EP2204007A2

EP2204007A2 - Generator and method of generating a secret-key pseudo-random function

Info

Publication number: EP2204007A2
Application number: EP08829862A
Authority: EP
Inventors: Yannick Seurin; Jacques Patarin; Henri Gilbert
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2007-09-05
Filing date: 2008-08-26
Publication date: 2010-07-07
Also published as: WO2009030857A2; FR2920617A1; WO2009030857A3

Abstract

The invention relates to a generator of a pseudo-random function with secret key K from an input block of m bits to an output block of n bits using a determined number a of cryptographic schemes F1(m1, n1),..., Fi(mi, ni),..., Fa(ma,na) nested in layers according to a recursive structure, each current cryptographic scheme Fi(mi, ni) associating ni output bits with mi input bits in a number of rounds ri, each round using an internal elementary function f(i) constructed on the basis of ti cryptographic schemes Fi+1(mi+1,ni+1) from ni+1 bits, to mi+1 bits, with ni+1 ni,mi+1 mi and ti = 1, each cryptographic scheme Fi(mi, ni) defining a minimum number of operations comp(mi, ni, ri ), dependent on said number of rounds ri, required in order to distinguish it from a random function associating mi input bits ni output bits, the generator comprising calculation means (7) for calculating, for each cryptographic scheme Fi(mi, ni), said number of rounds ri so that said number of operations comp(mi, ni, ri ) associated therewith is greater than or equal to a predetermined number 2c, c being an integer.

Description

Title of the invention

Generator and method for generating pseudo-random function with secret key

Technical field of the invention

The invention relates to the pseudo-random function generation domain for which there is evidence that relates their security to the complexity of the best attacks for very simple schemes to analyze. In particular, the invention relates to the field of symmetric cryptography, and relates to a method of block ciphering.

In particular, the invention finds a very advantageous application in that it allows a symmetric encryption / decryption with a high degree of security and ensuring a simple and effective implementation of hardware and software. It should be noted that symmetric encryption is widely used in all types of communications, such as mobile communications, the Internet, smart cards, and so on.

BACKGROUND OF THE INVENTION In symmetric cryptography, the sender and the recipient of an encrypted data exchange must share prior to any exchange the knowledge of a secret key K. Encryption and decryption algorithms parameterized by the key K respectively allow the transmitter to transform a clear message into a cryptogram and the recipient to recover the clear message from the cryptogram.

Block ciphering is one of the two main methods of symmetric encryption. At the secret key K, a block cipher algorithm associates an encryption function, that is to say, a bijective transformation E _κ of the set {0, l} ⁿ words of n bits, also called blocks. To encrypt a clear message M of any length, calls can be chained to the function E _κ according to different operating modes.

There are many known block cipher algorithms, such as Data Encryption Standard (DES), Advanced Encryption Standard (AES), MISTY, RC6, IDEA, and so on. Mathematically, these block cipher algorithms are generators of pseudo-random permutations, that is to say that at a relatively short key they associate a permutation of the set of n-bit blocks so that if the key is chosen randomly, the permutation obtained is difficult to distinguish from a really random permutation.

A concept similar to that of a pseudo-random permutation generator is that of pseudo-random function generator of n bits to m bits (where m is an integer equal or not to ri) difficult to distinguish from functions of n bits to m bits perfectly random. A generator of pseudo-random functions can be used according to various procedures for the construction of cryptographic algorithms including block ciphering algorithms, message authentication, or stream ciphers. The most widely used and recognized existing block cipher algorithms, such as I ¹ AES and DES, operate on keys consisting of a relatively short binary word and having no particular structure. For example, the secret keys of the DES consist of words of 56 bits length, those of the AES words of length 128, 192 or 256 bits. There are some rare block algorithms that operate on keys that have a particular structure that uses 8 secret permutations of the set {0, .., 255} of bytes, but there is no mathematical argument to base a more great confidence in the security of these algorithms that in those whose key consists of words of sufficient length, for example 128 bits. It is usually considered that for a block algorithm (or more generally a generator of functions or pseudo-random permutations) to be safe, it must be impossible, given the limitation of the computing resources that may be available in the years or decades ahead, to an adversary having an arbitrary number N of access "in black box" to the functions of encryption and / or decryption associated with an unknown secret key K, to realize one of the types of following attack: -reconstitute the secret key K; more generally, predicting a new pair of clear-ciphered messages (X, Y) satisfying Y = E _K (X) distinct from the N pairs of clearly-encrypted messages (Xi ₁ Y ₁ ) resulting from the N accesses of the opponent to encryption and / or decryption functions; still more generally, distinguish with a significant probability of success a function E _κ associated with a random key K of a perfectly random permutation of the set {0, 1} ⁿ of blocks of n bits, this by means of a test algorithm using the result of N black box accesses to the function and / or its inverse. This constitutes the most general definition of the security of an algorithm in the sense that guarding against this type of attack ensures absolute security of the algorithm from a mathematical point of view (ie excluding hidden channel attacks, etc. .).

It is generally accepted that the computational resources that could be implemented, now or in the coming years, by any adversary (including a coalition of millions of Internet users) are strictly less than 2 ⁸⁰ elementary operations.

Currently, in public-key cryptography, we speak of "security proofs", "partial proofs of security" or "reductionist proofs of security" of a scheme when we have been able to bring back the security of that system. scheme to solve a problem deemed difficult. The most classic problems considered difficult that are used to date in public key cryptography are the problem of factorization of integers and the problem of discrete logarithm on various finite groups.

As opposed to the situation in the field of public key cryptography, the security of known block algorithms, including those considered to be the safest as AES, is based on the current state of knowledge on a very empirical basis. For no known block algorithm, there are no mathematical arguments to establish a lower bound on the complexity of attacks of any of the types described above. The main types of arguments on which confidence can be built in the safety of algorithms considered to be the safest are:

absence of known attack of complexity lower than the desired level of security, for example of complexity less than 2 ⁸⁰ or 2 ^{| K |} , where \ K \ is the key length of the algorithm expressed in bits;

-sustainable resistance to particular methods of attack, eg resistance to differential cryptanalysis and linear cryptanalysis;

-finally, in the case of certain algorithms like DES, the existence of evidence of resistance to the most general type of attack mentioned above in the so-called Luby and Rackoff security model in which some of the components of the actual algorithm (eg key-dependent functions used at different laps) by perfectly random ideal functions. Although this type of proof does not provide a lower bound on the complexity of attacks against the real algorithm, it can be considered as an assurance that the general structure of the algorithm (for example the use of the so-called Feistel scheme in the case of the DES) does not present a defect of intrinsic weakness. In particular, it is described in the document "Efficient

Symmetric-Key Ciphers Based on an NP-Complete Subproblerri ¹ of Matt Blaze, a secret key encryption algorithm. This algorithm is built from several Feistel F ₁ schemes nested in layers. Each Feistel scheme F associates n, input bits n, output bits in an identical number of turns which is equal to 4 for each Feistel scheme F, nested. However, this algorithm has been cryptanalyzed by an attack on the Feistel scheme belonging to the upper layer of the nesting.

It has been demonstrated in the documents "Generic Attacks on Feistel Schemes" ¹ and "Security of Random Feistel Schemes with 5 or more Rounds" by J. Patarin that to avoid this attack, it is necessary that the Feistel Scheme of the upper layer of nesting associates with n, input bits n, output bits in at least 6 turns, more particularly, this document ("Security of Random Feistel Schemes with 5 or more Rounds") describes an attack on the Feistel schemas 5 towers 2 ^nι operations, which in the case of schemes Feistel to 64 input bits provides an attack 2 ⁶⁴ <2. ⁸⁰ Thus, it takes at least 6 turns.

However, even taking a number of turns equal to 6 for the Feistel scheme belonging to the upper layer, there is no guarantee that this type of algorithm remains resistant to future attacks. In addition, by taking this same number of turns for Feistel schemes belonging to lower layers, there could still be attacks on these schemes, destroying the security of the entire algorithm.

Thus, none of the known methods of encryption using a block algorithm (and more generally no algorithm for generating functions or pseudo-random permutations) conciliates the two following conditions:

1) the existence of mathematical arguments to support the conjecture that even when we use the algorithm beyond the uniqueness distance defined by Shannon, there is no attack achievable in less than 2 operations ^e, where c is a number sufficiently large to ensure strong security of the algorithm (e.g., greater than or equal to 80).

2) the existence of software implementations of speed close to that of the currently most used block algorithms, such as I ¹ AES or DES requiring realistic computing resources (time, memory, etc.).

OBJECT AND SUMMARY OF THE INVENTION The present invention relates to a method for generating secret key pseudo-random function K from an input block of m bits to an output block of n bits using a determined number α of cryptographic schemes Φi (mi, ni), ..., Φ, (m _ι , n,), ..., Φa (m _a , n _a ) nested in layers according to a recursive structure, each current cryptographic scheme Φ, (m, , n _ι ) associating with m, input bits n, output bits in a number of turns r ,, each lattice using an internal elementary function f ^ή constructed from t, cryptographic schemes Φ _{l + 1} (m _{l + 1l} n _{l + 1} ) of n _{l + 1} bits to m, ₊₁ bits, with n _{l + 1} <n, m _{l + 1} <m, and t, ≥ 1, each cryptographic scheme Φ, (m ,, n,) defining a minimum number of operations compim ,, n ,, r,), dependent on said number of revolutions r ,, necessary to distinguish it from a random function associating with m, input bits n, output bits , for each cryptographic scheme (m ,, ni) said number of rounds r, being selected so that said number of operations comp ^ m ,, n ,, r,) associated therewith is greater than or equal to a predetermined number ^e 2, c being an integer.

Thus, by modulating the number of turns, we provide a proof of security for each of the cryptographic schemes and therefore for the entire process of generating pseudo-random function. Thus, the best known attacks to distinguish each cryptographic scheme from a random function require a number of steps of calculation greater than or equal to the predetermined number 2 ^e which can be chosen very large.

Advantageously, said determined number of cryptographic schemes is chosen such that the most internal elementary functions A ^ constituting the cryptographic schemes Φa (m _a , n _a ) of the innermost layer are random functions defining a minimum size of said key secret.

Thus, the method for generating pseudo-random function has a high efficiency with a secret key of reasonable size. Advantageously, said predetermined number 2 ^e is equal to 2 ⁸⁰ .

Thus, the pseudo-random function generation method can not be distinguished from a random function associating m input bits n output bits in less than 2 ⁸⁰ calculation steps, which is the current security standard. According to a feature of the present invention, said cryptographic schemes Φ ₁ (mi, ni), ..., Φ, (m ,, n,) Φa (m _a , Ha) correspond to cryptographic permutation schemes TJi (D ₁ ), ..., π, (n,), ..., IJa (Ha), each cryptographic permutation IJ ₁ (H ₁ ) implementing a permutation of blocks of n bits. Thus, the method of generating pseudo-random function can be implemented using cryptographic permutation schemes which are more numerous and better studied than cryptographic schemes performing non-bijective functions. Thus, the pseudo-random function generating method can be used to perform secret key encryption in a simple and secure manner.

Advantageously, said cryptographic permutation schemes π, (ni), ..., π, (n,), ..., IJa (Ha) correspond to symmetrical Feistel schemes F ₁ (H ₁ ), ..., F ₁ (H ₁ ), ..., F _a (n _a ). Thus, the pseudo-random function generation method can be implemented very effectively, the Feistel schemes being well studied and simple to implement.

For each symmetrical Feistel scheme F ₁ (H ₁ ), said number of turns r, depends on the number of bits n and on said integer c according to an inequation defined by r,> 2c / n, + 4.

Thus, the pseudo-random function generation method can not be distinguished from a random permutation of n-bit blocks using known attacks. The invention is also directed to a pseudo-secretory key encryption method K from an input block of m bits to an n-bit output block using the pseudo-random function generating method according to any one of the features -above.

The invention is also directed to a secret key pseudo-random function generator K from an input block of m bits to an output block of n bits using a determined number <x of cryptographic schemes

Φi (m _1t ni), ..., Φ, (m ,, n _t ), ..., Φ _a (m _a , n _a ) nested in layers according to a recursive structure, each current cryptographic scheme Φ, (/ 77,, n, J associating m, input bits n, output bits in a number of revolutions r ,, each lattice using an internal elementary function f ^ή constructed from tι cryptographic schemes Φ _{l + 1} (m _{l +} i, n _{l + 1} ) of n, + i bits to m, + i bits, with n _{l + 1} <n _h m, + i <m, and t, ≥ 1, each cryptographic scheme Φ, (m ,, n,) defining a minimum number of comp (m _h n _h r,) operations dependent on said number of rounds r ,, necessary to distinguish it from a random function associating m, n input bits, output bits , the generator comprising calculating means for calculating, for each cryptographic scheme Φ, (m _h n,), said number of revolutions r, so that said number of operations comp (m _h n _h r,) which is associated with either greater than or equal to a predetermined number 2 ^e , where c is an integer. The invention is also directed to a pseudo-secretory secret-key encryption device K from an input block of m bits to an n-bit output block, the device comprising a pseudo-random function generator according to the above characteristics. The invention also relates to a computer program downloadable from a communication network and / or stored on a computer readable medium and / or executable by a microprocessor, the program comprising code instructions for performing the steps of the method of generating pseudorandom functions according to at least one of the above features, when executed on a computer.

The invention also provides a computer program downloadable from a communication network and / or stored on a computer readable medium and / or executable by a microprocessor, the program comprising code instructions for executing the steps of the encryption method according to the above characteristics, when run on a computer.

BRIEF DESCRIPTION OF THE DRAWINGS Other features and advantages of the invention will emerge on reading the description given below, by way of indication but without limitation, with reference to the appended drawings, in which:

FIG. 1 schematically illustrates a generator of pseudo-random functions, according to the invention; FIG. 2 diagrammatically illustrates an algorithm for generating a function of m bits to n bits, according to the invention; and

FIGS. 3A to 3C schematically illustrate an embodiment according to the invention. Detailed description of embodiments

According to the invention, FIG. 1 is a schematic figure of a pseudo-random function generator 1 with secret key

K of an input block 3 of m bits to an output block 5 of n bits. This generator 1 uses cryptographic primitives or schemes Φ, (m ,, n,) from m, bits to n, bits.

Indeed, the pseudo-random function generator 1 comprises data processing or calculation means 7 which construct a determined number ex of cryptographic schemes Φ _} (mi, rii), ..., Φι (m ,, n, ), ..., Φa (m _a , n _a ) nested in layers according to a recursive structure. The first cryptographic scheme is that of the outermost layer and the latest cryptographic scheme

Φa (m _a , n _a ) is that of the innermost layer. Each current cryptographic scheme Φ, (m ,, ni) associates m, input bits n, output bits with a number of turns r ,, each turn using an internal elementary function f'K Each internal elementary function f> is constructed from t, cryptographic schemes Φ _{l + 1} (m _{l + 1l} n _{l + 1} ) of n, ₊₁ bits to m, ₊ i bits, with n _{l + 1} <n, m, ₊ i <m , and t, ≥ 1.

Each cryptographic scheme Φ, (m ,, n,) is characterized by a minimum number of operations comp (m _h n ,, r,) necessary to distinguish it from a random function associating with / V ₁ input bits n , output bits.

This minimal number of operations comp {m _h n ,, r,) is a function called "complexity" which depends on the number of revolutions r, and possibly the parameters m, and n, involved in the construction of cryptographic schemes. This complexity function is representative of the complexity of generic attacks (that is, the attacks that make it possible to distinguish the cryptographic scheme from a truly random function when the elementary functions are random). For each cryptographic scheme Φ ^ m ,, / !,), the calculation means 7 determine the number of revolutions r, necessary for the minimum number of comp (m _h n _tl r,) operations associated with it to be greater than or equal to a predetermined number 2 ^e , where c is an integer. According to the current security standard it is possible to choose the predetermined number 2 ^e equal

- ₎ 80

Thus, the generator 1 of the present invention makes it possible to generate a pseudo-random function such that an adversary whose computing power is limited to 2 ^nd operations is incapable of distinguishing a function generated by this generator 1 and a random key of a really random permutation. This can be proved by means of security evidence based on the study of the safety of the intermediate "bricks" used, namely: - theorems concerning the so-called unconditional security of these bricks, that is to say -describe security terminals valid for an attacker with unlimited computing power;

-conjectures, supported by several years of research of the cryptographic community, on the complexity of the best possible attacks on the bricks used (called "generic attacks" because they apply to schemas where the elementary functions f ° ^} are functions really random).

In addition, the calculation means are adapted to calculate the determined number ex of cryptographic schemes so that the most internal elementary functions constituting the cryptographic schemes Φa (m _a , n _a ) of the innermost layer are functions random variables defining a minimum size of the secret key K.

Advantageously, the cryptographic schemes

0J (IrI ₁₁ D ₁ ), ..., Φ, (m _h n _t ) Φa (m _a , n _a ) can be bijective and correspond in particular to permutation schemes cryptographic rTj (ni), ..., π, (n,), ..., π _a (n _a ) which are very numerous and well studied. Each cryptographic permutation π, (nj implements a permutation of the blocks of n, bits.

In particular, the cryptographic permutations FI ₁ (Di), • • -, HiCnJ, ..., IJ _to Cn a) can correspond to symmetrical Feistel schemes F ₁ (IIi), ..., F ₁ (H ₁ ), ..., F _a (n _a ) which are simple to perform.

In this case, for each symmetrical Feistel scheme F, (nJ the number of turns r, depends on the number of bits n, and the integer c according to an inequation defined by r, ≥ 2c / n, + 4. modulating according to the invention, for each Feistel scheme

Fi, the number of turns needed by providing a proof of security for each of these diagrams, we provide proof of security for the entire generation process.

FIG. 2 illustrates an algorithm for generating a function of m bits to n bits or an permutation of n bits that is resistant to any attacker having a computing capacity less than or equal to 2 ^e , where c is for example 80.

In a first step El, this function or permutation is constructed from a certain cryptographic scheme Φ ₁ Cm ^ n ₁ ) or IJiCn ₁ ) (for example a Feistel scheme), with Hi ₁ = Im and D ₁ = Ii by fixing the number of roti used such that COmPCr ₁ ) = 2 ^e . This requires ri functions or elementary permutations f ^1} .

In a second step E2, each of these functions or elementary permutations / ^i; will in turn be implemented using U ₁ cryptographic schemes 0 ₂ Cm ^ n ₂ ) or IJ ₂ (D ₂ ) (which may be the same as or different from that of the first step) by setting the number of r ₂ tricks used such as Comp (r ₂ ) = ¥. The construction then requires ri times ti times r ₂ functions or elementary permutations f * ²⁾ . It is thus possible to continue the process recursively to a step E3 where the functions or elementary permutations of the internal cryptographic primitive will be truly random and will be the key

/ C of the generation process. Generally, there are a number of steps that will minimize the size of the secret key.

The generator of functions from m bits to n bits or permutations of n pseudo-random bits thus obtained then has a proven security against any opponent having a computation capacity less than or equal to 2 ^e in the direction or succeed in attacking the generator 1 would be to improve the generic attacks on the primitives used, which is very unlikely. In addition, this generator is very convenient to use because it is very efficient and has a reasonable key size.

In the case where a permutation is obtained, it can be used according to the usual procedures of block ciphers. In the case where a function is obtained, it can be used according to certain particular modes such as the counter mode to perform stream encryption or the CBC MAC mode to perform message authentication.

Intermediate cryptographic constructs used to obtain the generation of a random function are potentially numerous.

By way of example, the Feistel schemes described for example by Michael Luby and Charles Rackoff can be used in the document "How to Construct Pseudorandom Permutations from Pseudorandom Functions", SIAM J. Comput 17 (2): 373-386 (1988). ). The best conjectured attacks against these Feistel schemes have been described by Jacques Patarin in the document "Generic Attacks on Feistel Schemes". It will be noted that a Feistel scheme is an even bijection. Thus, when fitting the Feistel diagrams, the diagrams are constructed with even bijections. Moreover, it is easier to distinguish a diagram of

Feistel of a random function than of a bijection. It is also easier to distinguish a Feistel scheme from a bijection than from an even one. Indeed, the more one tries to distinguish a Feistel scheme from a large set, the easier it is.

In fact, whatever the number of turns of the Feistel scheme, it is always possible to distinguish it from a random function with 2 ⁿ operations and a bijection in 2 ²ⁿ operations (which is independent of the number of revolutions) . It is only when one tries to distinguish it from an even bijection that the number of necessary operations increases with the number of turns of the Feistel scheme.

The Feistel schemes also have so-called generalized or asymmetric variants.

Thus, for a generalized Feistel scheme, it is possible to use bricks which are either random functions, random bijections, or random even bijections, typically this concerns the most internal Feistel scheme in the nesting.

Typically, Feistel schemes using as brick only even bijections, are Feistel schemes of higher level compared to the most internal Feistel scheme.

For asymmetric Feistel schemes, the plaintext is divided into two blocks of different size, more particularly, it may concern the lower-level Feistel scheme.

Moreover, for symmetrical Feistel schemes, the plaintext is divided into two blocks of identical size. In particular, this concerns higher-level Feistel schemes.

In addition, for the intermediate cryptographic constructions, it is also possible to create a function of n bits to n bits from two random permutations P, and P _j of n bits to n bits by calculating the exclusive or "XOR" bit to bit of the output of both permutations (P, XOR P ₃ ). Unconditional security evidence also exists for this construction (for example, in Jacques Patarin's paper "On Linear Systems of Equations with Distinct Variables and Small Block Size", ICISC 2005: 299-32). It is also possible to use so-called "Benes" schemes which make it possible to obtain functions from 2n bits to 2n bits from random functions from n bits to n bits. Unconditional security evidence also exists for these schemes.

Thus, it is possible to realize the present invention according to several embodiments.

Indeed, FIGS. 3A to 3C illustrate an embodiment for the generation of a pseudo-random function among the many possible examples, according to the invention.

For this example, there are used Feistel schemes F, (n,) symmetrical with r, turns and the construction P, XOR P _j to obtain a pseudo-random permutation IJj ₂₈ from 128 bits to 128 bits, with a security of 2 ⁸⁰ operations.

FIGS. 3A to 3C describe the different steps of the construction starting from the outermost step (FIG. 3A) towards the innermost stage (FIG. 3C).

Thus, the step of FIG. 3A consists of a diagram of

Feistel to r _? turns, where n is determined by the following security criterion: the best conjectured attacks on a Feistel scheme at r _? turns have a complexity in 2f ^{rl'4) n} operations, where n is half the number of bits of the ciphered blocks.

If we want this complexity to be greater than 2 ⁸⁰ , we have to take r _? = 6. By being content with this one step, we need for the key of 6 elementary functions (random and independent) f / ^υ , ..., f / ^1J from 64 bits to 64 bits, so the total size of the key is 6x64x2 ⁶⁴ bit, which is too big to be used in practice. Then, we try to obtain the 6 functions from 64 bits to 64 bits from a second step (FIG. 3B). For this, we use the construction P, XOR P ₁ , applied to two Feistel schemes at r ₂ turns from 64 bits to 64 bits. The 6 elementary functions fi ⁽¹⁾ , ..., f / ^1J thus obtained will be used to construct the Feistel scheme of the previously described step. The same criterion as before shows that it is necessary to use r ₂ = 7 turns to obtain permutations of 64 bits to 64 bits not distinguishable from random permutations in less than 2 ⁸⁰ calculations. Each of the 6 elementary functions f / ^1J , ..., f / ^1J necessary to build the Feistel scheme of the upper stage requires 2x7 elementary functions from 32 bits to 32 bits, so the total size of the key at this step is 6x (2x7) x32x2 ³² bits. For the sake of simplification, FIG. 3B illustrates the construction of the elementary function f / ^υ of the upper step (FIG. 3A) from the 14 elementary functions fij ²⁾ , ..., Of course, this construction can be continued until the basic brick of the construction consists of elementary functions from 1 bit to 1 bit. However, there are a number of steps for which the size of the key is minimal.

In fact, for the parameters (block size of 128 bits, security level of 2 ⁸⁰ operations), the optimal number of steps is 4 (FIG. 3C). For the sake of simplification, FIG. 3C illustrates the construction of the elementary function fij ³⁾ of the upper step (not shown) from the 28 elementary functions fij ⁴⁾ , ..., fi4, 2 ⁽⁴⁾ .

In this case, the number of turns of the Feistel schemes to be used is respectively n = 6, r ₂ = 7, r ₃ = 9 and r ₄ = 14. The necessary basic functions are then 8-bit to 8-bit functions. and the size of the key is given by 6x (2x7) x (2x9) x (2x14) x8x2 ⁸ bits, or 10.8 MB, which is quite within the reach of the memory capacities of the current personal computers. The invention also relates to a downloadable computer program from a communication network comprising program code instructions for executing the steps of the generation method and / or the encryption method according to the invention when it is executed on a computer. This computer program can be stored on a computer-readable medium.

This program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other form desirable shape.

The invention also relates to a computer-readable information medium, comprising instructions of a computer program as mentioned above. The information carrier may be any entity or device capable of storing the program. For example, the medium may comprise storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a floppy disk or a disk. hard.

Claims

A method for generating secret key pseudo-random function K from an input block of m bits to an output block of n bits using a determined number ex of cryptographic schemes

Φι (mi, rii), ..., Φι (m ,, n,), ..., Φa (m _a , n _a ) nested in layers according to a recursive structure, each current cryptographic scheme 0, (IO ₁₁ D ₁ ) associating with m, input bits n, output bits in a number of turns r ,, each lattice using an internal elementary function f ^ή constructed from t, cryptographic schemes Φ _{l + 1} (rn _{l + 1} , n _{l + 1} ) of n, ₊₁ bits to m _{l + 1} bits, with n, ₊₁ <n, m _{l + 1} <m, and t, ≥ 1, each cryptographic scheme Φ, (m ,, n ,) defining a minimum number of comp {m _h n ,, η) operations, dependent on said number of revolutions n, necessary to distinguish it from a random function associating with m, n input bits, output bits, characterized in that for each cryptographic scheme Φ, (m ,, n _ι ) said number of turns r, is chosen so that said number of operations comp (m _h n ,, r,) associated with it is greater than or equal to to a predetermined number 2 ^e , where c is an integer.

2. Method according to claim 1, characterized in that said determined number of cryptographic schemes is chosen such that the most internal elementary functions t ^a) constituting the cryptographic schemes Φ _a (word, n _a ) of the innermost layer are random functions defining a minimum size of said secret key.

3. Method according to any one of claims 1 to 2, characterized in that said predetermined number 2 ^e is equal to 2 ⁸⁰ .

4. Method according to any one of claims 1 to 3, characterized in that said cryptographic schemes

0 ₁ (Hi ₁₁ H ₁ ), ..., Φ, (m ,, n,), ..., 0a (nie, Ha) correspond to cryptographic permutation schemes JIi (H ₁ ), ..., JI ₁ (H,), ..., JIa (Ha), each cryptographic permutation IJ ₁ (H ₁ ) implementing a permutation of blocks of n, bits.

5. Method according to claim 4, characterized in that said cryptographic permutation schemes IJ ₁ (Hi), ..., IJ ₁ (H,), ..., JIa (Ha) correspond to symmetrical Feistel schemes F ₁ (H ₁ ), ..., F ₁ (H ₁ ), ...,

Fa (Ha).

6. Method according to claim 5, characterized in that for each symmetrical Feistel scheme F, (n,) said number of turns r, depends on the number of bits n, and said integer c according to an inequality defined by r, ≥ 2c / n + 4.

Secret secret key pseudo-random encryption method K of an m-bit input block to an n-bit output block using the pseudo-random function generating method according to any one of claims 1 to 6 .

8. Secret key pseudo-random function generator K from an input block of m bits to an output block of n bits using a determined number ex of cryptographic schemes

0, (Hi ₁₁ H ₁ ), ..., 0, (Hi ₁₁ H ₁ ), ..., 0a (nie, Ha) nested in layers according to a recursive structure, each current cryptographic scheme 0 ₁ (Hi ₁₁ H ₁ ) associating with m input bits n, output bits in a number of turns r ,, each round using an internal elementary function f ^ή constructed from t, cryptographic schemes Φ _{l + 1} (m _{l + 1} , n _{l +} i) of n, ₊₁ bits to m, ₊ i bits, with n, ₊₁ < n ,, m _{l + 1} <m, and t, ≥ 1, each cryptographic scheme Φ _ι (m _ι , ri _ι ) defining a minimum number of operations comj ^ m ,, n ,, r,), dependent on said number of turns r ,, necessary to distinguish it from a random function associating m, input bits n, output bits, characterized in that it comprises calculation means for calculating, for each cryptographic scheme Φ, (m ,, n,), said number of revolutions r, so that said number of operations comp ^ m _h n ,, r,) associated with it is greater than or equal to a predetermined number 2 ^e , c being a whole number .

9. Generator according to claim 8, characterized in that said calculating means are adapted to calculate said determined number ex cryptographic schemes so that the elementary functions A ^; the most internal constituting the cryptographic schemes Φa (m _a , na) of the innermost layer are random functions defining a minimum size of said secret key.

Secret-secret pseudo-random encryption device K from an input block of m bits to an output block of n bits, characterized in that it comprises a pseudo-random function generator according to any one of claims 8 and 9.

11. Computer program downloadable from a communication network and / or stored on a computer readable medium and / or executable by a microprocessor, characterized in that it comprises program code instructions for the execution of the steps of the pseudo-random function generating method according to at least one of any of claims 1 to 6 when executed on a computer.

Computer program downloadable from a communication network and / or stored on a computer readable medium and / or executable by a microprocessor, characterized in that it comprises program code instructions for the execution of the steps of the An encryption method according to claim 7 when executed on a computer.