Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
  • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
  • H04L9/0631—Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/04—Masking or blinding
  • H04L2209/046—Masking or blinding of operations, operands or results of the operations
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/30—Compression, e.g. Merkle-Damgard construction

Definitions

• audiovisual streams can be used for end-users (digital television, pay-TV, movie download) or in a professional environment (video cameras communicating with each other and / or with a server in a digital mode).
• end-users digital television, pay-TV, movie download
• professional environment video cameras communicating with each other and / or with a server in a digital mode.
• This algorithm provides perfect security when using a key of the same length as the information to be encrypted or decrypted, this key then being taken as a mask. In practice, it is generally impracticable. To build the mask, we can for example concatenate successive copies of the encryption key. The algorithm is then vulnerable, for example to statistical attacks, and this vulnerability increases with the number of copies of the initial key that had to be made to generate the mask, so with the ratio between the number of bits of the information to process and number of bits of the key.
• the strong algorithm is a block algorithm (for example the AES) for which the information to be encrypted or decrypted is divided into blocks of fixed length (for example 128 bits in the case of the AES), each block being treated independently of others.
• the strong algorithm is executed on each of the blocks.
• the blocks themselves are grouped into sectors, a sector comprising several blocks (or several tens or hundreds of blocks depending on the applications). Encryption and / or decryption execute in two stages.
• each sector it is initially calculated, using a strong algorithm, a secondary encryption key dependent including data in this sector and varying from one sector to another.
• This secondary encryption key is, in a second time, used to encrypt / decrypt all or part of the blocks of the sector using a faster algorithm.
• the invention ensures, on the one hand, that the encrypted information does not occupy more bits than the information in the clear, and, on the other hand, that the secondary encryption keys can be easily calculated, both from information in the clear only encrypted information, when we know the keys of the strong algorithm, and that these secondary encryption keys are impossible to find otherwise.
• the invention relates to a method for encrypting and / or decrypting information in the form of a sequence of bits grouped in blocks, these blocks being themselves grouped into sectors.
• the method encrypts and / or decrypts a sector hereinafter called the sector to be treated and comprises the following steps:
• a step implementing a compression routine which takes as argument the sector to be processed and provides as a result a sequence of bits comprising fewer bits than the sector to be processed, this result being hereinafter called the secondary encryption key,
• the computation performed by the fast encryption routine uses a sequence of bits called a fast key, determined from the secondary encryption key.
• the result of the method is a sector hereinafter referred to as the result sector, composed of as many blocks as the sector to be treated, all or part of the blocks of the result sector being determined from the result blocks provided by the routine. fast encryption applied during the processing step.
• the method implements one or more primary encryptors, each of them using a sequence of bits called primary key, and performing a calculation taking as argument a block and providing as a result a new block.
• the compression routine comprises an intermediate step of determining a block hereinafter called the first intermediate block, and a calculation step of applying at least one primary encryptor to a block determined from this first intermediate block. The result of this calculation is used to determine the secondary encryption key.
• the method is further such that it is possible to find this secondary encryption key from the result sector.
• the first intermediate block is determined from the result of the application of the "exclusive or bitwise" operator, hereinafter referred to as the XOR operator, between all or some of the blocks. constituting the sector to be treated.
• the determination of this first intermediate block takes into account a sequence of bits called mixing key.
• the method uses a sequence of bits called the original encryption key and the mixing key can be determined from the original encryption key, and this during a step called first preliminary step.
• each of the sectors to be treated composing the information to be encrypted or decrypted is assigned a number called sector number.
• the calculation step that contributes to determining the secondary encryption key then comprises the following two phases.
• the first phase called the disturbance phase, consists in determining a block, hereinafter referred to as a disturbed block, taking into account, on the one hand, the first intermediate block and, on the other hand, a value depending on the sector number. .
• a second phase at least one primary cryptor is then applied to this disturbed block.
• the disturbed block determined during the disturbance phase is obtained by applying the XOR operator, between, on the one hand, the first intermediate block and, on the other hand, a value depending on the sector number assigned to the sector to be treated.
• the calculation step further comprises an additional phase of determining a block hereinafter called the second intermediate block, taking into account the result of the application of at least one primary encryptor to the secondary encryption key.
• the second intermediate block a block hereinafter called the second intermediate block
• the determination of all or part of the fast keys takes into account the first intermediate block and / or the second intermediate block.
• the method implements a function F for generating a series of numbers.
• the first number of this sequence is then generated from the secondary encryption key, and each subsequent number of the sequence is calculated by applying the function F to the number immediately preceding it in the series of numbers. All or part of the numbers of this suite are then taken into account to determine all or part of the quick keys used in the fast encryption routine.
• the fast keys are such that there is at least one subset of the set of fast keys, this subset can be the whole set, such as if one applied the XOR operator between all the fast keys of this subset, we would find the same result by applying the XOR operator between the first intermediate block and the second intermediate block.
• At least one of the primary encryptors provides result the result that would provide the encryption algorithm AES implemented on the same argument and with a key identical to the primary key used by this primary encryptor.
• the fast encryption routine calculates a result block from the result of the operation of applying the XOR operator between one of the fast keys and the block to be treated as an argument. by this routine.
• the method that is the subject of the present invention uses a series of bits called the original encryption key and comprises a second preliminary step of determining, from this original encryption key, all or part of the primary keys used by the primary encryptors.
• the invention also relates to an information processing system comprising calculation means and information storage means for implementing the previously described method.
• this system comprises two parts, respectively called host device and specific cryptographic device.
• the latter comprises processing means for performing the calculation step. It is also such that the primary keys used by the primary encryptors are never communicated outside this specific cryptographic device.
• the system includes link means enabling the host device to transmit to the specific cryptographic device information determined from the sector to be processed and link means allowing the specific cryptographic device to transmit the secondary encryption key to the host device.
• the host device comprises processing means for performing the processing step.
• the specific cryptographic device has storage means for storing a series of bits called the original encryption key, and of processing means for calculating all or part of the primary keys used by the primary encryptors, taking into account the original encryption key. It is further such that the original encryption key is never communicated outside the specific cryptographic device.
• the specific cryptographic device is removable and can be disconnected from the host device.
• it is connectable by a self-powered port, including a USB port.
• it is connectable to it by a wireless connection.
• the invention also relates to the cryptographic device described above.
• the invention also relates to any means of storing data in digital form, all or part of the data stored in this storage means having been encrypted using the method object of the present invention.
• the invention relates in particular to such storage means when all or part of the data is audiovisual data. It also relates in particular to such a storage means when it is intended to be read by optical reading.
• the invention also relates to any means for transmitting data in digital form, all or part of the data transmitted in this data transmission means having been encrypted using the method of the present invention, especially when all or part of the data. transmitted are data of an audiovisual nature.
• FIGS. 1 to 6 Several exemplary embodiments of the present invention are described below, in particular with reference to FIGS. 1 to 6. They differ in particular in the mode of calculation of the secondary encryption key from the sector to be treated and / or the result sector. All these examples are given here by way of illustration and not limitation.
• FIG. 1 represents an embodiment of the present invention, in which the secondary encryption key KS can be recalculated from one of the blocks in the result area.
• the invention implements two primary crypters CP1 and CP2, and preliminary steps make it possible to build, on the basis of an original encryption key KO, on the one hand, a KM mixing key and, on the other hand, two primary keys KP1 and KP2 respectively used by the two primary CP1 and CP2 crypters.
• the sector to be processed S (in this case, the information in the clear, which one proposes to encrypt) consists of n blocks M 0 , Mi, ..., M n _i and is assigned a number called NS area number.
• the final result of the calculation is a sector T, called sector result, composed of n blocks Co, Ci, ..., C n - I containing the encrypted information.
• An intermediate step E1 determines, from, on the one hand, n blocks M 0 , Mi, ..., M n _i composing the sector S to be processed, and, on the other hand, the sector number NS and the KM mixing key, a first intermediate block X.
• this intermediate step EI calculates a block from the sector number NS and the mixing key KM and then performs an operation XOR (or exclusive bitwise) between this block and the n blocks M 0 , Mi, ..., M n _i composing the sector to be treated.
• the first intermediate block X is then the result of this XOR operation. It will be said in this particular implementation that the intermediate step EI is of type XOR.
• a calculation step initially determines, starting from the first intermediate block X, a new block denoted Co, hereinafter referred to as discriminating block.
• the discriminant block Co is the first block of the final result, that is to say of the sector T.
• the determination of the discriminant block Co is done by applying to the intermediate block X the first encryptor CPl primary, using the first key Primary KPl. Once this block Co determined, the calculation step applies to it the second primary cryptor CP2, using the second primary key KP2.
• the secondary encryption key KS is then equal to the result of this calculation. It is therefore possible to find it from the result sector T, because the discriminant block which makes it possible to calculate it is one of the blocks of this sector result T.
• a processing step then makes it possible to encrypt the n-1 blocks Mi, M 2 ,..., M n -1, that is to say all the blocks constituting the sector to be treated S, excluding the first.
• This encryption is done using a fast cryptographic routine CR.
• n-1 sequences of bits, called fast keys, and noted respectively ki, k 2 , ..., k n _i, are calculated from the secondary encryption key KS.
• the calculation of the quick keys is done in two stages.
• K 0 , K 1 , K 2 ..., K n _i the first of these numbers being equal to the secondary key KS, each of the following being calculated by applying a function F to number that precedes it in the sequel.
• the n-1 numbers Ki, K 2 ..., K n _i then generate n-1 fast keys ki, k 2 , ... k n _i.
• Each of the n-1 blocks Mi, M 2 ,..., M n -i is then encrypted by the fast encryption routine CR using one of these fast keys, the result block resulting from this encryption giving the corresponding block in the sector result T.
• a particular implementation consists in using as function F the function "Identity" providing a result equal to its argument.
• the fast keys are then all equal to each other and equal to the secondary key KS encryption, which allows faster computing, but at the expense of cryptographic security.
• the fast cryptographic routine CR is a simple XOR mask and the result block is obtained by applying the XOR operator between the block to be processed and the fast key.
• the discriminant block may be any of the blocks of the result sector T, the position of this block may vary from one sector to another. In one of these variants, the position of the discriminator block in the result sector T is related to the sector number NS. In other variants, the discriminant block is taken into account in the calculation of the final result, that is to say the result sector T, so that it can be easily found from this sector result T, in particular by applying an XOR operator to all or some of the blocks forming the sector result T.
• FIG. 2 represents another embodiment of the invention, the purpose of which is to perform the operation opposite to that represented in FIG. 1.
• the sector to be treated is a sector to be deciphered T, composed of n blocks Co, Ci, ..., C n - I , the objective here being to find as sector result sector S which had been encrypted as shown in Figure 1, the sector number NS is the same.
• the same preliminary steps as in the example illustrated in FIG. 1 make it possible to build, from an original encryption key KO, on the one hand, a KM mixing key and, on the other hand, KPL primary keys. and KP2.
• the first intermediate block is the block Co, the first block of the sector to be deciphered.
• the intermediate block is any one of the blocks of the sector to be deciphered or is determined from all or part of the sector to be decrypted, in particular by applying an XOR operator to all or part of the blocks forming the sector. T.
• the second primary encryptor CP2 is directly applied to it, using the second primary key KP2, which generates the secondary encryption key KS.
• the fast keys ki, k 2 , ... k n _i are then calculated from the secondary encryption key KS in the same way as in the embodiment shown in FIG. 1, and each of the n-1 blocks to to treat Ci, C 2 ,..., C n -I is then decrypted by routine CR '1 , which is a reciprocal of the fast encryption routine CR, and with the aid of the corresponding fast key, the result of this decryption giving the corresponding block in the sector result S.
• n-1 blocks Mi, M 2 ,..., M n -i of this sector are reconstituted.
• the reciprocal routine CR '1 is identical to the fast cryptographic routine CR.
• the present embodiment illustrated in FIG. 2 comprises a complementary phase, during which a second intermediate block X is calculated by applying to the block Co the reciprocal algorithm of the first primary encryptor CP1 with the first primary key KP1.
• the block MQ is finally determined from the blocks Mi, M 2 ,..., M n-1 , the sector number NS, the mixing key KM, and the second intermediate block X.
• This calculation is the operation EI "1 , symmetrical of the intermediate step EI put into play during the encryption
• the block MQ is reconstituted by an operation XOR between the second intermediate block X, the n -1 result blocks Mi, M 2 , ..., M n _i already calculated and a block calculated from the sector number NS and the mixing key KM.
• Figure 3 shows another embodiment of the invention.
• the same preliminary steps as in the preceding examples make it possible to build, from an original encryption key KO, on the one hand, a KM mixing key and, on the other hand, the two primary keys KP1 and KP2 respectively used. by the two primary crypters CP1 and CP2.
• the sector to be treated S (in this case, the information in the clear, which one proposes to encrypt) consists of n blocks M 0 , Mi, ..., M n _i and is assigned a number called NS area number.
• the final result of the calculation will be a sector T composed of n blocks Co, Ci, ..., C n - I containing the encrypted information.
• An intermediate step EI determines a first intermediate block X from the n blocks M 0 , Mi, ..., M n _i composing the sector S to be processed and the mixing key KM.
• the secondary encryption key KS is obtained in two phases. During a first phase, called disturbance phase, an XOR operator is applied between the first intermediate block X and a value dependent on the sector number NS, providing as a result a block hereinafter called BP disturbed block. The second phase calculates the secondary encryption key KS by applying the first primary encryptor CP1 to the disturbed block BP. During a complementary phase, the second primary encryptor CP2 is then applied to the encrypted secondary key KS thus calculated, and an operator XOR is then applied between the result of the preceding operation and a value dependent on the sector number NS. which gives as a result a second intermediate block Y.
• disturbance phase an XOR operator is applied between the first intermediate block X and a value dependent on the sector number NS, providing as a result a block hereinafter called BP disturbed block.
• the second phase calculates the secondary encryption key KS by applying the first primary encryptor CP1 to the disturbed block BP.
• the secondary encryption key KS is used to generate the fast keys k ⁇ by a method similar to that used in the example shown in FIG. 1. In order not to burden FIG. 3, the details are not shown. These fast keys ki will be used by a fast cryptographic routine CR which encrypts all the blocks of the sector to be treated S to supply the corresponding blocks of the sector result T.
• a particular variant of implementation of the embodiment of the invention illustrated in FIG. 3 makes use of the properties of the XOR operator.
• the fast CR encryption routine simply consists in the application of an XOR operator between the block to be processed Mi and the corresponding fast key ki.
• the two intermediate blocks X and Y are taken into account in the generation of fast keys ki. More specifically, these are built of such that, by applying the XOR operator between all the fast keys k ⁇ , one would obtain the same result as by applying the XOR operator between the two intermediate blocks X and Y.
• a particular mode of construction of fast keys ki verifying these properties are given here as an illustrative and nonlimiting example of the possibilities of carrying out this particular variant. This particular mode of construction is realized in three stages.
• a first step consists in calculating intermediate fast keys, for example in a manner similar to that of the example illustrated in FIG. 1.
• a second step consists in applying the XOR operator between, on the one hand, all the keys intermediates and the intermediate blocks X and Y.
• a third step is to build one of the fast keys by applying the XOR operator between the corresponding intermediate fast key and the result of step 2, the other quick keys being equal to the corresponding intermediate keys.
• that of the intermediate fast keys to which the XOR operator is thus applied is variable from one sector to another and is chosen taking into account the sector number NS of the sector to be treated.
• the KM mixing key is not taken into account and the first intermediate block X is obtained by applying the XOR operator between the n blocks M 0 , Mi, ..., M n _i composing the sector to be treated S.
• the block X is calculated by first permuting the bits of all or part of the n blocks composing the sector to be treated S, before applying to them the operator XOR, the permutation to be performed. being determined from the KM mixing key.
• the permutation to be performed is variable from one block to another.
• the calculation of the second intermediate block Y from the result sector T is possible and can be done similarly to the calculation of the first intermediate block X from the sector to be processed S.
• FIG. 4 represents another embodiment of the invention, the purpose of which is to carry out the reverse operation of that carried out in the particular variant of the embodiment illustrated in FIG. 3.
• the sector to be treated is here a sector to decipher T , composed of n blocks Co, Ci, ..., C n - I , the objective being to find as final result the sector S which had been encrypted by this particular variant, the sector number being the same.
• An intermediate step EI determines a block Y which acts here as the first intermediate block, this block Y being determined from the n blocks composing the sector T to be processed and the mixing key KM.
• the secondary encryption key KS is obtained in two phases, similar to the embodiment illustrated in FIG. FIG. 3.
• a first disturbance phase an XOR operator is applied between the first intermediate block Y and a value dependent on the sector number NS, providing as a result a block hereinafter called the disturbed block BP.
• the second phase calculates the secondary encryption key KS by applying to the disturbed block BP the second primary encryptor in decryption mode (denoted here CP2 "1 ) .
• the first primary encryptor is then applied in decryption mode (noted here CPl '1 ) to the secondary encryption key KS, then an XOR operator is applied between the result of the previous operation and a value dependent on the sector number NS, which results in a block X which plays the role of second intermediate block.
• the secondary encryption key KS is then the same as that which was used during the encryption.
• Quick keys are built identically and are identical to those used for encryption.
• the fast CR encryption routine here consisting of a simple XOR operator application with a fast key, this fast CR encryption routine is its own reciprocal.
• the decryption operation here is therefore similar to the encryption operation, provided that the two primary encryptors are replaced by their reciprocal function, that is to say by making them operate in decryption mode, and to swap them. that is, to apply the second before the first.
• the mixing key KM is determined from the original encryption key KO. It is also possible to make variants in which the KM mixing key is public and fixed once and for all. As described with respect to the more sophisticated version of the particular variant of the embodiment illustrated in FIG. 3, its interest is mainly of a statistical nature, to ensure a statistical equidistribution of the values taken by the intermediate blocks.
• FIG. 5 illustrates an exemplary implementation in which the invention is implemented on a system comprising a host device and a specific cryptographic device DCS.
• the latter supports the preliminary step of determining the two primary keys KP1 and KP2, from the original key KB, and the calculation step in which the primary CP1 and CP2 encryptors are implemented using these primary keys KP1. and KP2.
• the host device is responsible for the rest of the processing.
• the cryptographic secrets that are the first primary key KPL, the second primary key KP2 and the original encryption key KO are never communicated outside the specific cryptographic device DCS.
• the host device determines a block called BP disturbed block from the first intermediate block X and a value dependent on a sector number NS assigned to the sector to be processed.
• the disturbed block BP is transmitted to the specific cryptographic device DCS.
• the latter applies the first primary encryptor CP1 to generate the secondary key KS which is communicated to the host device. It then applies the second primary encryptor CP2 to the secondary key KS to generate the second intermediate block Y which is also communicated to the host device.
• the latter using the information communicated to him, then determines the fast keys and implements the fast CR encryption routine.
• the information flows to or from the specific cryptographic device DCS are illustrated in the figure by triple arrows.
• the specific cryptographic device DCS is removable and can be detached from the host device. In its absence, it is impossible to perform encryption and / or decryption operations, which ensures total confidentiality of the encrypted information using the method object of the present invention.
• the specific cryptographic device DCS is presented as a "USB stick" connectable on a USB port, as taught in the patent. French 03/50626 filed September 30, 2003 issued January 20, 2006 and International Application PCT / FR2004 / 050299 June 30, 2004.
• the invention is implemented either without the use of a mixing key, or by using a KM mixing key that does not depend on the original encryption key KO, which is therefore identical for all the blocks.
• the KM mix key is used during the intermediate step EI supported by the host device.
• the primary crypters CP1 and CP2 implement a block cipher algorithm.
• the algorithm used is the AES algorithm, and is therefore the same for the two primary encryptors. It is then possible to use identical primary keys KP2 and KP2, but this may weaken the cryptographic security of the invention.
• FIG. 6 is a simplified diagram of the embodiment described in FIG.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=36360849

Family Applications (1)

Country Status (3)

Family Cites Families (2)

• 2005
  • 2005-08-04 FR FR0552436A patent/FR2889637B1/fr not_active Expired - Fee Related
• 2006
  • 2006-08-03 EP EP06794528A patent/EP1911190A2/de not_active Withdrawn
  • 2006-08-03 WO PCT/FR2006/050787 patent/WO2007015034A2/fr active Application Filing

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events