks 11 with the same bit size, and, if any, to a padding operation applied to at least one of the two Final 11 blocks of this plain text message once split.

[085] The cryptographic device 60 may additionally include a generator 67 (or a pseudo-generator) for generating an initialization vector (IV) that could be used to implement the method according to any of the embodiments disclosed in the present description. Such a generator (or another) could also be used to initialize counter 25 to an initial value, typically for reset purposes. Furthermore, it should be noted that register 23, counter 25 and, if applicable, generator 67, could be located within processing unit 64.

[086] When acting as a first device, particularly on the sender side, the encryption device 60 is typically designed to be used to encrypt plain text messages 10 which will then be decrypted by a decryption device 60', acting as a second device, in particular on the receiver side. Since the decryption phase corresponds to the reverse process of the encryption phase, the electronic components that form the encryption device are identical or similar to those of the decryption device. Only the functions associated with some components of the decryption device may differ from those of the encryption device. Therefore, the decryption device of the present invention will also be described herein with reference to the components of Fig. 5.

[087] Accordingly, this second device relates to cryptographic device 60' to implement a block decryption method using round repetition to provide, from a ciphertext message 50, a plaintext message 10 and a global tag 52 to authenticate the plain text message. This cryptographic device 60' comprises:

[088] - a register 23, typically in the form of a memory (or memory cell), for receiving first data 21,

[089] - an updater 25 for updating reproducible data 22 according to an update function f; for example, may refer to a counter 25 to increment counter data 22 according to an increment function (f),

[090] - an interface 61 for receiving at least ciphertext message 50,

[091] - a conversion unit 62 for converting and preferably storing the ciphertext message 50 into a plurality of ordered ciphertext blocks 51, all having the same bit size,

[092] - a processing unit 64 for successively processing each of the ciphertext blocks 11 in an ordered manner as a current ciphertext block during a round, the processing unit 64 further comprising a cryptographic unit 65, hosting an algorithm block decryption key 35 and a memory 66 comprising a single cryptographic key 34 (K).

[093] Each round comprises:

[094] - a first step to inform input data 20 to the block decryption algorithm 35, this input data comprising data 21 loaded into register 23 and reproducible data (counter data) 22,

[095] - a second step for calculating, within the block cipher algorithm 35, a first output 30 by processing input data 20 using the unique cryptographic key 34, the first output 30 comprising a first segment 31 and a second segment 32, the latter being defined as a local authentication tag and being stored (at least temporarily) in a memory, e.g., memory 66,

[096] - a third step for calculating and then storing (for example, in such memory 66) a plaintext block 11 by performing a first operation OP1 using, as operands, the first segment 31, the ciphertext block current 51 and the second segment 32 (i.e. the local brand).

[097] As long as all ciphertext blocks 51 have not been fully processed, processing unit 64 is further configured to reload register 23 with the current ciphertext block (i.e., the last calculated ciphertext block). and to update the reproducible data (e.g., to increment the counter data 22 via the counter increment function 25) before performing a new round by starting again for the first step.

[098] The conversion unit 62 is further configured to determine the plain text message 10 by concatenating the plain text blocks 11 of all rounds in an ordered manner, in particular in the aforementioned ordered manner, so as to maintain their respective positions between the blocks 11 within the plaintext message 10, and the corresponding blocks 51 within the ciphertext message 50.

[099] Processing unit 64 is further configured to reload record 23 with the current ciphertext block (i.e., the last ciphertext block that was processed) and to apply the increment function (f) to the data of counter 22 in order to increment them before executing only the first two steps of the round. Then, the processing unit 64 is configured to calculate the global mark 52 by a second operation OP2 using, for example, from memory 66, all the calculated local authentication marks (32) as operands.

[0100] Preferably, the processing unit 64 of the cryptographic device 60' is further configured to verify that the global tag 52 is identical to the authentication data provided along with the ciphertext message 50. Such authentication data will typically be the tag global 52 that was determined during the encryption phase by the cryptographic device 60. In the case where (for the same message 50) there is a difference between the global marks 52 provided by each of the cryptographic devices 60, 60', this means that the Plaintext message 10 (or ciphertext message 50) is not authentic. Accordingly, the processing unit 64 may perform an appropriate action, for example, it may trigger an alert message, interrupt the release of the plain text message 10, and/or may send information such as report data.

[0101] Of course, interface 61 is further configured to generate plain text message 10 once it has been returned.

[0102] It should be noted that the encryption algorithm of the cryptographic device 60 is the same as the decryption algorithm of the cryptographic device 60'. In fact, such an algorithm 35 can be used for encryption as well as decryption.

[0103] Furthermore, in order to determine the global mark 52, memory 66 (or other memory) will be used to store all local marks 32 or the intermediate results in case the global mark is determined progressively during each iteration. In one embodiment, the ciphertext message 50 or the plaintext message 10 could also be determined in the same manner.

[0104] The memory 66 of the cryptographic device 60, 60' may be a secure memory. In one embodiment, the components of the cryptographic device 60, 60' are comprised in a monolithic unit, therefore, it would not be possible to physically access the components, in particular at least the confidential components, without destroying the monolithic unit.

[0105] Cryptographic key 34 is used for both encryption and decryption purposes by cryptographic device 60, 60'.

[0106] Although the embodiments of the present disclosure have been described with references to specific exemplary embodiments, it will be evident that various modifications and changes can be made to these embodiments without departing from the broader scope of these embodiments. Therefore, the report and drawings must be considered from an illustrative and non-restrictive perspective. The accompanying drawings forming a part hereof show, by way of illustration, and not by way of limitation, specific embodiments in which the present subject matter may be practiced. The illustrated embodiments are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other embodiments may be used and derived therefrom, so that structural and logical substitutions and changes may be made without departing from the scope of this disclosure. Therefore, this Detailed Description should not be construed in a limiting sense, and the scope of the various embodiments is defined solely by the appended claims, together with the full range of equivalents to which such claims are designated.

[0107] Such embodiments of the inventive subject matter may be referred to herein, individually and/or collectively, by the term “invention” merely for convenience and without the intention of voluntarily limiting the scope of the present application to any individual inventive concept if more than one is, indeed, revealed. Thus, although specific embodiments have been illustrated and described herein, it should be appreciated that any arrangement calculated to achieve the same purpose may be used in substitution for the specific embodiments illustrated. This disclosure is intended to cover any and all adaptations or variations of the various embodiments. Combinations of the foregoing embodiments, and other embodiments not specifically described herein, will be apparent to those skilled in the art upon review of the above description.

Claims (15)

1. Block cipher method using round repetition to provide, from a plaintext message (10), a ciphertext message (50) and a global tag (52) to authenticate said ciphertext message (50), said plain text message (10) being converted into a plurality of ordered plain text blocks (11) having a predefined bit size, each of said plain text blocks (11) being successively processed in a ordered manner as a block of current plain text during a round, said method comprising the following actions: - loading first data (21) into a register (23), - executing said round by carrying out the following steps: - a first step for inserting input data (20) into a block cipher algorithm (35), said input data (20) comprising data (21) of said record (23) and reproducible data (22), - a second step for calculate, within said block cipher algorithm (35), a cryptogram (30) by encrypting the input data (20) using a single cryptographic key (34), said cryptogram (30) comprising a first segment ( 31) and a second segment (32), the latter being defined as a local authentication mark, - a third step for computing a block of ciphertext (51) by performing a first step (41) using, as operands , said first segment (31) and said current plaintext block (11), - as long as all said plaintext blocks (11) have not been processed in one round, reload register (23) with said ciphertext block (51) and applying an update function to said reproducible data (22) before executing a new round by starting again for said first step, - determining said ciphertext message (50) by means of concatenation of the ciphertext blocks (51) of all rounds in said ordered manner, and then - reloading the register (23) with the last calculated ciphertext block (51) and applying said update function to the reproducible data (22) before performing only the first two steps of said round, and then - calculating said global mark (52) by a second operation (42) using all calculated local authentication marks (32) as operands, CHARACTERIZED by the fact that the third stage of said round additionally uses said second segment (32) as operand. 2. Block cipher method according to claim 1, CHARACTERIZED by additionally comprising a preliminary step for restoring a common bit size between the first data (21) of said record (23) and said reproducible data (22) if the first data (21) and said reproducible data (22) do not have the same bit size, said preliminary step being carried out before inserting said input data (20) into the block cipher algorithm (35). 3. Block cipher method, according to claim 1 or 2, CHARACTERIZED by the fact that said first data (21) is an initialization vector. 4. Block cipher method according to claim 1 or 2, CHARACTERIZED by the fact that said first data (21) is the result of an initial operation (43) using associated plain text data (24) as operand . 5. Block cipher method according to any one of claims 1 to 4, CHARACTERIZED by the fact that said initial operation (43) and said first (41) and second (42) operations are exclusive OR logical operations. 6. Block cipher method according to any one of claims 1 to 5, CHARACTERIZED by additionally a step to fill a final plaintext block (11) with at least one standard bit in the case where the plaintext message (10) has a number of bits that is not a multiple of the number of bits of said plain text blocks (11). 7. Block decryption method using round repetition to provide, from a ciphertext message (50), a plaintext message (10) and a global tag (52) to authenticate said plaintext message, said ciphertext message (50) being converted into a plurality of ordered ciphertext blocks (51) having the same bit size, each of said ciphertext blocks (51) being successively processed in an ordered manner as a current ciphertext block during a round, said method comprising the following actions: - loading first data (21) into a register (23), - executing said round by carrying out the following steps: - a first step for inserting data from input (20) into a block decryption algorithm (35), said input data (20) comprising data (21) of said record (23) and reproducible data (22), - a second step for calculating, within the said block decryption algorithm (35), a first output (30) by decrypting the input data (20) using a single cryptographic key (34), said first output comprising a first segment (31) and a second segment (32), the last being defined as a local authentication mark, - a third step for computing a block of plain text (11) by performing a first step (41) using, as operands, said first segment (31) and said current ciphertext block (51), - as long as all said ciphertext blocks (51) have not been processed in one round, reload register (23) with said current ciphertext block (51) and applying an update function to said reproducible data (22) before executing a new round by starting again for said first step, - determining said plain text message (10) by means of concatenating the text blocks plan (11) of all rounds in said ordered manner, and then - reload the register (23) with the current ciphertext block (51) and apply said update function to the reproducible data (22) before performing only the first two steps of said round, and then - calculating said global mark (52) by a second operation (42) using all calculated local authentication marks (32) as operands, CHARACTERIZED by the fact that the third step of said round further comprises said second segment (32) as an operand. 8. Block decryption method according to claim 7, CHARACTERIZED by additionally comprising a preliminary step for restoring a common bit size between the first data (21) of said record (23) and said reproducible data (22) if said first data (21) and said reproducible data (22) do not have the same bit size, said preliminary step being carried out before inserting said input data (20) into the block cipher algorithm (35) . 9. Block decryption method, according to claim 7 or 8, CHARACTERIZED by the fact that said first data (21) is an initialization vector. 10. Block decryption method according to claim 7 or 8, CHARACTERIZED by the fact that said first data (21) is the result of an initial operation (43) using associated plain text data (24) as operand . 11. Block decryption method according to any one of claims 7 to 10, CHARACTERIZED by the fact that said initial operation (43) and said first (41) and second (42) operations are exclusive OR logical operations. 12. Block decryption method according to any one of claims 7 to 11, CHARACTERIZED by the fact that said ciphertext message (50) is additionally provided with authentication data and said method additionally comprises a step to verify if said authentication data is identical to said global tag (52), and if not, the ciphertext message (50) is declared as inauthentic. 13. Cryptographic device (60) for implementing a block cipher method using round repetition to provide, from a plaintext message (10), a ciphertext message (50) and a global tag (52) to authenticating said ciphertext message (50), comprising: - a register (23) for receiving first data, - an updater (25) for updating reproducible data (22) in accordance with an update function, - an interface (61 ) for receiving at least said plain text message (10), - a conversion unit (62) for converting and storing said plain text message (10) into a plurality of ordered plain text blocks (11) with the same bit size, - a processing unit (64) for successively processing each of said plain text blocks (11) in an ordered manner as a current plain text block during a round, said processing unit (64) further comprising a cipher unit (65), hosting a block cipher algorithm (35) and a memory (66) storing a single cryptographic key (34), - each round comprising: - a first step for inserting input data ( 20) in the block cipher algorithm (35), said input data (20) comprising data (21) of said record (23) and reproducible data (22), - a second step to calculate, within said algorithm of block cipher (35), a cryptogram (30) by encrypting the input data (20) using said unique cryptographic key (34), said cryptogram (30) comprising a first segment (31) and a second segment (32), the latter being defined as a local authentication mark and being stored in said memory (66), - a third step for calculating and storing, in said memory (66), a block of ciphertext (51) by means of of performing a first operation (41) using, as operands, said first segment (31) and said current plaintext block (11), - said processing unit (64) being further configured to reload the register ( 23) with said ciphertext block (51) and update the reproducible data (22) before executing a new round by starting again for said first step, provided that all said plaintext blocks (11) have not been processed in one round, - said conversion unit (62) being further configured to determine said ciphertext message (50) by concatenating the ciphertext blocks (51) of all rounds in said ordered manner, and - said processing unit (64) being further configured to reload the record (23) with the last calculated ciphertext block (51) and apply the update function to said reproducible data (22) so as to update it before of performing only the first two steps of said round, and then calculating said global mark (52) by a second operation (42) using, from said memory (66), all calculated local authentication marks (32) as operands, - said interface (61) being additionally configured to present said ciphertext message (50) and said global tag (52), CHARACTERIZED by the fact that said processing unit (64) is additionally configured to also consider said second segment (32) as an operand in the third step of said round. 14. Cryptographic device (60') for implementing a block decryption method using round repetition to provide, from a ciphertext message (50), a plaintext message (10) and a global tag (52) for authenticating said plain text message, comprising: - a register (23) for receiving first data (21), - an updater (25) for updating reproducible data (22) in accordance with an update function, - an interface ( 61) for receiving at least said ciphertext message (50), - a conversion unit (62) for converting and storing said ciphertext message (50) into a plurality of ordered ciphertext blocks (51) with the same bit size, - a processing unit (64) for successively processing each of said ciphertext blocks (51) in an ordered manner as a current ciphertext block during a round, said processing unit (64 ) further comprising a decryption unit (65), hosting a block decryption algorithm (35) and a memory (66) comprising a unique cryptographic key (34), - each round comprising: - a first step for inserting input data (20) in the block decryption algorithm (35), said input data (20) comprising data (21) of said record (23) and reproducible data (22), - a second step to calculate, within said algorithm block cipher code (35), a first output (30) by processing the input data (20) using said unique cryptographic key (34), said first output (30) comprising a first segment (31) and a second segment (32), the latter being defined as a local authentication mark and being stored in said memory (66), - a third step for calculating and storing, in said memory (66), a block of plain text (11 ) by performing a first operation (41) using, as operands, said first segment (31) and said current ciphertext block (51), - said processing unit (64) being further configured to reload record (23) with said current ciphertext block (51) and update the reproducible data (22) before executing a new round by starting again for said first step, provided that all said ciphertext blocks (51 ) have not been processed in a round, - said conversion unit (62) being further configured to determine said plain text message (10) by concatenating the plain text blocks (11) of all rounds in said orderly manner, and then - said processing unit (64) being further configured to reload the register (23) with the current ciphertext block (51) and apply the update function to said reproducible data (22) so as to updating them before performing only the first two steps of said round, and then calculating said global mark (52) by a second operation (42) using, from said memory (66), all calculated local authentication marks (32) as operands, - said interface (61) being additionally configured to present said plain text message (10), CHARACTERIZED by the fact that said processing unit (64) is additionally configured to also consider said second segment (32) as an operand in the third step of said round. 15. Cryptographic device (60'), according to claim 14, CHARACTERIZED by the fact that said processing unit (64) is additionally configured to verify that said global mark (52) is identical to the authentication data provided along with with the ciphertext message (50), and, if not, take appropriate action.