GB2186469A - A public key enciphering and deciphering system using stream ciphers - Google Patents

Abstract

The public key enciphering/deciphering system is for the transmission and reception enciphered text. The system includes encryption apparatus which generates enciphered text from plain text, and is provided with means which handles a stream cipher algorithm to transform plain text into enciphered text. The system further includes decryption apparatus which receives the enciphered text, and is provided with means which handles a stream cipher algorithm to transform the enciphered text into plain text. As shown the encryption apparatus includes a pseudo-random sequence generator PSG, a plain text generator PG, an encryptor RSA, a code tree CT and a code tree controller CTC. <IMAGE>

Description

SPECIFICATION A public key enciphering and deciphering system using stream ciphers The present invention relates to a public key enciphering and deciphering system using stream ciphers.

The invention finds application in multi-user public key enciphering and deciphering systems, such as electronic fund transfer and mobile radio systems, or in high security applications; or as a secure method of key distribution for other systems.

Known public key systems are based on block ciphers. The enciphering and deciphering algorithms used aretime-consuming, and therefore high speed ciphertexttransmission is not possible. Furthermore, each bit in a cipher text block is dependent on the other bits, so that a one-bit error in transmission results in erron eous deciphering of an entire block. Known public key systems also require additional bitsforerrordetection and correction.

In a public key system, each user places in a public file an encryption procedure, E. The user keeps secret the details of his corresponding decryption procedure, D. The two procedures have the following four prop- erties: (1 ) Deciphpringthe enciphered form of a message Yields M. ie D(E(M)) = M (2) Both D and E are easy to compute.

(3) Publicly revealing E does not reveal an easy way of computing D.

(4) If a message Mis first deciphered and then ciphered, M is the result. ie E(D(M)) = M Afunction E satisfying (1 ) - (3) is a "trap-door one-wayfunction". If it also satifies (4), it is a "trap-door one-way permutation".

Various schemes have been suggested as methods for obtaining effectivetrap-doorone-wayper- mutations; an algorithm which provides a high degree ofsecuritywith good authentication properties has been developed by Rivest, Shamir and Adleman. (RSA). The strength ofthe algorithm is based on the fact that it is computationaily infeasableto factorisethe product of two very large prime numbers.

The RSAAlgorithm: (1 ) Find two large prime numbers p and q, each about 100 decimal digits long. Let n = pq, and 0 = (p-l) (q-1).

(2) Choose a random integer, E between 3 and Owhich has no common factors with .

(3) Find an integer, D which is the inverse of E. ie. D*E differs from 1 by a multiple of O. The publicinformation consists of E and n; all the other quantities are kept secret.

Encryption Given a plain text message P, which is an integer between 0 and (n-l), and the public encryption numberE, form the ciphertext integer C,where C = Pre mod n Decryption Since E*D = 1, P=CDmodn Proof: P = CD mod n = PED mod n =p Cryptanalysis In order to determine the secrect decryption key, D, the cryptanalyst mustfactorise the 200 or so digit number n, which would take millions of yearns to perform using the fastest computing power currently available.

The two main disadvantages of the RSAtechnique are asfollows: (1 ) Exponentiation is computationally very time consuming and therefore encryption is slow.

(2) A one bit error in the transmitted block results in erroneous deciphering of the whole block.

However, the high degree of security provided by the algorithm, and the fact that there are no key distribution problems associated with a public key cryptosystem has initiated a more practical implementation ofthe RSAscheme using stream ciphers.

An aim ofthe present invention is to provide a public key system using stream ciphers which does not suffer from the disadvantages of the known systems which use block ciphers.

According to the present invention there is provided a public key enciphering system forthetransmission of enciphered text wherein, the system includes encryption apparatus arranged to generate enciphered text from plain text, and is provided with means which handles a stream cipher alogrithm to transform plain text into enciphened text.

According to the present invention these is provided a public key deciphering system for the reception of enciphered text wherein, the system includes decryption apparatus which receives the enciphered text, and is further provided with means which handles a stream cipher algorithm to transform the enciphered text into plain text.

An embodiment of the invention will now be described with reference to the accompanying drawings wherein: Figure 1 shows an example of a code-tree, which takes the form of a linked look-up table store, Figure2 shows a method offollowing a route through a code-tree, Figure 3 shows a block of bits in which are hidden a number of plain text bits, Figure 4 shows a block diagram of the method of construction ofthecode-tree, Figure 5shows a method oftransmitting blocks of data to form a ciphertexttransmitted block.

Figure 6shows a public key system using stream ciphers; and Figure 7shows a public key system using stream ciphers with increased security encryption.

Algorithm description The algorithm is based on the RSA encryption of k bit blocks of plain text. In order to achieve stream cipher encryption,thek bits are shifted by one bit before each encryption. The overall effect isto slide a k bit "window" along the plain text, as illustrated below, for example.

Plain text: 01011010001011100101111001 (011G0010) Initial Encryption: (01100010) Encrypted Value = C0 Shift: 0110001 Add in new bit, 10110001 Encrypted and encrypt: Value = C1 (k=8) If k=8 bits, there are 28 (=256) possible combinations for the block.

A code-tree is constructed and the encrypted values of each ofthese combinations stored in appropriate positions C1...Cn in a linked look-up store, as shown in Figure 1.

Since each of the nodes in the code-tree contain the RSA encrypted value of a shifted version of the original plain text, encryption may be performed by merely transmitting the contents of each node, by following a route through the code-tree depending on whether a '1 ' or a '0' has been shifted in. An example ofthis process is illustrated in Figure 2. For example if plain text = 10110, then the ciphertextwould be: 40,31,98,83,62.

The decryptor contructs a similar code-tree, and, by comparing the received ciphertextwith each ofthe two alternative cipher text values present at each node corresponding to a '0' or '1', can quickly recoverthe original plain text.

The algorithm so far described enables the 256 possible cipher text values to be easily reconstructed by a potential cryptanalystsince they are completely predictable. In orderto prevent this, the 8 bits of the plain text block are "hidden" in random positions in ann bit block, as shown in Figure 3, where A,B and C show possible positions ofthe random plain text bits. The remaining (n-8) bits are pseudo-random, generated by a pseudo-random sequence generator.

Code-tree construction The code-tree must be constructed by both the encryptor and decryptor units before any encryption/ decryption can take place. Since this is a relatively time-consuming operation, the length of the plain text block, k, and thereforethe number of elements stored inthe code-tree (=2k ) is keptto a minimumwhilst ensuring that successful cryptanalysis remains computationally infeasable. The block diagram illustrating code-tree construction is shown in Figure 4. The pseudo-random sequence generator PSG generates an n bit pseudo-random sequence where n could typically be 300 onto which the plain text generator PG superimposes the k-bit plain text block in the random positions b1, b2, b3,... by.1, bk.The plain text generator PG cycles through all the 2k combinations which are possible with a plain text block length of k bits. The new "plain text" blockthus generated is encrypted using the RSA algorithm, in encryptor RSA and stored inthecode- tree, CT, underthe control of the code-tree controller CTC. The pseudo-random and plain text sequences are then shifted by one bit, and re-encrypted to form the next element in the code-tree. The process continues until the code-tree has been completely filled.

Customisation The public key stream cipher algorithm effectively sets up a personalised private key between each pair of users, using the public key medium. The number of user-definable customisations are very large. These are: (a) The choice of pseudo-random sequence.

(b) The number of plain text bits used, and (c)The position of plain text bits.

Error detection and correction The public key stream cipher algorithm does not require any error detection/correction bits to be added to the ciphertext since it is self-error correcting, and may correct errors under severe error conditions.

By nature of the operation of the code-tree, each block transmitted will correspondto'0' or '1' of new plain text. Thus, the transmitted ciphertext blockwill be one of two possible outcomes, and a simple correlation between the received cipher text and the two expected values will enable the correct plain text bit to be recovered.

For example: Received Ciphertext: 0110100 Expected Cipher text: '0' 0010001 '1' 0100100 Correlation: 0010001 0100100 0110100 0110100 ++++ ++++++ Summation = +1 Summation = +5 Hence, the intended output = '1 ' In the case where E(0)+E(1) = 111...11,then upto a 50% error rate can be tolerated. (E(n) = Expected cipher text for n encrypted) Behaviour under different error conditions (a) Random Errors Assuming that transmission is over a linkwith p(e) = 0.04 p(e) = probability of error and that errors are randomly distributed; for a 500 bit block, Expected number of errors E(e) = 0.4 x 500 = 20 = 1 error every 25 bits This correlation may easily be accomplished after as few as 10 bits of cipher text have been received, and therefore the remaining 490 bits are of no consequence.

(b) Burst errors LetW = Burst Length X = Distance between bursts Y = Numberofbursts Z= Block length If W lessthan Z, and Ygreaterthanforexample 10, then burst error correction may be accomplished by correlating a number of bits up to the entire received block length.

Transmission Assume that the first block B1 is successfully decrypted after k1 bits. If necessary, make k1 large. The second block B2 to be transmitted is then superimposed onto the remainder ofthe first block B1 by EXORing the remaining (1 -k1) bits ofthe first block B1 with the second block B2. (1 = block length) The resultant block is then transmitted and, k2 bits later, the process is repeated for the third block B3, and then with block 4, etc., until the entire message TRC has been transmitted. An example of this is shown in Figure 5.

Once the decryptor has successfully correlated the first block, it can echo the superimposition process since it can extract the configuration of the remainder ofthe first blockfrom its own code-tree. Thus the speed ofthe transmission is roughly one kith of that of a conventional one-time pad stream cipher (with no redundant check bits added), where kj = block separation but still many thousand times faster than that using standard block RSA encryption.

Cryptanalysis The public key stream cipher algorithm is highly resistant to successful cryptanalytic attacksforthe following reasons: (1 ) It is considered to be computationally infeasableto successfullycryptanalysethe RSA alogorithm, since cryptanalysis involves factorising the product of two very large prime numbers.

(2) The number of bits used forthe plain text block may be varied; a potential cryptanalyst would haveto correctly guess how many bits were being used before cryptanalysis could be effected.

(3) Having guessed the positions of all k plain text bits, it will take for example on average 2 x 1078 yearsto guess the random (500-k) bit numberthatthe plain text has been "hidden" in, at a rate of one guess per microsecond.

(4) Although there are only 256five hundred bit blocksstored in the encryptor/decryptor code-treefor k=8 bits, known plain text attacks are made computationally infeasible since the current position in the code-tree is determined by all the plain text that has preceeded, like a convolution encoder. Therefore, onlytwo identical messages will have identical cipher text; two identical characters will not be encrypted in the same way.

In addition, a number of previous blocks will be superimposed on the cipher text making cryptanalysis even more difficult.

Authentication The public key stream cipher algorithm enables authentication for more secure communication systems be easily performed since each pair of users sets up a private key known only to themselves using the public key environment, ie. the plain text bit positions and pseudo-random sequences used. Thus the intended receiver may authenticate merely by transmitting ciphertext using these variables. The variables may be quickly changed at any stage if a fear of compromise is realised. The initial configurationforthevariables should be set, up without the knowledge of the intended transmitter (eg programmed into non-volatile RAM) to avoid compromising the information.

Subsequent configurations may be safely transmitted during stream ciphertransmissions since the algo- rithm is strong enough to avoid compromise of this information.

System enhancements (1) Pre-encryption of plain text.

The plain tex stream may be pre-encrypted during transmission using the pseudo-random sequence generator as a one-time pad. This action would make cryptanalysis even more difficult since the code-tree con trollerwould no longer output ciphertext according to the plain text to be transmitted, but instead to a pseudo-random sequence.

(2) Nonlinear Plain text shift.

The plain text bits may be shifted in a nonlinear fashion in orderto increase resistance to successful cryptanalysis.

(3) Changing Bit Positions.

The superimposed plain text bit positions may be varied for each encrypted entry in the code-tree; this would means that at a rate of one guess per microsecond, itwouid take 400,000 years to guess the bit positions of each code-tree entry if the length of the plain text block = 8 bits.

Figure 6 shows an example of a public key system showing a secure encryptor unit SEU and a secure decryptor unit SDU, with the transmission of insecure ciphertexttherebetween. The encryptor unit SEU includes a pseudo-random sequence generator PSG, which receives input plain text signals, a plain text generator PG, an encryptor RSA, a code-tree CT and a code-tree controller CTC as described with referenceto Figure 4. The controller CTC receives plain text input signals to provide the pre-encryption of plain text. The ciphertext is generated by the code-tree CT.

The secure decryptor unit SDU includes a pseudo-random sequence generator PSG, a plain text generator PG, an encryptor SA, a code-tree CT and a code-tree controller CTC as discussed with reference to Figure 4.

The cipher text is received by a comparator COMP and compared with the output from the code-tree CTto provide plain text output, which is combined with an output from the pseudo-random sequence generator PSG.

Figure 7 shows a public key system using stream ciphers with increased security encryption. The secure encryptor unit uses a combination of the plain text and the output generated by the pseudo-random sequence generator PSG to control the code-tree controller CTC. The pseudo-random sequence generator PSG also controls the encryptor RSA, which provides an inputforthe code-tree CT. The code-tree CT outputs insecure cipher text under the control ofthe code-tree controller CTC.

The secure decryptor unit SDU, receives the cipher text which applied to a comparator COMP. The decryptor unit includes a pseudo-random sequence generator PSG. The generator PSG provides two outputs, one is combined with the output of the comparator COMP to provide plain text, and the other is applied to an encryptor RSA, which generates an inputforthe code-tree CT. The code-tree CT, under control of its codetree controller CTC communicates with the comparator COMP.

Increasedsecurity encryption rules As an alternative to the encryption already described, instead of superimposing a k bit plain text block onto an n bit pseudo-random sequence, no plain text is used for encryption and that the code-tree is filled with a series of encrypted for example, pseudo-random sequences, ie. encrypted random numbers. This means that a potential cryptanalystwou Id have to: (1) Successfully decide which transmitted sequences has been superimposed into each other.

(2) Successfully cryptanalyse these sequences. (ie. cryptanalyse RSA).

(3) Decide which pseudo-random sequence has been used, and in which order they had been used to fill the code-tree.

(4) Decide which pseudo-random sequence had been used for the pre-encryptor one-time pad.

Therefore, the enhanced encryption rules provide considerably greater resistance so successful cryptanalytic attacks than those provided by the standard algorithm.

Claims (6)

1. A public key enciphering system for the transmission of enciphered text, wherein the system includes encryption apparatus arranged to generate enciphered text from plain text and is further provided with means which handles a stream cipher algorithm to transform plain text into enciphered text

2. A deciphering system for the reception of enciphered text, wherein the system includes decryption apparatus which receives the enciphered text, and is further provided with means which handles a stream cipher algorithm totransform the enciphered text into piain text.

3. A system as claimed in claim 1 or 2, wherein the apparatus includes a look-up table store in which is stored enciphered text blocks at positions pre-defined by a controller.

4. A system as claimed in claim 3, wherein the apparatus includes a sequence generator for generating a pseudo-random sequence, a plain text generator which superimposes a k-bit plain text block in random positions ofthe sequence, and transforming means which transforms the sequence into enciphered text blocks to be stored in the store.

5. A system as claimed in claim 2,3 and 4, wherein the apparatus includes a comparator which receives the transmitted encphered text, and underthe control of signals generated by the store, generates plain text.

6. Asystem as claimed in claim 2, wherein the bit positions for the superimposed plain text block are varied for each encrypted entry in the look-up table store.

6. A system as claimed in claim 1 and 3, wherein the apparatus includes a sequence generator providing first and second outputs, the first output is in the form of a pseudo random sequence and is transformed by transforming means prior to being stored in the store, the second output is a pseudo-random sequence which is combined with plain text to provide controlling signals for the controller.

7. A system as claimed in claim 2 and 3, wherein the apparatus includes a sequence generator providing first and second outputs, the first output is in the form of a pseudo-random sequence and is transformed by transforming means prior to being stored in the store, the second output is a pseudo-random sequence which is combined with an output from a comparatorto generated plain text, said comparator being arranged to receive the transmitted enciphered text for comparision with signals received from the store.

8. A system as claimed in claim 4, wherein the bit positions forthe superimposed plain text blockare varied for each encrypted entry in the look-up table store.

9. A system as claimed in any preceeding claim, wherein the plain text stream is a pre-encrypted during transmission.

10. Asystem as claimed in any preceeding claim, wherein the plain text is shifted in a non linear manner.

11. A system substantially as herein before described, with reference to the accompanying drawings.

Amendments to the claims have been filed, and have the following effect; (a) Claims 1 to 8 above have been deleted ortextually amended.

(b) Newortextuallyamended claims have been filed asfollows: (c) Claims 9 to 11 above have been re-numbered as 7 to 9.

1. A public key enciphering and deciphering system for the transmission of enciphered text, wherein the system includes encryption apparatus arranged to generate enciphered text from plain text and is provided with means which handles a stream cipher algorithm to transform plain text into enciphered text, and the system further includes decryption apparatus which receives the enciphered text, and is further provided with means which handles a stream cipher algorithm to transform the enciphered text into plain text, and, wherein the encryption apparatus and decryption apparatus include a look-up table store in which is stored enciphered text blocks at positions pre-defined by a controller.

2. A system as claimed in claim 1, wherein the encryption apparatus and the decryption apparatus include a sequence generator for generating a pseudo-random sequence, a plain text generator which superimposes a k-bit plain text block in random positions of the sequence, and transforming means which transformsthe sequence into enciphered text blocks to be stored in the store.

3. A system as claimed in claim 2, wherein the decryption apparatus includes a comparatorwhich re- ceivesthe transmitted enciphered text, and under the control of signals generated by the store, generates plain text.

4. A system as claimed in claim 2, wherein the encryption apparatus includes a sequence generator providing first and second outputs, the first output is in the form of a pseudo-random sequence and is transformed by transforming means priorto being stored in the store, the second output is a pseudo-random sequence which is combined with plain text to provide controlling signals for the controller.

5. A system as claimed in claim 3, wherein the decryption apparatus includes a sequence generator providing first and second outputs, the first output is in the form of a pseudo-random sequence and is transformed by transforming means priorto being stored in the store, the second output is a pseudo-random sequence which is combined with an output from the comparator to generate plain text, said comparator being arranged to receive the transmitted enciphered textfor comparision with signals received from the store.