EP2127197A2

EP2127197A2 - Identity based broadcast encryption

Info

Publication number: EP2127197A2
Application number: EP08762146A
Authority: EP
Inventors: Cécile DELERABLEE
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2007-02-28
Filing date: 2008-02-25
Publication date: 2009-12-02
Also published as: FR2913154A1; US20100098253A1; WO2008113950A2; WO2008113950A3

Abstract

According to the invention, a public key (PK) depending on a secret key is accessible to an emitter entity (2) and to receiver entities. A private key, that can be associated with a receiver entity, depends on the secret key and on an identity parameter (IDj) of said entity. The encryption of a message (M) intended for a set of s receiver entities (s > 1 ) comprises generating a symmetrical encryption key (K) and an associated cryptogram (Hdr) based on the public key, identity parameters of the s receiver entities and a number selected by the emitter entity. The cryptogram provides access to the associated encryption key by combination with the public key, the identity parameters of the s receiver entities and the private key of an identified receiver entity of the set. The message is encrypted in the emitter entity by the generated encryption key, and broadcasted in this encrypted form together with said cryptogram.

Description

CREDIT BROADCAST BASED ON IDENTITY

The present invention relates to data encryption techniques or identity-based messages.

Identity-based encryption schemes, hereafter referred to as identity-based encryption (IBE) schemes, have been introduced to facilitate the message encryption phase.

An IBE scheme allows a sender to encrypt a message for a recipient, without having to memorize a recipient's certificate or a public key decorrelated from its identity. The recipient's public key is indeed deduced from his identity.

An IBE scheme can be used in particular to encrypt electronic messages. A person A wanting to send a message to a recipient B typically uses the email address of B to obtain the encryption key to use. A trusted authority provides each user who authenticates a decryption private key corresponding to his email address that is to say his public key. Therefore, B does not need to make A know a public key, certified or not, so that A can encrypt messages. This greatly simplifies the management of the system. It is even possible for A to encrypt a message for B before B has obtained his decryption private key.

Some IBE schemes exploit the properties of bilinear applications, for example that described in "Practical Identity-Based Encryption Without Random Oracles", C. Gentry, Eurocrypt 2006, Vol. 196, Lecture Notes in Computer Science 4004, pp. 445-464.

In IBE systems, the keys to be stored are usually short. However, there is currently no way to quantify effectively send a message to a group of users in such a system. To send an encrypted message to N users using their identities, it is necessary to encrypt the message N times with N different keys and to transmit N encrypted messages or, if a broadcast channel is borrowed, to broadcast information having the size of N encrypted messages. The information to be sent then has a linear size according to the number of recipients, which is not effective when the number N becomes large.

An aspect of the invention relates to an identity-based cryptographic method, wherein a public key dependent on a secret key is accessible to an issuing entity and to receiving entities, and respective private decryption keys are associable with the entities. receiving. The private key of a receiving entity depends on the secret key and an identity parameter of this receiving entity. The method includes an operation of encrypting at least one message to a set of s receiving entities, s being a number greater than 1. This encryption operation comprises the following steps:

generating at least one symmetric encryption key and a cryptogram associated with said symmetric encryption key according to the public key, the identity parameters of the receiving entities and at least one integer chosen by the transmitting entity, the cryptogram being generated so that it has a constant size and independent of the number s, and that it gives access to said symmetric encryption key by combination with the public key, the identity parameters of the receiving entities and the private key of an identified receiving entity of said set;

encrypting the message with said symmetric encryption key in the transmitting entity; and

- Broadcast the cryptogram and the encrypted message from the issuing entity.

It is thus possible to obtain an IBE scheme in the context of a broadcast encryption. "Broadcast encryption" refers to cryptographic techniques used to broadcast content on an unsecured public channel so that only legitimate users are able to read that content. For example, legitimate users are those who have paid a fee. The broadcasting entity that broadcasts content wants this content to remain confidential to illegitimate users, which requires a particular encryption scheme. An example of broadcast encryption is described in "Broadcast encryption", A. Fiat and M. Naor, CRYPTO'93, Lecture Notes in Computer Science, Vol. 773, pp. 480-491, Santa Barbara, CA, USA, August 22-26, 1994. Springer-Verlag, Berlin.

By reconciling IBE schema and broadcast encryption, we obtain a schema, hereinafter called BIBE ("broadcast identity-based encryption"), well adapted to various contexts of applications, such as the effective constitution of mailing lists of electronic messages encrypted. BIBE schemas can be constructed with or without a random oracle (a "random oracle" is a theoretical cryptographic device capable of responding to any query by a perfectly random response drawn uniformly across its range of values, said response being the same at each once you make the same request).

In addition, unlike the prior art, the cryptogram giving access to the encryption key has a constant size and independent of the number s of receiving entities. It is thus convenient to set a limit to the amount of data to be broadcast.

Moreover, the decryption (and encryption) keys used can also be of constant size, relatively small, and independent of the number s. This property lends itself well to a software implementation.

In one embodiment, the encryption operation comprises a first phase of calculating and storing a vector of values. intermediates according to the public key and the identity parameters of the receiving entities, and at least one occurrence of a second phase executed by the transmitting entity. This second phase includes the following steps:

- draw an integer;

calculating a symmetric encryption key and the associated cryptogram as a function of the drawn integer and the intermediate value vector, without again taking into account the identity parameters of the receiving entities;

- encrypting a message with the calculated encryption key; and

- broadcast the calculated cryptogram and the encrypted message.

Thus, the first phase of the encryption operation will be performed only once for the same set of receivers targeted by an issuing entity during a given period. This is well suited to the video encryption framework for example. A video intended for a certain set of users is encrypted throughout its distribution for this set of users. The first phase of the encryption operation of calculating the vector of intermediate values can be performed once and for all at the beginning of the video, while the symmetric encryption key can be updated regularly (for example every second). by repetitively executing the second phase with successive random number draws. This diversification of keys prevents them from being effectively hijacked if some users try to publish or communicate the symmetric encryption key during the video broadcast. On the receiving entity side, the decryption operation can also be split into two phases, the first one executed once taking into account the identity parameters of the other receiver entities of the set and the second one that can be repeated several times. times without taking into account the identity parameters of the other receiving entities.

A usable BIBE schema uses a secret key that includes a element g of a cyclic group G ₁ of order p and an integer γ chosen between 1 and p-1, where p denotes a prime number. The public key can then have a representative component of an element w of the group G ₁ , equal to gY, a representative component of an element h of a cyclic group G ₂ of order p, a representative component of an element v of a cyclic group G _τ of order p, of the form v = e (g, h), and representative components of m elements of the group G ₂ of the form h 1, h ² , ..., W ^m , where e (.,.) Denotes a bilinear mapping of G ₁ XG ₂ in G _τ , and m denotes an integer not smaller than the aforementioned number s. As for the private key of a receiving entity, it can have a representative component of an element Aj of the group G ₁ of the form

Aj = g ^{1 /} (f ^{+ χ} j) where Xj is an integer determined by the identity parameters of said receiving entity.

In such a scheme, the symmetric encryption key for a set of s receiving entities (2 ≤ s ≤ m) can be determined by the element yk ^. {y ^{+ X} i) ^... {y ^{+ χ} _s ) _u G _τ , where X ₁ , ..., x _s are the integers determined by the respective identity parameters of the receiving entities. It is furthermore possible to provide for the cryptogram to have a component representative of the element C ₁ = w ^k of the group G ₁ and a representative component of the element

C ₂ = h ^k (y ^{+ χ} i) - (τ ^{+ χ} s) of the group G ₂ , where k is the integer chosen by the transmitting entity. A decryption operation performed by one of the receiving entities, whose private key has a component representative of the element A, = g ^{1 /} (f ^{+ χ} i), may comprise a recalculation of the symmetric encryption key from the element e (C <|, Zj) .e (Aj ^x ', C ₂ ) of the group Gj, where z, is the element of

group G ₂ equal to .

It is also proposed computer programs for encryption and decryption devices constituting issuing entities and receiving in an identity-based cryptographic method as presented above. On the sending side, the program includes instructions for implementing the steps of a process encryption operation during program execution by a processing unit of an encryption device. On the receiver side, the program comprises instructions for implementing the steps of a process decryption operation during a program execution by a processing unit of a decryption device.

Another aspect of the invention relates to an encryption device comprising:

a memory for holding a public key of an identity-based encryption scheme, the public key depending on a secret key and further accessible to receiving entities, the identity-based encryption scheme further comprising the capability of associating respective private keys with the receiving entities, the private key of a receiving entity depending on the secret key and an identity parameter of said receiving entity;

a generator of at least one symmetric encryption key and a cryptogram associated with said encryption key according to the public key, the identity parameters of a set of receiving entities and a chosen integer locally, s being a number greater than 1, said cryptogram being generated so that it has a constant size and independent of the number s, and that it gives access to said symmetric encryption key by combination with the public key the identity parameters of the receiving entities and the private key of an identified receiving entity of said set; and

a circuit for encrypting the message with said symmetric encryption key, the encrypted message being broadcast with the cryptogram.

Yet another aspect of the invention relates to a device for decryption comprising:

a memory for containing a public key of an identity-based encryption scheme and a private key associated with said device, the public key depending on a secret key and being further accessible to at least one issuing entity, the schema identity-based encryption apparatus further comprising the ability to associate respective private keys with receiving entities including the decryption device, the private key of a secret key dependent receiving entity and an identity parameter of said receiving entity;

a computer for retrieving a symmetric encryption key from a received cryptogram with an encrypted message from the transmitting entity, the public key, the identity parameters of a set of receiving entities including said device and the private key associated with said device, s being a number greater than 1 and said cryptogram having a constant size and independent of the number s; and

a circuit for decrypting the message with the symmetric encryption key.

Other features and advantages of the invention will appear in the following description of nonlimiting exemplary embodiments, with reference to the appended drawings, in which:

FIG. 1 is a block diagram of an encryption system for implementing an embodiment of the invention;

FIG. 2 is a block diagram of an exemplary encryption device; and

FIG. 3 is a block diagram of an exemplary decryption device.

The cryptographic method considered here involves an authority 1 over which builds trust. This authority is basically the only entity that has a secret key or master key MSK. It keeps it for example in a protected memory 10.

During the initialization of the system, a public key generator 11 of the authority 1 determines a public key PK and broadcasts it so that it is available to all users of the system. The public key PK is calculated based on the secret key MSK and system parameters representing the mathematical structure underlying the encryption scheme.

The authority 1 also has a private key generator 12 serving to provide a private key specific to a receiving entity 3 that has been able to authenticate with the authority 1. The private keys can be issued during the initialization. However, according to a characteristic of the IBE schemes, they are advantageously generated and delivered to their holders as and when required. An entity may in particular receive encrypted messages to its attention without having yet a private key decryption. By authenticating with the authority 1, this entity will be able to obtain its private key and decipher the message a posteriori.

The authority 1 has a module 13 implementing an authentication technique of the receiving entities 3 which request their private key. Once the entity 3 has been authenticated, its identity IDj is supplied to the private key generator 12 which returns the corresponding private key skj calculated according to IDj, the secret key MSK and the system parameters and sent to the entity via a channel protected.

The identity IDj of a receiving entity 3 consists of one or more parameters associated publicly with the entity. Any identity used in known IBE schemes can be adopted (see A. Shamir, "Identity-based cryptosystems and signature schemes", Advances in Cryptology - CRYPTO'84, Vol 196, Lecture Notes in Computer Science, pages 47-53, Santa Barbara, CA, USA, August 19-23, 1985. Springer-Verlag, Berlin). A typical example of identity is the e-mail address. Other parameters may be added at the choice of the entity concerned, such as an indication of the period of validity of the private key associated with the entity. A hash function can be applied to the identity to obtain a desired size data.

The public key PK made available to each enables an issuing entity 2 to encrypt messages M for a set of receiving entities 3 each designated by their identity. The issuing entity 2 uses any technique of symmetric encryption using a key K that it generates, and broadcasts the encrypted message CM accompanied by a header or cryptogram Hdr.

This cryptogram Hdr is constructed to give access to the symmetric encryption key K to any entity that has:

- PK public key (and system parameters);

identity parameters IDj of the receiving entities receiving the encrypted message; and

- The private key sk, one of these receiving entities.

Each receiver entity of the set can thus use its private key skj to retrieve the symmetric encryption key K and then decipher the message CM-

In some embodiments, the cryptogram Hdr has a constant size and independent of the number s, which avoids having too much information to transmit with the encrypted messages when the number of recipients becomes important. The private keys skj will also be able to have a constant size and independent of the number s.

Figure 2 schematically illustrates the organization of a device for encryption 2 constituting an issuing entity in an exemplary embodiment of the cryptographic method. The device 2 comprises a memory 20 where in particular the public key PK and the identities ID ₁ ,..., ID _S of the receiving entities which will be the addressees of one or more encrypted messages C ₁ are stored. Messages from a source 21 are encrypted in a circuit

22 using a symmetric encryption key K produced by a generator 23. IDj identities can be included in the address book of an email application.

From the public key PK and identities ID ₁ ,..., ID _S , the encryption key generator 23 produces not only a symmetric encryption key K, but also an associated cryptogram Hdr. The production of the pair (K, Hdr) involves the drawing of a random number k by a random number generator 25.

It is possible to make the calculations taking into account ID identities; all the receiving entities in the set are executed once for all transmissions of encrypted messages to that set of receiving entities. For this purpose, in a first phase, a module 24 of the encryption key generator 23 calculates a vector of intermediate values PKs as a function of the public key PK and the identities IDj of the s recipient entities, and stores this vector PK ₅ . Then, whenever there is a new message to be encrypted to these receiving entities, a number k is drawn and a module 26 calculates a new pair (K, Hdr) as a function of k and PK _S -

Note that since the calculation of PK ₅ only involves public parameters, this vector PKs could be calculated outside the encryption device 2 and received by it on a channel that does not need to be protected (the PK vector ₅ can be published). FIG. 3 schematically illustrates the organization of a decryption device 3 constituting an identity receiving entity ID, in an exemplary embodiment of the cryptographic method. The device 3 comprises a memory 30 in which the public key PK, the private key skj of the device and the identities ID ^, ..., IDμ are notably recorded. , IDj ₊ <|, ..., ID _S of the s-1 receiving entities which will be, with the device 3, the recipients of one or more encrypted messages C ^. IDj identities can be included in the address book of an e-mail application.

From the public key PK and identities IDj, a computer 33 retrieves a symmetric encryption key K from the cryptogram Hdr received with an encrypted message CM- It is possible to make the calculations taking into account identities IDj are executed once for all receptions of encrypted messages that will be destined for the same set of receiving entities. For this purpose, in a first phase, a module 34 of the computer 33 calculates an intermediate value z, as a function of the public key PK and identities IDj of the receiving entities, and stores this value z ,. Then, whenever there is a new message to be decrypted for these s recipient entities, a module 36 calculates the symmetric encryption key K from the cryptogram Hdr received with the encrypted message C _M and the intermediate value z, . It is again noted that, since the calculation of Zj only involves public parameters, this value z could be calculated outside the decryption device 3 and received by it on a channel that does not need to be connected. to be protected.

In an example of a mathematical environment that can be used in the above method, two cyclic groups G ₁ and G ₂ (distinct or not) are defined, each of order p, where p and a prime number, typically having a base representation. 2 of more than one hundred bits. A non-bilinear application degenerate e of G ₁ * G ₂ in another cyclic group G _τ is further defined. By bilinear we mean that for every pair of integers (a, b), every element u of G _1, and every element v of G ₂ , we have (u ^a , v ^b ) = e (u, v) ^ab . A possible example for this bilinear application e is the coupling of Tate. The system parameters mentioned above then comprise the number p and descriptors of the groups G ₁ , G ₂ and G _τ and the bilinear map e (.,.) -

In this example, the secret key MSK consists of an element g that the authority 1 pulls at random in the group G ₁ and in an integer γ lying between 1 and p-1: MSK = (g, γ). The public key generator 11 calculates the element w = g ^ of the group G ₁ and randomly draws an element h from the group G ₂ . It also calculates the element v = e (g, h) of the group Gj and the powers of the element h of the group

G ₂ : W, W ² , ..., W ^m , where m is an integer representing the maximum size of the set of receiving entities 3 to which an encrypted message can be addressed. In other words, the size s of a set of recipients can not be greater than m. The public key PK is then:

PK = (w, v, h, hY, hY ² , ..., hY ^m ).

The private key skj of an entity 3 of identity IDj consists in this case in an element A'j of the group G ₁ representative of the element Aj = g ^{1 /} (Y ^{+ x} j), where Xj is a given integer only by IDj. This element A'j is given by

A'j = Aj ^x j = g ^x / (Y ^{+ x} j). Typically, Xj is obtained by applying a cryptographic hash function H to the binary representation of the identity: Xj = H (IDj).

The H function is also described in the known system parameters of the different entities.

In this example, the symmetric encryption key K generated to encrypt a message M to identity receiving entities ID ₁ , ..., ID ₅ , after drawing a random number k, is determined by the element _v k (γ ⁺ _Xi ) ... ( _γ ⁺ x _s ) _{of the} group Q ₁ , with _X1 = H (ID ₁ ),. .., x _s = H (ID ₅ ). The key K can be equal to _v ^k ( ^{γ + χ} i) - ( ^{γ + χ} _s ) or more generally to F [v ^k ( ^{γ + χ} i) - ( ^{γ + χ} _s )], where F [.] designates any known function of the different entities thanks to the system information. The calculation of the element v ^k (Y ^{+ X} I) - (Y ^{+ X} S) by the encryption device involves the powers of h included in the public key PK, and takes advantage of the equality vY ^q = e (w, hY ^{q ~} ) resulting from the property of the bilinear map e (.,.), for 0 <q ≤ m.

To give access to this key K to the authorized entities, the cryptogram Hdr calculated by the generator 23 to be transmitted with the message C _M encrypted with K includes the element C ₁ = w ^k of the group G ₁ and the element

C ₂ = h ^k - (Y ^{+ χ} i) - (Y ^{+ χ} s) of the group G ₂ : Hdr = (C ₁ , C ₂ ).

A receiving entity 3 of the set of destination entities of the encrypted message C _M , having as its private key sk, = A ,, is able to recover the key K used by first calculating the element z, of the group G ₂ equal to

h J ^{= 1} 'J ^{≠ I]} then, from the cryptogram HdT = (C ₁₁ C ₂ ) received with the encrypted message, the element e (C <|, Zj) .e (A'i, C ₂ ) from the Gj group. Thanks to the properties of the bilinear map e (.,.), We can verify that if the private key skj = A ', is valid, this element e (C <|, Zj) .e (A'i, C ₂ ) of the group Gj is equal to _v k ^. ( ^{γ +} x ₁ ) ^... ( ^{γ +} x _s ) | _ _ac | £ çje symmetric encryption K is thus recovered according to: K = FIe (C ₁ , _Zi ) .e (A'i, C ₂ )].

As a variant, it is possible to take the private keys skj equal to the elements A; = g ^{1 /} (Y ^{+ x} j), and have the exponentiation calculated by the receiving entities 3 during the decryption: K = F [e (C <|, Zj) .e (Aj ^χ i, C ₂ )]. It is however more efficient to calculate the exponentiation once and for all when generating the key Private.

When a vector of intermediate values PK ₅ is calculated by a module 24 of the encryption device as represented in FIG. 2, this vector PKs includes the three elements w, a and b of the groups G <|, G ₂ and Gj, with a = hfr ^{+ χ} i) - -fr ^{+ χ} s) and b = v (τ ^{+ χ} i) - (Y ^{+ χ} s). The elements a and b are computable by the module 24 from the public key PK = (w, v, h, ri, ri, ² ,..., R i ^m ) and integers X _i , ..., x _s deduced identities ID-], ..., ID _S of the receiving entities of the target set. After obtaining the random number k, the module 26 calculates K and Hdr = (C ₁ , C ₂ ) according to: K = b ^k , C ₁ = w ^k and C ₂ = a ^k .

Since the groups G ₁ , G ₂ and G ₁ are cyclic of order p, the sums of integers in the exponents indicated above can be understood as sums modulo p.

The BIBE schema example described above uses a random oracle since a cryptographic hash function H is used to ensure the random character of the keys. Since the random oracle model is a theoretical notion, a hash function could only be used to compact the identity data, without the need for the hypothesis that one has a random oracle. Note that other schema implementations do not use random oracles. An example based on similar mathematical objects is described below. Here, we do not need the assumption mentioned above, but it is still possible to use a hash function. The level of security offered by the hash function is then less important.

Starting from the number p, the cyclic groups G ₁ , G ₂ and G _τ and from the bilinear application e (.,.) Mentioned above, we take a secret key MSK = (g, γ, α) with g chosen at random. in the group G ₁ , γ and α integers between 1 and p-1. The PK public key is built by choosing a element h of the group G ₂ , calculating h ₂ = h ^α then

PK = (w, v, h, W, W ² , ..., h ₂ h, IV, h ₂ Λ ..., h / ¹¹ ), the number m being defined as above.

The private key skj of an entity 3 of identity IDj is generated by starting by calculating two elements Aj and Bj of groups G ₁ and G ₂ , given by Aj = g ^{1 /} (Y ^{+ x} j ^{+ r} j - ^α ) and Bj = where rj is a number that the private key generator 12 randomly draws between 1 and p-1 for the receiving entity, and Xj is an integer determined solely by IDj. This integer Xj does not need to be generated using a cryptographic hash function. It can be taken equal to the identity IDj in binary representation: Xj = IDj. Powers of the element Bj are computed in order to produce the private key skj = (AJ, rj, Bj, BJY, BJY ² , ..., Bj ^ - ¹ ).

In this example, the symmetric encryption key K generated to encrypt a message M to identity receiving entities ID ₁ , ...,

ID _S , after drawing a random number k, is of the form K = F [v ^k (Y ^{+ X} I) - - (Y ^{+ X} S)], with X ₁ = ID ₁ , ..., x _s = ID ₅ and F [.] being any known function of the different entities.

To give access to this key K to the authorized entities, the cryptogram Hdr calculated by the generator 23 to be transmitted with the message C ^ encrypted with K includes the element C ₁ = w ^k of the group G ₁ and two elements C ₂ = h ^k ^{(γ + χ} i) - ^{(γ + χ} _s) _e t C ₃ = h ₂ ^k (y ^{+ χ} i) - (y ^{+ χ} _s) of the group G ₂ HcJr = _{(c1 1} C ₂₁ C ₃ ).

A receiving entity 3 of the set of recipient entities of the encrypted message CM is able to recover the key K used in computing

first the element z, of the group G ₂ equal to then, from cryptogram Hdr = (C <|, C2, C3) received with the encrypted message, the element e (C- |, Zj) .e (Aj ^χ i, C2) .e (Aj ^r i, C3) of the group Gj . Thanks to the properties of the bilinear map e (.,.), We can verify again that if the private key SkI = (A ,, η, B _j , B _j Y, B _j Y ² , -, B _j Y "^{1" 1} ) is valid, then

6 (C ₁₁ C ₂ ) .e (Al ^r i, C ₃ ) = v ^k fr ^{+ χ} i) - (Y ^{+ X} S). The symmetric encryption key K is therefore recovered by the formula: K = FIe (C ₁ , Z _j ) .e (A _j ^χ i, C ₂ ) .e (A _j ^r i, C ₃ )].

Alternatively, it is possible to take the ski private keys of the form skj = (A'j, A "j, Bj, BjY, BjY ² , ..., BjY ^{m" 1} ) with A'j = Aj ^x i and A "j = Aj ^r i. in this case, the receiving entity 3 holding the private key sk retrieves the symmetric encryption key K as K = FIE (C _1, Z _j) .e (A _'j, C _2). e (A " _j , C ₃ )], without having to recalculate the powers of A ₁ . In this variant, A'j is representative of Aj, whereas in the previous variant, rj, paired with Aj is representative of A "j = AjI

When a vector of intermediate values PKs is calculated by a module 24 of the encryption device as represented in FIG. 2, this vector PK ₅ includes the four elements w, a, a ₂ and b of the groups G ₁ , G ₂ and Gj with a = hfr ^{+ χ} i) --- (Y ^{+ χ} s), a ₂ = h ₂ ^{(γ + Xi)} - ^{(γ + Xs)} and b = vfr ^{+ χ} i) - (Y ^{+ X} S) . After obtaining the random number k, the module 26 calculates K and Hdr = (C ₁ , C ₂ , C ₃ ) according to: K = b ^k , C ₁ = w ^k , C ₂ = a ^k and C ₃ = a ₂ ^k .

Note that if we take α = O in the diagram without random oracle above, we fall back on the scheme with random oracle described above, the r are no longer necessary. The keys are made random by the fact that the integers Xj then depend on identities IDj through a cryptographic hash function.

The encryption and decryption devices represented on the FIGS. 2 and 3 can be realized by means of specific circuits or programmed logical components of the FPGA type or the like. A current embodiment, however, will use general purpose processors executing programs according to the invention written to implement the cryptographic calculations described above.

Claims

An identity-based cryptographic method, wherein a secret key-dependent public key (PK) is accessible to an issuing entity (2) and receiving entities (3), and in which private keys of respective decryption (skj) are associable with the receiving entities, the private key of a receiving entity depending on the secret key and an identity parameter (IDj) of said receiving entity, the method comprising an encryption operation of minus one message (M) to a set of s receiving entities, s being a number greater than 1, the encryption operation comprising the following steps:

generating at least one symmetric encryption key (K) and a cryptogram (Hdr) associated with said symmetric encryption key according to the public key, the identity parameters of the receiving entities and at least one integer ( k) chosen by the transmitting entity, said cryptogram (Hdr) being generated so that it has a constant size and independent of the number s, and that it gives access to said symmetric encryption key by combination with the key public, the identity parameters of the receiving entities and the private key of an identified receiving entity of said set;

- Broadcast the cryptogram and the encrypted message (CM) from the issuing entity.

2. Cryptographic method according to claim 1, wherein the private keys (skj) have a constant size and independent of the number s.

3. Cryptographic method according to any one of the preceding claims, wherein the encryption operation comprises a first phase of calculating and storing a vector of intermediate values (PK ₅ ) according to the public key and the parameters of the identity (IDj) of the receiving entities, and at least one iteration of a second phase executed by the transmitting entity (2) and comprising the following steps:

- draw an integer (k);

calculate a symmetric encryption key (K) and the associated cryptogram (Hdr) as a function of the drawn integer (k) and the intermediate value vector (PK ₅ ), without again taking into account the identity parameters of the entities receivers;

- encrypting a message with the calculated symmetric encryption key; and

- Broadcast the calculated cryptogram and the encrypted message (C _M ).

4. Cryptographic method according to claim 3, wherein the encryption operation comprises several iterations of the second phase for the encryption and dissemination of successive messages by the transmitting entity (2).

A cryptographic method according to any one of the preceding claims, comprising a decryption operation performed by at least one of the receiving entities (3), the decryption operation comprising the steps of:

recovering the symmetric encryption key (K) from the cryptogram (Hdr), the public key, the identity parameters of the receiving entities and the private key (sk) of said receiving entity; and

- Decrypt the broadcast message with the recovered symmetric encryption key.

The cryptographic method according to claim 5, wherein the decryption operation performed by said receiving entity (3) comprises a first storage phase of at least one intermediate value (z,) determined according to the public key (PK ) and identity parameters (ID ₁ , ..., IDj _-1 , ID _{i + 1} , ..., ID _S ) of the other receiver entities of the set, and at least one iteration of a second phase comprising the following steps:

recalculating the symmetric encryption key (K) according to the cryptogram (Hdr) received with an encrypted message (CM) from the transmitting entity (2), said intermediate value and the private key (skj) of said receiving entity, without taking into account again the identity parameters of the other receiving entities of the set; and

- decrypt said message with the recalculated symmetric encryption key.

The cryptographic method according to claim 6, wherein the decryption operation comprises several iterations of the second phase for the decryption of messages (C _M ) successively received with respective cryptograms (Hdr) from the transmitting entity (2). ).

8. Encryption device, comprising:

a memory (20) for holding a public key (PK) of an identity-based encryption scheme, the public key depending on a secret key (MSK) and being further accessible to receiving entities (3), the an identity-based encryption scheme further comprising the ability to associate respective private keys (skj) with the receiving entities, the private key of a receiving entity depending on the secret key and an identity parameter (IDj) of said receiving entity;

a generator (23) of at least one symmetric encryption key (K) and a cryptogram (Hdr) associated with said symmetric encryption key according to the public key, the identity parameters of a set of s receiving entities and a locally chosen integer (k), s being a number greater than 1, said cryptogram (Hdr) being generated in a manner it has a constant size and independent of the number s, and it gives access to said symmetric encryption key by combination with the public key, the identity parameters of the receiving entities and the private key of a identified receiving entity of said set; and

a circuit (22) for encrypting the message with said symmetric encryption key, the encrypted message (C _M ) being broadcast with the cryptogram.

An encryption device according to claim 8, wherein the generator (23) is arranged to store an intermediate value vector (PKs) calculated in a first phase according to the public key (PK) and the identity parameters ( IDj) of the receiving entities (3) and for executing a second phase of calculating a symmetric encryption key (K) and the associated cryptogram (Hdr) as a function of an integer (k) drawn in the second phase and intermediate values vector (PK ₅ ), without taking into account the identity parameters of the receiving entities, the second phase being renewable for the broadcast of successive encrypted messages to the receiving entities.

10. decryption device, comprising:

a memory (30) for holding a public key (PK) of an identity-based encryption scheme and a private key (sk) associated with said device, the public key depending on a secret key (MSK) and further being accessible to at least one transmitting entity (2), the identity-based encryption scheme further comprising the ability to associate respective private keys with recipient entities including the decryption device, the private key (skj) of a receiving entity (3) depending on the secret key and an identity parameter (IDj) of said receiving entity;

a calculator (33) for recovering a symmetric encryption key (K) from a cryptogram (Hdr) received with an encrypted message (CM) from the transmitting entity, from the public key, from the parameters of an identity of a set of receiving entities including said device and the private key (skj) associated with said device, s being a number greater than 1 and said cryptogram (Hdr) having a constant size and independent of the number s; and

a circuit (32) for decrypting the message with the symmetric encryption key.

11. A decryption device according to claim 10, wherein the computer (33) is arranged to store at least one intermediate value (Zj) calculated in a first phase according to the public key (PK) and the identity parameters ( ID ₁ , ..., ID _μi , ID _{i + 1} , ..., ID ₅ ) of the other receiver entities of the set, and to execute a second phase of calculating a symmetric encryption key (K) in a function of a cryptogram (Hdr) received with an encrypted message (CM) from an issuing entity (2), said intermediate value and the private key (skj) associated with said device, without again taking into account the identity parameters of the other receiving entities of the set, the second phase being renewable for receiving successive encrypted messages (CM) to the receiving entities.

A computer program for an encryption device (2) constituting an issuing entity in an identity-based cryptographic method according to any one of claims 1 to 4, the program comprising instructions for implementing the steps of an encryption operation of said method during execution of the program by a processing unit of the encryption device.

A computer program for a decryption device (3) constituting a receiving entity in an identity-based cryptographic method according to any one of claims 5 to 7, the program comprising instructions for implementing the steps of a decryption operation of said method during execution of the program by a processing unit of the decryption device.

14. A computer readable data medium on which a program according to claim 12 or claim 13 is recorded.