EP2951944A1

EP2951944A1 - Method of xor homomorphic encryption and secure calculation of a hamming distance

Info

Publication number: EP2951944A1
Application number: EP14701769.3A
Authority: EP
Inventors: Alain PATEY; Hervé Chabanne; Gérard Cohen
Original assignee: Telecom ParisTech; Institut Mines Telecom IMT; Morpho SA
Current assignee: Idemia Identity and Security France SAS; Institut Mines Telecom IMT
Priority date: 2013-02-01
Filing date: 2014-01-30
Publication date: 2015-12-09
Also published as: US20150365229A1; WO2014118257A1; FR3001848B1; FR3001848A1

Abstract

The invention concerns a method for encrypting a binary data item characterised in that it comprises the steps consisting of: - generating a public key and a private key, the public key being a sparse matrix comprising m rows and n columns, m being greater than the number I of bits of the binary data item, I being an integer strictly greater than 1, and the private key being a set of I indexed sets of integers between 1 and m such that for each set, the sum of the elements of the rows of the sparse matrix indexed by the elements of a set is zero, and - generating a binary sequence b comprising m bits, such that b=Mx+e+y in which o x is a random binary vector, o e is a random binary noise vector, and o y is a linear encoding of data item c. The invention also concerns a method for calculating a Hamming distance on data encrypted by the method of encryption.

Description

HOMOMORPHIC ENCRYPTION METHOD FOR EXCLUSIVE OR SECURE CALCULATION OF A HAMMING DISTANCE

FIELD OF THE INVENTION

The invention generally relates to methods for encrypting binary data, and their application for the secure calculation of Hamming distances between two data.

The invention finds applications in particular in the field of identification or biometric authentication. STATE OF THE ART

Many techniques of identification or biometric authentication are already known. Generally, they are implemented jointly by a control server of an individual or an object, which can proceed to the acquisition of a biometric data on an individual or an object, and by a management server a base comprising N biometric data of the same nature.

The data of the individual or of the object, acquired by the control server, is compared with the set of data of the database in order to identify whether at least one datum of the database corresponds to the datum acquired, and thus identify the individual or object as an individual or an object listed in the database.

To do this, it is common to calculate the Hamming distance between the data of the individual and one or more data of the base, that is to say the number of bits different from one data to another. This number can conventionally be calculated by carrying out the operation "exclusive OR" (known in English under the acronym XOR for "exclusive OR") between the two data, then counting the weight of Hamming, that is to say the number of bits at 1 of the result obtained.

A major problem in this context is to ensure the confidentiality of the data used. Indeed, the database includes private information to which the control server must not be able to access, and vice versa the management server must not obtain information on the individual, and in particular must not have access to the biometric data. which is exploited.

To address this issue, secure computing techniques have been developed that allow servers to perform calculations on encrypted data, so as to obtain the result of the calculations without decrypting the data or having access thereto.

In particular, a technique of data encryption and secure computing on the data encrypted by this technique has been developed to perform the operation "exclusive OR" between two data.

This technique is described in the publication of S. Goldwasser and S. Micali, Probabilistic encryption and how to play mental poker keeping secret biased information, in H.R. Lewis, BS Simons B., W. A. Burkhard, L. H. Landweber (eds.) STOC, pp. 365-377. ACM (1982).

The main disadvantage of this method is that it only allows to encrypt the data bit by bit, which considerably increases the calculation time required for its implementation.

There is therefore a need for the development of a data encryption method for the secure calculation of a faster Hamming distance.

PRESENTATION OF THE INVENTION

The object of the invention is to overcome the shortcomings of the prior art, by proposing a method of data encryption and secure calculation of Hamming distance on integer data, and no longer bit by bit.

Another object of the invention is to propose a method of identification or secure authentication of an individual. In this regard, the subject of the invention is a method for encrypting a binary data item, characterized in that it comprises the steps of:

generating a public key and a private key, the public key being a hollow matrix comprising m rows and n columns, m being greater than the number I of bits of the binary data item, I being an integer strictly greater than 1, and the private key being a set of I indexed sets of integers between 1 and m such that for each set, the sum of the elements of the rows of the hollow matrix indexed by the elements of a set is zero, and

generating a bit sequence b comprising m bits, such that b = Mx + e + y where x is a random binary vector,

e is a random binary noise vector, and

y is a linear encoding of the data c.

Advantageously, but optionally, the encryption method according to the invention may further comprise at least one of the following characteristics: the elements of the random noise vector e are Bernoulli variables. the encoding y of the data c is configured so that a partial knowledge of the coded data y is not decodable.

the encoding y of the data c is a linear encoding by lateral classes, that is to say that y is a randomly selected element among the elements satisfying the relation H'y = c, where H is a control matrix a linear code.

the generation of the public key and the private key includes:

the generation of indexed matrices of q rows and n columns, where q is strictly less than m, the rows of each matrix each comprising three 1 and the columns of each matrix each comprising zero or two 1,

o the generation of a hollow matrix M comprising m rows and n columns,

o the random generation of I indexed sets of integers between 1 and m such that each set comprises q elements whose index and such that two distinct sets do not comprise any common element, and

o for each indexed set, the replacement of the rows of the hollow matrix M indexed by the elements of the set, by the rows of the corresponding indexed matrix,

the generation of the public key and the private key includes:

the generation of indexed hollow matrices H _j , where d is an even integer greater than 3, each comprising q rows and q / 3 columns, where q is strictly less than m, each row of a matrix comprising d 1 ,

the generation of a hollow matrix M comprising m rows and n columns, o the random generation of I first indexed sets U _j , j between 1 and I, of integers between 1 + 1 and m such that:

^■ each set includes q elements, and

^■ two distinct sets do not include any common elements,

o the random generation of I second sets T _j , j between 1 and I, of integers between 1 and n, such that each set T _j comprises q / 3 elements,

o for all j between 1 and I,

■ the replacement of the elements of M such that:

"M _Ukit = H _jkq for all u _k e Uj, t _q e 7}, and

^■ the switching of the j ^th row of M with a line M indexed by a U _j element which is the sum of the rows of M are indexed by the elements of a subset W _j U _j, o the public key obtained being the hollow matrix M and the private key being the set, for j between 1 and I, union of sets W _j with the singleton j. The invention also proposes a method for decrypting an encrypted data obtained by applying to a binary data item the encryption method described above, the decryption method comprising:

for each set of indexed integers S _j , the binary summation of the bits of the encrypted data indexed by the elements of S _j , each bit obtained corresponding to the bit indexed by j of the encoded binary data, and the set of indexed bits obtained forming the encoded binary data, and decoding the data obtained, the decoded data forming the decrypted binary data.

An application proposed by the invention is a method of secure calculation of the operation "or exclusive" between two binary data encrypted by the implementation of the encryption method described above, comprising the steps of determining, from the encrypted data, a sequence of bits corresponding to the encryption, by said encryption method, of the result of the "exclusive" operation between the two binary data, and deciphering the bit sequence obtained by the implementation the decryption method.

Another application proposed by the invention is a method of secure calculation of a Hamming distance between two binary data encrypted by the implementation of the encryption method described above, the method comprising the steps of:

a) determining, from the encrypted data, the result corresponding to the encryption by the encryption method, of the result of the operation "or exclusive" between the two unencrypted data,

b) applying a permutation σ to the first I bits of the result obtained in step a), and

c) deciphering the bit sequence obtained in step b), and determining the Hamming weight of the data obtained.

Advantageously, but optionally, the method of secure calculation of a Hamming distance proposed by the invention may further comprise at least one of the following characteristics:

the method is implemented jointly by two processing units each holding one of the two binary data and a public key, a processing unit also holding the associated secret key, and in which:

each processing unit encrypts the data it holds from the public key, the unit holding the secret key transmitting its encrypted data to the second unit,

o the second unit implements steps a) and b) and transfers the result to the first unit, and

o the first unit implements step c).

the method is implemented jointly by a server unit holding the two encrypted data and the public key, and a client unit holding the public key and the associated private key, and wherein: o Γ server-unit implements steps a) and b) and transfers the result to the client unit, and

o the client unit implements step c). The invention also proposes a method for authenticating or identifying an individual, comprising comparing a binary data item acquired on the individual with one or more reference binary data acquired on listed individuals, each comparison comprising the calculating the Hamming distance between the data of the individual and a datum of the database, said calculation being carried out by implementing the method of secure calculation of a Hamming distance described above.

Advantageously, but optionally, in the method of authentication or identification of an individual, the data of the individual and the data or data of the database are biometric data obtained by encoding the same biometric trait on the individual and the individual (s) listed.

The invention finally proposes a system for identifying or authenticating an individual, comprising at least one control server of an individual to identify or authenticate, and at least one management server of a reference database. of listed individuals, the control server being adapted to carry out the acquisition of a biometric binary data of an individual, the control server and the management server being adapted to:

calculating at least one Hamming distance between the data of the individual and at least one datum of the database, by implementing the Hamming distance secure calculation method described above, and

determining, from the calculated Hamming distance (s), one or more data of the base having similarities with the data of the individual exceeding a predetermined threshold.

DESCRIPTION OF THE FIGURES

Other features, objects and advantages of the present invention will appear on reading the detailed description which follows, with reference to the appended figures, given by way of non-limiting examples and in which: FIG. 1 represents the main steps implemented for encryption and decryption of data,

FIG. 2 represents the main steps implemented for the secure calculation of a Hamming distance,

Figures 3a and 3b show two alternative embodiments of the calculation of a Hamming distance between two data.

DETAILED DESCRIPTION OF AT LEAST ONE MODE OF IMPLEMENTING THE INVENTION

Background and formalism

In all the following, the operations are carried out on binary data, that is to say that the calculations must be made in base 2 count. Thus, in particular, the nullity of a value corresponds to the nullity in base 2 of said value, i.e. the value must be congruent to 0 modulo 2.

Note also for the following definition: a matrix d-hollow, where d is an integer, is a matrix comprising, on each line, non-zero elements, the rest of the matrix comprising only 0.

In addition, the homomorphic encryption function is introduced for an operation o if, with two encrypted data Ci and c ₂ obtained by said encryption respectively of data mi and m ₂ , it is possible to determine the cipher c ₃ of a data m ₃ = m ₁ ° m2 by knowing only the public key (and not the secret key) of the encryption used.

Method of encrypting and decrypting data

Referring to Figure 1, there is shown the main steps of a method of encryption 1000 and decryption 2000 binary data each comprising I bits, I being strictly greater than 1.

The encryption method is an asymmetric encryption method, based on the use of a public key p _k accessible to all and allowing the encryption of data, and a secret key s _k accessible only to the recipient of the data, and necessary to achieve the decryption of the data.

The method therefore comprises a first step 100 of generating a public key p _k and a secret key s _k . The public key p _k is a hollow matrix M e {0, l) ^mxn , that is to say that the matrix comprises m rows and n columns, m and n being integers, and that it comprises on each line of elements equal to 1, the remainder of the matrix including only 0. d is therefore less than n.

The secret key s _k is a set of I indexed sets (Sj) _{j = 1} . _c , such that for all j between 1 and \, I Sj etΣ _{i £ S]} Mi = 0, where M, is the ^ith line of M.

The generation of the public key and the secret key can be implemented in different ways, of which two preferential modes of implementation are described below.

According to a first mode of implementation, this step 100 comprises the generation of indexed matrices H _j chosen uniformly among the matrices comprising q rows and n columns, and where each row of the matrix contains exactly three 1s and each column contains zero or two 1.

During a step 120, a matrix M 3-hollow is generated comprising m rows and n columns, m being greater than q, the lines of M being chosen according to a uniform distribution law.

During a step 130, indexed sets S _j , j between 1 and I, each comprising q integer elements between 1 and m, and such that for all j, e Sj and Sj n S are randomly generated. _k = 0 for ≠ k.

Then, during a step 140, for all j between 1 and I, the lines of M indexed by the elements of S _j are replaced by the lines of H _j .

The public key p _k is M, and the private key sk is the set of S _j

¾eii,., 0-

By this method, the characteristics of the public key and the secret key described above are obtained, and in particular the fact that each sum of the rows of the matrix M indexed by the elements of a S _j is zero.

Indeed, for each j, q lines of M are replaced by the q lines of the corresponding matrix H _j . However, each column of H _j comprises only 0 or 2 elements equal to 1. The summation of these lines is therefore zero (that is to say congruent to 0 modulo 2).

Alternatively, the step 100 of generating the public key p _k and the private key s _k comprises the generation, during a step 1 10 ', of I matrices d- indexed hollow H _j , j between 1 and I, d being an even integer greater than 3, and the elements of said matrices being chosen according to a uniform distribution law, each comprising q lines and q / 3 columns, where q is strictly lower to m.

During a step 120 ', a d-hollow matrix M is generated comprising m rows and n columns.

During a step 130 ', I randomly generates I indexed first sets Uj c {Z + 1, ..., m), j between 1 and I, each comprising q elements, and such that two distinct sets U _j and U _k do not include any common element: Uj U _k = 0.

During a step 140 ', I randomly generates I second sets T _j , j between 1 and I, integers between 1 and n, such that each set T _j comprises q / 3 elements.

Then, during a step 150 ', elements of M are replaced by elements of each matrix H _j , j between 1 and I, as follows: M _{Uk q} = Hj _kq for all u _k e Uj , t _q e Tj, and M _{Uk q} = 0 if tq ί Tj.

During a step 160 ', we identify a line j, of M indexed by an element of U _j which is the sum of the lines of M indexed by the elements of a subset W _j of U _j , and we switches that line with the j ^th line of M. this line is in view of the properties of matrices and sets generated in previous steps.

The public key p _k obtained is the matrix M and the private key s _k is

The fact that the sum of the rows of M are indexed by the elements of Sj is zero due to the fact that the j ^th row of M is equal to the sum of the line W _j and the additions are made binary.

Following step 100 of generating the public key and the private key, the encryption method includes the encoding 200 of the binary data c to obtain an encoded data y.

The encoding is performed by means of a linear coding which advantageously makes it possible to solve the so-called "wire-tap channel" problem, which is described in the article Wyner, AD: The wire-tap channel, The Bell System Technical Journal 54 (8), 1355-1387. The problem presented in this article is to propose a linear coding that allows to encode a data item A, to obtain an encoded data item B such that, if B reaches a recipient via a non-noisy listening line, that is that is to say that B reaches its destination without having undergone modifications, the recipient can decode it to obtain the data A.

On the other hand, if B reaches his addressee via a noisy line of listening, that is to say that the third party has only partial data B, which is typically the case of an attack by a third party , it is impossible to decode it to obtain the data A.

This type of coding makes it possible to ensure that even a partial knowledge of the encoded data B does not make it possible to obtain the decoded data A.

An encoding verifying these properties is for example the coding of the type called "by side classes" (called "coset coding"), also presented in the article.

Returning to the encryption method, the encoding step 200 of the binary data item c is advantageously performed by means of a linear coding of the type by lateral classes.

This type of encoding uses a linear code C of parameters [n, k, d] with a control matrix H of dimensions (nk) ^* k.

The encoding of a given m is a datum x such that H'x = m. To decode the encoded data x, the operation m = H'x is carried out.

In the case of the encryption method described with reference to FIG. 1, y is a vector of {0,1) 'randomly selected from among the set of vectors satisfying H. y = c, where c is the binary data item to be encrypted, and H is a dimension control matrix r ^* 1 of the linear code on which the lateral class coding is based.

During a step 300, an encrypted data item b is generated such that b = M. x + e + (y _{1 (} ..., y _;, 0, ..., 0), where M is the public matrix i.e., the hollow matrix obtained in step 100, x is a randomly generated binary column vector of size n, e is a randomly generated binary noise line vector of size m, and I first bits of the term (y _{1 (} ..., y _;, 0, ..., 0) are the elements of the encoding y of the data c, and the last ml bits are 0. Advantageously, the elements of the noise vector e are Bernoulli variables, that is to say that they follow a Bernoulli law of parameter ε: the elements of e thus have the value 1 with a probability ε. We note e -

^R Ber ™.

Preferably, ε is a very small value of the order of n ^{~ ^0-2} .The role of this noise vector is to make it difficult to find it from b.

The encryption method implemented has a high level of security, notably thanks to the encoding of the data c by a coding checking the properties of the "wire-tap channel".

Indeed, as indicated above, this coding allows a third party who would obtain a partial knowledge of the encoded data y would not be able to decode it.

In this case, a third party who obtains the numerical data b can not therefore be able to decipher it because, even if it obtains partial information about y, it does not give it any information on the data c. The encrypted data b obtained thus comprises m bits.

We will now describe the decryption 2000 of a data item b, comprising m bits, obtained by the implementation of the method described above. To do this, it is necessary to have the secret key s _k , that is to say, the set of indexed sets S _j .

Then, during a step 2100, the sum of the bits of b indexed by the elements of S _j for each j between 1 and I is calculated, which corresponds to a bit y _j of the encoded data y. The sequence of y _j constitutes the encoded data y = (iy _c ).

Indeed, the summation of the elements of Mx indexed by the elements of S _j is zero, because of the choice of S _j . The summation of the elements of b indexed by S _j will thus give _j , added to a negligible error term. Consequently, the bits obtained by the summation of the elements of b, indexed by the sets S _j , are the bits of y, with the noise near.

During a step 2200, the data obtained therefrom is decoded by applying the decoding of the linear code of type by lateral classes, that is to say c = Hy, where c is the decrypted binary data. The proposed encryption method has the advantage of being homomorphic for operation "XOR" (exclusive OR) symbolized by the operator®, that is to say that for two messages Ci and c ₂ of I bits to to encrypt, one can obtain the c c c ₂ cipher from bi and b ₂ , the data obtained respectively by the cipher of Ci and c ₂ .

In this case, the exclusive-or bi and b ₂ is a possible encrypted c _t (c ₂ by the encryption process 1000, that is to say that the implementation of the XOR operation between bi and b ₂ corresponds to the encryption of c ₁ ®c ₂ by the same encryption method 1000 with the same parameters.

This property is derived from the linear character of the code by lateral classes used.

Secure calculation method of Hamming distance

The encryption and decryption method described above makes it possible to implement a secure calculation 3000 of Hamming distances between two binary data Ci and c ₂ , this calculation being implemented jointly by two processing units Ui and U ₂ .

The concept of "secure" calculation indicates that the result of the calculation must be obtained without each processing unit having access to the data held by the other.

This calculation can be implemented according to two variants respectively represented in FIGS. 3a and 3b, the steps common to said variants being represented in FIG.

With reference to FIG. 2, the secure calculation of a Hamming distance between two binary data Ci and c ₂ is implemented between the digits bi and b ₂ corresponding to said data, obtained by implementing the encryption method described. above. It will be noted later bi = E (q) to indicate that a data b, is the encrypted data q by this encryption method.

The calculation method comprises obtaining the encryption 3100 of the result of the exclusive OR operation between the unencrypted binary data E (c ₁ c c ₂ ), this result being obtained by the implementation of the "exclusive OR" operation Between the ciphers: b ₁ @b ₂ = Ε ^ ε ^ φΕ ^), based on the homomorphic properties of the encryption method for the exclusive OR operation described above. The method then comprises the permutation 3200 of the first I bits of the result obtained in the preceding step, by the implementation of a permutation σ chosen randomly. The result obtained corresponds to the encryption of the permutation of the result of the operation "exclusive OR" between the two data c, not encrypted, that is to say £ ^, (a (c ₁ © c ₂ )). But the permutation does not modify the Hamming weight of a sequence of bits.

So the message a (c ₁ © c ₂ ) has the same Hamming weight as c ₁ (c ₂ , this Hamming weight corresponding to the Hamming distance between Ci and c ₂ .

It is therefore sufficient, during a step 3300, to decipher the message E {O (C ₁ @C ₂ )) and to determine the Hamming weight of the result obtained to obtain the Hamming distance between Ci and c ₂ .

As indicated above, several implementations of this method by processing units Ui and U ₂ are possible.

According to a first embodiment, illustrated in FIG. 3a, each processing unit Ui and U ₂ respectively have a binary data Ci, c ₂ and a public key p _k of the type used in the method described above. before. The corresponding secret key s _k is held by only one of the two units, for example Ui.

During a first step 3010, each processing unit encrypts the data it holds by implementing the encryption method 1000 described above. The unit Ui holding the secret key then transfers its encrypted data E (ci) to the other unit U ₂ in a step 3020.

Then, the unit U ₂ implements the exclusive OR operation 3100 between the two encrypted data, chooses and performs the permutation σ 3200 of the first I bits of the result obtained to obtain '(a (c ₁ c c ₂ )) . The unit U ₂ transfers this result to the unit Ui during a step 3210 and the unit Ui decrypts the result, by implementing the decryption method 2000, thanks to the secret key s _k it holds, to obtain oc ₁ @c ₂ ) and counts its Hamming weight, to obtain the Hamming distance between Ci and c ₂ .

Optionally, the result of the Hamming distance between the data can be communicated by the unit Ui to the unit U ₂ . According to an alternative implementation mode, represented in FIG. 3b, the processing unit Ui initially has the two already encrypted data E (ci) and E (c ₂ ) and the public key p _k . The processing unit U ₂ has the public key p _k and the private key s _k .

This situation applies in particular to the case of cloud computing, where the unit Ui is a remote server that stores confidential data of individuals and must not have access to it.

In this situation, it is the unit Ui that performs the exclusive OR operation 3100 between the two encrypted data, which chooses and applies 3200 the permutation σ of the first I bits of the result obtained. Then, during a step 3210, the unit Ui transfers E (a (c ₁ @c ₂ j) obtained in step 3200 to the unit U ₂ .

During a step 3300, the unit U ₂ decrypts, by application of the method 2000, thanks to the secret key that it holds, the data received from the unit U ₂ to obtain the data item a (c ₁ © c ₂ ), counts its Hamming weight and thus obtains the Hamming distance between Ci and c ₂ .

Optionally, the unit U ₂ can also transfer the Hamming distance between the data q to the unit Ui.

Application to secure identification or authentication

This method 3000 for calculating a Hamming distance is advantageously applied to the identification (comparison of an individual to a plurality of candidate individuals to detect a correspondence between the individual and one of the candidates) or the authentication (comparison an individual with a candidate individual to detect a biometric match of an individual.

A biometric datum of an individual is then compared to one (in the case of authentication) or several (in the case of identification) data of individuals listed, each comparison being made by calculating the Hamming distance between the data.

Biometric data are digital encodings of biometric traits of individuals. They must correspond to the same biometric feature in order to be comparable: this feature may be one or two irises, one or more fingerprints, the shape of the face, the shape of the venous network, the DNA, the palm prints, etc. A biometric identification or authentication system 1 of an individual adapted for the implementation of the method 3000 advantageously comprises a control server SC of an individual to be identified and a management server SG of a biometric database , said base comprising at least one reference biometric datum c, acquired on a listed individual.

The control server SC advantageously comprises means for acquiring a biometric data item b on an individual to identify or authenticate. This may be for example a fingerprint reader or a biometric identity document, or a camera.

The SC control and management servers SG are advantageously configured to implement one or other of the implementation variants of the method 3000 described above.

In the implementation represented in FIG. 3a, the processing unit U1 advantageously corresponds to the control server SC which acquires data b on an individual to identify and compares said data with one or more data c held by the management server. to obtain, for each Q, the Hamming distance between the data b and the data c ,.

Typically, if a Hamming distance between b and one of the data c is less than a predetermined threshold, a correspondence is detected between the individual on whom the data b was acquired and the reference individual on whom the data was acquired. Q.

In the implementation shown in FIG. 3b, the processing unit U ₂ advantageously corresponds to the control server SC. In this case, the reference data stored in the database is already encrypted, so that the management server SG can access only the encrypted data, and the control server encrypts the data b acquired on the individual before the transmit to the management server.

At the end of the method 3000, the control server obtains the Hamming distance between the data item b and one or more data Q of the database, and can similarly detect a correspondence between the individual and one or more listed individuals. Thus, an encryption method has been presented that makes it possible to calculate a Hamming distance over integer data in a secure manner, and no longer bit by bit, this calculation can also be applied to the identification or the biometric authentication.

Claims

1. Method for encrypting a binary data item (c), characterized in that it comprises the steps of:

generate a public key (p _k ) and a private key (s _k ), the public key being a matrix (M) dig including m rows and n columns, m being greater than the number I of bits of the binary data, I being a an integer strictly greater than 1, and the private key being a set of I indexed sets (S _j ) of integers between 1 and m such that for each set, the sum of the elements of the rows of the hollow matrix indexed by the elements d a set is zero, and generate a b bit sequence comprising m bits, such that b = Mx + e + y where

o x is a random binary vector,

o e is a random binary noise vector, and

o y is a linear encoding of the data c.

2. A method of encrypting a binary data according to the preceding claim, wherein the elements of the random noise vector e are Bernoulli variables.

3. A method of encrypting a binary data according to one of claims 1 or 2, wherein the encoding y of the data c is configured so that a partial knowledge of the coded data y is not decodable.

4. Method for encrypting a binary data item according to one of claims 1 to 3, wherein the encoding y of the data item c is a linear encoding by lateral classes, that is to say that y is an element randomly selected among the elements verifying the relation H'y = c, where H is a control matrix of a linear code.

The encryption method according to one of claims 1 to 4, wherein the generation of the public key and the private key comprises: generating indexed matrices (H _j ) of q rows and n columns, where q is strictly less than m, the rows of each matrix each comprising three 1 and the columns of each matrix each comprising zero or two 1,

the generation of a hollow matrix M comprising m rows and n columns,

the random generation of indexed sets (S _j ) of integers between 1 and m such that each set comprises q elements whose index and such that two distinct sets do not comprise any common element, and

for each indexed set, the replacement of the rows of the hollow matrix M indexed by the elements of the set, by the rows of the corresponding indexed matrix.

6. Encryption method according to one of claims 1 to 4 wherein the generation of the public key and the private key comprises:

the generation of indexed hollow matrices H _j , where d is an even integer greater than 3, each comprising q rows and q / 3 columns, where q is strictly less than m, each row of a matrix comprising d 1, the generation of a hollow matrix M comprising m rows and n columns,

the random generation of I first indexed sets U _j , j between 1 and I, of integers between 1 + 1 and m such that:

o each set includes q elements, and

o two distinct sets do not include any common element,

the random generation of I second sets T _j , j between 1 and I, of integers between 1 and n, such that each set T _j comprises q / 3 elements,

- for all j between 1 and I,

o the replacement of the elements of M such that:

"M _Ukitq = H _{jk q} for all u _k e Uj, t _q e 7}, and

^■ M _{Uk> q} = 0 if q £ 7} o the permutation of the j ^th row of M with a line M indexed by a U _j element which is the sum of the rows of M are indexed by the elements of a subset W _j II ,, - the public key obtained being the hollow matrix M and the private key being the set, for j between 1 and I, union of sets W _j with the singleton j.

7. A method for decrypting an encrypted data obtained by applying a binary data item of the method according to one of the preceding claims, the method comprising:

for each set of indexed integers S _j , the binary summation of the bits of the encrypted data indexed by the elements of S _j , each bit obtained corresponding to the bit indexed by j of the encoded binary data, and the set of indexed bits obtained forming the encoded binary data, and

decoding the data obtained, the decoded data forming the decrypted binary data.

8. Secure calculation method of the operation "or exclusive" between two binary data encrypted by the implementation of the method according to one of claims 1 to 6, comprising the steps of:

determining, from the encrypted data, a sequence of bits corresponding to the encryption, by said encryption method, of the result of the "exclusive" operation between the two binary data, and - decrypting the bit sequence obtained by setting process according to claim 7.

9. A method of secure calculation of a Hamming distance between two binary data encrypted by the implementation of the method according to one of claims 1 to 6, the method comprising the steps of:

d) determining, from the encrypted data, the result corresponding to the encryption by the method according to one of claims 1 to 6, of the result of the operation "or exclusive" between the two unencrypted data, e) applying a permutation σ to the first I bits of the result obtained in step a), and

f) decipher the bit sequence obtained in step b), and determine the Hamming weight of the data obtained.

10. A method for secure calculation of a Hamming distance according to the preceding claim, the method being implemented jointly by two processing units each holding one of the two binary data and a public key, a processing unit also holding the key. associated secret, and wherein:

the second unit implements steps a) and b) and transfers the result to the first unit, and

the first unit implements step c).

1 1. A method of secure calculation of a Hamming distance according to claim 9, the method being implemented jointly by a server unit holding the two encrypted data and the public key, and a client unit holding the public key and the private key associated, and wherein:

the server unit implements steps a) and b) and transfers the result to the client unit, and

the client unit implements step c).

12. A method for authenticating or identifying an individual I, comprising comparing a binary data item acquired on the individual with one or more reference binary data acquired on listed individuals,

characterized in that each comparison comprises calculating the Hamming distance between the data of the individual and a datum of the base, said calculation being made by the implementation of the method according to one of claims 9 to 11.

13. The method of claim 12, wherein the data of the individual and the data or data of the database are biometric data obtained by encoding the same biometric trait on the individual and the listed individual (s).

14. An identification or authentication system of an individual, comprising at least one control server of an individual to be identified or authenticated, and at least one management server of a reference database of identified individuals the control server being adapted to acquire a biometric binary data of an individual,

the system being characterized in that the control server and the management server are adapted to:

calculating at least one Hamming distance between the data of the individual and at least one datum of the base, by implementing the method according to one of claims 9 to 1 1, and